• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Send email with MailKite from any workflow. See README for inputs + the inbound→repository_dispatch recipe.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changelog

• bf624853a310007127d7223e7f1c1952186b028f: Merge pull request #60 from Martinez1991/feat/action-advice-inputs (@Martinez1991)
• 1723f878b86eaab1925a57820f79ce9160b8ee96: feat(action): expose the advisory layer (–advice / AI / –fix) as inputs (@Martinez1991)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• fix: re-enable YAML merge keys dropped by js-yaml v5 by @Radiergummi in https://github.com/matchory/docker-swarm-deployment-action/pull/152
• feat: active Compose → Swarm reconciliation by @Radiergummi in https://github.com/matchory/docker-swarm-deployment-action/pull/153

Full Changelog: https://github.com/matchory/docker-swarm-deployment-action/compare/v1.1...v1.2.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

[5.5.0] — 2026-07-03

Added

• Runtime framework-root detection (_detect_framework_root) — auto-detects framework/library repos from package metadata, enabling noise suppression on arbitrary cloned repos (not just known benchmark paths)
• Test-file noise policy (_is_test_file, _TEST_FILE_NOISE_RULES) — suppresses CWE-798/327/338 findings in test fixtures, examples, and demos
• Expanded framework-internal path markers — 60+ new patterns covering cloned campaign repos (py-flask/, js-express/, etc.) and installed packages
• Confidence downgrading for non-exempt framework-internal findings (0.5 cap) and test-file findings (0.6 cap)

Changed

• rich moved to production dependencies — declared explicitly in pyproject.toml; guardrails updated to 10MB limit with rich allowlist
• CWE-617 severity: high → medium (error-handling, not direct exploit)
• CWE-532 severity: high → medium (information leak)
• README precision claims — replaced “0.4% FP rate” with honest “36-58% precision on web apps”
• Test count badge: 1,207 → 1,234

Fixed

• Framework noise suppression now works on cloned repos — previously only matched specific benchmark directory names; now catches py-flask/, js-express/, and 30+ common clone patterns
• FrameworkFingerprint made mutable — inspect_ast_node() and verify_endpoint_protection() can now set detected_framework at runtime
• verify_endpoint_protection checks default values — FastAPI = Depends(...) pattern (default value, not annotation) now detected

Engineering Spec Compliance

• Phase 1.3: Dependency declaration (rich as prod dep)
• Phase 1.4: mypy --strict added to CI
• Phase 2.2: register_symbol, resolve_call, propagate_taint_cross_file in interprocedural.py
• Phase 2.3: FrameworkFingerprint.inspect_ast_node + verify_endpoint_protection
• Phase 2.4: Rule severity recalibration
• Phase 3.1: generate_remediation_snippet with 6 code-fix templates
• Phase 3.4: ProcessPoolExecutor parallel analysis
• Phase 3.5: safe_parse_target with 3-encoding fallback
• Phase 4.1: docs/rules/index.md rule catalog
• Phase 4.2: rules/custom_checks.yaml blueprint
• Phase 4.3: filter_findings_by_git_diff PR isolation

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v0.2.7

• Fix: summary comment now updates in-place on re-review instead of duplicating (post_inline.py)
• Fix: new delete_issue_comment() helper for cleaning up stale OpenCode-created comments ( eview_context.py)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

GitHub Action that lints, trust-scores, and estimates token savings for agent skill files on every pull request via ModelBound.co context management tools.

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Version v1.2.7

• Fix Resolving Class Names Shadowed By Local Variables

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

PatchFlow CLI v0.1.3

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Bug Fixes

• 6d6dcca8ab3e82afd29d15f6ec26254e80423fc1: fix(install): resolve PATH issues and add containerized install test matrix (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

Other Changes

• 3fd6e36d76c27da5feb9148450e9d887c80c7350: PatchFlow CLI v0.1.2 — local-first security scanner with framework-aware SAST (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Drun v2

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

The lookup tools now attribute the calling agent — and the release pipeline publishes the MCP-registry listing automatically.

• Client identity on lookups (#91): check_server, list_servers, and request_grade send the connected client’s handshake identity (name/version plus declared title, website, description, and capability keys such as sampling/roots) to polygraph.so’s aggregate per-agent usage counters. Software metadata only — nothing about the user is read or sent; all fields are optional server-side.
• Official MCP Registry auto-publish (#93): pushing a litmus-v* tag now also publishes server.json to registry.modelcontextprotocol.io via GitHub OIDC, with a fail-fast version-drift check.
• polygraph plugin 0.6.0: spawn pinned to this release (#92).

No grading-semantics changes: litmus-v12 / litmus-skill-v2 unchanged.

• This action is used across all versions by 75 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Enhance Liquid-to-Qute converter for full Jekyll migration by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/978
• Fix capture blocks in Jekyll converter blocks by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/982
• Expand on how to use bundled sass output by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/984
• Fix aliases to work with and without trailing slash by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/995
• No co-authored by any LLM in commits. by @jtama in https://github.com/quarkiverse/quarkus-roq/pull/1000
• Fix svg diagram rendering by @jtama in https://github.com/quarkiverse/quarkus-roq/pull/997
• added code block menu language dropdown by @edewit in https://github.com/quarkiverse/quarkus-roq/pull/994
• improved navigation by @edewit in https://github.com/quarkiverse/quarkus-roq/pull/990
• Add tips on sanisation for Jekyll migration by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/983
• Add utilities for converting Jekyll frontmatter to Roq equivalents by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/998
• Hook migration into top-level build and parent by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1004
• Bump info.picocli:picocli from 4.7.5 to 4.7.7 by @dependabot[bot] in https://github.com/quarkiverse/quarkus-roq/pull/1010
• Trivial formatting - tidy missing line break in root pom by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1012
• docs: custom search trigger section to Lunr Search documentation by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1016
• ci: Update action versions for Java setup and GitHub Pages configuration by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1015
• Add tests specifically checking slug overrides are honoured by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1008
• Add minimum Quarkus version requirement to release notes by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1014
• Bump org.mvnpm.at.fortawesome:fontawesome-free from 7.2.0 to 7.3.0 by @dependabot[bot] in https://github.com/quarkiverse/quarkus-roq/pull/1017
• fix: Enhance image handling for absolute paths in Page model by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1024
• fix: handle null collections in getPosts method by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1023
• Allow link defaults to be configured globally by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1020
• Support deeply nested data directories as grouped CDI beans by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1011
• Add list:whereExp filter for Jekyll where_exp migration by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1021
• Evaluate (sort of) conditional directives in asciidoc before yupiik header parsing by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1003
• docs: enhance SEO documentation with per-page meta tag configuration by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1025
• Honour slug in frontmatter with sneaky path conditional by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1028
• docs: add holly-cummins as a contributor for code by @allcontributors[bot] in https://github.com/quarkiverse/quarkus-roq/pull/1032
• docs: add myfear as a contributor for code by @allcontributors[bot] in https://github.com/quarkiverse/quarkus-roq/pull/1031
• Add :dir placeholder to support slug overrides and nested paths by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1013
• Add dir segment placeholders by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1027
• Add quarkus-roq-plugin-og-image extension by @myfear in https://github.com/quarkiverse/quarkus-roq/pull/1007
• Update Jekyll frontmatter converter for pagination and permalink migration by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/1039
• Add linktree theme by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1043
• Consistency em FlatMap in review jerome by @matheusandre1 in https://github.com/quarkiverse/quarkus-roq/pull/1038
• Revert og-card plugin to unblock release by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1046
• Fix theme:base codestart using default theme content by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1047
• Jekyll migration: Add converter to transform _config.yml by @holly-cummins in https://github.com/quarkiverse/quarkus-roq/pull/991
• Add medium-zoom for image zoom support by @mcruzdev in https://github.com/quarkiverse/quarkus-roq/pull/910
• Introduce hybrid mode as a plugin by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1019
• Add qute: false alias, CLI –version, alert styling, and collapsible sections by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1048
• Bump current version to 2.1.5 by @ia3andy in https://github.com/quarkiverse/quarkus-roq/pull/1049

New Contributors

• @myfear made their first contribution in https://github.com/quarkiverse/quarkus-roq/pull/1007

Full Changelog: https://github.com/quarkiverse/quarkus-roq/compare/2.1.4...2.1.5

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Understanding is the new bottleneck

• Generates architectural background and change intuition from the PR diff
• Builds HTML flow diagrams and a code walkthrough
• Includes a 5-question interactive quiz for review comprehension
• Supports OpenRouter with configurable model selection
• Defaults to deepseek/deepseek-v4-flash

How it works:

1. Computes the diff against the PR base branch
2. Skips oversized patches based on a configurable line threshold
3. Sends the diff to an OpenRouter model
4. Renders a standalone HTML artifact
5. Uploads the result to the workflow run and can comment on the PR

Recommended usage:

• actions/checkout@v4 with fetch-depth: 0
• pull-requests: write permission if PR comments are enabled
• OPENROUTER_API_KEY stored as a repository secret

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/scrlkx/dotenv-seeder/compare/v1...v2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Fixed a bug which restricted allowlisted repos to be not processed as well.

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v2.14.0

Released 2026-07-04.

Multi-provider orchestration hardening. A large batch of correctness and run-safety fixes for real-codebase runs across mixed providers (Claude, OpenAI, OpenRouter, DeepSeek, MiniMax, Qwen, Gemini), contributed by @shanemmattner and finished to green.

Fixes

• Stalled-manager watchdog no longer misdiagnoses a healthy manager as an auth failure: a manager doing real root-cause investigation before it POSTs its first child task is no longer killed at a hardcoded deadline, the config override is honored, and the failure record names the real cause. (#2179)
• Failure classifier stops false-positive-killing healthy workers: bare-substring patterns (413, 429, 401, max_tokens, context window) no longer match structured tool-call log data; detection is anchored to real error shapes. (#2183)
• Janitor acceptance checks tolerate idiomatic worker paths: path_exists honors explicit globs and an opt-in fuzzy basename fallback, so a run where workers placed correct output at repo-idiomatic paths is not cascaded to a false sev1. (#2186)
• Injected .claude/skills/bernstein-*.md files are excluded from work-branch commits, so they stop causing a merge conflict on every worker merge. (#2187)
• Per-call token usage is priced and surfaced on the openai_agents provider path, so budget guards are no longer inert on non-Claude runs. Model pricing matches the most specific key first, so mini and flash variants price at their own rate instead of the parent model rate.
• strict_json_schema is disabled for non-OpenAI models that reject it, with diagnostic logging.
• Plus the rest of the 22-fix batch across adapters, tasks, cost, routing, quality, and observability.

Features

• Tunable agent run-length limits: max_turns, an error-budget floor, and max_agent_runtime_s, configurable per run.

Internal

• Pricing table extracted into a dependency-free cost.model_prices leaf so adapters can price a call without reaching scheduler internals; public create_pr API preserved; a diagnostic pre-call log that dumped request headers/body verbatim is now redacted.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• hotfix: deps update and CVE fixes by @pradeepbbl in https://github.com/spawnlab-dev/stack-deploy-action/pull/27

Full Changelog: https://github.com/spawnlab-dev/stack-deploy-action/compare/v1...v1.0.2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• update (#1) (c033c3d)
• . (75037b1)
• fix (ab3960a)
• add . (2a8c9d9)
• Initial commit (15c66f4)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Two deterministic model-hygiene rules.

• deprecated-model: flags a model id that’s retired (the call 404s) or deprecated and scheduled for removal, and names the current model to switch to. Exact-match against a known list, so a live model or alias is never flagged.
• unsupported-params: flags temperature/top_p/top_k set on a model that rejects them — the OpenAI o-series and the newest Anthropic models, where the parameter is a no-op or a 400.

Both stay silent when the model isn’t a plain string literal.

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/95
• deps: bump the npm-dependencies group with 2 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/94
• check in codeQL config and workflow by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/98
• deps: bump the npm-dependencies group with 6 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/97
• ci: bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/96
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/99
• deps: bump the npm-dependencies group with 5 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/101
• ci: bump codecov/codecov-action from 6.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/100
• ci: bump github/codeql-action from 4.35.3 to 4.36.0 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/102
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/103
• deps: bump the npm-dependencies group with 2 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/104
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/105
• deps: bump the npm-dependencies group with 5 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/108
• ci: bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/107
• ci: bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/109
• ci: bump codecov/codecov-action from 6.0.1 to 7.0.0 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/106
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/110
• deps: bump the npm-dependencies group with 4 updates by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/111
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/112
• fix release workflow sequencing by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/113
• ci: bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in https://github.com/thekbb/expand-aws-iam-wildcards/pull/114
• Update IAM action data by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/115
• make release orchestration deterministic by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/116
• Document release preflight checks by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/117
• add 0th cut of release shell script by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/118
• prep for v1.2.7 by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/119
• reset versions to re-test release script by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/120
• Prepare v1.2.7 release by @thekbb in https://github.com/thekbb/expand-aws-iam-wildcards/pull/121

Full Changelog: https://github.com/thekbb/expand-aws-iam-wildcards/compare/v1...v1.2.7

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

miu-cr v0.85.1

AI code review for local changes and GitHub pull requests. Use it as a CLI, CI gate, or GitHub Action with your own LLM key.

Install

curl -fsSL https://cr.miu.sh/install.sh | sh -s -- v0.85.1
brew install vanducng/tap/miucr
go install github.com/vanducng/miu-cr/cmd/miucr@v0.85.1

GitHub Action:

permissions:
  pull-requests: write

steps:
  - uses: actions/checkout@v6
  - uses: vanducng/miu-cr@v0.85.1
    with:
      api-key: ${{ secrets.ANTHROPIC_API_KEY }}

Common commands

miucr login --provider openai
miucr review --staged
miucr review --from main --to HEAD --gate high
miucr review --pr owner/repo#123 --post
miucr upgrade

Docs: https://cr.miu.sh

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Bump version to v0.17.2 by @tyler-gilbert in https://github.com/work-spaces/install-spaces/pull/33

Full Changelog: https://github.com/work-spaces/install-spaces/compare/v0.17.1...v0.17.2

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Bump version to v0.17.2 by @tyler-gilbert in https://github.com/work-spaces/spaces-checkout-run/pull/27

Full Changelog: https://github.com/work-spaces/spaces-checkout-run/compare/v0.17.1...v0.17.2

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

uses: wozaki/project-closed-issue-move-to-top-action@0636114292c9298d48a87622a2e25e5636ebe6d5 # v1.19.0

What’s Changed

• chore(deps): update int128/release-typescript-action action to v1.74.0 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/147
• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/148

Full Changelog: https://github.com/wozaki/project-closed-issue-move-to-top-action/compare/v1.18.0...v1.19.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

fix fatal error

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Marketplace-valid action metadata: display name “Powderworks Housekeeping”, description under 125 characters. The uses: zmaril/housekeeping@v1 interface is unchanged.

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v1.1.5 (2026-07-03)

Build

• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump helm.sh/helm/v3 from 3.21.1 to 3.21.2 (#432)
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump actions/cache from 5 to 6
• deps: bump msgpack
• deps: bump github.com/containerd/containerd
• deps: bump actions/checkout from 6 to 7
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
• deps: bump k8s.io/apimachinery from 0.36.1 to 0.36.2
• deps: bump the pip group across 1 directory with 2 updates
• deps: bump helm.sh/helm/v3 from 3.21.0 to 3.21.1 (#426)

Fix

• add pod logs before pod down
• fix deployment validation for completed Kubernetes Job pods (#430)
• selm: update smurf selm log structure for failure pod

Pull Requests

• Merge pull request #438 from clouddrove/fix/selm-logs
• Merge pull request #437 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-f6ef7e54f3a1f4e2a05a66ed1a8702c07ae94346
• Merge pull request #436 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-5a15692ae38a05cc3aa3b7ab6744add91e9b8591
• Merge pull request #433 from clouddrove/dependabot/go_modules/go_modules-6e0011ac6e
• Merge pull request #434 from clouddrove/dependabot/pip/docs/sm/docs/pip-b15cf8365f
• Merge pull request #435 from clouddrove/dependabot/github_actions/actions/cache-6
• Merge pull request #431 from clouddrove/dependabot/github_actions/actions/checkout-7
• Merge pull request #428 from clouddrove/dependabot/go_modules/k8s.io/apimachinery-0.36.2
• Merge pull request #429 from clouddrove/dependabot/go_modules/github.com/Azure/azure-sdk-for-go/sdk/azidentity-1.14.0
• Merge pull request #427 from clouddrove/dependabot/pip/docs/sm/docs/pip-cdb1555457

v1.1.4 (2026-05-27)

Build

• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump k8s.io/apimachinery from 0.35.4 to 0.36.1 (#412)
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml (#413)
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml (#414)
• deps: bump helm.sh/helm/v3 from 3.20.2 to 3.21.0 (#415)
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml
• deps: bump urllib3
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml

Fix

• Upgrade Go Version and Remove Auto Release Tag Creation from Workflows (#419)

Pull Requests

• Merge pull request #423 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-ca8d61c90f059d7ed8c3fc608877d19cc5d965f5
• Merge pull request #410 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-4b2ff708285026c1211445c4acb213af1c6ff3ba
• Merge pull request #411 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-4b2ff708285026c1211445c4acb213af1c6ff3ba
• Merge pull request #409 from clouddrove/dependabot/pip/docs/sm/docs/pip-c30c77f42d
• Merge pull request #407 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-c165f939ce9ad3de94da8fc50b3368565bea4fda
• Merge pull request #408 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-c165f939ce9ad3de94da8fc50b3368565bea4fda

v1.1.3 (2026-05-05)

Build

• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml

Docs

• update CHANGELOG.md for v1.1.2

Fix

• provisionGHCR: add warning for get environment variable (#403)

Pull Requests

• Merge pull request #405 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-c0dc8f22e1836ac0a76ee7a7d9f4c2e30e5293e8
• Merge pull request #406 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-c0dc8f22e1836ac0a76ee7a7d9f4c2e30e5293e8

v1.1.2 (2026-04-30)

Build

• deps: bump github.com/hashicorp/terraform-exec
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump go.opentelemetry.io/otel
• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml

Fix

• replace ANSI escape sequences with pterm for safe, consistent show command output (#397)
• update go version 1.25.5 to 1.25.8 (#396)

