• This action is used across all versions by 25 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The eslint-config-fk action is an ESLint configuration for Försäkringskassan projects. It provides a custom base configuration tailored to FK’s development guidelines, with rules set as warnings and disabled during local builds but enabled in CI/CD pipelines. The action simplifies the setup of ESLint configurations by providing pre-defined configurations for different project types such as Vue, TypeScript, and Cypress. It also supports overriding specific rules and global variables for certain files or directories.

What’s Changed

15.8.15 (2026-08-29)

Bug Fixes

• deps: update dependency eslint-plugin-jest to v29.16.2 22700f4

• This action is used across all versions by 28 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The YAML Reader GitHub Action reads a specified YAML file from a repository and outputs its contents as JSON. This action automates the parsing of YAML files, enabling developers to easily convert YAML configurations into JSON format for further processing or integration with other tools.

What’s Changed

• use 1.0.* yaml reader (cfdc6f4)
• upd (01aace6)
• add –json (701c72b)
• test (5277b61)
• init (9620163)
• Initial commit (9b2f349)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uploads test coverage data to gocov from GitHub Actions, handling various programming languages and formats like Go (LCOV), JavaScript/TypeScript (LCOV), Java (JaCoCo), and Python (Cobertura). It supports splitting coverage across different jobs in a matrix build for better visibility and reporting. The action is designed to automatically generate badges and PR comments on the hosted service or your own server, ensuring comprehensive test coverage reporting for your projects.

What’s Changed

What’s Changed

• Fork PRs upload tokenless through the GitHub App by @bykclk in https://github.com/gocov/gocov-action/pull/8

Full Changelog: https://github.com/gocov/gocov-action/compare/v1.6.0...v1.7.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action monitors pull requests to detect and warn about design system violations in your codebase. It checks only added lines, compares them to the learned values from roast-my-design-system, and provides specific comments indicating any issues found, helping maintain a clean and consistent design system.

What’s Changed

Your design system dies one pull request at a time. This makes sure it doesn’t.

The guard judges only the lines a pull request adds, against the design system the repo already has. It catches stray colours (and names the nearest token), spacing values new to the codebase (and names the nearest step), undeclared typefaces, !important, and arbitrary Tailwind values. One sticky comment per pull request, updated in place; strict mode fails the check instead.

Field-tested against vercel/ai-chatbot, excalidraw and shadcn-ui, plus master-only repos, repos with no remote, and detached-HEAD CI. Exclusions scope the judging as well as the learning, and on a fork’s pull request the verdict lands in the workflow log with a line saying why it could not be posted. Honest limits are documented in the README.

Full history in CHANGELOG.md.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action sets up a MySQL database in Docker using various options to configure and execute MySQL. It solves problems related to configuring and running MySQL databases within GitHub Actions environments, which are limited by Linux. The action supports multiple MySQL versions and can be used to manage different configurations for the database.

What’s Changed

• Update Dockerfile (88923f6)
• Update Dockerfile (958fe5b)
• Update Dockerfile (76bb5fc)
• Update action.yml (2f7c2ae)
• Update entrypoint.sh (149624a)
• Update action.yml (76f218b)
• Update Dockerfile (94ea8c5)
• Improve documentations (700bd56)
• Add restart option (c2f734e)
• Add test code (82ee48a)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

offsec-ai is an offensive-security toolkit that combines classic network reconnaissance with modern AI/LLM security testing. It automates tasks such as scanning live AI/LLM endpoints, probing Model Context Protocol (MCP) servers, and performing full-stack infrastructure security assessments. The tool can also detect and report on secrets in responses from Postman collections.

What’s Changed

• fix: bound pending task count in batch_check for hybrid identity and security headers (2041948)
• feat: add Postman Collection v2.x security scanner and attacker (v2.7.0) (e4668e8)
• ci: publish container to GitHub Container Registry (ghcr.io) (46d755c)
• fix: remove undefined OwaspScanResult string annotation in test_cli.py (F821) (8e750e3)
• feat: add A2A protocol security support (v2.6.0) (1b99a1b)
• fix: define OUTPUT_ARGS before use; -o was silently dropped (v2.5.9) (889e688)
• chore: replace all example.com targets with simpleportchecker.com (676106d)
• fix: –format not -f for ai-owasp-scan; use simpleportchecker target (v2.5.8) (504b6e8)
• fix: skip –timeout for ai-owasp-scan which does not support it (v2.5.7) (67a28cd)
• chore: use Gemini public endpoint in ai-owasp-scan job (6a13857)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Agent-Argus (argus-agent) automates security audits of code repositories by identifying and blocking test cases that assert nothing or do not call functions. It helps prevent incorrect assumptions in tests and ensures that code is thoroughly tested before deployment, preventing potential issues and vulnerabilities.

What’s Changed

Source distribution and wheel for argus-agent v1.0.0.

Install directly from this repository at this tag:

pip install "argus-agent @ git+https://github.com/Inan15/Agent-Argus.git@v1.0.0"

Repository visibility, MEASURED 2026-08-29 by gh repo view Inan15/Agent-Argus --json visibility,isPrivate -> PUBLIC / isPrivate: false. What that buys a consumer, stated plainly: the pinned install resolves for anybody with no credential, and the GitHub Release and its attached packages are publicly downloadable. This SUPERSEDES the 2026-08-15 measurement, which read PRIVATE / isPrivate: true and said the pinned install cannot resolve for anybody — tag or no tag — without a read credential carried in the URL (git+https://<credential>@github.com/...) — accurate on its date, never re-run for fourteen days, and false for an unknown part of them. That is the whole hazard of this sentence: it is a dated measurement, not a standing claim, and re-running the command above before relying on it is the only thing that keeps it true.

The exit-code wire contract is UNCHANGED by this release: 0=RELEASE_READY, 1=no verdict produced, 2=NOT_READY_FOR_RELEASE, 3=INSUFFICIENT_COVERAGE. Exit 1 is reserved and is never a verdict — a run that produced no verdict made no statement about your code. See CHANGELOG.md for the full consumer contract.

CI evidence: run 33235322979 (ac1265e6ffabe0a6cb3b7633dc3107bd3556b274, 3/3 legs green) on audit-ci.yml covers the commit being released. Observed 2026-08-29 through the GitHub API.

SCOPE of that run, because a green run is evidence for what it EXECUTED and this one did not execute everything it carries. Each leg reported 1777 passed, 4 skipped. The run recorded the following as NOT EVALUATED rather than as passing, so the citation above does not reach them: (1) tests/test_installed_artifact.py (TC-ArgusAgent-RELEASE-001-25..-28) — the fresh-environment installed-artifact proof: every [project.scripts] console script, argus --help, a fixture audit run to a real verdict, and an MCP JSON-RPC exchange over stdio through the installed argus-mcp shim. All four SKIPPED on all three legs, each reporting the named E6 outcome NOT EVALUATED — uv is not on PATH, so the wheel could NOT be installed into a fresh environment and nothing about the INSTALLED distribution was checked. So the front-door claim of this release is held by LOCAL runs only, and this citation does not cover it. Provisioning uv on the CI runner is a tooling decision that has not been taken; it is filed OPEN and unscheduled as DF-12-9-B, owned by the Engineering Lead. Reading the citation as covering these would be the same class of overstatement as quoting a run id without the sha it covers.

This release makes no assurance claim about Argus itself. Argus’s dogfood run is a self-audit and is not independent corroboration.

Beta: Argus’s finding precision has not been independently validated. Its findings rest on the Argus dogfood corpus, a self-audit of this repository. Treat findings as a prompt to look, not a verdict. This notice is removed only when the >=80% precision gate is met; nothing else removes it.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The mdsmith GitHub Action is designed to automate the process of linting and formatting Markdown files in a repository. It focuses on improving readability and consistency across multiple files and pipelines by checking style, structure, and cross-file integrity. The action provides auto-fix capabilities that automatically rewrite errors found during linting, ensuring that Markdown content remains clean and consistent.

What’s Changed

What’s Changed

• perf: audit against high-performance-go.md, fix 5 measured hot paths by @jeduden in https://github.com/jeduden/mdsmith/pull/770
• perf: audit against high-performance-go.md, fix 5 measured hot paths by @jeduden in https://github.com/jeduden/mdsmith/pull/774
• perf: audit against high-performance-go.md, fix top 5 hot-path violations by @jeduden in https://github.com/jeduden/mdsmith/pull/775
• perf: fix top 5 hot-path issues from a high-performance-go.md audit by @jeduden in https://github.com/jeduden/mdsmith/pull/780
• perf: fix top 5 high-performance-go.md violations found by codebase audit by @jeduden in https://github.com/jeduden/mdsmith/pull/782
• perf: audit against high-performance-go.md, fix 5 confirmed hot paths by @jeduden in https://github.com/jeduden/mdsmith/pull/785
• perf: fix top 5 high-performance-go.md violations by @jeduden in https://github.com/jeduden/mdsmith/pull/786
• perf: fix top 5 high-performance-go.md violations from a 3-agent audit by @jeduden in https://github.com/jeduden/mdsmith/pull/783
• perf: audit against high-performance-go.md, fix top 5 new hot-path issues by @jeduden in https://github.com/jeduden/mdsmith/pull/788
• perf: fix 4 high-performance-go.md violations found by codebase audit by @jeduden in https://github.com/jeduden/mdsmith/pull/794
• perf: consolidate #776, #779, #790, #793 with manual conflict resolution by @jeduden in https://github.com/jeduden/mdsmith/pull/800
• chore(deps): bump markdownlint-cli2 from 0.23.1 to 0.23.2 in /docs/research/benchmarks/npm by @dependabot[bot] in https://github.com/jeduden/mdsmith/pull/778
• fix(foreignregion): resolve MDS073 rule-ID collision with slidevstructure by @jeduden in https://github.com/jeduden/mdsmith/pull/791
• docs(security): scope zero-egress claim and add MDS072 SSRF caveat by @jeduden in https://github.com/jeduden/mdsmith/pull/771
• feat(init): APM coexistence — --apm flag, kind pack, and guide by @jeduden in https://github.com/jeduden/mdsmith/pull/772
• chore(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/jeduden/mdsmith/pull/787
• docs(security): 2026-08-14 post-audit diff review — clean window by @jeduden in https://github.com/jeduden/mdsmith/pull/795
• docs(security): 2026-07-31 post-audit diff review — no new findings by @jeduden in https://github.com/jeduden/mdsmith/pull/781
• docs(security): 2026-08-07 post-audit diff review — zero new findings by @jeduden in https://github.com/jeduden/mdsmith/pull/789
• docs(security): consolidate the 2026-07-31, 08-07 and 08-14 post-audit reviews by @jeduden in https://github.com/jeduden/mdsmith/pull/801
• feat(mds072): SSRF guard and per-run egress ceiling by @jeduden in https://github.com/jeduden/mdsmith/pull/769
• test(cmd/mdsmith): add dedicated unit tests for runCheck/runFix by @jeduden in https://github.com/jeduden/mdsmith/pull/784
• perf: fix 5 highest-impact violations of the high-performance-go guideline by @jeduden in https://github.com/jeduden/mdsmith/pull/802
• plan: vendor go-runewidth as a patched fork, bump tinygo to 0.41.1 by @jeduden in https://github.com/jeduden/mdsmith/pull/804
• feat(runewidth): vendor go-runewidth as a patched fork, remove eager LUT by @jeduden in https://github.com/jeduden/mdsmith/pull/807
• ci(tinygo): bump pinned tinygo 0.39.0 → 0.41.1 by @jeduden in https://github.com/jeduden/mdsmith/pull/808
• perf: fix top 5 high-performance-go.md violations by @jeduden in https://github.com/jeduden/mdsmith/pull/811
• build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @dependabot[bot] in https://github.com/jeduden/mdsmith/pull/812
• refactor(githooks): split by responsibility; record 2026-08-23 arch audit by @jeduden in https://github.com/jeduden/mdsmith/pull/815
• test(pkg/mdsmith): add dedicated unit test for readBoundedFrontMatterSource by @jeduden in https://github.com/jeduden/mdsmith/pull/805
• feat(metrics,rules): add MET007 word-frequency metric and MDS074 over-repetition rule by @jeduden in https://github.com/jeduden/mdsmith/pull/806
• refactor(cmd/mdsmith): move list-query subcommand logic into query.go by @jeduden in https://github.com/jeduden/mdsmith/pull/809
• test(rules): add dedicated unit tests for occurrence and slidevstructure private helpers by @jeduden in https://github.com/jeduden/mdsmith/pull/810
• docs(security): 2026-08-28 post-audit diff review by @jeduden in https://github.com/jeduden/mdsmith/pull/816
• feat(schema): let filename: accept a list of globs (OR match) by @jeduden in https://github.com/jeduden/mdsmith/pull/818
• perf: cut check allocations 21% and CPU 6% across five hot-path fixes by @jeduden in https://github.com/jeduden/mdsmith/pull/813
• fix(security): remove proxy blind spot from MDS072 guarded HTTP client by @jeduden in https://github.com/jeduden/mdsmith/pull/819

