Monitoring Your Hermit Toolchain with Vigilmon: CI Health, Tool Availability & Alerts

Hermit installs hermetic, self-contained CLI tools directly into your project without touching the system package manager. It's a great way to lock tool versions across your team and CI. But when Hermit's package registry is unreachable, your CI pipelines fail at install time — and without monitoring, you won't know until a developer reports a broken build. Vigilmon lets you watch the health of your Hermit-dependent pipelines and the registries they depend on.

What You'll Build

• Vigilmon HTTP monitors for Hermit's package registry and your private package index
• A CI pipeline heartbeat so you know when builds stop running
• A health check script for your build workers
• Email and Slack alert channels

Prerequisites

• A project using Hermit for tool management
• CI/CD pipeline (GitHub Actions, GitLab CI, Drone, etc.)
• A free Vigilmon account

Step 1: Monitor the Hermit Package Registry

Hermit downloads packages from a manifest registry. If the registry is unreachable, hermit install fails and your CI breaks cold.

Monitor the Public Registry

| Field | Value | |---|---| | URL | https://github.com/cashapp/hermit-packages/ | | Method | GET | | Expected status | 200 | | Check interval | 5 minutes |

Create this monitor in Vigilmon under Monitors → New HTTP Monitor. If GitHub goes down or the packages repo is unavailable, you'll be alerted before your next CI run hits it.

Monitor a Private Package Index (if applicable)

If you host your own Hermit package index, add a second monitor:

| Field | Value | |---|---| | URL | https://hermit-packages.yourdomain.com/ | | Method | GET | | Expected status | 200 | | Expected body | Any stable string in the index response | | Check interval | 2 minutes |

Step 2: Add a CI Pipeline Heartbeat

A heartbeat monitor tells you when your CI pipeline stops running — catching outages, disabled cron schedules, or broken self-hosted runners.

GitHub Actions

# .github/workflows/build.yml
name: Build

on:
  push:
    branches: [main]
  schedule:
    - cron: "0 */6 * * *"  # run every 6 hours to keep heartbeat alive

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Activate Hermit
        run: |
          curl -fsSL https://github.com/cashapp/hermit/releases/download/stable/install.sh | bash
          . ./bin/activate-hermit

      - name: Install tools
        run: hermit install

      - name: Build
        run: make build

      - name: Ping Vigilmon heartbeat
        if: success()
        run: |
          curl -fsS "$VIGILMON_HEARTBEAT_URL" || true
        env:
          VIGILMON_HEARTBEAT_URL: ${{ secrets.VIGILMON_HEARTBEAT_URL }}

GitLab CI

# .gitlab-ci.yml
build:
  script:
    - curl -fsSL https://github.com/cashapp/hermit/releases/download/stable/install.sh | bash
    - source ./bin/activate-hermit
    - hermit install
    - make build
    - |
      if [ -n "$VIGILMON_HEARTBEAT_URL" ]; then
        curl -fsS "$VIGILMON_HEARTBEAT_URL" || true
      fi

In Vigilmon:

1. Monitors → New Heartbeat Monitor
2. Set expected interval to 8 hours (for a 6-hour schedule, with 2-hour grace)
3. Copy the ping URL into your CI secret:

VIGILMON_HEARTBEAT_URL=https://vigilmon.online/api/heartbeat/xxxxxxxx

Step 3: Health Check Script for Build Workers

If you run self-hosted CI workers, add a health check script that Vigilmon can probe periodically.

#!/usr/bin/env bash
# scripts/worker-health.sh — expose as an HTTP endpoint via socat or your runner's health API

set -euo pipefail

HERMIT_BIN="./bin/hermit"
STATUS="ok"
ISSUES=()

# Check Hermit binary exists
if [[ ! -x "$HERMIT_BIN" ]]; then
  STATUS="degraded"
  ISSUES+=("hermit binary missing")
fi

# Check tools are installed
if [[ -x "$HERMIT_BIN" ]]; then
  if ! "$HERMIT_BIN" status --json 2>/dev/null | grep -q '"installed":true'; then
    STATUS="degraded"
    ISSUES+=("hermit packages not installed")
  fi
fi

# Output JSON
ISSUES_JSON=$(printf '%s\n' "${ISSUES[@]}" | jq -R . | jq -s .)
echo "{\"status\":\"$STATUS\",\"issues\":$ISSUES_JSON,\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"}"

Expose this script as an HTTP endpoint (via a lightweight server or your runner's built-in health API), then add a Vigilmon HTTP monitor for it.

Step 4: Alert When Tool Versions Drift

Hermit locks tool versions in .hermit/go.hcl (or your language's manifest). You can add a CI step that alerts Vigilmon when a version check fails, acting as a canary for dependency drift.

#!/usr/bin/env bash
# scripts/check-tool-versions.sh

set -euo pipefail

EXPECTED_GO_VERSION="1.22.0"
ACTUAL_GO_VERSION=$(go version | awk '{print $3}' | sed 's/go//')

if [[ "$ACTUAL_GO_VERSION" != "$EXPECTED_GO_VERSION" ]]; then
  echo "Version drift: expected Go $EXPECTED_GO_VERSION, got $ACTUAL_GO_VERSION"
  # Notify via Vigilmon webhook
  if [[ -n "${VIGILMON_WEBHOOK_URL:-}" ]]; then
    curl -s -X POST "$VIGILMON_WEBHOOK_URL" \
      -H "Content-Type: application/json" \
      -d "{\"text\":\"Tool version drift detected: Go expected $EXPECTED_GO_VERSION, got $ACTUAL_GO_VERSION\"}"
  fi
  exit 1
fi

In Vigilmon, create a Webhook Alert Channel and store its URL as VIGILMON_WEBHOOK_URL in your CI secrets.

Step 5: Configure Alert Channels

In Vigilmon's Alerts settings:

Email

1. Alert Channels → Email
2. Add your DevOps / platform team email
3. Attach to the registry monitor and the heartbeat monitor

Slack Webhook

1. Create a Slack Incoming Webhook for #devops-alerts
2. In Vigilmon, Alert Channels → Webhook
3. Paste the Slack URL:

{
  "text": "🚨 *{{ monitor.name }}* is DOWN\n{{ monitor.url }}\nStatus: {{ event.status }}\n<https://vigilmon.online|Open Vigilmon>"
}

Step 6: Test Everything

# 1. Verify registry is reachable
curl -fsSL https://github.com/cashapp/hermit-packages/ | head -5

# 2. Trigger a heartbeat manually
curl -fsS "$VIGILMON_HEARTBEAT_URL"

# 3. Use Vigilmon's "Test Alert" button to verify Slack/email delivery

# 4. Disable your CI cron schedule for 9+ hours → heartbeat alert fires

What You Now Have

| Monitor | Catches | |---|---| | Registry HTTP check | Package registry outages, network issues | | CI heartbeat | Pipelines stopping, runner crashes, disabled schedules | | Worker health check | Self-hosted runner degradation | | Webhook alert | Tool version drift, install failures |

Next Steps

• Add monitors for any artifact registries or package proxies your Hermit packages download from
• Use Vigilmon's response time history to detect slow package downloads before they time out CI
• Add a Vigilmon status page for your platform team

Found this useful? Vigilmon is free to start — sign up here and have your first monitor live in under 5 minutes.