Pull Requests

• Merge pull request #404 from clouddrove/dependabot/go_modules/github.com/hashicorp/terraform-exec-0.25.2
• Merge pull request #401 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-0d9fa74b29d820d7ffe031704ec53bf7653c97c3
• Merge pull request #402 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-0d9fa74b29d820d7ffe031704ec53bf7653c97c3
• Merge pull request #400 from clouddrove/dependabot/go_modules/go_modules-c9a791322e
• Merge pull request #392 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-21cd5a8d11a5f01560103ac3fcae05835e9e3699
• Merge pull request #393 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-21cd5a8d11a5f01560103ac3fcae05835e9e3699

v1.1.1 (2026-04-23)

Fix

• replace ANSI escape sequences with pterm for safe, consistent show command output

v1.1.1-beta (2026-04-23)

Build

• deps: bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml
• deps: bump clouddrove/github-shared-workflows/.github/workflows/release-tag.yml

Feat

• add smurf stf show command and fixed issue raised by clouddrove ci (#388)

Pull Requests

• Merge pull request #392 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/release-tag.yml-21cd5a8d11a5f01560103ac3fcae05835e9e3699
• Merge pull request #393 from clouddrove/dependabot/github_actions/clouddrove/github-shared-workflows/dot-github/workflows/pr-checks.yml-21cd5a8d11a5f01560103ac3fcae05835e9e3699

v1.0.11 (2026-04-17)

v1.1.0 (2026-04-17)

Build

• deps: bump k8s.io/client-go from 0.35.3 to 0.35.4

Pull Requests

• Merge pull request #367 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.35.4

v1.0.10 (2026-04-17)

Build

• deps: bump k8s.io/api from 0.35.3 to 0.35.4

Pull Requests

• Merge pull request #368 from clouddrove/dependabot/go_modules/k8s.io/api-0.35.4

v1.0.9 (2026-04-17)

Build

• deps: bump k8s.io/apimachinery from 0.35.3 to 0.35.4

Pull Requests

• Merge pull request #369 from clouddrove/dependabot/go_modules/k8s.io/apimachinery-0.35.4

v1.0.8 (2026-04-15)

Build

• deps: bump actions/upload-pages-artifact from 4 to 5
• deps: bump pillow
• deps: bump softprops/action-gh-release from 2 to 3
• deps: bump helm.sh/helm/v3 from 3.20.1 to 3.20.2

Feat

• enhance smurf stf init with complete Terraform flags and implement GitHub shared workflows (#366)

Pull Requests

• Merge pull request #365 from clouddrove/dependabot/github_actions/actions/upload-pages-artifact-5
• Merge pull request #364 from clouddrove/dependabot/pip/docs/sm/docs/pip-489ca64b8d
• Merge pull request #363 from clouddrove/dependabot/github_actions/softprops/action-gh-release-3
• Merge pull request #362 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.20.2

v1.0.7 (2026-04-08)

Feat

• add github shared workflows and add smurf stf init flags

v1.0.6 (2026-04-06)

Fix

• plan: Update terraform plan logs structure remove repeated lines
• plan: Update terraform plan logs structure

v1.0.5 (2026-04-06)

Fix

• plan: Update terraform plan logs structure

v1.0.4 (2026-04-03)

Fix

• Add support for applying Terraform plan file (tfplan) without manual approval in smurf stf (#359)

v1.0.3 (2026-04-02)

Fix

• fix go vet
• resolve sonar qube issue

v1.0.2 (2026-04-01)

Fix

• resolve smurf stf plan and apply auto approve issue

v1.0.1 (2026-04-01)

v1.0.1-beta (2026-04-01)

Build

• deps: bump requests
• deps: bump actions/deploy-pages from 4 to 5
• deps: bump k8s.io/client-go from 0.35.2 to 0.35.3
• deps: bump github.com/fatih/color from 1.18.0 to 1.19.0
• deps: bump k8s.io/api from 0.35.2 to 0.35.3
• deps: bump google.golang.org/grpc
• deps: bump helm.sh/helm/v3 from 3.20.0 to 3.20.1
• deps: bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
• deps: bump docker/setup-qemu-action from 3 to 4
• deps: bump docker/login-action from 3 to 4
• deps: bump k8s.io/client-go from 0.35.1 to 0.35.2
• deps: bump k8s.io/api from 0.35.1 to 0.35.2
• deps: bump actions/upload-artifact from 6 to 7
• deps: bump actions/download-artifact from 7 to 8
• deps: bump github.com/pterm/pterm from 0.12.82 to 0.12.83
• deps: bump hashicorp/setup-terraform from 3 to 4

Fix

• resolve smurf apply auto approve issue
• update CHANGELOG.md file

Pull Requests

• Merge pull request #357 from clouddrove/dependabot/github_actions/actions/deploy-pages-5
• Merge pull request #358 from clouddrove/dependabot/pip/docs/sm/docs/pip-aa7cb66ac2
• Merge pull request #354 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.35.3
• Merge pull request #352 from clouddrove/dependabot/go_modules/go_modules-9c5197dcb8
• Merge pull request #355 from clouddrove/dependabot/go_modules/k8s.io/api-0.35.3
• Merge pull request #356 from clouddrove/dependabot/go_modules/github.com/fatih/color-1.19.0
• Merge pull request #340 from clouddrove/fix/changelog
• Merge pull request #351 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.20.1
• Merge pull request #350 from clouddrove/dependabot/go_modules/golang.org/x/oauth2-0.36.0
• Merge pull request #348 from clouddrove/dependabot/github_actions/docker/login-action-4
• Merge pull request #349 from clouddrove/dependabot/github_actions/docker/setup-qemu-action-4
• Merge pull request #343 from clouddrove/dependabot/github_actions/actions/download-artifact-8
• Merge pull request #344 from clouddrove/dependabot/github_actions/actions/upload-artifact-7
• Merge pull request #345 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.35.2
• Merge pull request #347 from clouddrove/dependabot/go_modules/k8s.io/api-0.35.2
• Merge pull request #342 from clouddrove/dependabot/go_modules/github.com/pterm/pterm-0.12.83
• Merge pull request #341 from clouddrove/dependabot/github_actions/hashicorp/setup-terraform-4

v1.0.0 (2026-02-24)

Build

• deps: bump github.com/hashicorp/terraform-exec
• deps: bump pillow (#337)
• deps: bump k8s.io/api from 0.35.0 to 0.35.1
• deps: bump k8s.io/client-go from 0.35.0 to 0.35.1
• deps: bump golang.org/x/oauth2 from 0.34.0 to 0.35.0

Pull Requests

• Merge pull request #338 from clouddrove/dependabot/go_modules/github.com/hashicorp/terraform-exec-0.25.0
• Merge pull request #335 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.35.1
• Merge pull request #336 from clouddrove/dependabot/go_modules/k8s.io/api-0.35.1
• Merge pull request #333 from clouddrove/dependabot/go_modules/golang.org/x/oauth2-0.35.0

v0.1.7-Beta (2026-02-20)

Fix

• Update deploy command

v0.1.6-Beta (2026-02-18)

Fix

• smurf selm command update
• scan and helm install command update

v0.1.5-Beta (2026-02-18)

Feat

• update plan commands
• add states command
• handle empty env variable

Fix

• scan and helm install command update
• add parameter for release test
• remove unused parameter
• increase time out helm upgrade
• update kubernetes function for error handling

v0.1.4-Beta (2026-01-27)

Build

• deps: bump helm.sh/helm/v3 from 3.19.5 to 3.20.0

Pull Requests

• Merge pull request #331 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.20.0

v0.1.3 (2026-01-20)

Pull Requests

• Merge pull request #330 from clouddrove/fix/smurf-stf

v0.1.3-Beta (2026-01-20)

v0.1.2-Beta (2026-01-20)

v0.1.2 (2026-01-20)

Build

• deps: bump helm.sh/helm/v3 from 3.19.4 to 3.19.5
• deps: bump filelock
• deps: bump urllib3

Pull Requests

• Merge pull request #329 from clouddrove/feat/OCI-chart
• Merge pull request #326 from clouddrove/feat/multi-threading
• Merge pull request #328 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.19.5
• Merge pull request #327 from clouddrove/dependabot/pip/docs/sm/docs/pip-81c3d069c8
• Merge pull request #325 from clouddrove/dependabot/pip/docs/sm/docs/pip-8177a8837a

v0.0.5-Beta (2026-01-20)

v0.0.4-Beta (2026-01-20)

v0.0.2-Beta (2026-01-20)

v0.0.3-Beta (2026-01-20)

v0.0.2-beta (2026-01-20)

v0.0.4-beta (2026-01-20)

v0.0.3-beta (2026-01-20)

v0.1.1-beta (2026-01-20)

Build

• deps: bump douglascamata/setup-docker-macos-action
• deps: bump k8s.io/client-go from 0.34.3 to 0.35.0 (#319)
• deps: bump filelock
• deps: bump pymdown-extensions

Pull Requests

• Merge pull request #322 from clouddrove/dependabot/github_actions/douglascamata/setup-docker-macos-action-1.1.0
• Merge pull request #318 from clouddrove/dependabot/pip/docs/sm/docs/pip-c4ff2e68b4
• Merge pull request #317 from clouddrove/dependabot/pip/docs/sm/docs/pip-d9bbda99d0

v0.1.0 (2025-12-15)

Build

• deps: bump helm.sh/helm/v3 from 3.19.3 to 3.19.4
• deps: bump actions/upload-artifact from 5 to 6
• deps: bump actions/download-artifact from 6 to 7
• deps: bump actions/cache from 4 to 5
• deps: bump helm.sh/helm/v3 from 3.19.2 to 3.19.3
• deps: bump k8s.io/api from 0.34.2 to 0.34.3
• deps: bump k8s.io/apimachinery from 0.34.2 to 0.34.3
• deps: bump k8s.io/client-go from 0.34.2 to 0.34.3
• deps: bump golang.org/x/oauth2 from 0.33.0 to 0.34.0
• deps: bump urllib3
• deps: bump github.com/spf13/cobra from 1.10.1 to 1.10.2

Pull Requests

• Merge pull request #315 from clouddrove/dependabot/github_actions/actions/upload-artifact-6
• Merge pull request #314 from clouddrove/dependabot/github_actions/actions/download-artifact-7
• Merge pull request #316 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.19.4
• Merge pull request #312 from clouddrove/dependabot/github_actions/actions/cache-5
• Merge pull request #310 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.19.3
• Merge pull request #306 from clouddrove/dependabot/go_modules/k8s.io/api-0.34.3
• Merge pull request #307 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.34.3
• Merge pull request #308 from clouddrove/dependabot/go_modules/k8s.io/apimachinery-0.34.3
• Merge pull request #305 from clouddrove/dependabot/go_modules/golang.org/x/oauth2-0.34.0
• Merge pull request #304 from clouddrove/dependabot/pip/docs/sm/docs/pip-a6aa50acab
• Merge pull request #302 from clouddrove/dependabot/go_modules/github.com/spf13/cobra-1.10.2

v0.2.5-beta (2025-12-12)

v0.2.4-beta (2025-12-11)

Fix

• update smurf terraform provision command
• smurf stf plan –out flag update

v0.2.3-beta (2025-12-11)

Fix

• smurf stf apply logs

Reverts

• added context in ai

v0.2.2-beta (2025-12-03)

Fix

• smurf terraform plan support -out

v0.0.9 (2025-11-26)

v0.2.1-beta (2025-11-24)

Build

• deps: bump actions/checkout from 5 to 6
• deps: bump golang.org/x/crypto

Feat

• add smurf sdkr for google cloud platform(GCP)

Pull Requests

• Merge pull request #299 from clouddrove/dependabot/github_actions/actions/checkout-6
• Merge pull request #298 from clouddrove/dependabot/go_modules/go_modules-dd7da38a6b

v0.2.0-beat (2025-11-19)

Build

• deps: bump helm.sh/helm/v3 from 3.19.1 to 3.19.2
• deps: bump k8s.io/api from 0.34.1 to 0.34.2
• deps: bump k8s.io/apimachinery from 0.34.1 to 0.34.2
• deps: bump k8s.io/client-go from 0.34.1 to 0.34.2

Feat

• add history max flag for smurf selm

Pull Requests

• Merge pull request #293 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.19.2
• Merge pull request #294 from clouddrove/dependabot/go_modules/k8s.io/client-go-0.34.2
• Merge pull request #295 from clouddrove/dependabot/go_modules/k8s.io/apimachinery-0.34.2
• Merge pull request #296 from clouddrove/dependabot/go_modules/k8s.io/api-0.34.2

v0.0.8 (2025-11-11)

Build

• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
• deps: bump helm.sh/helm/v3 from 3.19.0 to 3.19.1
• deps: bump douglascamata/setup-docker-macos-action
• deps: bump golang.org/x/oauth2 from 0.32.0 to 0.33.0
• deps: bump github.com/containerd/containerd
• deps: bump github.com/docker/docker

Pull Requests

• Merge pull request #290 from clouddrove/dependabot/github_actions/douglascamata/setup-docker-macos-action-1.0.2
• Merge pull request #291 from clouddrove/dependabot/go_modules/helm.sh/helm/v3-3.19.1
• Merge pull request #292 from clouddrove/dependabot/go_modules/github.com/Azure/azure-sdk-for-go/sdk/azidentity-1.13.1
• Merge pull request #288 from clouddrove/dependabot/go_modules/golang.org/x/oauth2-0.33.0
• Merge pull request #285 from clouddrove/dependabot/go_modules/github.com/docker/docker-28.5.2incompatible
• Merge pull request #286 from clouddrove/dependabot/go_modules/go_modules-6b61ce4306

v0.1.9-beta (2025-11-10)

Feat

• change logs and update format command
• Add smurf terraform

v0.1.8-beta (2025-11-07)

Feat

• Add smurf terraform
• update docs with latest changes

v0.0.7 (2025-11-04)

Build

• deps: bump actions/download-artifact from 5 to 6
• deps: bump actions/upload-artifact from 4 to 5

Pull Requests

• Merge pull request #280 from clouddrove/dependabot/github_actions/actions/upload-artifact-5
• Merge pull request #281 from clouddrove/dependabot/github_actions/actions/download-artifact-6

v0.1.7-beta (2025-11-04)

Feat

• improve code suggested by Gemini AI

v0.1.6-beta (2025-11-03)

Feat

• improve code suggested by Gemini AI
• improve code suggested by Gemini AI
• improve code suggested by Gemini AI
• improve code suggested by Gemini AI
• improve code suggested by Gemini AI

v0.1.5-beta (2025-10-31)

Feat

• Update the code as suggested by Gemini AI.

v0.1.4-beta (2025-10-31)

Feat

• update smurf provision GHCR logs

v0.1.3-beta (2025-10-31)

Feat

• Add GHCR repo feature

v0.1.2-beta (2025-10-31)

Feat

• Add GHCR repo feature

v0.1.1 (2025-10-30)

Feat

• add smurf deploy command

v0.1.0-beta (2025-10-27)

Build

• deps: bump github.com/pterm/pterm from 0.12.81 to 0.12.82 (#279)
• deps: bump golang.org/x/oauth2 from 0.31.0 to 0.32.0 (#277)
• deps: bump github.com/docker/docker (#276)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#275)
• deps: bump douglascamata/setup-docker-macos-action (#274)

Feat

• add smurf selm init command
• add command for push docker image on ghcr

v0.0.6 (2025-10-03)

v0.0.06 (2025-10-03)

Build

• deps: bump github.com/docker/docker

Feat

• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• Updated smurf selm with code changes suggested by Gemini AI
• update error log structure for selm

Pull Requests

• Merge pull request #273 from clouddrove/feat/selm-logs
• Merge pull request #271 from clouddrove/dependabot/go_modules/github.com/docker/docker-28.5.0incompatible

v0.0.8-Beta (2025-10-01)

Feat

• update error log structure for selm

v0.0.7-Beta (2025-09-30)

Feat

• update smurf selm log structure

v0.0.6-Beta (2025-09-29)

v0.0.5 (2025-09-23)

v0.0.9-beta (2025-09-23)

Fix

• selm template command issue
• selm template command issue

Pull Requests

• Merge pull request #268 from clouddrove/fix/time-issue

v0.0.8-beta (2025-09-22)

Build

• deps: bump github.com/hashicorp/terraform-exec
• deps: bump github.com/hashicorp/terraform-json
• deps: bump github.com/hashicorp/terraform-json
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity
• deps: bump helm.sh/helm/v3 from 3.18.6 to 3.19.0 (#260)
• deps: bump k8s.io/client-go from 0.34.0 to 0.34.1 (#257)

Fix

• resolve readiness issue
• resolve readiness issue

Pull Requests

• Merge pull request #264 from clouddrove/dependabot/go_modules/github.com/hashicorp/terraform-exec-0.24.0
• Merge pull request #265 from clouddrove/dependabot/go_modules/github.com/hashicorp/terraform-json-0.27.2
• Merge pull request #262 from clouddrove/dependabot/go_modules/github.com/Azure/azure-sdk-for-go/sdk/azidentity-1.12.0
• Merge pull request #263 from clouddrove/dependabot/go_modules/github.com/hashicorp/terraform-json-0.27.1

beta-v0.0.5 (2025-09-15)

v0.0.7-beta (2025-09-15)

Feat

• test new log structure
• test new log structure

v0.0.6-beta (2025-09-15)

Feat

• test new log structure

v0.0.5-beta (2025-09-08)

Build

• deps: bump golang.org/x/oauth2 from 0.30.0 to 0.31.0 (#256)
• deps: bump github.com/docker/docker
• deps: bump actions/setup-go from 5 to 6
• deps: bump actions/setup-python from 5 to 6
• deps: bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#251)

Feat

• update selm install log structure

Pull Requests

• Merge pull request #252 from clouddrove/dependabot/github_actions/actions/setup-python-6
• Merge pull request #253 from clouddrove/dependabot/github_actions/actions/setup-go-6
• Merge pull request #254 from clouddrove/dependabot/go_modules/github.com/docker/docker-28.4.0incompatible

v0.0.4 (2025-09-01)

Build

• deps: bump k8s.io/client-go from 0.33.3 to 0.34.0 (#247)
• deps: bump github.com/hashicorp/terraform-exec (#246)
• deps: bump k8s.io/apimachinery from 0.33.4 to 0.34.0 (#245)
• deps: bump github.com/stretchr/testify from 1.11.0 to 1.11.1 (#244)