Full Changelog: https://github.com/jeduden/mdsmith/compare/v0.54.0...v0.55.0

• This action is used across all versions by 11 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

NeuroLink is a universal AI integration platform that unifies multiple AI providers and models into a single API using TypeScript-first development. It provides features like switching providers with a simple parameter change, leveraging built-in tools and integrating with any MCP-compliant tool server. NeuroLink also includes enterprise-level features such as Redis memory and multi-provider failover to optimize costs automatically.

What’s Changed

12.7.2 (2026-08-29)

Bug Fixes

• (localUsage): pin window monotonicity, and stop two tests lying about failure (f07f145)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

AIsbom is a security scanner for AI models that performs static analysis to detect malware, license risks, and code execution vulnerabilities within ML model files. It scans various formats like PyTorch Pickle bytecode, Keras configurations, GGUF chat templates, ONNX graphs, and SafeTensors. The action can be used as a GitHub Action to post an idempotent PR comment on every commit, helping developers identify potential security issues before model deployment.

What’s Changed

Correction to the v1.3.2 notes

v1.3.2 introduced content-based discovery for files no extension claims, and documented one known limit: that a payload could only hide behind a literal larger than the whole 16MB sniff budget.

That figure was wrong. The real threshold was roughly 64KB — about 254× easier to reach than published. This release fixes the underlying gap and makes the documented ceiling the true one.

What was wrong

Discovery reads a 64KB head and re-reads with a larger budget only when that head looks like an unfinished pickle. The signal for “unfinished” was at least one opcode parsed.

A pickle that opens with a single literal bigger than that first read completes zero opcodes — so the larger read never happened, and the file was never discovered at all. Measured on the released v1.3.2:

first-literal    65,000 B: CRITICAL (RCE Detected: os.system)
first-literal    70,000 B: NOT DISCOVERED
first-literal 1,000,000 B: NOT DISCOVERED

Scope: discovery only, and only for files whose extension nothing claims. The same padded payloads under a recognized extension such as .pkl were always caught, as was a payload followed by a large literal. If you scan .pt, .pkl, .safetensors, .gguf or any other recognized format, this never applied to you.

The fix

Discovery now also re-reads when the first opcode declares an argument that runs past the buffer — the one way a genuine pickle yields no opcodes at all.

• Length-prefixed arguments (BINBYTES, BINUNICODE, BINBYTES8, …) are read exactly from their size prefix.
• Newline-terminated arguments cannot be measured without the terminator, so they are admitted only for the handful of opcodes that can really begin a pickle (STRING, UNICODE, INT, LONG, FLOAT), only when no newline is already in view, and only when the next byte matches what that opcode’s argument must start with.

That last guard is what keeps the walk cheap. A parquet file opens PAR1, and P is the PERSID opcode — but no real pickle begins with a persistent id, so parquet still settles on its first 64KB instead of being re-read to the cap. There is a test asserting exactly that.

Verification

• Every previously-evading pad is now caught — 70,000 B, 250,000 B, 1,000,000 B and 2,000,000 B, in both the protocol-0 quoted-string and binary length-prefixed shapes.
• The ceiling is now real: caught at 16,773,120 bytes, not discovered at 16,781,312.
• Cost unchanged — a 5,101-file node_modules walk still yields 0 artifacts in 0.83s.
• poetry run pytest: 831 passed, 91.38% coverage.
• aisbom bypass-scorecard --check: gate green, 9/11 unchanged.

What’s not changing

Exit codes, output formats and the CycloneDX/SPDX schemas are identical to v1.3.2. No new dependencies. The bypass scorecard is unmoved at 9/11 — this gap was never one of the eleven published corpus cases, which is its own lesson about what a corpus does and does not cover.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates compliance checks for AI models and pipelines, ensuring adherence to UAE PDPL, GDPR, and EU AI Act regulations. It enforces data protection, model documentation completeness, Terraform policy compliance, and auditor-facing artifacts in CI/CD pipelines. The action supports multiple entry points for different use cases and runs on GitHub Actions.

What’s Changed

Reusable GitHub Actions that turn UAE PDPL, GDPR and EU AI Act requirements into blocking CI checks. Every policy is an executable check that fails the build, not a paragraph in a document nobody reads.

Adopt in one step

steps:
  - uses: actions/checkout@v4
  - uses: mmubarak-io/ai-compliance-gates@v1
    with:
      data-path: ./data
      model-cards-path: ./model_cards
      terraform-paths: "infra/*.tf"

The gates

How it fails

A gate must never report success for a check it did not perform.

Code 2 is the load-bearing one. A path matching zero files, unreadable input, a format with no reader, invalid config and a run given no gate at all all exit 2 rather than passing. Partial coverage blocks too: a directory of Parquet shards next to one CSV does not pass on the strength of the CSV. Opt out only deliberately with allow-empty or allow-unscanned, and the gap stays recorded in the evidence pack as PARTIAL, never PASS.

Each gate is also available on its own under .github/actions/, and the whole pipeline as a reusable workflow at .github/workflows/gates.yml.

Full changelog: https://github.com/mmubarak-io/ai-compliance-gates/blob/main/CHANGELOG.md

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This action automates the creation and execution of test suites in Go, providing features such as isolation and parallelism, along with a specification-driven approach to testing through BDD vocabulary. It supports generating test outputs that are both readable and in sync with the underlying code.

What’s Changed

What’s Changed

• fix(docs): point the gopher image at its new site/static home by @mvrahden in https://github.com/mvrahden/go-test/commit/8a3845b9b313acaa66a0dc2257f6df496560b094
• chore: Go 1.25 is the supported floor, 1.27 the newest version tested by @mvrahden in https://github.com/mvrahden/go-test/commit/33d0762a5b3795df5073bd8cced931560af5d765
• feat(cli): every JSON surface emits one compact line, halving the payload by @mvrahden in https://github.com/mvrahden/go-test/commit/36150839f75acb910ab486590720ff90e7ef6e6d
• fix(vscode): discovery streams the CLI’s output instead of losing it past 1 MiB by @mvrahden in https://github.com/mvrahden/go-test/commit/cc46b4940444744dc8261c12eeab400b938ea158
• Restore compatibility with Go 1.27 and test main after merge by @mvrahden in https://github.com/mvrahden/go-test/pull/113
• Update every dependency and raise the extension floor to VS Code 1.123 by @mvrahden in https://github.com/mvrahden/go-test/pull/121
• fix(ci): the publish jobs receive their tokens again, and refuse to run without them by @mvrahden in https://github.com/mvrahden/go-test/commit/9ccfa36d
• fix(ci): the tokens travel under names no environment secret can shadow, and the guards run from the workspace root by @mvrahden in https://github.com/mvrahden/go-test/commit/f4aa6289

Full Changelog: https://github.com/mvrahden/go-test/compare/v1.27.0...v1.28.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sigil is an automated security auditing action that scans AI agent code to detect malicious patterns before they reach working environments. It uses a quarantine-first approach and provides eight analysis phases, including Install Hooks, Code Patterns, Network/Exfil, Credentials, Obfuscation, Provenance, Prompt Injection, Skill Security, and LLM Analysis.

What’s Changed

Sigil v1.3.3

Quick Install

Homebrew (macOS/Linux):

brew tap nomarj/tap
brew install sigil

npm (macOS/Linux):

npm install -g @nomarj/sigil

Cargo (Rust):

cargo install sigil-cli

Installer script:

curl -fsSLO https://www.sigilsec.ai/install.sh
sh install.sh

Manual Installation

macOS (Apple Silicon):

curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/sigil-macos-arm64.tar.gz
curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt
tar -xzf sigil-macos-arm64.tar.gz
sudo mv sigil /usr/local/bin/

macOS (Intel):

curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/sigil-macos-x64.tar.gz
curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt
tar -xzf sigil-macos-x64.tar.gz
sudo mv sigil /usr/local/bin/

Linux (x64):

curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/sigil-linux-x64.tar.gz
curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt
tar -xzf sigil-linux-x64.tar.gz
sudo mv sigil /usr/local/bin/

Linux (ARM64):

curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/sigil-linux-arm64.tar.gz
curl -fsSLO https://github.com/NOMARJ/sigil/releases/download/v1.3.3/SHA256SUMS.txt
sha256sum -c --ignore-missing SHA256SUMS.txt
tar -xzf sigil-linux-arm64.tar.gz
sudo mv sigil /usr/local/bin/

Windows (x64): Download sigil-windows-x64.zip, extract, and add to your PATH.

Verify checksums

sha256sum -c SHA256SUMS.txt

What’s Changed

• fix(release): move embedded packs into the crate for cargo publish; bump 1.3.3 by @nomark-dev in https://github.com/NOMARJ/sigil/pull/145

Full Changelog: https://github.com/NOMARJ/sigil/compare/v1.3.2...v1.3.3

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action seo-audit is designed to crawl an entire website’s sitemap and check all pages for SEO, metadata, and structured data issues that single-page graders often overlook. It automates the process of identifying problems such as duplicate content, long page titles, and missing language switcher links on translated pages. The action can be run in CI environments or directly from the command line with minimal setup, ensuring comprehensive SEO audits across a site’s entire structure without requiring manual checks.

What’s Changed

Updating from 1.38.0 or earlier on macOS needs one command

This release fixes an updater that could not install its own fix. On 1.38.0 and earlier, Update offers this version and then does nothing: the banner reads GitHub’s releases while brew upgrade reads Homebrew’s own copy of the tap, which is refreshed at most once a day, so for a while after any release the two disagree and Homebrew answers “the latest version is already installed”.