Feat

• Add support for --wait flag in smurf selm upgrade command (#243)

Feat

• update claude pr workflows for testing (#242)

Pull Requests

• Merge pull request #248 from clouddrove/fix/cloud-workflow

v0.0.3 (2025-08-26)

Build

• deps: bump actions/upload-pages-artifact from 3 to 4 (#240)
• deps: bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#239)

Fix

• Add repo chart support in upgrade (#241)

v0.0.2 (2025-08-21)

Build

• deps: bump helm.sh/helm/v3 from 3.18.5 to 3.18.6 (#237)
• deps: bump github.com/aws/aws-sdk-go from 1.55.7 to 1.55.8 (#236)
• deps: bump k8s.io/api from 0.33.3 to 0.33.4 (#235)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#234)
• deps: bump github.com/hashicorp/terraform-json (#233)

v0.0.1 (2025-08-20)

Build

• deps: bump the go_modules group with 2 updates (#230)
• deps: bump helm.sh/helm/v3 from 3.18.5 to 3.18.6 (#227)
• deps: bump helm.sh/helm/v3 in the go_modules group (#226)
• deps: bump k8s.io/api from 0.33.3 to 0.33.4 (#221)
• deps: bump github.com/hashicorp/terraform-json (#220)
• deps: bump actions/checkout from 4 to 5 (#217)
• deps: bump actions/download-artifact from 4 to 5 (#216)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#215)
• deps: bump github.com/aws/aws-sdk-go from 1.55.7 to 1.55.8 (#214)
• deps: bump github.com/docker/docker in the go_modules group (#213)
• deps: bump k8s.io/client-go from 0.33.2 to 0.33.3 (#206)
• deps: bump github.com/docker/docker (#201)
• deps: bump helm.sh/helm/v3 in the go_modules group (#197)
• deps: bump github.com/docker/docker (#194)
• deps: bump github.com/docker/docker (#193)
• deps: bump k8s.io/api from 0.33.1 to 0.33.2 (#190)
• deps: bump urllib3 (#189)
• deps: bump helm.sh/helm/v3 from 3.18.2 to 3.18.3 (#188)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#186)
• deps: bump requests (#185)
• deps: bump github.com/pterm/pterm from 0.12.80 to 0.12.81 (#182)
• deps: bump helm.sh/helm/v3 from 3.18.1 to 3.18.2 (#180)
• deps: bump github.com/docker/docker (#179)
• deps: bump github.com/docker/docker (#177)
• deps: bump helm.sh/helm/v3 from 3.18.0 to 3.18.1 (#176)
• deps: bump k8s.io/api from 0.32.2 to 0.33.1 (#169)
• deps: bump github.com/hashicorp/terraform-json (#158)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#157)
• deps: bump golang.org/x/oauth2 from 0.29.0 to 0.30.0 (#156)
• deps: bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.7 (#149)
• deps: bump github.com/docker/docker (#148)
• deps: bump github.com/docker/docker (#147)
• deps: bump douglascamata/setup-docker-macos-action (#146)
• deps: bump github.com/hashicorp/terraform-exec (#144)
• deps: bump helm.sh/helm/v3 from 3.17.2 to 3.17.3 (#143)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#142)
• deps: bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 (#139)
• deps: bump github.com/docker/docker (#132)
• deps: bump github.com/golang-jwt/jwt/v5 in the go_modules group (#130)
• deps: bump github.com/docker/docker (#125)
• deps: bump github.com/containerd/containerd (#123)
• deps: bump helm.sh/helm/v3 from 3.17.1 to 3.17.2 (#119)
• deps: bump golang.org/x/net in the go_modules group (#117)
• deps: bump k8s.io/apimachinery from 0.32.2 to 0.32.3 (#115)
• deps: bump golang.org/x/oauth2 from 0.27.0 to 0.28.0 (#111)
• deps: bump github.com/docker/docker (#108)
• deps: bump golang.org/x/oauth2 from 0.26.0 to 0.27.0 (#107)
• deps: bump github.com/docker/docker (#104)
• deps: bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (#97)
• deps: bump k8s.io/apimachinery from 0.32.1 to 0.32.2 (#94)
• deps: bump helm.sh/helm/v3 from 3.16.4 to 3.17.1 (#91)
• deps: bump github.com/hashicorp/terraform-exec (#89)
• deps: bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 (#83)
• deps: bump github.com/docker/docker (#77)
• deps: bump github.com/hashicorp/terraform-exec (#78)
• deps: bump github.com/Azure/azure-sdk-for-go/sdk/azidentity (#69)
• deps: bump k8s.io/apimachinery from 0.31.4 to 0.32.1 (#66)
• deps: bump github.com/aws/aws-sdk-go from 1.55.5 to 1.55.6 (#65)
• deps: bump github.com/docker/docker (#63)
• deps: bump golang.org/x/oauth2 from 0.24.0 to 0.25.0 (#59)
• deps: bump github.com/moby/term from 0.5.0 to 0.5.2 (#58)
• deps: bump jinja2 (#57)
• deps: bump github.com/docker/docker (#56)
• deps: bump helm.sh/helm/v3 from 3.16.3 to 3.16.4 (#54)
• deps: bump golang.org/x/crypto in the go_modules group (#52)
• deps: bump k8s.io/api from 0.31.2 to 0.31.4 (#48)
• deps: bump github.com/docker/docker (#46)
• deps: bump github.com/pterm/pterm from 0.12.79 to 0.12.80 (#34)
• deps: bump k8s.io/apimachinery from 0.31.2 to 0.31.3 (#32)
• deps: bump helm.sh/helm/v3 from 3.16.2 to 3.16.3 (#29)
• deps: bump helm.sh/helm/v3 from 3.16.2 to 3.16.3 (#19)
• deps: bump k8s.io/client-go from 0.31.1 to 0.31.2 (#16)

Feat

• Enhance smurf sdkr and smurf selm logging structure (#229)
• added install.sh (#140)

Feat

• new release tag v1.1.1 (#170)
• Improved performance of docker image (#153)
• fixed docs code (#145)
• integrated -f flag in lint and template of smurf selm (#136)
• Working on smurf version command
• Added new command in smurf which is helm plugin install (#127)
• added flag for plan –destroy (#126)
• updated docker image tag and documentation (#105)
• updated naming convention
• update contributors url
• added major release (#100)
• updated social logo (#90)
• disable tests (#88)
• unit test logic and smurf improvement (#62)
• configured github action to deploy github pages (#28)
• updated permission
• added requirement.txt (#27)
• added dns name (#26)
• updated branch name in trigger
• added workflows (#14)
• Add initial Go module structure and foundational directories (#1)

Fix

• fixed test in install_test.go (#122)

Fmt

• improved naming (#174)

What’s Changed

• build(deps): bump helm.sh/helm/v3 from 3.21.0 to 3.21.1 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/426
• build(deps): bump the pip group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/427
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/429
• build(deps): bump k8s.io/apimachinery from 0.36.1 to 0.36.2 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/428
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/431
• build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/435
• build(deps): bump msgpack from 1.1.0 to 1.2.1 in /docs/sm/docs in the pip group across 1 directory by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/434
• build(deps): bump github.com/containerd/containerd from 1.7.32 to 1.7.33 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/433
• build(deps): bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml from ca8d61c90f059d7ed8c3fc608877d19cc5d965f5 to 5a15692ae38a05cc3aa3b7ab6744add91e9b8591 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/436
• build(deps): bump helm.sh/helm/v3 from 3.21.1 to 3.21.2 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/432
• fix: fix deployment validation for completed Kubernetes Job pods by @anket-cd in https://github.com/clouddrove/smurf/pull/430
• build(deps): bump clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml from 5a15692ae38a05cc3aa3b7ab6744add91e9b8591 to f6ef7e54f3a1f4e2a05a66ed1a8702c07ae94346 by @dependabot[bot] in https://github.com/clouddrove/smurf/pull/437
• feat: enhance smurf selm logs to capture terminated pod details during failed deployments by @anket-cd in https://github.com/clouddrove/smurf/pull/438

Full Changelog: https://github.com/clouddrove/smurf/compare/v1.1.4...v1.1.5

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

0.8.1 (2026-07-03)

Bug Fixes

• release: disable PyPI attestations for reusable-workflow publish (28a147d)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s new since v1.0.0

• feat: append-to-description publish mode + workflow_run/pr-number support (#13)
• feat: warn (advisory, non-blocking) when the preview URL risks HTTP 414, and document the mitigation in the README (#19)
• ci: verify-dist gate, dependabot-dist auto-rebuild, immutable-action publishing
• Various dependency bumps

All changes are backward compatible: new inputs default to the previous behavior, and the URL-length check only warns, it never fails the action. No breaking changes, so the v1 tag is being moved to this release rather than cutting a v2.

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 111 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• chore(deps-dev): bump @types/node from 26.0.1 to 26.1.0 by @dependabot[bot] in https://github.com/garnet-org/action/pull/81
• fix: improve error messages by @nicolasparada in https://github.com/garnet-org/action/pull/84
• feat: add agents.md to repo by @nicolasparada in https://github.com/garnet-org/action/pull/85

Full Changelog: https://github.com/garnet-org/action/compare/v2.1.0...v2.1.1

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/ghcr-manager/ghcr-manager/compare/v1.1.4...v1.1.5

• This action is used across all versions by 2 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Chores

• deps: update all non-major dependencies (595d091)

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 4,081 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Bump the “all” group with 2 updates across multiple ecosystems by @dependabot[bot] in https://github.com/graalvm/setup-graalvm/pull/222
• Add support for GraalVM innovation releases by @fniephaus in https://github.com/graalvm/setup-graalvm/pull/223

Full Changelog: https://github.com/graalvm/setup-graalvm/compare/v1.5.6...v1.6.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat: add GlossaryManager and LinguisticInstructionsManager and CLI for them by @AntonovAnton in https://github.com/l10n-dev/ai-l10n/pull/48

Full Changelog: https://github.com/l10n-dev/ai-l10n/compare/v1.8.0...v1.9.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

OSS Security Policy as Code Starter Kit v10.0.0

The normalized-findings major (ADR-030). The kit now correlates the scanner evidence it already composes — six kit evidence JSONs plus four external SARIF drops — into one deduplicated, KEV/EPSS-ranked finding view, delivered as a new versioned artifact and a new command. Stateless by design: one clone-only run, no database, no state between runs, no network.

Highlights

• New command: correlate-findings (23rd command). Normalizes findings from Semgrep, the four IaC/K8s scanners, zizmor, poutine, OSV-Scanner, and Gitleaks into one vocabulary; deduplicates across scanners with deterministic opk-fk/v1 fingerprints (conservative under-merge: the same CVE from two tools collapses, distinct issues never do); and ranks CISA-KEV first, then EPSS, then severity. Re-runs are bit-identical.
• New contract: findings/1.0 (.oss-policy-kit/findings.json) — strict schema, published at reports/schema/findings-1.0.schema.json. Every source’s original severity is preserved verbatim; missing/unreadable evidence is recorded honestly, never fatal.
• Opt-in gates for the correlated set: --fail-on-severity and --fail-on-kev (a correlated group gates once, regardless of how many tools reported it). Control evaluators are untouched — fence tests prove evaluate output is byte-identical with the feature present or absent.
• Finding-level waivers: vulnerability_ids:-keyed entries in waivers.yaml (the same ones emit-vex consumes) mark findings as waived — visible in the artifact, exempt from the findings gates, and provably unable to change any control state.
• Offline EPSS/KEV enrichment: --enrichment-file takes a user-supplied snapshot that refines ranking only (inferred trust, provenance recorded). The kit ships no bundled advisory data.
• Aggregator SARIF export: --format sarif self-describes as an aggregator/correlator — never the scanner — with per-result source-tool attribution and a double-reporting warning.
• evaluate --with-findings-summary: additive extensions.findings_summary block (totals, by-severity, KEV/high-EPSS counts, findings digest) computed in-process; changes no state, summary, digest, or exit code.

Breaking changes (see docs/v10.0.0-migration-guide.md)

• The deprecated cra-eu-ready-2-1 profile alias is removed (ADR-029, one-major cycle complete). Use cra-eu-conformance-evidence-1; the old id exits 2 with a pointer.
• The legacy evaluation-report-v1/v2/v3.schema.json files no longer ship in the wheel or the public reports/schema/ mirror (the contracts were removed in v9.0.0). The mirror now carries the real current contracts (reports/2.0 + findings/1.0).
• scripts/migrate-1.0-to-2.0.py is removed — retrieve it from the v9.x tags for stored legacy reports.
• export-evidence requires reports/2.0 input. The silent reports/1.0 fallbacks are gone, and previously-wrong outputs are fixed: SPDX annotations now carry real states/messages, every renderer reads target_path, chainloop stops reading a nonexistent waivers array.

Docs

• New findings-correlation.md — the contract, the opk-fk/v1 key spec, the under-merge guarantees, and the anti-ASPM fence.
• New v10.0.0 migration guide; CLI reference and README updated for the 23-command surface.
• triage-cvss-epss-kev.md no longer implies the evaluator thresholds are tunable (they are fixed; tunable prioritization is the findings surface).

Integrity

Quality gates: 4,310 unit + 19 property tests (including determinism, order-independence, and six mandatory fence tests), mypy strict, coverage 93%+. Pre- and post-publish clean-room validation on the real PyPI artifact. PyPI Trusted Publishing + registry attestations; container signed with cosign keyless.

License: Apache-2.0.

• This action is used across all versions by 7 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• ci: bump actions/checkout from 6 to 7 in the all-actions group by @dependabot[bot] in https://github.com/maester365/maester-action/pull/43
• Interactive report available as GitHub artifact with a direct link by @svrooij in https://github.com/maester365/maester-action/pull/42

Full Changelog: https://github.com/maester365/maester-action/compare/v1.1.0...v1.2.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changelog

• 8b28bef427d98b63b5f50a96aaf0fbc1e4575894: Merge pull request #45 from Martinez1991/feat/crosswalk-multicloud-azure-gcp (@Martinez1991)
• 8852a90f27d4d886188266d468c6962b3e31f789: feat(crosswalk): multi-cloud consensus — Azure + GCP + more AWS (real overlaps) (@Martinez1991)

• This action is used across all versions by 10 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

1.1.12 (2026-07-03)

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Version v1.2.6

• Treat NUL Bytes As Ignorable Whitespace

• Type Schema.SObjectType Describe-Result Properties As Their Real Types

• Resolve Null-Argument Constructor Overloads By Most-Specific Non-Null Position

• Allow Public Override Of A Global Abstract Method

• Match Namespaced Custom-SObject Type Arguments In Generic Assignability

• Add Schema.SObjectType Child-Relationship Property Regression Test

• Return Real Record-Type Infos From Schema.SObjectType Describe Properties

• Treat Array-Literal Elements As Values, Not Constructor Arguments

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• Create README.md (3e1d589)
• Update test.yml (3a7ed11)
• Update entrypoint.sh (4e15ea0)
• Update entrypoint.sh (6418942)
• Update entrypoint.sh (51f3a42)
• Create test.yml (d46361f)
• Create entrypoint.sh (bcf8584)
• Create Dockerfile (72d2f0b)
• Create action.yml (89fad1e)

• This action is used across all versions by 25 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Lint action version v4.3.0 has been released!

What’s Changed

• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/25
• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/26
• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/27
• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/28
• chore(deps): pin dependencies by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/29
• chore(deps): update actions/checkout digest to df4cb1c by @renovate[bot] in https://github.com/Profiidev/rust-lint-action/pull/30
• chore: shared renovate config by @Profiidev in https://github.com/Profiidev/rust-lint-action/pull/31
• fix: add warnings on linter success by @Profiidev in https://github.com/Profiidev/rust-lint-action/pull/32
• Release version v4.3.0 by @profidev-commit-bot[bot] in https://github.com/Profiidev/rust-lint-action/pull/33

Full Changelog: https://github.com/Profiidev/rust-lint-action/compare/v4.2.0...v4.3.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/riceball-tw/goog/commits/v1.0.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• release: 0.7.10 — fix mcpb/Smithery bundle crash, MCP tool metadata (6eb9373)
• fix: mcpb/Smithery bundle crashed with no node_modules; add MCP tool metadata (8ed0ea0)
• release: 0.7.9 — per-rule path scoping + docs-prose carve-out (Backstage eval fixes) (54110d9)
• release: 0.7.8 — dependency-manifest goes section-aware (version bumps no longer flagged) (2f992bc)
• release: 0.7.7 — fix GH Marketplace action.yml rejection + MCP registry description cap (87b8fdf)
• fix: action.yml name collision + description over Marketplace’s 125-char cap (05227d2)
• fix: shorten server.json description under the MCP registry’s 100-char cap (2a4ada1)
• release: 0.7.6 — distribution plumbing (MCP registry, Docker/GHCR, pre-commit, GH Action, Claude plugin) (56fc4a6)
• release: 0.7.5, republish with updated README after 0.7.4 publish (3c778dd)
• docs: promote history-audit as the quick-start aha moment (2611797)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

First public release.

Groundskeeper is a first responder for new GitHub issues. When someone opens one, it reads your repo, then posts a single grounded comment: a duplicate check, the repro info that’s missing, a pointer to the relevant file and line, and suggested labels. If it doesn’t have anything solid to say, it stays silent.

It runs as a GitHub Action in your own CI on your own Anthropic key. No hosted service, no third-party app to install.

Install:

• uses: theadamdanielsson/groundskeeper@v1

Defaults to claude-sonnet-4-6. Requires an ANTHROPIC_API_KEY repo secret and issues: write permission. See the README for the full setup.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

miu-cr v0.84.1

AI code review for local changes and GitHub pull requests. Use it as a CLI, CI gate, or GitHub Action with your own LLM key.

Install

curl -fsSL https://cr.miu.sh/install.sh | sh -s -- v0.84.1
brew install vanducng/tap/miucr
go install github.com/vanducng/miu-cr/cmd/miucr@v0.84.1

GitHub Action:

permissions:
  pull-requests: write

steps:
  - uses: actions/checkout@v6
  - uses: vanducng/miu-cr@v0.84.1
    with:
      api-key: ${{ secrets.ANTHROPIC_API_KEY }}

Common commands

miucr login --provider openai
miucr review --staged
miucr review --from main --to HEAD --gate high
miucr review --pr owner/repo#123 --post
miucr upgrade

Docs: https://cr.miu.sh

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Vibgrate CLI 2026.703.7

Released 2026-07-03

Routine maintenance update for the CLI.

What changed

Changed

• Maintenance release with internal improvements and dependency updates.

Benchmarks

Two-arm benchmark of this release against 2026.703.5, interleaved on one runner against the pinned corpus (157 metrics compared).

No regressions against the previous release.

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.703.7

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• docs: document the version release process by @fengmk2 in https://github.com/voidzero-dev/setup-vp/pull/101
• ci: auto-rebuild action bundle on Renovate dependency bumps by @fengmk2 in https://github.com/voidzero-dev/setup-vp/pull/103
• feat: resolve Vite+ version from package.json / catalog by @fengmk2 in https://github.com/voidzero-dev/setup-vp/pull/102

Full Changelog: https://github.com/voidzero-dev/setup-vp/compare/v1.13.0...v1.14.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/wordlift/graph-sync/compare/v6.11.2...v6.11.3

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/wrbl606/backlog.md-to-pr/compare/0.0.2...0.0.3

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• bump up base image to resolute
  • outdated: clang-format 17-20
  • enabled gnucoreutils
• bump up many components:
  • gcc: 15.2 -> 16.1
  • Boost: 1.89.0 -> 1.91.0
  • CMake: 4.1.1 -> 4.3.3
  • difftastic: 0.64 -> 0.69
  • mold: 2.40.4 -> 2.41.0
  • wild: 0.8.0 -> 0.9.0
• removed components:
  • old clang-format s
  • clang-head

$ ./pull.bash v20260703

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Added

• operational_coverage dimension for AGENTS.md (#83). Measures whether an AGENTS.md actually equips a coding agent to operate the repo: real setup/build/test commands (command-family classification, doc-wide, headings never gate) plus code-style / gotchas / PR directive sections with concrete code tokens. Surfaced in the CLI dimension table, the GitHub Action’s PR comment, and accepted by the leaderboard submit API.

Changed

• BREAKING (scores): the AGENTS.md headline profile is now structure 0.40 / operational_coverage 0.40 / efficiency 0.20 (was 0.5/0.5). efficiency was a validated gameable proxy — a junk-fence-stuffed doc scored 92.5/A while the same real commands written inline scored 70.0/C. All AGENTS.md scores re-baseline (30-file corpus: mean 61.06, no file reaches S). SKILL.md / CLAUDE.md / .cursorrules / system-prompt scoring is byte-identical to 8.3.0.

Security

• Fixed a ReDoS in the operational_coverage heading regex (quadratic on whitespace-only heading lines) before it ever shipped — found by a 75-agent adversarial review pass, together with a directive-gate gaming hole, a fence-state desync, and 12 command-recall bugs. Full record: docs/specs/agents-md-operational-coverage.md §11.

Full changelog: https://github.com/Zandereins/schliff/compare/v8.3.0...v8.4.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/ghcr-manager/ghcr-cleanup-manager/compare/v1.1.4...v1.1.5

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Primera versión del SQL/NoSQL Syntax Validator Action. Valida archivos .sql y .mongo sin servidor requerido.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/goweft/tenter-rs/compare/v2...v2.1.0

• This action is used across all versions by 17 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/dae00cbd1175595edfdf44f1b84bc3f043d08a0b with plugin-scanner 2.0.972.

Full Changelog: https://github.com/hashgraph-online/ai-plugin-scanner-action/compare/v1.2.371...v1.2.372

• This action is used across all versions by 11 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1...v1.2.372

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v5.6.0 (2026-07-03)

Install-time guard + GitLab-native output + registry hardening (both remaining roadmap bets)

Ships the last two strategic bets from the 2026-07 roadmap. A second 4-lens adversarial verification gate reviewed the diff and BLOCKED the first candidate with 5 confirmed findings, all fixed here (a real Windows RCE among them). 40 new tests (1120 total).

• Install Guard (Bet 2): supply-chain-guard guard <npm|pnpm|yarn|bun> [args...] checks each package spec against the offline IOC feed + known-bad-version blocklist + typosquat heuristics BEFORE the package manager runs any lifecycle script; a hit blocks the install (exit 2). --force overrides with a loud warning, --dry-run never invokes the manager. The only install blocker whose entire blocklist is auditable in git history, offline, no account.
• GitLab-native output (Bet 3, delivered on the v5.5.0 GHCR image): --format gitlab emits a GitLab Dependency Scanning report (schema 15.2.4) for artifacts:reports:dependency_scanning, so findings surface in the GitLab security UI. Suppressed findings are excluded (mirrors the SARIF path).
• Registry hardening: the Open VSX download and every redirect hop are now constrained to an https host allowlist (open-vsx.org + its storage host); the /tmp -> os.tmpdir() migration is finished across npm/pypi scanners.
• CI/infra: Docker base images pinned by sha256 digest (with a weekly dependabot docker ecosystem to refresh them); the Jenkins example uses npx; scan --no-history skips writing .scg-history/ (the pre-commit hook uses it so hooks never write state into consumer repos).

Fixed by the verification gate before release:

• Windows command injection (critical) in the Install Guard: the cmd.exe argument escaping was single-pass, but the npm/pnpm/yarn/bun .cmd shims re-parse %*, so a crafted package token (x"&echo ...&") could execute arbitrary commands. Now double-escaped (cross-spawn doubleEscapeMetaChars), proven closed by the gate’s own PoC.
• Install-verb bypasses: npm isntall (and the other documented typo-aliases), yarn global add, and a value-taking global flag before the verb (npm --prefix x install evil) all silently skipped scanning. Verb detection rewritten; flag values are no longer misread as package specs.
• --format gitlab could emit a >255-char vulnerability name that fails the GitLab schema, making GitLab discard the whole report; names are now capped.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Release v2.2.9

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Initial release 🎉

Audit how AI crawlers (GPTBot, ClaudeBot, PerplexityBot) read your site - straight from your CI.

Highlights

• Deep-crawl audit of any URL, parsed exactly the way Al crawlers see it (no JS execution)
• 0-100 score + grade, with the full per-page report written to the GitHub job summary
• CI gate: the step fails when the score drops below your threshold
• Branch preview support: boot your environment with command, scan it locally before it ships
• Optional authenticated CI report + repo badge on isready.ai with a Pro/Team api-key (OIDC-verified)
• Zero setup: pre-bundled, dependency-free - no install step at runtime

Usage

- name: AI readiness audit
   uses: isreadyai/audit-action@v1
   with:
     url: ${{ env.DEPLOY_URL }}
     threshold: 80

See the README for all inputs, outputs, permissions and security notes. Learn more at isready.ai.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• fix(shell): make setup-shell rc line self-healing when the CLI leaves $PATH by @JeongJaeSoon in https://github.com/JeongJaeSoon/agent-guard/pull/96
• release: v1.7.1 by @github-actions[bot] in https://github.com/JeongJaeSoon/agent-guard/pull/97

Full Changelog: https://github.com/JeongJaeSoon/agent-guard/compare/v1.7.0...v1.7.1

• This action is used across all versions by 4 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

🛠️ Dependencies

• chore(deps): update dependencies by @renovate[bot] in https://github.com/jkroepke/setup-sops/pull/238

Full Changelog: https://github.com/jkroepke/setup-sops/compare/v1.5.45...v1.5.46

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Added

• README hero image + social-preview card
• GitHub Action: sticky PR comments (pr-comment input) — score, grade, top 3 fixes, kept updated in place; degrades safely on fork PRs

Fixed

• Security hardening: argument-injection fix in gitinfo.clone, least-privilege GITHUB_TOKEN, all third-party Actions pinned to commit SHAs + Dependabot, secret scanning + branch protection enabled
• CI: full-history checkout fixes a PR-merge-commit misclassification in the self-scan dogfood tests

Full details: CHANGELOG.md

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Add ingest pipeline and trace-mined probes by @kelkalot in https://github.com/kelkalot/probelock/pull/1

New Contributors

• @kelkalot made their first contribution in https://github.com/kelkalot/probelock/pull/1

Full Changelog: https://github.com/kelkalot/probelock/compare/v0.1.0...v0.2.0

• This action is used across all versions by 7 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat: force_languages input by @lfventura in https://github.com/lfventura/list-repository-languages/pull/8

Full Changelog: https://github.com/lfventura/list-repository-languages/compare/v3.2.1...v3.3.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/MettleCI/mcix-overlay-apply/compare/v0.0.36...v0.0.37

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/MettleCI/mcix-system-version/compare/v0.0.27...v0.0.37

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/MettleCI/mcix-unit-test-execute/compare/v0.0.27...v0.0.37

• This action is used across all versions by 8 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Usage

- uses: Mic92/hestia@v1.0.4
  with:
    version: v1.0.4

What’s Changed

• gha: retry finalize when the uploaded entry is not yet visible by @Mic92 in https://github.com/Mic92/hestia/pull/86

Full Changelog: https://github.com/Mic92/hestia/compare/v1.0.3...v1.0.4

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v0.10.1 — Marketplace branding + cleanup

A packaging/metadata patch on top of v0.10.0. No engine behavior change — receipts, mode: verify, and the gates are identical.

What changed

• Marketplace branding on the composite Action (branding.icon: check-circle, color: green) so it can be listed on the GitHub Marketplace with an icon.
• Removed a now-unreachable inner mode != assert guard in the assert step (already gated by the step if: and the reject-unsupported-mode step).
• @v0 references in the docs now resolve via a moving v0 major tag that tracks the latest v0.x release. For the security-critical mode: verify gate, keep pinning an exact tag (e.g. @v0.10.1) as the README recommends.

Verify quick reference

- uses: actions/checkout@v4
# set up your runtime + deps here (setup-node, npm ci, …)
- uses: mohamedzhioua/agent-done-or-not@v0.10.1
  with:
    mode: verify
    checks: |
      test: npm test
      build: npm run build

Full history in CHANGELOG.md.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Promotes the funding-instrument checks that were a single dimension of the AP2 harness (AP2-015) into a first-class module — the tokenized card credential (Visa Trusted Agent Protocol / Mastercard Agentic Tokens) that sits inside an AP2 Payment Mandate as the instrument that actually moves money.

New: card_token_harness.py — 12 tests (CTK-001..012), #229

Stdlib-only, deterministic reference verifier, every check fails closed.

• Binding: agent holder-key, channel/domain, cross-network substitution
• Scope: merchant, per-transaction amount cap (both bounds — negative amounts rejected), cumulative velocity cap, consent policy
• Cryptogram: freshness (monotonic-counter replay), amount-binding (no re-pricing)
• Lifecycle: expiry, revocation/suspension (“identify and revoke”)
• Supply chain: PAN de-tokenization protection

Grounded in EMV payment tokenisation + TAVV/DTVV dynamic cryptograms. AP2 answers “is this agent authorized to pay for this cart”; the card token answers “is this credential valid, unrevoked, fresh, and bound to this agent/merchant/amount/channel” — they compose.

520 → 532 tests, 36 → 37 modules. Two fail-open gaps (negative-amount, None==None binding) surfaced by Bugbot were fixed and are now guarded by negative tests before merge.

The harness now covers all four layers of the agentic-payments stack plus the card-network funding rail underneath them. Verified by scripts/count_tests.py (definitive: 532).

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Methodology litmus-v12 — two false-positive fixes so a server’s correct, defensive behavior is no longer graded as a fault.

• C-04 (probe 3.2): a validation error that quotes the rejected input back (e.g. Pydantic input_value='…') is a safe rejection, not server-generated amplification — no longer a false D. (#85)
• C-02 (probe 2.1): a mutation verb under a negation (“Cannot create or revoke keys”) no longer reads as a permission-mislabel lie; clause-scoped, so a real “Deletes… Cannot be undone.” still trips. (#85)

methodologyVersion moves litmus-v11 → litmus-v12 (a string, so older attestations coexist). Release bump in #86. Both fixes are covered by regression tests reproduced from real servers.

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v1.7.8 was tagged on the wrong commit and did not actually contain the enrichment fix; v1 pointer was updated but the deployed code path in fast-paths still skipped _enrich_candidate_licenses. This release ships the real fix: _enrich_candidate_licenses(candidates, target) is now called on the pin-arxiv and search-method fast-paths (gated on REMYX_LICENSE_GATE, idempotent, best-effort). REMYX-190 evidence: https://github.com/remyxai/VQASynth/issues/105 opened with license_class=unknown despite WnQinm/Annotator having a clearly readable BSD-3-Clause LICENSE — the fast-path never called the enrichment step.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/srbsa/diffgate/compare/v0.7.6...v0.7.7

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Adds embedding_inversion, a 7th probe that flags pipelines exposing raw embedding vectors (invertible back to source text per vec2text). Structural detector, a vulnerable/hardened demo pair, unit tests, and a threat-model section. Install or upgrade: pip install -U rag-redteam

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

chore(release): 1.193.0

1.193.0 (2026-07-03)

✨ Features

• remove is-first-release-tag (f210a51)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

miu-cr v0.82.4

AI code review for local changes and GitHub pull requests. Use it as a CLI, CI gate, or GitHub Action with your own LLM key.

Install

curl -fsSL https://cr.miu.sh/install.sh | sh -s -- v0.82.4
brew install vanducng/tap/miucr
go install github.com/vanducng/miu-cr/cmd/miucr@v0.82.4

GitHub Action:

permissions:
  pull-requests: write

steps:
  - uses: actions/checkout@v6
  - uses: vanducng/miu-cr@v0.82.4
    with:
      api-key: ${{ secrets.ANTHROPIC_API_KEY }}

Common commands

miucr login --provider openai
miucr review --staged
miucr review --from main --to HEAD --gate high
miucr review --pr owner/repo#123 --post
miucr upgrade

Docs: https://cr.miu.sh

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• workaround for non-UTC timezone host environment
  • Singularity/Apptainer binds Etc/UTC to host timezone at default
• speed up CI
• bump up actions
  • including apptainer 1.4.4 -> 1.5.2
• update msvc-wine

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Sync language check structure by @yvette-carlisle in https://github.com/hack-ink/vibe-style/pull/35
• Roll dependencies by @yvette-carlisle in https://github.com/hack-ink/vibe-style/pull/81
• Speed up vstyle tune telemetry by @yvette-carlisle in https://github.com/hack-ink/vibe-style/pull/82

Full Changelog: https://github.com/hack-ink/vibe-style/compare/v0.2.1...v0.2.2

• This action is used across all versions by 17 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/6a3f3b3419536de769697931aecf26e2e0d10df8 with plugin-scanner 2.0.968.

Full Changelog: https://github.com/hashgraph-online/ai-plugin-scanner-action/compare/v1.2.367...v1.2.368

• This action is used across all versions by 11 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1...v1.2.368

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v5.5.0 (2026-07-02)

Community batch: all 8 seeded issues shipped, hardened by an adversarial release gate

Implements every open issue (#40-#47) in one release. Before tagging, a 4-lens adversarial verification gate reviewed the full diff and BLOCKED the first candidate with 6 confirmed findings - all fixed here (details below). 35 new tests (1057 total).

• Open VSX registry support (#40): supply-chain-guard vscode <id> --registry openvsx scans extensions from open-vsx.org (VSCodium, Gitpod, Theia); marketplace stays the default. Windows fix: scanner temp dirs now use os.tmpdir() instead of /tmp.
• Badge output (#42): --format badge emits Shields.io endpoint JSON. The badge derives from the findings summary, mirroring exit-code semantics (critical = red, high = orange, medium = yellow, else green).
• pre-commit hook (#41): .pre-commit-hooks.yaml + a “prepare” build script so git-based installs compile dist/; README documents the .pre-commit-config.yaml snippet.
• CI recipes (#44, #45, #46): examples/ gains CircleCI, Jenkins, and Azure Pipelines gate configs.
• Official Docker image (#47): multi-stage Dockerfile (non-root, unzip included, installs the locally built tarball of the tagged source) + docker.yml publishing multi-arch (amd64/arm64) images to ghcr.io/homeofe/supply-chain-guard on every release tag, with provenance and SBOM attestations. All workflow actions SHA-pinned and verified upstream.
• Coverage gate (#43): vitest v8 coverage with thresholds wired into CI; coverage summary uploaded as a build artifact.

Fixed by the verification gate before release (would have shipped broken):

• Docker build died at npm ci (the new prepare script ran before tsconfig/src existed in the layer) - now –ignore-scripts in the builder.
• Badge severity inversion: one critical finding scored “medium” risk level and rendered a YELLOW badge while the CLI exited 2 - badges now mirror the gate.
• prepare: npx tsc could download and execute the namesquatted “tsc” registry package on cold installs - now plain tsc (bin-PATH only).
• pre-commit docs pinned rev v5.4.2, a tag that predates the hook file - now gate-enforced via check:version-sync.
• CircleCI example used an invalid when: key and would not compile.
• The README badge recipe froze the badge green exactly when findings appeared (scan exits non-zero, publish step skipped) - now || true + if: always().