Once, in a terminal:

brew update && brew upgrade --cask seo-audit

From 1.38.1 onward the button does both steps itself, and this is the last time it is needed.

Fixed

• Update said a new version had appeared and then did nothing. The banner reads GitHub’s releases; brew upgrade reads Homebrew’s own clone of the tap, and that clone is refreshed by an auto-update which runs at most once a day. So for up to twenty-four hours after a release the two disagree: the window offers 1.38.0, Homebrew answers “Not upgrading seo-audit, the latest version is already installed”, and the process exits 0 — so nothing reported a failure and nothing moved.

  brew update now runs first, as a step rather than a hope, and the command shown on screen says both so that running it by hand does the same thing. Found by pressing Update on a real 1.36.0 with 1.38.0 published, watching it do nothing, and going after the reason.

• Linux was told to run a command that could not work. An apt-installed copy was offered sudo apt-get install --only-upgrade seo-audit, and no apt repository anywhere carries this package — the .deb is downloaded from a release and installed by hand. apt would answer that it cannot locate it. The same failure as above in a different package manager: an instruction that reads like an answer and is not one. That copy now goes to the release page, where the next .deb actually is.

  With nothing left that could produce it, the “Show me” path and its dialog are gone. An option nothing can reach is an option that does not exist.

• The winget path could never have worked, token or no token. Detection ran winget list --id Nurkamol.SeoAudit --exact and then asked whether the output contained seo-audit. It never does: winget prints an Id column reading Nurkamol.SeoAudit, the Name is SEO Audit, and the lowercase hyphenated spelling appears nowhere. So the check was false for every winget install there could ever be — and would have stayed false after a manifest shipped, with the branch dead for a reason nobody was looking at any more. It matches on the identifier now, case-insensitively, which is what winget is.

  The identifier is one constant rather than three copies, and the guard that keeps it in step with the workflow reads that constant and also fails if anybody writes it out by hand again.

• The bundle declared no publisher, licence or description, all of which a winget manifest requires and all of which Windows shows in Add/Remove Programs. Set, so the first submission has something true to carry.

Installing on macOS

brew tap nurkamol/seo-audit https://github.com/nurkamol/seo-audit
brew trust nurkamol/seo-audit
brew install --cask seo-audit

Homebrew verifies the download against the checksum below and clears the quarantine flag for you, so the app opens the first time.

Downloading the zip instead? macOS may say “SEO Audit is damaged and can’t be opened.” It is not damaged. The app is ad-hoc signed rather than notarised — notarising needs a paid Apple Developer account this project does not have — and macOS refuses quarantined apps without a notarisation ticket. Check what you downloaded first:

shasum -a 256 seo-audit-1.38.1-macos.zip
# f1ce47dace1edecef143143f27e50f94dcd068b621e86affdc0ed39d4457eeb1

Then, once it matches, clear the flag — no sudo needed:

xattr -dr com.apple.quarantine "/Applications/SEO Audit.app"

That is what right-click → Open does in the Finder, without the dialog. Apple Silicon, macOS Tahoe or newer.

Windows and Linux

The setup.exe, .deb and .AppImage below are attached by a separate job and may appear a few minutes after this release does.

The Windows installer is unsigned, so SmartScreen shows “Windows protected your PC” — More info → Run anyway. Same reason as macOS: a code-signing certificate is a paid, per-year thing this project does not have. The .AppImage needs chmod +x before it will run.

Check any of them first. A SHA256SUMS.txt covering every file here is attached alongside them, and the same checksums are listed at the end of these notes:

shasum -a 256 --ignore-missing -c SHA256SUMS.txt

Checksums

Verify a download before you wave a warning away. With SHA256SUMS.txt saved beside the file, in the same folder:

shasum -a 256 --ignore-missing -c SHA256SUMS.txt

1328e19d7b4e3de68706ac978376b6b5f02a03182c2434e60a809b2671bdea17  SEO.Audit_1.38.1_amd64.AppImage
c147fe6865200efeff9454df5c792a4bc087f0a201ebc7d807a4309323ada651  SEO.Audit_1.38.1_amd64.deb
30fe3d86dee9b056638fa986387e9a1a0a20224a90764366a79aebde4c67d1af  SEO.Audit_1.38.1_x64-setup.exe
f1ce47dace1edecef143143f27e50f94dcd068b621e86affdc0ed39d4457eeb1  seo-audit-1.38.1-macos.zip

The macOS line appears twice in these notes on purpose: once above, computed when the app was built, and once here, computed from what is actually attached. They should agree.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Chock is a governance-as-code tool that automates AI coding agents by compiling rules into deterministic guardrails. It ensures that all AI coding agents within a team or open-source project follow specific policies, such as disallowing force pushes to the main branch, and provides coverage reports on rule adherence across different agents.

What’s Changed

Agent-hooks py launcher fallback and INT-3 verb list

MINOR: the agent-hooks emitter output changes, so an adopter’s next chock sync / chock plugin build rewrites .github/hooks/*.json. No credited enforcement surface changes — the guard runs the same, just with one more way to find an interpreter.

Changed

• Agent-hooks Bash resolver adds the py launcher fallback. The Bash branch resolved command -v python3 || command -v python; the PowerShell branch already tried py. On a Windows checkout where only the py launcher is on PATH, the Bash hook exited “no python interpreter found” and the guard failed open. It now also tries py, matching the PowerShell branch, so the two agree about where enforcement holds. (#71)
• INT-3 recognises pin as a verb. Policy ids like pin-github-actions no longer draw a spurious “does not start with a verb” warning. (#71)
• Docs: dropped a stale hardcoded published-version snapshot from the compatibility page; the GitHub Action example now pins v0.6.0. (#72)

Release verification

The full pre-tag routine ran at zero failures on the tagged lineage: 844 tests green, 83% statement coverage, docs-accuracy and emitter-golden checks pass, catalog truth-check 251/251 eval cases (block and allow), and a byte-identical rebuild of the published distribution trees. Post-tag verification (PyPI publish attestation, cold install, and distribution republish from this tag) runs next and the distribution repos will republish against v0.6.0.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates web application security audits using AI coding agents. It provides actionable security reports with realistic consequences, reviewable changes, and evidence-based decisions. The action supports JavaScript/TypeScript frameworks and generates route-security.json and route-security.md files. It can be used to audit a local project without contacting a deployment or modifying code, focusing on actionable results and providing clear explanations of what needs human confirmation.

What’s Changed

v0.8.0 release evidence

Status: complete. Immutable release, npm package, verified installer and signed v1 are published. The immutable and moving-alias consumers passed, and the byte-matched durable live-verification record is available as both a workflow artifact and GitHub Release asset.

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

Outcome

v0.8.0 deepens the existing JavaScript/TypeScript route review without adding a framework, ORM, general SAST or automatic-repair claim.

• Route-security v3 follows exact route, query, direct JSON-body and Server Action object selectors through at most four exact project-local call edges.
• Object, principal and tenant facts remain separate. Supported Prisma/Drizzle operations record visible query predicates, supported post-load comparisons, absent supported constraints or incomplete evidence as different outcomes.
• Express, NestJS, Next.js App Router and Next.js Server Actions share one bounded project graph, while framework inventory and access-path coverage remain independent.
• Compatible v3 baselines can expose lost authorization evidence or incomplete current paths. Route-security v1/v2 baselines are not_comparable / route_schema_changed under v3.
• Each rendered review lead includes the professional term, plain-language meaning, conditional consequence, evidence limit, review proposal, change risk and owner/non-owner/normal-flow checks.

completed means the bounded static model reached a supported operation. It does not prove runtime reachability, correct authorization, control-flow dominance, exploitability or absence of an unsupported path. Clerk, Better Auth and Supabase remain experimental; Supabase always requires deployed RLS-policy evidence.

Fixed-commit effectiveness evidence

The denominator was frozen before implementation at 14 eligible paths across four exact public commits, with a target of 10 and a six-path grounded floor. It was not reduced after misses.

• 13 of 14 frozen paths completed: Drizzle 6/6 and Prisma 7/8.
• The sole miss, Formbricks ACTION getMembershipRole, remains partial with argument_mapping_ambiguous and call_target_unresolved.
• The review contains 63 distinct completed operation chains and 50 additional completed review paths outside the frozen score; additional paths were not added to the denominator.
• Four completed paths retain supporting limitations. Completion does not erase them.
• Same-machine median runtime ratios were 1.10x to 1.41x against the v0.7.3 baseline, below the 2x stop threshold for all four fixed targets.

The review, provenance record and minimized regression bind these facts. This author-selected fixed corpus is bounded effectiveness evidence, not production precision/recall, framework-wide coverage or a vulnerability benchmark.

Candidate verification

The local P13 gate completed with the failure history retained rather than rewritten. The single npm run check invocation stopped first on a stale curated v2 fixture; its explicit continuation then found one duplicate-ID renderer fixture and the v0.7.3-bound active journey catalog. The schemas and duplicate-ID validator were not relaxed. After the focused corrections, non-overlapping runner records cover all 82 intended test files: 81 passed, zero failed, one opt-in real-adapter file skipped and zero not run. Prerequisite surfaces record three passed and one explicit skip. The shell smoke suite and every remaining lint/contract command passed; no second monolithic check was run.

Final local artifacts:

• npm dry-run package: v0.8.0, 215 files, 645,212 packed bytes, SHA-1 1b45330758998f04eeacf71166ab20310fd1c1e7;
• SPDX 2.3 SBOM: two packages, SHA-256 e3a0cd020e846d6f8af3751a9ff31bf108b4e1813c958b7cc337d2a6846e295f;
• parser bundle: SHA-256 f8d700c78a6d0a50513a672b419074a87597093733d2d69ecee92675d8139698;
• active five-project v0.8.0 catalog: exact tool source 80d21afbbca2075a66e761b085e7bd4752fdac7f, all five fixed checkouts clean, two complete and three explicitly incomplete audit exits;
• secret scan: two intentional planted test-fixture files, zero production credential values after redacted manual classification;
• Skill validation, package isolation, document/product/release/distribution contracts and git diff --check: passed.

Hosted candidate verification passed before immutable publication on the final release source:

• source commit: 119cbcc7f8d327482df8abfa50a4af0b69fcceee;
• CI run 33263683220: success on macOS/Ubuntu with Node 22/24, including pinned real-adapter fixtures on Ubuntu Node 22;
• CodeQL run 33263683203: success on the same commit;
• main was observed at that commit, but the branch-protection API reports that main is not protected. The hosted checks passed; their enforcement by branch protection is not claimed.

Immutable publication evidence

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.8.0

The SSH-signed annotated tag object is e826ede4b3ee1eab9237b5ea49ba8e340da26bd5 and peels to release source 119cbcc7f8d327482df8abfa50a4af0b69fcceee. Repository-local SSH verification passes, and GitHub reports verified: true with reason valid for that exact tag object.