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat(shell): resolve agent-guard without a PATH install for the bang guard by @JeongJaeSoon in https://github.com/JeongJaeSoon/agent-guard/pull/94
• release: v1.7.0 by @github-actions[bot] in https://github.com/JeongJaeSoon/agent-guard/pull/95

Full Changelog: https://github.com/JeongJaeSoon/agent-guard/compare/v1.6.0...v1.7.0

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 38 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• [Junie]: Update Junie CLI Version to 2144.7 in Files by @mashan555 in https://github.com/JetBrains/junie-github-action/pull/172

Full Changelog: https://github.com/JetBrains/junie-github-action/compare/v1...v1.5.6

• This action is used across all versions by 10 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

9.80.4 (2026-07-02)

Bug Fixes

• (core): vertex schema fallback, mcp log dedup, safe serialization, timeout handling (2889ed2)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• fix(ci): prefetch quirk-library images before validation in the publish lane (#76) (c7ef4fb)
• chore(release): prepare v0.3.0 — changelog + version refs (#75) (b2ef03e)
• docs: consolidate experimental tracks into docs/experimental.md (#73) (8a910a5)
• feat(examples): ebpf-go validation recipe — loader example + cookbook (#72) (7eed351)
• feat(ci): publish the quirk-library matrix to GitHub Pages weekly (#71) (1d75677)
• feat(action): command-mode inputs + built-in matrix names for the GitHub Action (#70) (00e2017)
• docs: drop internal “Repository Hygiene” section from README (#69) (b127315)
• fix(docs): readable contrast in test-command screenshot (#68) (2491a69)
• feat(cli): add test-command verb + README screenshot of a real run (#67) (88971fe)
• docs: surface command mode as a core feature + soften Falco loader claim (#66) (c790219)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat: implement safety improvements by removing apiKey field and refactoring key management by @AntonovAnton in https://github.com/l10n-dev/ai-l10n/pull/47

Full Changelog: https://github.com/l10n-dev/ai-l10n/compare/v1.7.1...v1.8.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat: review verdict labels, comment-only reviews, web search by @louisescher in https://github.com/louisescher/crabd/pull/4
• feat: Delete crabd.yml, prepare for public release by @louisescher in https://github.com/louisescher/crabd/pull/6
• chore: version packages by @github-actions[bot] in https://github.com/louisescher/crabd/pull/5

New Contributors

• @louisescher made their first contribution in https://github.com/louisescher/crabd/pull/4

Full Changelog: https://github.com/louisescher/crabd/compare/v0.1.0...v0.1.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

First gem release since 0.1.0 (v0.2.0 was tagged but its publish failed; its changes are included here). Published to RubyGems as moult.

moult-action

• The bare uses: moult-rb/moult-rb@v1 workflow now works out of the box: the action installs moult from its own checkout (no Gemfile needed in your repo) and moult-cloud-url defaults to https://moultrb.com.
• Actionable first-run errors: a missing permissions: id-token: write now says exactly that instead of a Ruby backtrace; non-2xx responses from GitHub’s token endpoint are reported with status and body.
• Pull requests from forks are gated in CI but skip the upload with a notice — GitHub issues no OIDC identity to fork PRs.
• base-sha defaults to the PR base branch (or the merge queue’s base SHA), falling back to the repository default branch — repos whose base branch isn’t main no longer fail their first PR scan.
• merge_group events are supported as pr scans; pull_request_target is rejected in auto mode (it checks out the base branch, which would silently gate an empty diff as a pass).

Gem

• Moult::CloudUpload.projection — the sanitised upload payload builder (allow-listed keys, absolute paths stripped).
• License changed from MIT to Apache-2.0.

Full details in CHANGELOG.md.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Github Marketplace release.

Full Changelog: https://github.com/n0namedeveloper/DeepRabbit/compare/v1.1.0...v1.1.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• Bump pnpm/action-setup from v4 to v6 (0b8282d)
• CI: add Astro, SvelteKit, Remix, and Nuxt fixtures to the test matrix (377d196)
• Support Astro, SvelteKit, Remix, and Nuxt static builds (2bb9389)
• Add framework-compatibility test suite and offline build inputs (b31ebe4)
• Initial release (6857aff)

• This action is used across all versions by 1 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• feat: deny closing footer with name and website by @peterpeterparker in https://github.com/peterpeterparker/blog-to-newsletter-action/pull/5

Full Changelog: https://github.com/peterpeterparker/blog-to-newsletter-action/compare/v0.0.3...v0.0.4

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

litmus-v11 — C-02 gains expected-upstream inference, fixing a first-party-egress false positive.

An honest API-wrapper server — a tool that transparently calls the API it advertises (openai_chat → api.openai.com) — made an undeclared egress attempt and was capped at D, even though the upstream is the very API its own surface names. Before an undeclared host is now counted as overreach, the harness infers whether it is a plausible upstream for the server’s own tool surface: a host named verbatim in the tool text (strong), or an egress host whose registrable label matches a non-generic brand token drawn from the surface and the package owner/name (medium, plain-TLD hosts only). A match reclassifies the attempt from overreach into an informational egress-inferred finding — disclosure, not exoneration.

Guardrails keep lookalikes out: whole-label (never substring) matching, a generic-label stoplist, registrable-label-only matching (so openai.evil-cdn.com is not cleared), and shared-tenant suffixes (github.io, vercel.app, …) treated as their own level (so attacker.github.io does not inherit foo.github.io’s match). This only ever turns a false D → a correct pass, never the reverse, so every litmus-v1…v10 attestation stays valid. The independent C-03 probe 4.2 canary-in-egress check is unchanged and still floors real exfiltration at F. The A–F rubric and the on-chain EAS schema are unchanged; the evidence bundle schema advances to 1.7.0 (adds the egress-inferred finding kind).

Ships #83 (the fix) and #84 (the release bump). methodologyVersion → litmus-v11.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com

🔎 Findings Triage

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Enterprise with a subscription.

Triage findings straight from the Findings view. Each finding gets a triage status you can move through its lifecycle:

Open → Under Review → Remediating → Risk Accepted → False Positive → Resolved

Add a triage note to record the decision, mute a finding, all from the row’s actions menu. The current status shows inline on every finding row, so you keep track of what has been reviewed and stop re-checking the same issues scan after scan.

The status also follows the finding automatically across scans: when a finding flips from FAIL to PASS on the next scan it moves to Resolved, and when it flips from PASS back to FAIL it moves to Reopened. You always know whether an issue is genuinely fixed or has regressed, without touching it by hand.

Read more in our Findings Triage documentation.

⚙️ Scan Configuration

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Enterprise with a subscription.

Create named, reusable scan configurations from a dedicated Scans / Configuration page. Each configuration is YAML that follows the structure of prowler/config/config.yaml, so you only include the keys you want to override; the rest fall back to the built-in defaults. Values are validated on save against a per-provider, type-safe configuration schema that range-checks each field and rejects unknown keys, so a malformed config is caught before it ever reaches a scan. Attach a configuration to one or more providers so it applies on their next scan, or save it now and attach providers later.

From the Providers view you can pick which configuration a provider uses (Default or any of your saved ones) without leaving the page. No more passing config files around by hand.

Read more in our Scan Configuration documentation.

✅ Per-Requirement Configuration Validation

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Enterprise with a subscription.

Compliance frameworks can now declare ConfigRequirements on a requirement, so it’s reported as FAIL when its mapped checks ran under a configuration too loose to satisfy it. Even if every individual finding PASSed. This applies across all compliance outputs: CSV, OCSF, and console tables, and is the engine behind Scan Configuration’s “marked as FAIL” behavior described above.

Read more in our Configuration File documentation.

⏱️ Okta — Request Throttling & Retries

Prowler now proactively throttles Okta API requests to stay under rate limits, with reactive retries on HTTP 429 as a safety net. Both are set in the scan configuration (or their equivalent CLI flags):

• okta_requests_per_second (config file) / --okta-requests-per-second (CLI) — cap the request rate. Default: 4 req/s.
• okta_max_retries (config file) / --okta-retries-max-attempts (CLI) — bound retry attempts. Default: 5.

This makes large Okta scans more reliable and less likely to be rate-limited.

Read more in our Okta rate limit documentation.

📉 AWS — Cap Resources Scanned per Service

Large AWS accounts can now cap how many resources Prowler analyzes for the highest-volume services, keeping scan time and cost under control. Set a global limit with max_scanned_resources_per_service, or override it per service:

• EBS snapshots (max_ebs_snapshots)
• Backup recovery points (max_backup_recovery_points)
• CloudWatch log groups (max_cloudwatch_log_groups)
• Lambda functions (max_lambda_functions)
• ECS task definitions (max_ecs_task_definitions)
• CodeArtifact packages (max_codeartifact_packages)

Limits are disabled by default (0 = unlimited); only positive values cap the analyzed resources.

[!WARNING] When a positive limit is set, compliance results reflect only the sampled resources, not every matching resource in the account.

Read more in our configuration file documentation.

🏷️ Azure — Filter by Resource Group

Azure scans can now be scoped to one or more resource groups with the new --azure-resource-group / --azure-resource-groups option. This lets you run focused assessments against specific environments, teams, or workloads instead of scanning every accessible resource in the subscription.

Prowler validates the requested resource groups across accessible subscriptions and applies the scope across supported Azure services, making targeted Azure scans faster, cleaner, and easier to review.

Examples:

• Single resource group: prowler azure --az-cli-auth --azure-resource-group rg-prod
• Multiple resource groups: prowler azure --az-cli-auth --azure-resource-group rg-prod1 rg-prod2

Read more in our Azure Resource Groups documentation.

Thanks to @Legin-ML for contributing this feature!

🧭 Provider Group Filter

Filter the Overview, Findings, Resources, Scans, and Providers views by provider group. Scope the whole app to a team, an environment, or a business unit in one click instead of filtering provider by provider.

Read more about managing provider groups in our RBAC documentation.

🔬 API — Timestamp Precision in Findings Filters

The /api/v1/findings endpoint now accepts full timestamps on the inserted_at and updated_at filters (filter[inserted_at__gte], filter[inserted_at__lte], and the updated_at variants), so you can query narrow time windows instead of whole days. Date-only filtering keeps working, so existing integrations are unaffected.

Findings inserted within a precise timestamp window

curl --globoff \
    
'[http://localhost:8080/api/v1/findings?filter[inserted_at__gte]=2026-07-01T06:12:18Z&filter[inserted_at__lte]=2026-07-02T19:25:55Z](http://localhost:8080/api/v1/findings?filter[inserted_at__gte]=2026-07-01T06:12:18Z&filter[inserted_at__lte]=2026-07-02T19:25:55Z)' \    
-H 'Authorization: Bearer <YOUR_TOKEN>' \    
-H 'Accept: application/vnd.api+json'

Combine inserted_at and updated_at windows in a single request

curl --globoff \
'[http://localhost:8080/api/v1/findings?filter[inserted_at__gte]=2026-07-01T05:12:18Z&filter[inserted_at__lte]=2026-07-02T20:25:55Z&filter[updated_at__gte]=2026-07-01T06:12:18Z&filter[updated_at__lte]=2026-07-02T19:25:55Z](http://localhost:8080/api/v1/findings?filter[inserted_at__gte]=2026-07-01T05:12:18Z&filter[inserted_at__lte]=2026-07-02T20:25:55Z&filter[updated_at__gte]=2026-07-01T06:12:18Z&filter[updated_at__lte]=2026-07-02T19:25:55Z)' \
-H 'Authorization: Bearer <YOUR_TOKEN>' \
-H 'Accept: application/vnd.api+json'

🕸️ Attack Paths — Neptune as a persistent sink

Attack Paths can now persist its graph in AWS Neptune in addition to Neo4j, selectable via ATTACK_PATHS_SINK_DATABASE=neptune (default neo4j). Cartography’s per-scan ingest database stays on Neo4j. The scan task preflights the ingest database and the configured sink before ingestion, and provider graph cleanup now deletes relationships in directed batches before deleting nodes.

This is the groundwork for scale: a managed graph database lets Attack Paths hold much larger graphs, extend coverage to more providers, and link resources across them so an attack path can cross provider boundaries instead of stopping at one cloud’s edge.

Read more in the Attack Paths documentation.

🔐 New Secret-Scanning Engine — Kingfisher

Prowler’s secret-scanning checks now run on Kingfisher instead of detect-secrets. Scans run fully offline by default, and obvious placeholder values (e.g. password123, changeme) are no longer reported, cutting down false positives.

Opt in to live validation with the new --scan-secrets-validate flag (or the aws.secrets_validate config option): Prowler checks discovered secrets against the provider APIs, and any secret confirmed to be live is reported as critical, so you can prioritize the credentials that actually work.

[!NOTE] The detect_secrets_plugins configuration option has been removed, as it is no longer used by the new engine.

Read more in our secret detection documentation.

🔍 Checks

AWS

• stepfunctions_statemachine_encrypted_with_cmk — Step Functions state machines use a customer-managed KMS key for encryption at rest instead of the default AWS-owned key. Thanks to @Sid-0602!
• waf_regional_webacl_logging_enabled — AWS WAF Classic Regional Web ACLs have logging enabled to a Kinesis Data Firehose stream. Thanks to @Sid-0602!
• IAM privilege escalation — the privesc checks now cover AWS Bedrock AgentCore paths across Runtime, Harness, Code Interpreter, and Custom Browser. Thanks to @MrCloudSec!
• apigateway_restapi_no_secrets_in_stage_variables - Scans API Gateway REST API stage variables for hardcoded passwords, API keys, and tokens. Thanks to @chirag1206!
• awslambda_function_no_secrets_in_code — This check now supports a secrets_ignore_files audit-config option to skip files inside the deployment package by glob pattern (e.g. *.deps.json), suppressing .NET dependency-manifest false positives without masking real secrets.
• s3_bucket_object_public — spot-checks a configurable sample of object ACLs in each bucket and flags objects granted to the AllUsers or AuthenticatedUsers groups. Disabled by default; opt in via the s3_bucket_object_public_enabled configuration option. Thanks to @Synchx00!

Read more in our AWS documentation.

Explore all AWS checks at Prowler Hub.

Microsoft 365

New Conditional Access hardening checks:

• entra_conditional_access_policy_explicitly_targets_azure_devops — at least one enabled policy explicitly includes the Azure DevOps cloud application, rather than relying on a broad “All cloud apps” policy. Thanks to @mzl2233!
• entra_conditional_access_policy_no_exclusion_gaps — every user, group, role, or application excluded from an enabled policy stays in scope of another enabled policy. Thanks to @UTKARSH698 with @arieleli01212 as co-author!
• entra_conditional_access_policy_groups_management_restricted — every security group referenced by an enabled or report-only policy is management-restricted or role-assignable. Thanks to @SAMurai-16!
• exchange_application_access_policy_restricts_mailbox_apps — every service principal with Microsoft Graph application-level Exchange mailbox permissions is restricted by an Exchange Online Application Access Policy. Thanks to @VasistAcharya!

Read more in our Microsoft 365 documentation.

Explore all Microsoft 365 checks at Prowler Hub.

Compliance

🧩 CIS Benchmark Refresh — Six New Versions

Prowler ships a coordinated refresh of the CIS Benchmarks across six providers:

• AWS — CIS Amazon Web Services Foundations Benchmark v7.0.0, adding the new Organizations section (2.1.1-2.1.6), resource policy (2.21), web front-end access logging (4.10), and VPC Endpoints (6.8) recommendations.
• Azure — CIS Microsoft Azure Foundations Benchmark v6.0.0.
• GCP — CIS Google Cloud Platform Foundation Benchmark v5.0.0.
• Kubernetes — CIS Kubernetes Benchmark v2.0.1.
• GitHub — CIS GitHub Benchmark v1.2.0.
• Microsoft 365 — CIS Microsoft 365 Foundations Benchmark v7.0.0.

Read more in our compliance documentation.

Explore the full compliance catalog at Prowler Hub.

🌐 CIS Controls v8.1 — Universal Framework

A new universal (cross-provider) compliance framework mapping existing checks across 18 providers — AWS, Azure, GCP, Kubernetes, M365, GitHub, AlibabaCloud, OracleCloud, GoogleWorkspace, Okta, Cloudflare, Vercel, MongoDB Atlas, OpenStack, Linode, StackIT, NHN, and Scaleway — to the 18 CIS Critical Security Controls and their Safeguards. Ships with a dedicated detail view and report mapping in the UI.

Read more in our compliance documentation.

Explore the full compliance catalog at Prowler Hub.

🙌 External Contributors

Thank you to our community contributors for this release!

• @chirag1206 — apigateway_restapi_no_secrets_in_stage_variables check (#11188)
• @MrCloudSec — AWS Bedrock AgentCore privilege escalation paths in the IAM privesc checks (#11726)
• @Sid-0602 — stepfunctions_statemachine_encrypted_with_cmk (#11538) and waf_regional_webacl_logging_enabled (#11539) checks
• @mzl2233 — entra_conditional_access_policy_explicitly_targets_azure_devops check (#11182)
• @UTKARSH698 with @arieleli01212 as co-author — entra_conditional_access_policy_no_exclusion_gaps check (#11577)
• @SAMurai-16 — entra_conditional_access_policy_groups_management_restricted check (#11342)
• @vahidg — Azure PostgreSQL flexible server collection resilience fix (#11595)
• @davletd — Azure keyvault_logging_enabled AuditEvent category fix (#11660)
• @VasistAcharya — exchange_application_access_policy_restricts_mailbox_apps (#11247)
• @Legin-ML — Filter scans at Resource Group level (#10657)
• @Synchx00 — s3_bucket_object_public check (#9517)

UI

🚀 Added

• Filter the Overview, Findings, Resources, Scans, and Providers views by provider group (#11659)
• CIS Controls v8.1 compliance support, including its detail view and report mapping (#11700)

API

🚀 Added

• Timestamp precision support for /api/v1/findings inserted_at and updated_at filters (#11754)

🔄 Changed

• Attack Paths: AWS Neptune is now supported as a persistent sink database, selectable via ATTACK_PATHS_SINK_DATABASE=neptune (default neo4j), Cartography’s (bumped to 0.138.1) per-scan ingest database stays on Neo4j (#11524)
• Attack Paths: Scan task now checks the ingest Neo4j database and configured graph sink before starting graph ingestion (#11743)
• Disable PowerShell telemetry in the API container image (#11746)

🐞 Fixed

• Attack Paths: Provider graph cleanup now deletes Neo4j and Neptune relationships in directed batches before deleting nodes (#11755)
• scan-perform no longer reports an error when a provider is deleted during a running scan (#11696)