Release workflow 33263798089 completed successfully and published four immutable assets:

• SHA256SUMS: SHA-256 e606db959a83171a6d19a76ff29979e9c5155594fa993be376fb36a10c75899e;
• release manifest: SHA-256 3bee5679b353c3071eac1452cf52b2439979b30ded03686afbb734eec63b846a;
• SPDX 2.3 SBOM: SHA-256 cce92a9bfdd96617c59d0c49c2f59f0ce07e9ea2b529de2f0dad16f57296a137;
• source archive: SHA-256 d6136bdc82975274cc0059ad0bf36e602b447dbfb9cbcca8a7a058b60bb8d888.

The downloaded asset set passed checksum, manifest, archive lifecycle and GitHub attestation verification. The manifest and tag identify the same release source. The archive contains 547 entries and its SBOM declares SPDX 2.3 with two packages.

npm trusted-publishing run 33263916671 published web-app-security-skill@0.8.0 from the same source. npm records shasum 1b45330758998f04eeacf71166ab20310fd1c1e7, integrity sha512-zbnRkSZ4bdMgRtXprWSp8uvgMswAGjdZstXbcObLJlOIvjnpbmmSHQzdzWPTTlID3giNFfsDH8hchnomYQfUNQ== and SLSA provenance for that workflow/source. All 215 npm package files match the signed release source archive byte-for-byte. A fresh-cache exact-version consumer returned Web App Security Skill 0.8.0.

Verifier commit f55c80e7c5014ff6d39d61ca8cbb4fec2ec1fbac records the public v0.8.0 asset digests and has SHA-256 0e3e27ae7f00314668337b9d0a2d8a350ac01b908ab65aa0b2856c614278d5a7. Bootstrap commit 12cb085d7f3a21c2b6ffb6cb2758ee4247e2af9f fixes that verifier identity and has SHA-256 137b5d8fdf6f616be3aa2631e0134b354fd9142ce19419bad6c37e5b0409480f. Focused trust-chain tests pass locally. Public raw bootstrap retrieval, an isolated clean install and the immutable full-SHA Action consumer have now passed. The public bootstrap matched SHA-256 137b5d8fdf6f616be3aa2631e0134b354fd9142ce19419bad6c37e5b0409480f before execution. It installed all three supported targets under an isolated HOME with --attestation required; GitHub CLI attestation verified successfully, and no existing user installation was touched.

Immutable consumer run 33264836987 completed successfully against the full release source SHA. The owned Express/Prisma fixture produced route-security v3 with completed bounded-path coverage and an observed owner constraint, without converting the review evidence into a confirmed-vulnerability claim. The moving-v1 consumer and live-verification jobs were intentionally skipped until P16.

Final promotion and live verification

Signed annotated v1 was moved with an exact guarded lease from tag object 7bd05668153d21c1ac55ac35e8707703e2a6eb0f to 3e44c123d45f5fc06fa437fe1fbd58a71c5aaaa8. It peels to immutable release source 119cbcc7f8d327482df8abfa50a4af0b69fcceee. Repository-local signer-policy verification passes, and GitHub reports verified: true with reason valid for the new tag object.

Final public verification run 33265256940 completed successfully on coordination commit 43dbc9bdbe31e994560212d56131f60f956805b7. It verified:

• the immutable full-SHA Express/Prisma route-security v3 consumer;
• the signed v1 passive crawl consumer and its authorization-refusal behavior;
• GitHub Release checksums, manifest, signed tag and build provenance;
• npm package bytes and provenance;
• an isolated all-target installer run with GitHub attestation required;
• the published moving-alias state.

The workflow produced web-app-security-skill-0.8.0.live-verification.json as both a 90-day workflow artifact and durable Release asset. The two downloaded records matched byte-for-byte with SHA-256 5ff2d022a192ae2d95a805e26464d8e392d3e68d0c91f43fe4ea72887525bead; the record reports live_verified and all eight public gates as verified.

The expected authorization-refusal probe is visible in the workflow UI as an exit-2 annotation. The step used continue-on-error, the following assertion required that failure, and the consumer job concluded successfully. It is negative-test evidence, not an unhandled workflow failure.

Public release facts

• GitHub Release: https://github.com/parousia8888/web-app-security-skill/releases/tag/v0.8.0
• npm: https://www.npmjs.com/package/web-app-security-skill/v/0.8.0
• Immutable Action source: 119cbcc7f8d327482df8abfa50a4af0b69fcceee
• Signed v1 tag object: 3e44c123d45f5fc06fa437fe1fbd58a71c5aaaa8
• Signed v1 source: 119cbcc7f8d327482df8abfa50a4af0b69fcceee
• GitHub signature state: verified: true, reason valid
• Final combined consumer: https://github.com/parousia8888/web-app-security-skill/actions/runs/33265256940
• Durable live-verification record: https://github.com/parousia8888/web-app-security-skill/releases/download/v0.8.0/web-app-security-skill-0.8.0.live-verification.json

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SkillSeal is a local-first, offline-first CLI tool that lints, scores, and routing-tests SKILL.md files. It catches invalid frontmatter, vague descriptions, oversized files, dangling file references, rm -rf/curl | sh in code blocks, hardcoded paths, OS-specific commands, and more. The action helps identify issues before agents use the skills, ensuring quality and reliability.

What’s Changed

• feat: add –explain-score breakdown of the QUALITY category

Full Changelog: https://github.com/pespinel/SkillSeal/compare/v0.26.2...v0.27.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Plori agent action creates a persistent workspace for each repository to analyze pull request commits, inspecting surrounding code and running targeted tests instead of judging a diff in isolation. It automates the process of reviewing code changes without duplicating work across PRs. The action maintains a signed claim link for private repositories or exhausted free quotas, allowing owners to continue reviews after claiming the repository.

What’s Changed

Persistent remote pull-request review with GitHub Actions OIDC and isolated comment permissions.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Z-AI GLM Code Review Bot automates code reviews using AI-driven models, providing inline line-level review comments, deterministic scanners, structured findings with noise caps and severity rankings, and interactive /zai commands. It also offers commit-status feedback and per-path review instructions without editing the workflow.

What’s Changed

Z-AI GLM Code Review Bot v2.0.0 — the Marketplace release of the v2 line, now running on the Node 24 runtime.

This tag supersedes the original v2.0.0 cut: it moves the tag to current main so @v2.0.0, @v2, and the Marketplace listing all serve the latest audited build — build 31b626c (2026-08-29). A floating v2 major tag tracks this release.

Since the original v2.0.0 cut

Runtime & tooling

• node20 → node24 (runs.using) — Node 20 reached EOL in April 2026 and GitHub Actions forces Node 24 execution. CI now tests Node 22/24.
• @actions/core pinned to 2.0.3 (core@3 breaks native ESM bundling), actions/checkout & setup-node bumped to v7.

Review defaults (2026-08-29, #21)

• Default model is now glm-5.3 (ZAI_MODEL). glm-5.3-flash works out of the box as the faster/cheaper option — no allowlist, any model name passes through.
• ZAI_MAX_FINDINGS default raised 8 → 25 (clamp unchanged at [1, 50]; .zai.yml can still only lower the cap).

Supply-chain & dependency refresh (2026-08-29, #22–#29)

• Workflow hardening (#22, #23): every CI action SHA-pinned, persist-credentials: false, job timeouts, ubuntu-24.04, concurrency guards, and new actionlint / zizmor / CodeQL / OSSF Scorecard / Socket gates — plus a workflow-security policy test that enforces the invariants.
• Dependabot 7-day supply-chain cooldown on npm and GitHub Actions ecosystems (new releases age 7 days before Dependabot proposes them).
• Dependency bumps: actions/upload-artifact v7.0.1, github/codeql-action v4.37.8, vitest family 4.1.11; picomatch and others follow via the cooldown. @actions/core stays deliberately on 2.x.
• README quickstart pinned to the audited build SHA (#29).

Security & correctness (audited across 14 adversarial waves, all fixed via TDD)

• Adversarial audit waves W1–W21 (#8, #12): 170+ bugs fixed across prompt-injection defenses, markdown rendering (CommonMark code spans, nested blockquotes, surrogate pairs), .zai.yml config wiring, scheduling/push parity, and secret redaction.
• CodeRabbit follow-up (#10): 4 findings fixed, including a prompt-injection bypass and an unbounded scheduleMaxPrs.
• Feature-tracker audit (#9): 66 user stories walked, 5 logistical bugs fixed.
• Simplification audit (#13): 20 fixes — 9 drifting duplicate helpers deduped, 2 hardening fixes, plus a real .zai.yml glued-quote parsing bug.
• Deferred follow-ups (#15): key-parity & action.yml drift guards, early-exit pagination, worker pool, status-policy parity.

Housekeeping

• Version pinned to v2 everywhere (package.json 2.0.0, @v2 usage ref), README gains a Marketplace badge and refreshed docs, MIT license field added.
• Action renamed to Z-AI GLM Code Review Bot — the name “Z.ai Code Review” was already taken on the Marketplace by the upstream repo.

Test suite: 2349 passing. Zero npm audit vulnerabilities.

Upgrading from v1

See the README for the v2 input table — v2 adds structured findings, inline review comments, deterministic scanners (gitleaks + ast-grep), a walkthrough summary, .zai.yml repo config, and incremental review. All v1 users should carry ZAI_API_KEY unchanged; everything else has sensible defaults.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

next-secure-check is a Next.js-focused security checker that provides deterministic findings for common vulnerabilities before deployment. It uses rule-based pattern matching and AST analysis to scan local projects, offering insights into potential security risks without executing repository code or using AI at runtime. This tool helps developers identify and address security issues early in the development process.

What’s Changed

What’s changed

• The reusable composite Action now invokes the published next-secure-check@0.5.0 CLI.
• Existing inputs, outputs, summary behavior, SARIF handling, and the @v1 consumer reference remain compatible.
• The release follows the v0.5.0 npm publication and the successful security-check workflow.

Validation

• GitHub Security Check run 33261300291 passed build, typecheck, lint, tests, release gate, security check, and reusable Action smoke.
• The four npm packages report version 0.5.0, with next-secure-check latest at 0.5.0.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the build process for Wails.io v3 projects. It installs GoLang and NodeJS, builds the application, and optionally uploads the results to GitHub or publishes them on a tagged release. The action supports various build options such as obfuscation, platform selection, caching, and package uploading.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.14...v3-alpha.14

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The spec-ci-plugin GitHub Action ensures that pull requests adhere to specified guidelines, automating tasks like validating specs, checking for security vulnerabilities, ensuring scope compliance, and verifying acceptance criteria. It posts a structured report as a PR comment when the checks are passed or fails them if there are issues. The action requires a GitHub token and specifies input parameters such as the spec file path and how to handle errors.

What’s Changed

Patch release whose purpose is to move the v1 tag onto the injection-scanner v0.1.0 default.

What changed

Only the default value of the injection-scanner-version input: v0.0.3 → v0.1.0. No input, output, or behaviour of this Action changed.

Why it matters

The scanner this Action runs got substantially better, and @v1 consumers were not getting it.

Four of the five attack categories were rewritten from lists of literal phrases into verb × modifier × object matrices. Before, a paraphrased payload walked straight past — which made this Action’s PR gate substantially weaker than it looked. Recall is measured against a corpus written from the threat model rather than derived from the scanner’s own patterns, and is pinned by tests upstream.

Upgrading

Nothing to do if you pin @v1 — this release moves that tag for you.

If you pin an immutable tag, move to @v1.1.1. If you pin injection-scanner-version explicitly, set it to v0.1.0 to pick up the detection work.

See injection-scanner v0.1.0.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the creation of VIBGrate CLI command documentation, generating markdown files based on a template and JSON data. It simplifies the process of documenting command options, descriptions, and examples by rendering them directly from a JSON file structure. This is particularly useful for developers who need to maintain comprehensive documentation without manual intervention.

What’s Changed

Vibgrate CLI 2026.829.1

Released 2026-08-29

This release of the Vibgrate CLI includes important fixes and a new feature for improved architecture classification reporting. Users can expect enhanced accuracy in handling existing imports and better insights into unclassified files.

What changed

Changed

• vg scan now reports architecture classification coverage, detailing the share of source files with layers and identifying directories containing unclassified files.

Fixed

• vg review now correctly treats an existing import as occupancy, preventing failures due to typos in handlers that have already called a repository.
• VG Code on a local Spark model no longer stalls on search_symbols, and project AGENTS.md MCP names now run as search_code / graph tools.

Benchmarks

Two-arm benchmark of this release against 2026.826.1, interleaved on one runner against the pinned corpus (187 metrics compared).

2 regression(s) — published, not omitted:

• Token reduction vs baseline agent (equal success): 0.22 → 0.20 (-9.2%)
• Agent tokens with vg (comparable tasks, total): 562247 → 620882 (10.4%)

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.829.1

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

RustScript is a tool that allows users to write helper scripts in Rust and run them as shell scripts, with no compile step. It interprets a practical subset of the language and validates files with real rustc. The action supports features like functions, closures, structs, enums, patterns, loops, iterators, collections, and more. It also bridges the std library and some external crates for additional functionality.

What’s Changed

Full Changelog: https://github.com/VladasZ/rustscript/compare/v0.6.15...v0.6.16

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Apex Test List GitHub Action generates a list of tests that should be run, enabling users to automate and save time by skipping tests not relevant to their automated processes. It supports identifying tests using Apex annotations or a centralized metadata filter, simplifying the process of managing test dependencies in Salesforce environments. The action is available as both a Salesforce CLI plugin and a native GitHub Action for GitHub Actions users.

What’s Changed

1.14.2 (2026-08-29)

Bug Fixes

• deps: bump the salesforce group with 2 updates (#404) (acf6e10)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sigil automates the security auditing of AI agent code before it reaches working environments. It scans repositories, packages, and tools for malicious patterns, including intentional malicious code. The action fills a gap by implementing a quarantine-first approach to protect developers from inadvertently deploying potentially harmful code.

What’s Changed

• fix(release): build linux-arm64 natively on the arm runner; bump 1.3.2 (#144) (d518086)
• fix(release): vendor OpenSSL for aarch64-linux cross build; bump 1.3.1 (#143) (3c39f10)
• fix(api): add sentry-sdk to requirements.lock so the image actually has it (#142) (3058497)
• fix(deploy): roll container apps directly after image push (#141) (64e44b6)
• chore(NOM-616): mark brief complete, record DONE in progress.md (#129) (b504325)
• fix(deps): patch HIGH OSV advisories in dashboard and plugin lockfiles (#140) (dc7e683)
• fix(launch): remove Stripe IDs, true-up privacy claims, honest FP framing (#139) (61306ae)
• feat(docs): complete deployment and rollback runbooks (LAUNCH-005) (#134) (0f73627)
• fix(NOM-615): drain stale cursor before rollback in _MssqlStore.upsert (#135) (29557f9)
• feat(billing): test-mode Stripe webhook support (NOM-884 US-003) (#136) (6afd0e8)

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Nox is an open-source static analysis tool designed to identify and prevent security vulnerabilities in AI applications. It analyzes code offline and does not rely on APIs or external services, ensuring determinism and privacy. Nox can detect issues such as prompt injection, embedding leakage, agent over-privilege, and more, covering OWASP Top 10, MCP Top 10, and other security aspects related to AI applications. It provides a comprehensive inventory of all model invocations, auth environment variables, and endpoints for multi-language projects.

What’s Changed

Nox v1.31.0 (2026-08-29T10:59:16Z)

Language-agnostic security scanner with first-class AI application security.

Installation

macOS/Linux (Homebrew)

brew tap felixgeelhaar/tap
brew install nox

Direct Download

Download the appropriate archive for your platform from the assets below.

What’s Changed

Changelog

Features

• 7172305a11f8f00e0f8eb53cb46a50fd6ff80169 feat(intel): enrol an operator’s second factor from the CLI (#490)
• 703b105ec9841a067c16f49fd7bf46ab3615748c feat(vulnsource): superset model with verifiable non-suppression (#478)

Bug Fixes

• cc304dfef2de32c10369e080325a667cd8faa579 fix(cli): scan –help shows the flags that make it emit an SBOM (#492)

Refactoring

• 80d0f4a7526f57c7a18856c7438ac1e698ba8f83 refactor: move the shared kernel out to nox-core (#485)

Others

• f8dc9ac9adf3e09e56645e3ad0046f6d4195c770 build: warden gate for nox (#486)
• 8b00e6c4a3dcbb3ef9fcda5e32ad1812bf8f9d76 docs(changelog): 1.31.0, and let nox run its own secret check (#487)
• 34b37a31efe5eb37aeed015ec1ec3d394b8fe255 docs(changelog): the two help fixes that shipped in 1.31.0 (#495)
• 8e24156a6d9ef3f22fcd9a384342624f14bb3b1d docs(vex): describe –product as what OpenVEX actually takes (#491)

Full Changelog: https://github.com/nox-hq/nox/compare/v1.30.1...v1.31.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action nurkamol/seo-audit automates the SEO audit of a website by crawling its sitemap and checking every page for metadata, structured data, and other SEO issues that single-page graders might miss. It provides zero dependencies, is one command to use, and works in CI environments.

What’s Changed

Added

• The Raycast extension can ask Search Console. The engine has had --search-console since 1.21.0 and the extension never exposed it — a launcher showing every finding except the one number that is not a proxy for attention. A checkbox switches it on and a field names the property, the same shape the flag has: bare means the site being crawled, a value names a property.

  It does not ask for credentials. Getting them opens a browser and writes a file, which is a terminal errand rather than a control in a window — the same answer the macOS app gives. Without them the engine reports search-console-unconfigured and names what is missing, so this fails in the report rather than going quiet.

  Checked in both directions, because both failures are silent: a preference the code reads and the manifest never declares is a control nobody can reach, and one declared but never read is a control that does nothing.

• --reports lists the runs kept on this machine, and --reports 2026-08-01 lists what was kept since. The library was reachable from the macOS window and the served list and from nowhere on the command line, which is the one place the rest of this tool lives. /reports gains the same filter as a date control, and both call one function so the browser and the terminal cannot disagree about what “since” means.

  That function is not in src/library.mjs. That module opens files, so it imports node:fs, and the Worker showing the same list has no filesystem and would not have survived the import — src/kept.mjs is the pure half both sides need.

  A date it cannot read is refused rather than ignored, because listing every run when somebody asked for one week looks like an answer. A date that hides everything says how many it hid, since an empty list and an empty library read identically and only one of them means “widen the date”.

• A check that fires on every page is one thing to change, not one per section. Grouping by URL prefix is right when a check hits part of a site — that is the Shopify /products/ insight this project’s grouping was built on — and wrong when it hits all of it. gohugo.io produced 200 things to change and 104 of them were four checks that each applied to all 150 pages; canonical-missing alone arrived as twenty-six separate pieces of work, one per prefix, making the reader do the arithmetic that tells them it was site-wide. The same report is now 100 things to change, and those four read every page crawled (150), 1,695 links in.

  Exactly every page, never nearly. On 149 of 150 “every page” is a false sentence, and a report is only worth reading because its sentences are true. It costs no extra requests — the grouping was already computed.

Fixed

• “1 image(s) without width/height” was the most repeated finding title in a real report and read like a form nobody finished. Fifty of these across seven files now pick the right word. Zero is plural, which is the case that gets written wrong by reaching for n > 1.

• “1 links in” — the same defect one line further on, hardcoded rather than spelled (s), so no search for the first would have found it. It had been shipping for as long as reach has been reported, and no fixture ever had exactly one inbound link. Found by running the tool against a real site and reading the output, which is the only way anything here has ever been found.

• A PDF’s section headings could be left alone at the foot of a page, with the findings they introduce overleaf. A cause block listing every affected page can be most of a page tall, so a heading placed just before one had nowhere to go — the packer was greedy and had no keep-with-next rule. Three of the 53 pages in a gohugo.io export ended that way: Content 79, Indexability 26, Images 52.

  A heading now travels with the block it introduces. PDF.paginate came out of write to make it testable without a renderer, because the bug is arithmetic rather than drawing — including the cases that must not move a heading, and the one where a page holds nothing but headings and must not be emitted blank.

  It does not make the document shorter, and the page count is unchanged at 53. The white space above a page break comes from cause blocks being atomic and nearly page-tall; only splitting them would reclaim it, and a finding split across a page break is worse than a short page.

Installing on macOS

brew tap nurkamol/seo-audit https://github.com/nurkamol/seo-audit
brew trust nurkamol/seo-audit
brew install --cask seo-audit

Homebrew verifies the download against the checksum below and clears the quarantine flag for you, so the app opens the first time.

Downloading the zip instead? macOS may say “SEO Audit is damaged and can’t be opened.” It is not damaged. The app is ad-hoc signed rather than notarised — notarising needs a paid Apple Developer account this project does not have — and macOS refuses quarantined apps without a notarisation ticket. Check what you downloaded first:

shasum -a 256 seo-audit-1.37.0-macos.zip
# a350802df8f5f4bdf808909aab22a88d5313d1b3ffd50c543f41e8d8545fc2bb

Then, once it matches, clear the flag — no sudo needed:

xattr -dr com.apple.quarantine "/Applications/SEO Audit.app"

That is what right-click → Open does in the Finder, without the dialog. Apple Silicon, macOS Tahoe or newer.

Windows and Linux

The setup.exe, .deb and .AppImage below are attached by a separate job and may appear a few minutes after this release does.

The Windows installer is unsigned, so SmartScreen shows “Windows protected your PC” — More info → Run anyway. Same reason as macOS: a code-signing certificate is a paid, per-year thing this project does not have. The .AppImage needs chmod +x before it will run.

Check any of them first. A SHA256SUMS.txt covering every file here is attached alongside them, and the same checksums are listed at the end of these notes:

shasum -a 256 --ignore-missing -c SHA256SUMS.txt

Checksums

Verify a download before you wave a warning away. With SHA256SUMS.txt saved beside the file, in the same folder:

shasum -a 256 --ignore-missing -c SHA256SUMS.txt

8e4e289a09f72481a476afcd194af08395b22966f801510db8a75fd5f70e3fd2  SEO.Audit_1.37.0_amd64.AppImage
649b24e6c2434637061bc6e103f4c85c8f067da3bdad33f94baa29f12cbb1bcd  SEO.Audit_1.37.0_amd64.deb
a8b061f31ffd6f39a4492de1ab6d4a0dcbd882491eb44044a50836ab8691a8e4  SEO.Audit_1.37.0_x64-setup.exe
a350802df8f5f4bdf808909aab22a88d5313d1b3ffd50c543f41e8d8545fc2bb  seo-audit-1.37.0-macos.zip

The macOS line appears twice in these notes on purpose: once above, computed when the app was built, and once here, computed from what is actually attached. They should agree.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, @nyaomaru/changelog-bot, automates the creation of polished changelog entries based on commit history, pull request titles, and release notes. It can also use AI models to enhance the tone and clarity of the changelog. The action supports various options for customization, including LLM integration and PR readiness.