SDK

🚀 Added

• exchange_application_access_policy_restricts_mailbox_apps check for M365 provider, verifying every service principal with Microsoft Graph application-level Exchange mailbox permissions is restricted by an Exchange Online Application Access Policy, preventing tenant-wide mailbox access by unscoped applications (#11247)
• Per-requirement configuration validation for compliance frameworks via ConfigRequirements, so a requirement is reported as FAIL when its configurable checks ran with a configuration too loose to satisfy it (applied across all compliance outputs: CSV, OCSF, and console tables) (#11669)
• entra_conditional_access_policy_explicitly_targets_azure_devops check for M365 provider, verifying at least one enabled Conditional Access policy explicitly includes the Azure DevOps cloud application instead of relying on a broad “All cloud apps” policy (#11182)
• entra_conditional_access_policy_no_exclusion_gaps check for M365 provider, verifying every user, group, role, or application excluded from an enabled Conditional Access policy stays in scope of another enabled policy (#11577)
• entra_conditional_access_policy_groups_management_restricted check for M365 provider, verifying every security group referenced by an enabled or report-only Conditional Access policy is management-restricted or role-assignable (#11342)
• stepfunctions_statemachine_encrypted_with_cmk check for AWS provider, verifying that each Step Functions state machine uses a customer-managed KMS key for encryption at rest rather than the default AWS-owned key (#11538)
• CIS Controls v8.1 universal compliance framework mapping existing checks across 18 providers (AWS, Azure, GCP, Kubernetes, M365, GitHub, AlibabaCloud, OracleCloud, GoogleWorkspace, Okta, Cloudflare, Vercel, MongoDB Atlas, OpenStack, Linode, StackIT, NHN, and Scaleway) to the 18 CIS Critical Security Controls and their Safeguards (#11700)
• CIS Microsoft 365 Foundations Benchmark v7.0.0 compliance framework for the M365 provider (#11699)
• waf_regional_webacl_logging_enabled check for AWS provider, verifying that each AWS WAF Classic Regional Web ACL has logging enabled to a Kinesis Data Firehose stream (#11539)
• sdk_only provider property (default true) and Provider.get_app_providers(), so a provider (built-in or external) stays CLI/SDK-only and hidden from the app unless it declares sdk_only = False (#11427)
• Provider.get_scan_arguments(), Provider.get_connection_arguments() and Provider.get_credentials_schema() contract methods, so a provider persisted as a stored uid plus a secret dict can be constructed and validated programmatically (to be consumed by the API in a later change) (#11578)
• Okta API request throttling to proactively stay under rate limits, configurable via okta_requests_per_second in the config file and the --okta-requests-per-second CLI flag, plus configurable retries via okta_max_retries / --okta-retries-max-attempts as a safety net (#11702)
• CIS Amazon Web Services Foundations Benchmark v7.0.0 compliance framework for the AWS provider, adding the new Organizations section (2.1.1-2.1.6), resource policy (2.21), web front-end access logging (4.10), and VPC Endpoints (6.8) recommendations (#11707)
• CIS Microsoft Azure Foundations Benchmark v6.0.0 compliance framework for the Azure provider (#11708)
• CIS Google Cloud Platform Foundation Benchmark v5.0.0 compliance framework for the GCP provider (#11714)
• CIS Kubernetes Benchmark v2.0.1 compliance framework for the Kubernetes provider (#11722)
• CIS GitHub Benchmark v1.2.0 compliance framework for the GitHub provider (#11719)
• AWS Bedrock AgentCore privilege escalation paths in the IAM privilege escalation checks, covering Runtime, Harness, Code Interpreter and Custom Browser (#11726)
• --scan-secrets-validate flag and aws.secrets_validate configuration option to optionally validate the secrets discovered by the secret-scanning checks against the provider APIs; secrets confirmed to be live are reported as critical (#11694)
• apigateway_restapi_no_secrets_in_stage_variables check for AWS provider, scanning API Gateway REST API stage variables for hardcoded secrets such as passwords, API keys, and tokens (#11188)
• s3_bucket_object_public check for AWS provider, spot-checking a configurable sample of object ACLs in each bucket and flagging objects granted to the AllUsers or AuthenticatedUsers groups; disabled by default and opted into via the s3_bucket_object_public_enabled configuration option (#9517)
• Azure provider now supports --azure-resource-group to scope resource-level checks to specific resource groups across all accessible subscriptions (#10657)

🔄 Changed

• Replaced the detect-secrets library with Kingfisher as the engine for the secret-scanning checks; scans run fully offline by default and obvious placeholder values are no longer reported as findings (#11694)
• Removed the detect_secrets_plugins configuration option, which is no longer used by the new secret-scanning engine (#11694)
• awslambda_function_no_secrets_in_code now supports a secrets_ignore_files audit-config option to skip files inside the deployment package by glob pattern (e.g. *.deps.json), suppressing .NET dependency-manifest false positives without masking real secrets (#11222)
• AWS scans for EBS snapshots, Backup recovery points, CloudWatch log groups, Lambda functions, ECS task definitions, and CodeArtifact packages now support configurable resource analysis limits via aws.max_scanned_resources_per_service; limits are disabled by default and only positive values cap analyzed resources (#11228)

🐞 Fixed

• GitHub repository_has_codeowners_file check no longer flags archived repositories, since they are read-only and cannot be updated without first being unarchived, making the finding not actionable (#11735)
• Report secret-scanning checks as MANUAL instead of PASS when the scanner fails (non-zero exit, timeout, unparseable output or missing binary), so a scanner failure is no longer indistinguishable from “no secrets found” (#11694)
• Avoid a false FAIL in cloudwatch_log_group_no_secrets_in_logs when a multiline event’s secrets are all removed by secrets_ignore_patterns during the rescan (#11694)
• Key the cloudwatch_log_group_no_secrets_in_logs secret scan by log group ARN instead of name, so same-named log groups and streams in different regions no longer collide and reuse each other’s findings (#11694)
• Compliance frameworks contributed by several external packages under the same provider are now merged instead of overwritten, so every entry-point directory a provider contributes is discovered (#11578)
• Azure PostgreSQL flexible server collection no longer drops the remaining servers in a subscription when one server fails to collect; the connection_throttle.enable parameter (removed in PostgreSQL 16+) is treated as absent only when the Azure SDK reports it as not found, so unexpected lookup failures are not silently reported as throttling disabled (#11595)
• Azure keyvault_logging_enabled now accepts Key Vault diagnostic settings that enable the explicit AuditEvent category, avoiding false failures when Azure returns category-based logs without category groups (#11660)
• GitHub default branch protection checks now evaluate repository rulesets in addition to classic branch protection, avoiding false positives for repositories that enforce protection through rulesets (#11723)
• Okta, Alibaba Cloud and OpenStack scan-config sections are now validated against a registered schema instead of being silently accepted, so their configurable thresholds (session/idle timeouts, retention days, image-sharing and secret-scanning settings) log a warning and fall back to the built-in default whenever a value is out of range (#11725)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v3 is the current major: verify, lint, and diff evidence bundles from AI agent runs in CI, with coding-agent sandbox governance and in-toto/DSSE bundle attestation.

What v3 carries

• sandbox-command: run a coding agent under assay sandbox and verify the resulting evidence bundle in the same job.
• attest-key: in-toto/DSSE attestation over the bundle (assay evidence attest).
• The v2.1 AI Agent Security feature set: compliance packs, BYOS push, artifact attestation, coverage badges, PR summaries, SARIF for code scanning.

v3.0.1 fixes

• Authenticate the latest-release lookup and resolve the release before caching the CLI (#30, #31), removing rate-limit flakes on busy runners.

Breaking vs v2: the legacy marketplace mode/run inputs are not carried; pin Rul1an/assay-action@v2 if you depend on those. Migration notes in the action spec.

Pin the major: uses: Rul1an/assay-action@v3

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changelog

• 16da0508205b06be18de0adb4a721ba5fc07182a: ci: e2e verification of the published action (v1.0.0 + v1, linux + windows) (@schuettc)
• 1d399dc296ec3f1977e607a204deb0fc133a8109: fix(action): shorten description under Marketplace 125-char limit (@schuettc)

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v2.13.0

Released 2026-07-02.

Run-safety guardrails and per-role endpoint configuration.

Fixes (run safety)

• GitHub backlog auto-sync is now opt-in and off by default. Previously a run in a repository with open GitHub issues would pull every open issue into the backlog before task scoping, which could silently discard a seeded goal and spawn work against the entire issue list. Enable it explicitly with the github.sync_backlog seed config key (or the BERNSTEIN_SYNC_GITHUB_BACKLOG env override). (#2178)
• A seeded goal is no longer silently dropped when the backlog is non-empty: the run now prints a loud warning naming the precedence and how to force the goal, instead of quietly planning from the backlog. (#2178)
• Agent worktree merges refuse to land on the repository default branch. The merge and push path resolves the protected default (origin/HEAD, then init.defaultBranch, then the conventional names, treating both main and master as protected when the remote head is ambiguous) and refuses to merge or push agent work onto it, recording the refusal, so a run started from a default-branch checkout can no longer push unreviewed commits straight to the trunk. (#2178)

Features (per-role model configuration)

• role_model_policy entries gain optional base_url and api_key_env next to model/provider, so different roles can target different OpenAI-compatible endpoints in one workflow (for example a fast manager endpoint and cheaper worker endpoints). api_key_env names an environment variable and is validated against the same fail-closed provider allowlist as the runner. YAML anchors give reuse across roles with no new file format. Absent fields keep today’s behavior. (#2159)
• ModeProfile gains top_p, top_k, and max_tokens beside its existing temperature, and the previously-deferred apply_mode_to_spawn wiring is completed so a mode profile’s sampling parameters actually reach the spawn and the runner manifest. (#2159)
• Opt-in builtin tools for the openai_agents runner, for runs without an MCP gateway, selected by tool_source: builtin (the gateway remains the default). read_file, write_file, and list_dir are workdir-confined (absolute and parent-escape paths are rejected). run_command is a restricted process-exec primitive: bare-name commands only, shell interpreters blocked, resolved against PATH, available only under a configured OS sandbox provider or an explicit opt-in; its filesystem confinement is the OS sandbox, not the builtin. Every builtin call is recorded to the run event log so a gateway-free run stays auditable. (#2159)

Quality

• Resolved refurb FURB123 findings in the OWASP control-map builders.

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

0.2.0 (2026-07-02)

⚠ BREAKING CHANGES

• pipr init –types-only and –no-types are removed and generated .pipr/types/pipr-sdk.d.ts is no longer written; types come from the installed @usepipr/sdk package.
• structure runtime action logging (#10)
• consolidate public API contracts (#9)

Features

• consolidate public API contracts (#9) (01db150)
• support installable npm dependencies in .pipr config (#14) (97794bc)

Code Refactoring

• structure runtime action logging (#10) (64addf1)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

chore(release): 1.74.0

1.74.0 (2026-07-02)

✨ Features

• updates (328fff6)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

First release. Static, zero-execution scanner for AI-agent content (MCP servers, skills, plugins): RCE, secret exfiltration, destructive ops, prompt-injection, tool-poisoning, hidden-unicode. Rug-pull detection (lock/verify), OWASP LLM Top 10 mapping, SARIF, GitHub Action, and an MCP server to vet-before-install. Install: pip install frisk-scan

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

First stable Marketplace release of the UnityInFlow Spec Compliance action.

What’s included

• Typed status and report action outputs (matching the runtime core.setOutput calls)
• injection-scanner-version default bumped to v0.0.2 — the tag carrying the Linux musl binaries the action downloads at runtime
• Deterministic committed dist/ (no sourcemaps) guarded by a git diff --exit-code dist/ staleness gate in CI
• Public/fork CI runs secretless on GitHub-hosted runners; release automation stays on org self-hosted runners
• Moving v1 tag maintained automatically on release publish

Usage

- uses: UnityInFlow/spec-ci-plugin@v1

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Polder Drift now works with any design system — including your in-house one. Point library_paths at a checkout of your DS repo (source-only monorepo workspaces work too), and generate the look-alike detection data straight from your DS’s own source:

npx @usepolder/drift profile   # writes .polder.profile.yml — review, prune, commit

Also in this release: PRs with 100+ changed files are now fully analysed, the CLI honours .polderignore and shows each finding’s suppression id, every finding carries its source line, and scans are ~3× faster. All backward compatible — existing configs, suppression files, and @v1 workflows keep working unchanged.

What’s Changed

• docs: add fetch-depth: 0 to the recommended workflow by @jongjesse in https://github.com/usepolder/drift/pull/9
• Five improvements: pagination, CLI suppression parity, detection profiles, finding lines, single parse by @jongjesse in https://github.com/usepolder/drift/pull/10
• Any design system: resolve exports from DS repos + auto-generate detection profiles by @jongjesse in https://github.com/usepolder/drift/pull/11

Full Changelog: https://github.com/usepolder/drift/compare/v1...v1.1.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/vbem/configure-huawei-cloud-credentials/compare/v0.0.2...v1.0.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

The Hive Skill v0.1.0

Initial public release of The Hive Skill, an open-source autonomous multi-agent orchestration skill for agentic coders.

The Hive Skill turns one AI coding agent into a structured six-role council:

Role Table

What is included

• SKILL.md core skill definition
• Six council role files
• Autonomous execution loop
• Token efficiency mode
• Compressed role output mode
• Default invocation behavior
• Anti-slop rules
• Validation rules
• Final and blocked report formats
• OpenCode / OpenCode Go adapter
• Claude Code adapter
• Codex adapter
• Generic .agents adapter
• Install scripts for Bash and PowerShell
• GitHub Action wrapper
• Security policy
• Apache-2.0 license

Supported agentic coding workflows

The Hive Skill is designed for:

• OpenCode / OpenCode Go
• Claude Code
• Codex
• Generic .agents workflows
• SKILL.md-compatible agent runtimes

Important note

Version v0.1.0 provides role-simulated orchestration inside compatible agentic coding tools.

Real multi-model or real subagent execution depends on the runtime being used.

Basic usage

Invoke the skill with a simple prompt:

Use The Hive Skill to fix this.

• This action is used across all versions by 11 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1...v1.2.367

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

skill-probe in your pipeline, gating on statistics instead of vibes

The CI question isn’t “are my skills perfect?” — it’s “did this PR make any skill worse?” Activation is stochastic, so raw-rate comparisons make CI flaky. v0.9.0 makes the gate honest.

Baseline regression gating

skill-probe --config probe.config.json --save-baseline baselines/main.json   # once, on main
skill-probe --config probe.config.json --baseline baselines/main.json        # every PR

Each case is compared against the baseline with Fisher’s exact test, Benjamini-Hochberg corrected — noise passes, significant drops fail (exit 1). Drift in config/runtime/model since the baseline warns (matched cases still gated); new/missing cases are reported, not gated; a side with no valid probes is NOT COMPARABLE, never a silent pass. Significant improvements are flagged as a nudge to re-save the baseline.

Run manifest

Every --json result now stamps who/what/when: tool version, command, ISO date, runtime, model, k/threshold/conf, and a config hash (cwd excluded — the same library on a laptop and a CI runner is the same experiment). Two runs are comparable; a report is citable.

GitHub Action

- uses: HystonKayange/skill-probe@main
  with:
    config: probe.config.json
    args: --baseline baselines/main.json
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Installs skill-probe + the runtime CLI (Claude Code by default, swappable) and runs any subcommand (audit/context/diagnose/doctor).

Plus: repo CI (typecheck + tests, no API calls). 83 tests. Baseline save→gate loop proven live.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• v0.6.2: memory pass/fail semantics and hardening fixes by @IonDen in https://github.com/IonDen/mlx-model-doctor/pull/22

Full Changelog: https://github.com/IonDen/mlx-model-doctor/compare/v0.6.1...v0.6.2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Initial release of the action.

• This action is used across all versions by 10 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

9.80.3 (2026-07-02)

Bug Fixes

• (vertex): reserve final_result step + graceful cap recovery in native Anthropic loop (ee44e60), closes #1123

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

🚀 OLIVE Action v1 - 첫 번째 릴리즈

📋 릴리즈 개요

OLIVE Action의 첫 번째 공식 릴리즈입니다. 이 Action은 GitHub Actions에서 OLIVE CLI를 사용하여 오픈소스 라이선스 의무사항 준수를 자동화하는 도구입니다.

✨ 주요 기능

🔍 자동 의존성 분석

• Pull Request 생성 시 소스코드 의존성을 자동으로 분석
• 다양한 프로그래밍 언어 지원 (Python, Node.js, Java, Rust, Ruby, Dart, Flutter 등)
• ORT (OSS Review Toolkit) 기반의 정확한 의존성 추출

💬 PR 코멘트 자동 작성

• 분석 결과를 Pull Request에 자동으로 코멘트 작성
• 라이선스 정보, 매핑된 컴포넌트, 매핑되지 않은 의존성 목록 제공
• 실패 시에도 적절한 에러 메시지 자동 작성

🔗 OLIVE Platform 연동

• 분석 결과를 OLIVE Platform으로 자동 전송
• 오픈소스 라이선스 및 취약점 관리 지원
• 프로젝트별 라이선스 의무사항 추적

📦 분석 결과 저장

• GitHub Artifacts를 통한 상세 분석 결과 저장
• dependency.csv, dependency.json, mapping.csv, mapping.json, unmapping.csv 파일 제공
• 설정 파일 (local-config.yaml) 보관

🛠️ 기술적 특징

컨테이너 기반 실행

• Docker 컨테이너 환경에서 격리된 실행
• 다양한 개발 도구가 사전 설치된 통합 환경
• 안정적이고 재현 가능한 실행 환경

다중 언어 지원

• Python: 3.11.10, pip, pipenv, poetry, conan
• Node.js: 20.14.0, npm, yarn, pnpm, bower
• Java: Gradle 8.13, OpenJDK 11
• Rust: 1.72.0
• Ruby: 3.3.5, bundler, cocoapods
• Dart/Flutter: 2.18.4/3.24.4
• PHP: 8.3, composer
• Android: Android SDK, command-line tools

모듈화된 구조

• 6단계 실행 프로세스로 명확한 워크플로우
• 각 기능별 분리된 스크립트로 유지보수성 향상
• 사용자 정의 설정 파일 지원

🚀 사용법

기본 사용법

name: OLIVE Action

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main, develop]

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  olive-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run OLIVE Action
        uses: kakao/olive-action@v1
        with:
          olive-token: ${{ secrets.OLIVE_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

고급 설정

- name: Run OLIVE Action with custom settings
  uses: kakao/olive-action@v1
  with:
    olive-project-name: "my-custom-project"
    olive-token: ${{ secrets.OLIVE_TOKEN }}
    github-token: ${{ secrets.GITHUB_TOKEN }}
    source-path: "./src"
    user-config-path: "./user-config.yml"
    artifact-retention-days: "7"
    comment-on-pr: "true"
    analyze-only: "false"
    debug: "false"

🔧 입력 파라미터

📊 출력 결과

GitHub Artifacts

• dependency.csv, dependency.json: 의존성 분석 결과
• mapping.csv, mapping.json: 컴포넌트 매핑 결과
• unmapping.csv: 매핑되지 않은 의존성 목록
• local-config.yaml: OLIVE CLI 설정 파일

PR 코멘트

• OLIVE CLI 버전 및 프로젝트 정보
• 라이선스 분석 결과 요약
• 매핑된 컴포넌트 및 매핑되지 않은 의존성 목록
• 아티팩트 다운로드 링크

🚨 사전 준비사항

1. OLIVE Platform 토큰 발급

• OLIVE Platform에서 API 토큰 발급
• 토큰 발급 가이드 참고

2. GitHub Secrets 설정

• OLIVE_TOKEN: OLIVE Platform API 토큰
• GITHUB_TOKEN: GitHub Actions 기본 토큰 (자동 제공)

🔍 실행 단계

1. 소스 위치 검증 - 분석할 소스코드 경로 확인
2. OLIVE CLI 초기화 - 프로젝트 설정 및 토큰 검증
3. 의존성 분석 - 소스코드 의존성 추출 및 분석
4. 컴포넌트 분석 - 의존성을 OLIVE 컴포넌트에 매핑
5. 라이선스 분석 - 라이선스 정보 추출 및 분석
6. OLIVE Platform 연동 - 분석 결과를 Platform으로 전송

🛡️ 보안 및 안정성

• 격리된 실행 환경: Docker 컨테이너를 통한 안전한 실행
• 토큰 검증: 실행 전 필수 토큰들의 유효성 검증
• 에러 처리: 실패 시 자동 정리 및 에러 리포팅
• 리소스 관리: 컨테이너 자동 정리로 메모리 누수 방지

📚 문서 및 지원

• 사용 가이드: README.md
• OLIVE Platform: https://olive.kakao.com/
• OLIVE CLI: https://github.com/kakao/olive-cli

📄 라이선스

이 프로젝트는 Apache License 2.0 하에 배포됩니다.