What’s Changed

What’s Changed

• chore: upgrade TypeScript 7 and dependencies by @nyaomaru in https://github.com/nyaomaru/changelog-bot/pull/184
• docs(changelog): 0.6.11 by @github-actions[bot] in https://github.com/nyaomaru/changelog-bot/pull/183
• refactor: separate changelog run phase by @nyaomaru in https://github.com/nyaomaru/changelog-bot/pull/185
• chore: update dependencies by @nyaomaru in https://github.com/nyaomaru/changelog-bot/pull/186
• Release: 0.6.12 by @github-actions[bot] in https://github.com/nyaomaru/changelog-bot/pull/187

Full Changelog: https://github.com/nyaomaru/changelog-bot/compare/v0.6.11...v0.6.12

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The setup-slipshow GitHub Action installs the slipshow presentation tool in the action environment, supporting macOS and Linux runners. It allows users to automate the installation of specific versions of slipshow using the version input parameter, defaulting to the latest version if omitted. The action is useful for CI/CD pipelines where slipshow presentations need to be compiled and published to GitHub Pages.

What’s Changed

First release.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SkillSeal is a CLI tool that lints, scores, and routing-tests SKILL.md files for best practices. It catches issues such as invalid frontmatter, vague descriptions, oversized files, dangling file references, hardcoded paths, OS-specific commands, and more before an agent can execute the skill.

What’s Changed

• fix(quality): don’t flag markdown links inside code spans as dangling
• fix(metadata): recognize Claude Code’s documented frontmatter extensions

Full Changelog: https://github.com/pespinel/SkillSeal/compare/v0.22.0...v0.23.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action checks that key development context files exist, are more than a placeholder, and fit within the targeted context window. It fails builds when specs do not meet these criteria, ensuring that coding agents have comprehensive context for their tasks. The action supports customizing spec files, paths, and other settings to suit different development workflows.

What’s Changed

First release.

Checks that your AI-agent spec files exist, are more than a stub, and fit inside the context window you are targeting.

• Verifies PRD.md, ARCHITECTURE.md and DESIGN.md by default, or any file list you pass
• Flags specs below a word-count threshold as stubs
• Estimates the combined token count and warns when you go over budget
• Writes a report to the job summary, and optionally comments on the pull request
• Fails the build on a missing or hollow spec, or set fail-on-missing to false to report only

Composite action, no Node build step.

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the onboarding of a new API repository by generating and executing test cases, enforcing contracts, and linking insights. It streamlines the process by creating a service account token and team ID using Postman Onboarding: Service Token, then feeding these outputs into this composite action. The action supports workspace creation, OpenAPI upload, collection generation, repository artifact sync, built-in smoke and contract runs, and optional Postman Insights linking.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/91
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/92
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/93
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/94
• chore(deps): pin Insights onboarding v2.2.1 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/95
• fix: consume Insights human-session normalization by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/96
• fix: consume repo-sync v2.2.0 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/97
• fix: expose mock environment and refresh Azure pins by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/98
• feat: pass mock visibility policy through to repo-sync by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/99
• chore: pin repo-sync v2.4.0 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/100
• fix: document private mock credential paths for consumers by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/101
• fix(deps): advance the bootstrap pin to v2.13.2 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/102
• fix(deps): advance bootstrap and repo-sync pins by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/103
• fix(deps): advance repo-sync pin to v2.6.7 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/104
• fix(deps): advance repo-sync pin to v2.6.8 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/105
• fix(deps): advance bootstrap pin to v2.13.7 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/106
• fix(deps): advance sibling pins to the latest released tags by @github-actions[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/107
• fix(ci): validate sibling pins without local checkouts by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/111
• feat(azure-devops): forward an explicit workspace squad id from the Windows template by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/112
• fix(release): harden composite pin and E2E releases by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/113
• fix(release): supersede stale aliases with pending cuts by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/114
• fix(release): wait for correlated E2E run names by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/115
• fix(release): keep pin ratchet synchronized by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/116
• fix(ci): preserve pin updater test fixtures by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/117
• fix(release): reconcile failed release completions by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/118
• fix(release): emit automated completion events by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/119
• fix(release): bound failed release recovery by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/120
• fix(release): hold auto release through E2E completion by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/121
• feat: expose spec-only onboarding scope by @sean-riney in https://github.com/postman-cs/postman-api-onboarding-action/pull/123
• docs: add service-account workspace permission preflight by @andrewpostymt in https://github.com/postman-cs/postman-api-onboarding-action/pull/122
• chore(deps-dev): bump the npm-minor-patch group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/108
• fix(ci): make cache pin assertion semantic by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/124
• chore(deps): bump actions/cache from 4.2.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/109
• feat: publish as @postman/onboarding-api with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/127
• fix(release): gate alias advance on npm publish output, not job result by @pavan-nelakuditi in https://github.com/postman-cs/postman-api-onboarding-action/pull/128
• fix(release): keep alias gates on publish job result by @pavan-nelakuditi in https://github.com/postman-cs/postman-api-onboarding-action/pull/129
• feat: add monorepo working-directory by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/130
• fix(release): require pull requests for pin advances by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/131
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/134
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/139
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/142
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/143
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/144
• fix(security): harden workflow trust boundaries by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/145
• fix(security): harden onboarding and release boundaries by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/149

New Contributors

• @github-actions[bot] made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/107
• @andrewpostymt made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/122
• @postman-suite-pin-bot[bot] made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/134

Full Changelog: https://github.com/postman-cs/postman-api-onboarding-action/compare/v2.1.8...v3.5.9

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Postman Onboarding: Azure Spec Discovery GitHub Action automates the discovery and export of API specifications from Azure services using only existing Azure credentials. It solves the problem of integrating Azure APIs into Postman onboarding by automatically discovering, ranking, and exporting OpenAPI or AsyncAPI specifications based on the provider’s access levels, environment variables, or committed .postman bindings. The action supports a variety of Azure providers and provides a six-tier narrowing pipeline to resolve API specs efficiently.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/15
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/18
• fix(test): assert the packaged version against package.json by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/19
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/20
• fix(release): fetch the tag parent before ancestry checks by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/21
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/22
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/23
• chore(deps): bump the actions group and follow the pins by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/24
• fix(ci): split dist parity and add Dependabot writeback by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/26
• fix(ci): use checkout v7 tag for writeback by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/28
• fix(ci): trigger writeback on dependabot branches by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/29
• fix(ci): pin writeback actions to immutable SHAs by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/30
• fix(ci): address Codex writeback feedback by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/31
• fix(ci): use ESM execSync and update permission test by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/32
• test(windows): preserve gate timing under contention by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/34
• feat: publish as @postman/onboarding-azure-spec-discovery with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/38
• fix(release): gate aliases on npm publish output and retry registry r… by @pavan-nelakuditi in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/39
• fix(release): size registry read-back window to measured propagation delay by @pavan-nelakuditi in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/40
• fix(release): keep alias gates on publish job result by @pavan-nelakuditi in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/41
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/42
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/44
• fix(security): harden spec processing boundaries by @jaredboynton in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/45

New Contributors

• @pavan-nelakuditi made their first contribution in https://github.com/postman-cs/postman-azure-spec-discovery-action/pull/39

Full Changelog: https://github.com/postman-cs/postman-azure-spec-discovery-action/compare/v1.3.5...v1.5.5

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the creation of a Postman workspace from an OpenAPI specification. It generates baseline, smoke, and contract collections with executable contract tests, covering various protocols like gRPC, SOAP, GraphQL, AsyncAPI, and MCP. The action is part of the Postman API Onboarding suite and uses credentials to access and interact with Postman’s services.

What’s Changed

What’s Changed

• chore: normalize multifile receipt after v2.21.2 by @github-actions[bot] in https://github.com/postman-cs/postman-bootstrap-action/pull/218
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/220
• chore: rebind multifile receipt to source by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/221
• fix(security): harden untrusted input boundaries by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/222
• fix(preview): stabilize concurrent collection markers by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/224
• fix(release): refresh E2E registry revision by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/225
• fix(import): eliminate rename finalization writes by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/226
• fix(collections): converge concurrent imports safely by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/227
• fix: prove atomic collection writes via sync receipts by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/228
• fix(collections): replace export preflight with sync snapshots by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/229
• fix(release): pin repo-sync populated snapshots by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/230

Full Changelog: https://github.com/postman-cs/postman-bootstrap-action/compare/v2.21.2...v2.21.10

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of exporting Postman collections, environments, and monitoring configurations into a repository. It helps streamline API development by integrating CI/CD pipelines, mocks, and monitors directly from Postman into the codebase. The action supports both monorepos and individual projects, and it can handle various synchronization modes to ensure that changes are managed efficiently.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/102
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/103
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/104
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/105
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/106
• chore(deps): bump the actions group and follow the pins by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/107
• Fix public mock validation before reuse by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/108
• feat: add manual mock validation environment by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/109
• fix: pin preview test branch context by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/110
• feat: support private mocks with runtime credential injection by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/111
• fix: bind private mock runtime auth in production by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/112
• feat: make private mock credentials self-service across CI, app, and runner by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/113
• fix: execute private mock auth hooks for segmented hosts by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/114
• fix: resolve templated private mock URLs before auth by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/115
• docs: make gate commands independently verifiable by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/134
• feat: publish as @postman/onboarding-repo-sync with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/140
• ci: install restricted dependencies without npm token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/141
• fix(deps): move private @postman platform packages to devDependencies by @pavan-nelakuditi in https://github.com/postman-cs/postman-repo-sync-action/pull/144
• feat: support monorepo working directories by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/145
• fix(release): repair stale rolling alias by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/146
• fix(release): use workflow-capable tag token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/147
• fix(release): use writable workflow token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/148
• fix(release): scope workflow token to repository by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/149
• fix: fail when artifact commit is rejected by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/150
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/151
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/153
• fix(security): harden secret persistence checks by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/154
• fix(security): harden repository and asset trust boundaries by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/155
• fix(gc): reconcile nameless preview collections by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/156
• fix(gc): replace export scans with inventory snapshot by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/157
• fix(release): pin authenticated E2E provider by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/158
• fix(release): let new cuts supersede stale evidence by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/159
• fix: avoid fresh collection export after mock creation by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/160
• fix(collections): use populated Sync snapshots by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/161

Full Changelog: https://github.com/postman-cs/postman-repo-sync-action/compare/v2.1.15...v2.10.9

• This action is used across all versions by 704 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the publishing process for Python projects using python-semantic-release. It uses semantic release, which helps manage project releases and changelogs automatically. This action integrates seamlessly with Python Semantic Release configurations to handle versioning and automated releases through a GitHub workflow.

What’s Changed

v10.6.2 (2026-08-29)

Build System

• deps: Bump python-semantic-release from v10.6.1 to v10.6.2 (#108, 6d89e2d)

Detailed Changes: v10.6.1…v10.6.2

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action “GitHub Project → Trello Sync” automates the process of keeping a Trello board up-to-date with issues from a specified GitHub Project. It creates one card per issue, updating its title, description, labels, and assignees based on the issue’s status within the project. The action supports different statuses in the GitHub Project to map to specific Trello lists (Todo, In Progress, Done).

What’s Changed

GitHub Project Trello Sync v1.0.0

First stable release.

Features

• Creates and updates Trello cards from GitHub Project Issues
• Synchronizes Todo, In Progress, In Review and Done statuses
• Synchronizes issue titles, descriptions, labels and mapped assignees
• Supports personal and organization-owned GitHub Projects
• Supports immediate Issue-event synchronization
• Supports scheduled reconciliation for Project status changes
• Requires no hosted server or third-party automation service

See the README for complete installation and configuration instructions.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

sbomlyze is a GitHub Action that compares two Software Bills of Materials (SBOMs) to detect changes and security issues. It helps identify tampered components and ensures compliance by scoring SBOMs based on NTIA, CISA, and BSI standards. The action provides an immutable SHA for comparison, enabling reliable drift detection without temporary files.

What’s Changed

Changelog

• db9182a06acbc58a66143978765f096a576f1f9c chore(main): release 0.5.3 (#52)
• 9662e6b13f556ac0efe50e472b5af32dcfe00f9a fix: sync action version metadata to v0.5.2 (#51)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints “Hello World” or “Hello” + a specified name to the log, automating the greeting process. It allows users to specify who they want to greet and displays the current time when greeted.

What’s Changed

Full Changelog: https://github.com/RivieraKid/gha-kaniko/compare/v1...v0.0.1

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Amazon Bedrock Agent to analyze files in a pull request and provide feedback tailored to specific requirements. It enables integration with Amazon Bedrock Knowledge Bases for context-aware insights, enhancing the analysis capabilities beyond code review.

What’s Changed

What’s Changed

• 21 closing pr should end agent session by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/27

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.8.0...v0.9.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI tool designed to automate the deployment process by translating developer intentions into optimized infrastructure configurations. It simplifies the setup of various cloud providers and services, reducing the need for manual configuration files and freeing up developers to focus on code instead of infrastructure management. With Sherpa, developers can write plain English prompts to deploy their applications across multiple clouds seamlessly, providing a transparent and cost-effective way to build and deploy applications globally.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the validation of Agent Skill bundles to ensure they are portable, have accurate versions and integrity, and detect any drift between the manifest and actual bundle contents. It helps teams track the version history and integrity of their skills across different platforms and sessions. The action ensures that a downloaded or shared bundle matches its recorded state before installing it, using SHA-256 hashes to catch tampering and accidental drift.

What’s Changed

Skill Provenance 6.2.0

This release adds portable, no-plugin verification and makes bundle identity easier to verify across GitHub, GitHub Pages, and agent-facing surfaces.

Highlights

• Added verify.sh, a zero-install bootstrap that pins and authenticates the canonical validator before execution.
• Added regression coverage for local and downloaded validator pins, tamper rejection, exit-code propagation, paths with spaces, and temporary-file cleanup.
• Expanded the evaluation suite to 41 core and 18 supplemental scenarios, 59 total.
• Separated immutable bundle tags (vX.Y.Z) from GuideCheck sidecar tags (guidecheck-X.Y.Z) throughout docs and release checks.
• Updated GitHub Pages, llms.txt, the assistant guide, agentic-surface inventory, roadmap, and project context for v6.2.0.
• Added a dated 2026 skill-versioning ecosystem observation with explicit reproduction boundaries.

Verification

• Canonical manifest validation passed for all 11 bundle files.
• Release-surface checks passed, including ZIP/source agreement and exact tag-family references.
• Validate bundle, CodeQL, and GitHub Pages workflows passed on commit 2a752319377327b5fd905c0b72f222ad4fb0cb26.
• skill-provenance.skill SHA-256: e0ebef495463492641a39b9fedb8b949c05f93b0b20265eef5e46433747622dc

Full details are in CHANGELOG.md.

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

ZIRAN is an AI-driven security tool designed to identify vulnerabilities in AI agents, including their capabilities and potential attack chains. It models agents as graph structures and conducts multi-phase campaigns to detect dangerous tool chains, execution-level side effects, and multi-phase exploits that conventional scanners might overlook. The tool uses machine learning to analyze the interactions between agent functions and tools, providing a comprehensive understanding of the agent’s behavior and vulnerabilities.

What’s Changed

0.38.0 (2026-08-29)

Features

• observability: add –log-format flag and bind campaign/phase/vector log context (de1acee)
• observability: configure structlog with json/text renderers and context helpers (8aef7f1)
• observability: metrics CLI flags, Prometheus scrape test, Grafana dashboard, docs (4d7294f)
• observability: OTel metrics export (Prometheus-compatible) (f71e238)
• observability: OTel metrics module + campaign/phase/attack instrumentation (cbe49a3)
• observability: structured JSON logging via structlog (4981da2)
• runtime: add FlushThrottle for incremental checkpoint writes (9596291)
• runtime: add on_vector_complete hook to PhaseExecutor (14c2752)
• runtime: incremental mid-phase checkpoint flush with –checkpoint-flush-interval (9fe7940)
• runtime: partial-phase checkpoint resume (6652f7f)
• runtime: rate-limiting and retry with exponential backoff for LLM provider calls (17def68)
• runtime: token-bucket limiter and retry-with-backoff for LLM calls (#281) (06d6ee3)
• runtime: wire rate-limited LLM client into factory and CLI (#281) (e8bfc60)

Bug Fixes

• alerting: never create a GitHub issue when dedup cannot be confirmed (5cda14d)
• alerting: never create a GitHub issue when dedup cannot be confirmed (0c6e89a)
• anthropic: detect AsyncAnthropic clients under anthropic 1.x (e33dd7c)
• observability: guard provider label read and ignore prometheus_client imports (55c96ea)
• security: bump mcp and json-repair to clear the audit gate (f264689)
• security: bump mcp and json-repair to clear the audit gate (#370 tier 2) (01c5fd7)
• security: bump pillow, pyasn1, bedrock-agentcore and websockets (56cc289)
• security: bump pillow, pyasn1, bedrock-agentcore and websockets (#370 tier 1) (665c7a1)
• security: clear new pip-audit advisories (aiohttp, cryptography, chromadb) (bae6690)
• security: clear remaining npm audit high-severity advisories in ui (f0b3768)
• security: clear remaining npm audit high-severity advisories in ui (e99c675), closes #373
• typing: ignore missing anthropic stubs when extra not installed (7e1249e)

What’s Changed

• chore: bump the python-dependencies group across 1 directory with 4 updates by @dependabot[bot] in https://github.com/taoq-ai/ziran/pull/355
• fix(security): bump pillow, pyasn1, bedrock-agentcore and websockets (#370 tier 1) by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/371
• fix(security): bump mcp and json-repair to clear the audit gate (#370 tier 2) by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/372
• chore: bump postcss from 8.5.15 to 8.5.23 in /ui by @dependabot[bot] in https://github.com/taoq-ai/ziran/pull/374
• chore: bump brace-expansion from 5.0.6 to 5.0.8 in /ui by @dependabot[bot] in https://github.com/taoq-ai/ziran/pull/375
• fix(security): clear remaining npm audit high-severity advisories in ui by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/388
• feat(runtime): rate-limiting and retry with exponential backoff for LLM provider calls by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/391
• chore(ui): apply frontend dependency group bumps with peer-conflict fixes by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/390
• feat(runtime): partial-phase checkpoint resume by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/402
• feat(observability): structured JSON logging via structlog by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/403
• ci: bump the actions group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/taoq-ai/ziran/pull/385
• chore(deps): allow anthropic 1.x and websockets 17.x with adapter compatibility fix by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/401
• chore: update structlog requirement from <26,>=24.1 to >=24.1,<27 in the python-dependencies group across 1 directory by @dependabot[bot] in https://github.com/taoq-ai/ziran/pull/407
• fix(alerting): never create a GitHub issue when dedup cannot be confirmed by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/377
• docs(specs): archive six delivered specs and correct their lifecycle status by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/369
• feat(observability): OTel metrics export (Prometheus-compatible) by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/406
• release: v0.38.0 — Production Scale by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/408
• chore(main): release 0.38.0 by @leoneperdigao in https://github.com/taoq-ai/ziran/pull/409

Full Changelog: https://github.com/taoq-ai/ziran/compare/v0.37.1...v0.38.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action gh-setup-wpenv automates setting up the @wordpress/env package for WordPress development in CI environments, enabling developers to build and test plugins and themes with Dockerized WordPress environments using Node.js. It provides a simple setup process by installing Node.js, global wp-env, and optionally starting the environment, making it easier to automate WordPress development tasks on GitHub Actions runners.

What’s Changed

Initial release

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Delivery Autopilot Runner GitHub Action automates the process of using an AI pipeline to plan, build, check, and self-heal code changes from a ticket. It requires an active subscription with Delivery Autopilot, which triggers the action to run based on signed instructions. The action checks out the repository only on GitHub’s runners and does not send any source code to Tekunda’s servers. Users can set up the action using a GitHub App or by manually configuring it in their workflow.

What’s Changed

Runner-dist synced from AutoPilot 3969f92a66fd. @v1 now points here.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the build process for Wails.io v3 projects. It installs GoLang and NodeJS, runs a build, and optionally uploads the results to GitHub and releases on tagged builds. The action supports various configurations such as platform selection, obfuscation, caching, and package upload options.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.9...v3-alpha.9

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, troaxx/sentral, helps diagnose and understand why a CI job failed by comparing the CI environment with your local one. It provides an honest confidence score and highlights any discrepancies between the two environments. The tool is particularly useful for Node.js and Python projects running on Ubuntu runners but does not yet support other platforms or configurations. To use it, add it to your workflow when a previous step fails, and optionally run it locally to generate a baseline for future comparisons.

What’s Changed

Full Changelog: https://github.com/Troaxx/sentral/commits/v1

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of building professional resumes using YAML files with the YAMLResume CLI. It allows users to build multiple resumes in a single step, customize build options such as skipping validation and PDF generation, outputs generated file paths, and seamlessly integrates with actions/upload-artifact. The action supports various workflows and provides detailed outputs for further processing.

What’s Changed

Features

• bump yamlresume from v0.15.3 to v0.16.0 (01b1810)

Full Changelog: https://github.com/yamlresume/action/compare/v0.15.3...v0.16.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that automates accessibility checks in your CI/CD pipeline. It enables companies to define an audience and percentage of WCAG guidelines to be met, allowing them to ensure their products are accessible without the need for extensive learning or external solutions. The action uses AI analysis to measure guidelines more abstractly and provides feedback to developers if their code does not meet accessibility requirements.