Copyright 2025 Kakao Corp. http://www.kakaocorp.com

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Initial release.

• night / dawn / city themes
• real moon phase, longest streak constellation, language mountains or skyline
• zero dependencies, works with the default GITHUB_TOKEN

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Small Update:

• Integrate minimatch
• Improve comment parsing
• Add PR descriptions passing
• Add reasoning-effort and timeout parameters
• Improve logging
• Bug fixes

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

✨ New Features

• Repository Memory Rules — teach the bot your team’s coding conventions
  • Comment @synaptic-ai remember: <rule> on any PR to add a rule
  • Rules stored in .synaptic/rules.json and enforced during every review
  • Collaborator verification before adding rules
  • Dedicated extraction prompt for faster processing

🐛 Bug Fixes

• Fix pr_number used before defined in main_remember()
• Fix direct engine not outputting REMEMBER_RULE_JSON
• Move collaborator check before LLM extraction to avoid wasted API calls
• Add collaborator check to process_remember_from_comment()
• Filter find_latest_comment_with_remember() by bot author + review signature

📝 Documentation

• Add preview screenshots (PR Overview, Issue Summary, Inline Comments) to README

Full Changelog: https://github.com/minhphu102003/ai-pr-review-action/compare/v0.1.3...v0.2.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Update README.md by @GoodPie in https://github.com/moult-rb/moult-rb/pull/2
• Add GitHub Actions workflow for Moult integration by @GoodPie in https://github.com/moult-rb/moult-rb/pull/3
• Support baseline scan uploads in the composite action by @GoodPie in https://github.com/moult-rb/moult-rb/pull/4

New Contributors

• @GoodPie made their first contribution in https://github.com/moult-rb/moult-rb/pull/2

Full Changelog: https://github.com/moult-rb/moult-rb/compare/v0.1.0...v0.2.0

• This action is used across all versions by 10 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

1.1.11 (2026-07-02)

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

👻 Maintenance

• ci: add scheduled workflow to bump the pinned CLI version by @shenxianpeng in #45
• chore: pin default cli-ref to a stable release for reproducibility by @shenxianpeng in #43

Full Changelog: https://github.com/open-delivery-spec/validate-action/compare/v0.2.0...v0.2.1

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Patch release shipping the security and correctness fixes from the 2026-07-02 engineering review.

False-pass paths (grading correctness):

• A1 — iptables add-op is now atomic (set -e): a partial rule insertion exits non-zero so the caller falls back to --internal instead of running with broken NAT and silently missing IP-literal/DoH egress
• A2 — readOnlyHint:true can no longer bypass the exercise skip gate: unsafeToExerciseToolNames now checks the broad STATE_CHANGING_VERBS set regardless of the annotation, so a lying swap_*/buy_*/approve_*/mint_* tool is never actively bait-called
• A3 — content in a JSON-RPC error response is now scanned: callToolArgs carries errorText; probes 1.2, 1.3 run scanInjection on it, probe 3.1 runs internalsLeak
• A5 — MCP progress forwarding: void sendNotification(…) → .catch(() => {}) so a client disconnect during a run can’t kill the server process

Sandbox observability:

• A4 — selectedNetwork() defaults to base (mainnet); server.json and the plugin .mcp.json now ship NEXT_PUBLIC_POLYGRAPH_NETWORK=base
• A6 — removeHostDnat emits a stderr warning on failure so dangling host iptables rules are visible in operator logs

Verify tools:

• B6 — verify_attestation / verify_skill_attestation: found-but-null now surfaces as lookup_failed rather than not_available (a trusted index disagreeing with the chain is not unevaluated)
• B7 — revoked attestations show status:"revoked", expired ones status:"expired"; expirationTime included in the payload

Housekeeping:

• B11 — dead MINTER_PRIVATE_KEY removed from .env.example
• B12 — action.yml default version pin updated; CONTRIBUTING release flow now documents all six steps including the v1 retag

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/postman-cs/postman-bootstrap-action/compare/v2...v2.6.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v2.0.1

• Fix the ephemeral-environment input being ignored. Ephemeral deployments are now notified as ephemeral instead of as a regular GitHub deployment, and deployment-url is required when ephemeral-environment is true.

v2.0.0

• The action now runs on Node 24.

v1.2.1

• Allow ephemeral-environment as a valid input param

v1.2.0

• Don’t guess a recent PR number based on SHA for non-PR events

v1.1.5

• Allow pull-request-number as a valid input param

v1.1.4

• Fix a problem where the sha passed in via merge_group events was wrong, causing commit checks to never complete

v1.1.3

• Update README.md to include deployment_type examples

v1.1.2

• Correct code sample in README where GITHUB_TOKEN is being passed as a secrets instead of an env

v1.1.1

• Improve logging to facilitate debugging

v1.1.0

• Expose an eventId on errors
• Output the environmentId on attemptNotifyDeploy

v1.0.4

• Extract information from Github Event and send it to attemptNotifyDeploy

v1.0.3

• Add qawolf-base-url optional input

v1.0.2

• Fix action name on documentation

v1.0.1

• Fix build problem and add branding

v1.0.0

• Initial version

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Build & Push to Registry v1.0.0

First stable release of actions-docker-build-push, a GitHub Action for building Docker images and pushing them to container registries with a predictable naming convention.

Main features

• Build Docker images using Docker Buildx
• Push images to GitHub Container Registry by default
• Support any container registry, including Docker Hub, Harbor, OVHcloud Managed Private Registry, and custom registries
• Default authentication with GitHub actor and GITHUB_TOKEN
• Automatic image naming based on branch, tag, or pull request
• Environment suffixes such as prod, dev, staging, rc, hotfix, feat, and pr-{number}
• Auto-generated version tags using YYYY-MM-DD.shortsha
• Optional :latest tag on main/master builds
• Support for additional tags
• Support for multi-platform builds
• Support for build arguments
• Support for multi-stage Dockerfile targets
• Automatic OCI labels
• Optional local build validation with push: "false"
• Output image reference, repository, version, suffix, tags, digest, and build timestamp

Default behavior

With no registry credentials passed, the action defaults to GitHub Container Registry:

ghcr.io/{owner}/{repo}-{suffix}:YYYY-MM-DD.shortsha

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

The v1.7.5 cocoindex install step ran ccc --version as a sanity check, but the typer app doesn’t expose a –version flag so it raised a red “No such option ‘–version’” error box in the Actions UI. The || true suppression meant the step still succeeded, but the visible error box was misleading.

Replaces with a quiet command -v ccc PATH check. No functional change.

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• docs: simplify description (#4) (46cd9d2)
• docs: rename action to gated automerge (d80ec1c)
• docs: add required checks read permissions (240cb58)
• feat: add option to disable require-checks (2362745)
• deps: bump nixpkgs in the dependencies group across 1 directory (#2) (77ebbe4)
• feat: add support for skip-labels (7cd48f4)
• Auto update internal actions (bb2e6d1)
• Add release workflow (6fc2ea8)
• Add linting and dependabot (499faef)
• Add action.yaml with examples (0f0d6da)

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/runs-on/action/compare/v2.1.2...v2.2.0

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v2.11.0

Released 2026-07-02.

Features

• The openai_agents runner accepts optional sampling and endpoint parameters: temperature, top_p, top_k, base_url, and api_key_env on the runner manifest, flowing into the SDK client and model settings. Absent fields keep the previous behavior byte-identical. When base_url is set the runner switches to the chat-completions API and excludes the custom client from tracing, so a third-party key is never sent to the default tracing endpoint. Every effective parameter is logged in the runner start event, so runs stay self-describing. Design validated in daily runs by @shanemmattner (#2159). (#2173)
• api_key_env is fail-closed: it must name a known LLM provider key from the built-in allowlist; anything else requires the operator to allow it via BERNSTEIN_ALLOWED_API_KEY_ENVS on the host, which a repository cannot set. Requesting sampling parameters on an adapter without the new SUPPORTS_SAMPLING_PARAMS capability fails loudly instead of silently dropping them. (#2173)
• SDK runners now write heartbeats, so they are visible to the stall watchdog between spawn and exit. (#2173)

Fixes

• The Docker sandbox path from v2.10.0 is hardened: each spawned agent gets its own sandbox session (one exec timeout no longer tears down every agent’s container), committed work is bundled out of the container and fetched into the host repo under sandbox/<session_id> refs, sandbox lifecycle events land in the HMAC-chained audit log with emissions serialized so concurrent lifecycles cannot fork the chain, and provisioning probes task-server reachability and warns on daemons without host networking. (#2162, #2172)
• The bernstein worker loop can spawn agents again: it constructed the spawner with arguments that never existed and raised TypeError on the first claimed task. The server URL now also reaches spawned agents through the environment allowlist. (#2163, #2171)

Dependencies

• Routine CI action digest updates (github/codeql-action, docker/setup-buildx-action).

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

1.5.3 (2026-07-02)

Bug Fixes

• run bundled Docker actions on the Node 24 runtime (#8) (526d49e)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

0.1.3 (2026-07-02)

Bug Fixes

• gate releases on main ci (#7) (eb479e0)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Patch over v1.1.0: the golden-context / candidate-context inputs now resolve through the runs subcommand (available in every 0.3.x SDK) instead of requiring gate CLI flags newer than the PyPI release. Caught by this repo’s smoke test before any user hit it. The v1 tag points here.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Agents Shipgate v0.14.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/xDevMe/podcast-generator/commits/v1.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/y-matsuo081991/ai-adr-enforcer/compare/v1.1.3...v1.1.5

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• chore(ci): bump actions/checkout from v6 to v7 by @fabasoad in https://github.com/fabasoad/setup-prolog-action/pull/9

Full Changelog: https://github.com/fabasoad/setup-prolog-action/compare/v1.1.1...v1.1.2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• chore(ci): bump actions/checkout from v6 to v7 by @fabasoad in https://github.com/fabasoad/setup-uiua-action/pull/7

Full Changelog: https://github.com/fabasoad/setup-uiua-action/compare/v0.1.2...v0.1.3

• This action is used across all versions by 235 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Highlights

This release is heavy on CSS intelligence. fallow health --css now understands CSS-in-JS (styled-components, emotion, linaria, vanilla-extract, StyleX, Panda) as first-class, ships a second styling-health quality axis, and adds a design-token blast-radius index. Plus a staged human review walkthrough, an opt-in unused-prop exemption, and a batch of framework false-positive fixes.

CSS intelligence (CSS program, Phases 3-4)

• CSS-in-JS is first-class in fallow health --css. styled-components / emotion / linaria (tagged templates) and vanilla-extract / StyleX / Panda / emotion-object (object notation) previously produced null css_analytics. A lexical lifter now extracts the CSS body from both forms and feeds it through the same structural analytics and styling-health pipeline, so a CSS-in-JS app gets real duplicate-block, structural, and token-sprawl signals. Dep-gated on a declared CSS-in-JS library, so non-CSS-in-JS projects are byte-unchanged.
• Styling-health: a second CSS-quality axis, confidence-aware. fallow health --css reports a separate styling_health score (0-100) and A-F grade with a Deductions: breakdown across five capped penalty categories. It carries a confidence marker (high / low) so a thin authored-CSS surface (utility-first Tailwind app) renders dimmed with a caveat instead of an authoritative grade. Descriptive-only: no exit code, badge, or CI gating.
• Formula v3 weights value drift over exact repetition. Research is clear that exact CSS duplication is the least-harmful pattern while design-token inconsistency is the real maintenance harm, so the exact-block penalty is down-weighted to a soft hint and token-erosion gains a hardcoded-value-sprawl drift term (distinct un-tokenized box-shadow / border-radius / line-height values). STYLING_HEALTH_FORMULA_VERSION bumps to 3. If you diff styling_health.score/grade over time, re-baseline or gate on formula_version; the one-time step-change at this boundary is expected.
• Design-token blast-radius (token_consumers) for Tailwind v4 AND CSS-in-JS tokens. fallow health --css --format json now carries a reverse index of where each design token is consumed. Change --color-brand (Tailwind @theme) or a StyleX defineVars / vanilla-extract createTheme token and see a consumer_count plus located consumers[] before touching it. consumer_count is a static lower bound (descriptive context, not a deletion gate); the authoritative dead-token finding stays unused_theme_tokens.
• New get_token_blast_radius MCP tool. A focused, read-only tool that surfaces the token blast-radius directly without the agent needing to know the data hides inside css_analytics.
• Fuzzy CSS clones via value canonicalization. fallow dupes now canonicalizes CSS values on the stylesheet path (a zero-with-unit collapses to bare 0, a hex color expands to its long lowercased form), so value-drifted clones (0px vs 0, #fff vs #ffffff) hash equal and the same shadow / gradient / transition recipe re-implemented with drift finally matches. Scoped to CSS-family files and SFC/Astro <style> regions; JS/TS clone detection is unchanged.

Review and configuration

• fallow review --walkthrough: a staged terminal tour. Renders the review walkthrough guide as an ordered, human-readable tour (Review Focus header, staged sections, per-file one-line facts and grounded badges, a collapsed “cleared” panel). --format markdown emits a paste-into-PR artifact; --format json is byte-identical to --walkthrough-guide. Per-file viewed state persists locally (--mark-viewed) and tolerates a moved tree. Always exits 0.
• unusedComponentProps.ignorePattern: exempt intentionally-unused props. Set "unusedComponentProps": { "ignorePattern": "^_" } to exempt props whose local destructure binding matches the regex (the leading-underscore convention that TS noUnusedParameters and ESLint varsIgnorePattern honor). Applies to Vue, Svelte, Astro, and React/Preact. Opt-in; default behavior is unchanged. Thanks @hniedner for the request. (Closes #1648)

CI, coverage, and architecture

• The GitLab CI template can reuse a pre-installed fallow binary. Set FALLOW_SKIP_INSTALL: "true" to skip npm install -g fallow and run a fallow already on PATH (for example a version pinned through a pnpm catalog), so CI runs the same binary as your local lint gate. The job fails fast when no fallow is found. Thanks @Jerc92 for the patch in #1662.
• Coverage upload enrichment. fallow coverage --with-callers uploads importer edges, and the inventory upload now emits per-function complexity and per-file churn.
• Typed architecture boundaries. fallow-engine, fallow-output, and fallow-api now own the command-neutral analysis runners, output contracts, and programmatic Rust boundary; LSP, MCP, and NAPI callers consume typed results and serialize JSON only at protocol boundaries. The old fallow-programmatic-cli compatibility crate has been removed.

Bug fixes

• Iterating a typed class array no longer false-flags the class members as unused. A cluster of unused-class-member false positives where the class is only used through an iteration loop variable is now fixed across array-method callbacks (.map / .forEach / .filter / …), for...of, React/Preact JSX .map, Svelte {#each}, Vue v-for (including props.<field> sources), Angular @for / *ngFor inline templates, and Astro template .map. Over-credit only: a genuinely unused member still reports. Thanks @Ericlm for the report and minimal reproduction. (Closes #1707, #1711, #1712, #1713)
• unused-files no longer false-flags a Next.js page.mdx when next.config wraps its config object. export default withMDX(nextConfig) (the official @next/mdx idiom), module.exports = createJestConfig(cfg), and nested/curried wrappers now resolve, which also fixes the same class for any wrapped Vite / Webpack / Jest config. Thanks @AlonMiz for the report. (Closes #1642)
• unused-files no longer false-flags a commit-and-tag-version updater script. A new plugin (legacy enabler standard-version) credits each bumpFiles[] / packageFiles[] updater module and filename target, from both the package.json key and standalone .versionrc configs, gated on the file existing on disk. Thanks @rbalet for the report. (Closes #1640)
• unused-class-members no longer false-flags framework-dispatched OpenLayers methods or a coercion-only toString. A handleEvent on an ol/interaction/* subclass and a toString used only through string coercion (template interpolation, String(...), +) are now credited, with tight gating so genuinely-dead members still report. (Closes #1638)
• Telemetry findings_present is recorded again for fallow flags, fallow watch, and the security survivors / blind-spots subcommands. A debug-build invariant now fails fast if any finding-surfacing workflow records an event without noting its find-state, preventing the whole regression class. No change to the telemetry payload shape. (Closes #1650)

Full Changelog: https://github.com/fallow-rs/fallow/compare/v2.103.0...v2.104.0

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 43 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

New Features

• Add group_by option to the accessibility scanner by @taarikashenafi in https://github.com/github/accessibility-scanner/pull/239
• Add dry_run option to the accessibility scanner by @taarikashenafi in https://github.com/github/accessibility-scanner/pull/232
• Distinguish wcag vs best practice by @kzhou314 in https://github.com/github/accessibility-scanner/pull/233
• Match axe findings by rule and report all failing elements by @kzhou314 in https://github.com/github/accessibility-scanner/pull/240
• Disable reopen wontfix by @kzhou314 in https://github.com/github/accessibility-scanner/pull/234
• Update reflow-scan text to improve clarity and reference WCAG 2.2 by @taarikashenafi in https://github.com/github/accessibility-scanner/pull/231

Dependency/documentation updates

• chore(deps): Bump ruby/setup-ruby from 1.307.0 to 1.308.0 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/218
• chore(deps-dev): Bump the npm-minor-and-patch group across 5 directories with 3 updates by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/219
• chore(deps): Bump ruby/setup-ruby from 1.308.0 to 1.310.0 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/220
• chore(deps): Bump puma from 8.0.1 to 8.0.2 in /sites/site-with-errors in the bundler-minor-and-patch group by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/221
• chore(deps): Bump ruby/setup-ruby from 1.310.0 to 1.311.0 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/225
• chore(deps): Bump ruby/setup-ruby from 1.311.0 to 1.313.0 in the github-actions group across 1 directory by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/227
• chore(deps-dev): Bump vite from 8.0.12 to 8.0.16 by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/228
• chore(deps-dev): Bump @types/node from 25.9.0 to 26.0.0 by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/236
• chore(deps-dev): Bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/237
• chore(deps): Bump the github-actions group across 4 directories with 2 updates by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/235
• chore(deps): Bump concurrent-ruby from 1.3.5 to 1.3.7 in /sites/site-with-errors by @dependabot[bot] in https://github.com/github/accessibility-scanner/pull/238

New Contributors

• @taarikashenafi made their first contribution in https://github.com/github/accessibility-scanner/pull/231
• @kzhou314 made their first contribution in https://github.com/github/accessibility-scanner/pull/234

Full Changelog: https://github.com/github/accessibility-scanner/compare/v3.2.0...v3.3.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Published from immutable commit e6660a53c73391a10e8e721e3a245b25e3289b4b. The release workflow publishes PyPI, GitHub Action, Snap Store, and GHCR Docker distributions after shared tag verification, QA, matrix, and coverage builds.

Release artifacts:

• dist/*
• dist/SHA256SUMS.txt
• dist/*.cdx.json
• standalone trustcheck-*-windows-x86_64.exe with checksum
• unsigned trustcheck-*-store.msix for Microsoft Store submission
• GHCR Docker images for linux/amd64, linux/arm64, and linux/arm/v7

Verify the direct Windows executable before use:

Get-AuthenticodeSignature .\trustcheck-*-windows-x86_64.exe | Format-List
Get-FileHash .\trustcheck-*-windows-x86_64.exe -Algorithm SHA256

The Authenticode status must be Valid, include a timestamp certificate, and match the adjacent .sha256 file. The Store signs the MSIX during submission; the workflow tests its execution alias with a disposable certificate before upload.

GitHub Action:

• Immutable: uses: Halfblood-Prince/trustcheck@v2.1.2
• Compatible major: uses: Halfblood-Prince/trustcheck@v2

Full Changelog: https://github.com/Halfblood-Prince/trustcheck/compare/v2.1.1...v2.1.2

• This action is used across all versions by 17 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/320919c7979db097e4d0485e97a0a7675bc59620 with plugin-scanner 2.0.966.

Full Changelog: https://github.com/hashgraph-online/ai-plugin-scanner-action/compare/v1.2.365...v1.2.366

• This action is used across all versions by 11 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1...v1.2.366

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

0.9.16 (2026-07-02)

Bug Fixes

• deps: update codex-docker image to v0.142.5 (#46) (fc08eb8)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Release v2.2.8

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Highlights

• Added aigate start guided setup routes for quickstart, AI setup, pre-push hooks, release readiness, and full project guard setup.
• Added aigate test for Git readiness plus detected project test command execution.
• Added aigate aitest for AI remediation prompt generation and optional Codex, Claude, Gemini, or custom agent execution with --apply.
• Added repository Claude Code instructions through CLAUDE.md and .aigate/integrations/claude.md.
• Updated multilingual README, usage, operations, roadmap, AI integration, GitHub Action, examples, and generated HTML overview docs.
• Extended the reusable GitHub Action to support test and safe aitest prompt generation.

Validation

• npm run ci
• Release workflow dry run
• Tagged release workflow publish
• node src/cli.mjs release-check --npm --language ko

Package

• npm: aigate-cli@0.1.5

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

OSS Security Policy as Code Starter Kit v9.0.3

This release is the v9.0.3 release of the OSS Security Policy as Code Starter Kit (refine this line before publishing).

Highlights

• No feature-level changes in this release.

Improvements

• retitle SAST-OSV-068 — the kit ingests OSV verdicts, it is not reachability-aware
• honor SOURCE_DATE_EPOCH for every outcome-affecting clock read; freeze the suite clock
• formalize SELF_ATTESTED in the published reports/2.0 schema (9.0.3)
• build Gemara state maps from pairs to clear a Snyk Code false positive

Notes

• release 9.0.3 (#110)
• ADR-030 amendment re-grounding the v10.0.0 surface; flip ADR-021 to accepted
• suppress reviewed Snyk Code false positive via .snyk; keep the gate strict
• make Snyk Code + Snyk Open Source advisory (continue-on-error)

License: Apache-2.0.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

SnarkGirl v1.15.3 — The Wiki Ledger + a Living Pitch 📖⚽

The World Cup tournament got two big upgrades: it now lives in your repo’s Wiki, and the pitch actually plays.

The tournament moved to the repo Wiki

• Standings + match reports are now human-readable, browsable wiki pages organized as World Cup → Season → Match: a Home index of seasons, a Season-{slug} standings page each, and one Season-{slug}-Match-{N} report per PR. No more base64 tokens to shuttle around.
• Every page carries a keyed HMAC signature footer — change a win from 3 to 4 in the wiki editor and wiki.py verify flags it INVALID. Export a private SGWC_SECRET for a real barrier.
• Resuming a season is just “clone the wiki.” The user names the season (and its duration) at kickoff.
• New helper wiki.py (render/verify/verify-all/load-season). Retired the old token.py.

The live pitch is alive

• Players roam their formation and pass the ball, holding shape at each kickoff until someone takes it.
• A goal is scripted end-to-end: the ball is worked to the scorer, who drives at the net and buries it.
• A red card sets up a penalty kick — a code red is converted, an agent red is saved by the keeper.
• Sent-off players walk to a bench at the edge (home top-left, away top-right).
• The champion & awards now present on the wiki season page (the live arena ends on the standings).

Full changelog: https://github.com/mattkelly1991/SnarkGirl/blob/main/CHANGELOG.md

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changes

• docs: link sbx sandbox docs and document sandbox inputs @mdelapenya (#97)

Contributors

@mdelapenya

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v0.1.1

• Strip model preamble: remove leading text before ## PR Review heading in both OpenCode and direct engine paths
• OpenCode engine: post_inline.py now always updates summary comment when body changes (preamble or Key Issues stripped)
• Direct engine: sanitize_review() strips preamble before posting

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Cohort-link bump (no direct package changes). See .changeset/config.json for the fixed-cohort definition.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

semvertag 0.8.2 — release pipeline on PyPI Trusted Publishing

No library changes. The package is identical to 0.8.1; this release exercises the new publish path end-to-end.

CI

• Releases now authenticate to PyPI via Trusted Publishing (OIDC) instead of a long-lived PYPI_TOKEN secret. uv publish auto-detects the GitHub Actions id-token; the release job runs under a pypi environment that scopes the trusted publisher (#46).

Downstream

No action required. Nothing about the installed package changes.

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Version v1.2.5

• Support DataWeave reduce With A Default Accumulator

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

PatchFlow CLI v0.1.2

Benchmark Results (v1.0)

• 18 intentionally vulnerable repos: 100% recall, 918K LOC, 19 CWE categories
• 5 historical CVE repos: 100% recall, 387K LOC
• 10 clean repos: 0.094 HC/KLOC, 720K LOC

See Benchmark Report v1.0 for details.

Changelog

Other Changes

• a071d0ab0a8732c375c1c99e4abed4ec5a984855: PatchFlow CLI v0.1.2 — security scanner with update notification (Ghertil Abdelmalek ghertilabdelmalek@outlook.fr)

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• HF Hub checkpoint preflight for architecture-add Issues (REMYX-178) (8a70186)
• arxiv HTML retry: title-overlap threshold + project-page one-hop + README verification (c6c021f)
• README: add lerobot #9 (ECoT reasoning supervision) to Examples (85fa29b)
• Coding-agent prompt: guidance on auto-format scope (be8720d)
• README: drop the “Recommended” ENVIRONMENTS.md section (82b9549)
• Recommend ENVIRONMENTS.md + cocoindex as the default setup (9ca24e1)
• License detection: retry via arxiv HTML on unfavorable buckets (615af84)
• README: restore smellslikeml/peft #5 as the primary Outrider artifact (e8fb3a0)
• README: swap smellslikeml/peft #5 for the upstream draft huggingface/peft #3382 (28cfc14)
• README: add huggingface/peft #3382 (upstream draft) to Examples (bc70d94)

• This action is used across all versions by 4 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• feat: Update spotdemo4/better-checkout action to v0.13.0 (#154) (3fc7f0af893590575d0d65b8a2e3fbbdff95fdec)
• bump: v1.54.1 -> v1.55.0 (d2afabdda2558d6cf558962bbc7dce09ff5e9950)
• chore(deps): update github actions to v1.54.1 (#153) (4e0f684fbdfd7f3a0f78fe5cfe6702ef984c3370)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

chore(release): 1.72.0

1.72.0 (2026-07-02)

✨ Features

• updates (da42214)

📚 Documentation

• update .github/index.md (b643fff)

• This action is used across all versions by 1 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

• J-all-329 Only mark job complete when it has no open tasks (bd99322)
• T-all-2240 Make testPush a no-op smoke test (fixed no-code message) (deabf19)
• T-all-2238 Reconcile job deploy state on push; configurable pending label (de092bb)
• fix: Only extract job ids. (340d9bb)
• fix: move to node 24.x (a19c034)
• fix: move to node 24.x (ab6d493)
• fix: link doc (c83286a)
• fix: space in view name (ff4ac90)
• fix: space in view name (d0c570f)
• fix: urlencode (f66608d)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Initial release

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

What’s Changed

• Bump version to v0.17.1 by @tyler-gilbert in https://github.com/work-spaces/install-spaces/pull/32

Full Changelog: https://github.com/work-spaces/install-spaces/compare/v0.16.0...v0.17.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

v1.0.0

Initial release of the PHP-Scoper Action, a composite GitHub Action for scoping PHP project dependencies using humbug/php-scoper.

What’s Included

• PHP version selection: Choose any PHP version using php-version (default: 8.2).

• Flexible PHP-Scoper versions: Use a specific release tag, version constraint, or branch with scoper-version.

• Custom working directory: Run the action from any subdirectory within your repository.

• Configurable PHP-Scoper configuration: Specify the path to scoper.inc.php using a relative or absolute path.

• Optional Composer installation: Skip composer install when the vendor/ directory already exists.

• Custom Composer arguments: Pass additional Composer options through composer-args.

• Early validation: Validate the working directory, configuration file, and PHP version before installing dependencies.

• Action outputs:

  • output-path: Absolute path to the generated scoped build.
  • scoped-files: Total number of scoped PHP files.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

[5.0.0] — 2026-06-27

Added

• Rust Pattern Engine — Native regex matching via PyO3 (ansede_rust_core), 3.6x faster on large files with graceful Python fallback
• Java Tree-Sitter AST Analyzer (java_ast_analyzer.py) — Replaces regex heuristics with accurate AST parsing. 9 checkers: CWE-89, CWE-78, CWE-328, CWE-918, CWE-601, CWE-79, CWE-798, CWE-22, CWE-862
• 4 New Detectors: CWE-942 (CORS wildcard), CWE-94 (Jinja2 SSTI), CWE-362 (TOCTOU), CWE-862 (Spring Actuator)
• Precision Benchmark Harness (benchmarks/precision_benchmark.py) — Multi-language, multi-repo precision tracking with per-CWE heatmaps
• is_framework_internal() context filter — Suppresses findings in framework/library internals (Flask src/, Express lib/)
• 21-repo scale proof — Validated across 7 languages with 99%+ precision on clean code

Changed — Precision (99.4% FP Reduction)

• Calibration: Removed bare method names (exec, query, execute, raw) from callee sets to prevent Mongoose/ORM false positives
• Calibration: JS-023 regex anchored with (?<!\.) to prevent Browserify .require() false positives
• Calibration: Extended ambiguous callee guard to resolve/join for path traversal
• Calibration: JS-018 __proto__:null now recognized as defensive pattern, not prototype pollution
• Calibration: Java write() XSS check requires HTTP response receiver, not JSON writer
• Calibration: 9 CVE benchmark severity thresholds corrected (MEDIUM→MEDIUM, not HIGH)
• Calibration: CWE-295, CWE-502, CWE-532 added to test-file noise filter

Changed — Performance (96% Faster)

• AST walk cache: Pre-computed per-function node lists shared across all 49 Python rules
• _rule_24 fix: Module-level AST walk moved outside per-function loop (20x → 1x)
• Lazy symbolic guards: Skip when no findings or conditionals present
• Lazy datascience rules: Skip for files without DS imports
• Java regex→AST: Always uses tree-sitter when available, eliminating regex overhead

Fixed

• Windows path handling: \tests\, \examples\, \docs\ backslash patterns in triage filters
• Empty CWE display: PY-003 assigned CWE-252, PY-044 assigned CWE-1120
• Test-file CWE-98 suppression: Dynamic require in test files correctly filtered
• CVE Recall: 92.7%→100% (164/164 across 5 languages)

What’s New Since v4.1.0

• 100% CVE recall (164/164) — every known vulnerability detected
• 99.4% FP reduction on 5 clean repos (535→3 findings)
• 86% FP reduction on 21 repos across 7 languages
• 96% faster Python scanning (2,600→5,100 LOC/s)
• 3.6x faster JavaScript pattern matching via Rust engine
• Java AST analyzer replaces regex, PetClinic: 38→0 findings

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changes

• feat: wrap claude execution in Docker sbx sandbox @mdelapenya (#95)

Contributors

@mdelapenya

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

npm tarball release for @records-fhir/validator@0.4.1. Synced from medvertical/records monorepo.

Install

npm install @records-fhir/validator@0.4.1

What’s new in 0.4.1

Patch release for the standalone validator evidence lanes and MII reference workflow. Released with @records-fhir/validation-types 0.1.5.

Added

• Added validator claim summary generation for publishing the current HL7, MII reference, and FHIR Schema dual-path evidence in one machine-readable artifact.
• Added FHIR Schema dual-path action reporting so unconfirmed graph/reference buckets remain explicit follow-up work instead of hidden parity debt.
• Added package-backed terminology diagnostics and local terminology server helpers for deterministic MII/FHIR Schema quality lanes.

Changed

• Hardened the MII reference triangulation workflow with reference-health probes, policy-rule extraction, skip taxonomy, and failed-profile prewarm details.
• Refreshed the public validator documentation around the 2026-07-01 evidence: 496/496 HL7 executable JSON comparisons, 231/231 measured MII reference parity, and 555-fixture FHIR Schema dual-path coverage.
• Tightened FHIR Schema graph slicing, reference-target extraction, and pattern diagnostics while keeping the graph path in parallel evidence mode.

Fixed

• Fixed MII package relevance detection so package names containing substrings such as isik are not misclassified as Gematik ISiK packages.
• Fixed nested profile slice scoping and choice/FHIRPath edge cases uncovered by the MII and FHIR Schema dual-path lanes.

Verification

• Verified with repository lint, stable tests, targeted validator Vitest suites, full affected conformance, MII reference gate, HL7 parity gate, and FHIR Schema dual-path report generation.

Matched npm tarballs

• @records-fhir/validator@0.4.1 — also tagged validator-v0.4.1
• @records-fhir/validation-types@0.1.5

The matching GitHub Action release (if any) is published separately under tag v0.4.1 and is not auto-synced; this release covers the npm package only.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

The harness now tests all four layers of the agentic-payments stack. Since the last PyPI release (v4.5.0), two conformance layers landed — this release ships both.

Highlights (v4.5.0 → v4.7.0: 474 → 520 tests, 33 → 36 modules)

Merchant-journey layer — NEW (UCP/ACP), #228

ucp_acp_harness.py — 12 tests, stdlib-only, fail-closed reference verifier.

• UCP (Shopify Universal Cart): profile owner-key binding, cross-merchant line-item injection, journey step-order / skip-consent, quote integrity, cart-scope-vs-stated-intent, profile takeover.
• ACP (OpenAI/Stripe): checkout-session binding, SharedPaymentToken merchant + amount scope, order idempotency, product-feed authenticity, session expiry.

Authorization + hardening layer (AP2 + Fireblocks x402), #227

ap2_harness.py (17) + x402_fireblocks_harness.py (17) — AP2 mandate-chain authorization (FIDO-governed) and the Fireblocks x402 request-integrity / spend-governance / batch-settlement extension. Includes fixes to three fail-open verifier gaps (credential-release flag-trust, scope fail-open, SSRF range gap) surfaced by Bugbot, now guarded by negative tests.

Coverage now spans

comms (MCP/A2A) → merchant journey (UCP/ACP) → authorization/trust (AP2/TAP) → settlement (x402/MPP/L402).

Full inventory: docs/TEST-INVENTORY.md. Verified by scripts/count_tests.py (definitive: 520).

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Full Changelog: https://github.com/pdrodavi-group/create-configured-repo/commits/v1.0.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

Changed

• Prompt-injection/secret precision (ruleset 25): two more FPs on defensive/security content closed, recall-preserving. (1) A -----BEGIN PRIVATE KEY----- format marker held as a string constant (auth code building a PEM, e.g. @ai-sdk/google-vertex) no longer flags ST-SECRET-EMBEDDED — the pattern now requires actual base64 key material after the marker; a real multi-line key still fires. (2) A credential path cited inside a markdown inline-code span in a security guide (`write to ~/.ssh`, e.g. claude-blog) is routed to needs_review instead of ST-SENS-PATH — scoped to markdown, so a JS template literal in code and a bare path in prose still fire. Both removed spurious ST-COMBO-EXFIL escalations. New unit tests + negative corpus samples; FP floor and benign corpus stay at zero.