What’s Changed

• feat: add parse debug (229d26d)
• feat: json response schema (3d2a1fe)
• feat: update build (1646112)
• feat: update code (41bf74f)
• feat: update dist (5ffd432)
• feat: add githubToken in action (b20caef)
• feat: add logs for debug (a29f11d)
• fix: order (75ba53e)
• feat: add runController (7338606)
• feat: add service (34c25e0)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The zongou/run-ttyd-server GitHub Action starts a ttyd server, which allows users to connect to their terminal sessions over the internet using web browsers or SSH clients. This action helps automate the setup and management of a remote terminal service that can be accessed securely from any device with internet access.

What’s Changed

Full Changelog: https://github.com/zongou/run-ttyd-server/commits/0.0.8

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates React Native over-the-air updates using the Aether push SDK. It simplifies CI/CD processes by releasing updates to apps on iOS and Android platforms, providing options like customizing deployment channels, rollouts, and metadata. The action supports both release and release-react commands and handles various configuration inputs to streamline the update release process in a CI pipeline.

What’s Changed

0.4.1 (2026-08-28)

Bug Fixes

• action: treat a skipped duplicate as success (#30) (657d269)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Planizer is a deterministic static-analysis linter for SQL Server migrations that analyzes DDL, DML, and migration scripts to ensure they are safe, reversible, and perform within expected limits. It provides detailed findings with rules covering locking/blocking, rewrite vs metadata-only operations, reversibility, failure risk, and transaction hygiene, generating exit codes and SARIF reports for CI integration and GitHub code scanning.

What’s Changed

Planizer is a deterministic static-analysis linter for SQL Server (MSSQL) / T-SQL migrations. It reads plain .sql files ‚Äî no database connection required ‚Äî and answers the questions every migration review asks before a change reaches production:

Does it lock the table, and for how long? Does it rewrite the data or only metadata? Can it be rolled back? Will it fail on a re-run, or on our version and edition?

Every finding carries a rule id, a severity, a line:column, a one-sentence reason, a suggested fix (as SQL where possible), and the version/edition assumption it was produced under.

What’s in 0.1.0

53 rules in six families:

Also in this release

• Statements nested in IF / BEGIN…END / WHILE / TRY…CATCH are analyzed like top-level ones, with their batch and control-flow context.
• Four outputs: text, json, markdown (PR comments), sarif (GitHub code scanning) ‚Äî plus --sarif-file to write SARIF alongside any other output.
• A composite GitHub Action: uses: mustafaabasaran/planizer@v0.1.0.
• Suppressions (-- planizer:ignore RULE_ID reason) and per-directory .planizer.json config.
• Worst-case defaults: SQL Server 2019 Standard ‚Äî the edition where the expensive surprises live.

Why you can trust the rules

The behavior catalog behind the rules (operation √ó version √ó edition ‚Üí lock, data movement, reversibility) is not documentation-derived guesswork: a CI job measures every row against real SQL Server containers ‚Äî Developer and Express ‚Äî using transaction-log deltas, two-session blocking profiles and expected error numbers. The current state is 30/30 rows verified on Developer, 26/26 applicable rows on Express, zero contradictions. That harness has already corrected two claims this project got wrong.

The rules were also validated against a private corpus of 24 production repositories (8,507 migration files, 1.5M statements) over several false-positive rounds.

Install

As a GitHub Action (no install):

- uses: mustafaabasaran/planizer@v0.1.0
  with:
    path: migrations
    target-version: '2019'
    edition: standard
    fail-on: critical

As a .NET tool, from the package attached below (requires .NET 10; the tool rolls forward to newer majors):

dotnet tool install --global --add-source <folder-with-the-downloaded-nupkg> Planizer
planizer analyze migrations/ --output text

From source:

git clone https://github.com/mustafaabasaran/planizer && cd planizer
dotnet pack src/Planizer.Cli -c Release
dotnet tool install --global --add-source src/Planizer.Cli/nupkg Planizer

Scope and limitations

• SQL Server only for now; PostgreSQL is planned via a Squawk adapter.
• Offline analysis only. Rules that need schema or statistics report inconclusive rather than staying silent; snapshot and live modes are the next phase (“this migration takes an estimated X seconds and Y MB of log”).
• No LLM anywhere in the pipeline ‚Äî parser plus a verified behavior catalog, so the same input always produces the same report.
• Not yet on NuGet.org.

Docs

README · Rule pages · Roadmap · Design decisions

This is an early release — issues and rule suggestions are very welcome, especially false positives from real migrations.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action cherry-picks pull requests onto long-running backport branches and gates the original pull request and its backports with bidirectional checks. It allows users to specify allowed backport branches and gate check names, and provides options for cherry-picking behavior and label management. The action is useful for maintaining multiple stable release branches while ensuring that changes are backported correctly.

What’s Changed

Host-aware support for github.com, ghe.com (data residency), and GitHub Enterprise Server. Host URLs are sourced from the runner env vars (GITHUB_API_URL, GITHUB_GRAPHQL_URL, GITHUB_SERVER_URL) instead of hardcoding github.com.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action nurkamol/seo-audit crawls a website’s sitemap and checks each page for SEO, metadata, and structured data problems, offering zero dependencies and automatic execution within CI. It automates tasks that single-page graders typically miss, ensuring comprehensive site audits without manual intervention.

What’s Changed

Added

• A score out of 100, and the checks that passed to earn it. Every report now opens with a number, a grade and a ring: 81/100 (B), followed by the arithmetic that produced it. A run starts at 100 and pays for what is wrong with it — an error-level check costs 12 points, a warning 4, spread across the pages it is on — so what a check costs is exactly what fixing it is worth, and every piece of work in Start here now carries the points it returns.

  This project has refused a score everywhere else and the refusal still stands for the thing people usually mean by one: nothing here predicts a ranking, estimates traffic, or grades a site against its competitors. The weights are not a new judgement either — every check already carries a level, argued over check by check when it was written, and scripts/check-levels.mjs reads those levels back out of the source so a check promoted from warning to error cannot keep its old weight. A test asserts it on the machine of whoever changes one.

• What passed, and what was never checked. A report that only lists faults gives no way to tell a check that passed from one that never ran, and a missing finding reads exactly like a passing one. Both are now named: a Passing section listing every check the site cleared, in its own words (“Every page has an og:image”, not og-image-missing), and a Not checked section saying why the rest did not apply — no page carries an image, no redirect map was given, PageSpeed was not asked.

  A check that could not run is left out of the score entirely rather than counted as passed. A site with no images has not passed the alt-text check, and scoring it as though it had would hand out points for doing less.

• Errors and warnings first, notes after them. Findings used to arrive interleaved, and a note is “worth knowing, may be deliberate” — reading forty of them mixed into the faults is how a reader loses track of which is which. The terminal, the Markdown and the HTML now put what is wrong first and everything only worth knowing under its own heading, which says out loud that none of it costs the score anything.

• --write-schema <file> — the JSON-LD this site could add: WebSite, Organization and BreadcrumbList. Every schema generator on the internet asks you to type the answers in; this one refuses to ask, because the moment it asks it is no longer describing the site — and structured data that describes a site inaccurately is worse than none. It is a machine-readable claim the page does not support, which is a manual-action category at Google.

  So the rule is narrower than the rest of this project’s and it is absolute: every value emitted is a string this crawl read off this site. An organisation is named only when the site names itself in og:site_name, because the home page’s title with its tagline still attached is a claim about a company’s name.

  The first live run made the point better than any test: a breadcrumb built from <title> produced “Assets | Jekyll • Simple, blog-aware, static sites” as a step. A title is not a breadcrumb name. Now a step is named by the page’s <h1> when it has exactly one, or by what the site’s own navigation calls it when the links agree and the words are not “read more” — and by nothing else. Jekyll › Docs › Assets. On that site 142 pages were skipped rather than given a name invented from a slug.

  The refusal can be the good answer here, so it says which it is: a site that already declares everything this could write gets told exactly that, with the counts, rather than the same sentence a site with no evidence gets.

• --write-llms <file> — the llms.txt this site should have had. Sibling to --write-sitemap, on the same premise: the crawl has already read every page’s title, description, section and indexing directives, which is exactly what the file is made of. Every line is a string the site already serves — a page that gave us no description gets a line without one rather than a sentence somebody made up about it, and the H1 is the site’s own name for itself rather than a guess.

  It refuses for the same reasons the sitemap does, and the refusals matter more than the file: this is a document handed to an assistant as the authoritative summary of a site, and one built from a third of the site is worse than none because it looks complete. A truncated crawl writes nothing and names the run that would work.

  Reachable everywhere: the flag, llms-out=1 on the Worker, the macOS Export menu (which says why when the engine refused), the Raycast extension, and a write-llms input on the Action. --write-sitemap gained the Action input it should always have had while the wiring was open.

• Search Console now answers where you rank, and what for. The same connection, asked one more question — no second account, no scrape, no keyword provider, and no number that anybody here worked out.

  Every response Google has ever sent carried position, and it was being thrown away. It now travels with each finding, so a template on page two can be ordered ahead of one nobody has been shown, and the scope line says “12 pages, 4,300 impressions, best at position 6.4”.

  search-console-striking names the crawled pages at positions 11 to 20 — page two, where the click-through rate is roughly nothing and the ranking is already earned — with the query each is closest on, most-shown first. It is the only list in this tool that is an opportunity rather than a fault, and moving one of them up two places is usually less work than a new page.

  A live property found the part no test would have: Google returns HTTP 200 and zero query rows for a site under its anonymity threshold — 99 impressions over 28 days was well under. Silence there reads exactly like “this site is found for nothing”, so the report says which it is. The query call is best-effort besides: if it fails, the positions still stand.

• Which AI crawlers a site lets in. GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot, PerplexityBot, Google-Extended, Applebot-Extended, CCBot and five more, asked of robots.txt through the same robotsVerdict() every other robots question in this project goes through — so a rule this reads and a rule Google reads are the same rule, longer-Allow-wins included. Nothing is fetched that was not already being fetched and nothing is estimated: a site’s position on being read by the answer engines is already written down in a file it already serves.

  It is a note, and stays one. A publisher who does not want their work in a training set and says so has done the correct thing correctly, and a check that cries wolf gets the whole report ignored. What the finding adds is the distinction everybody gets wrong — an answering crawler fetches a page because somebody asked a question just now, so blocking it removes the site from that answer today; a training crawler does not, and blocking it changes nothing about being cited. And it says whether anybody actually decided: a block that arrives through User-agent: * rather than the agent’s own name is usually a CDN or plugin default nobody has seen.

  The one thing here that is a fault gets a warning: ai-crawler-conflict, a site serving llms.txt — a file whose only purpose is to tell an assistant what to read — while robots.txt turns that assistant away. The invitation never gets read, and unlike the block itself, nobody chose it.

  New area, AI & answer engines, which llms-missing moves into: it is addressed to assistants rather than to crawlers and belongs beside the agents that read it.

• /checks, served beside /options: every scored check with its weight, its area and what it says when it passes. “What does this thing actually check” is now a question with a fetchable answer rather than one that needs a source file read.

Changed

• The CSV is the whole checklist, not only the faults. A points column carries what each failing check is taking off the score, so a spreadsheet sorts by what fixing something is worth rather than only by how often it occurs. Checks that passed arrive as rows at level pass, and ones that did not apply as not-checked with the reason in detail.

  Additive on purpose: points is appended after detail rather than put beside indexable where it reads better, so every column keeps the index it has had since the file shipped. Anything filtering on error, warn or info is untouched.

• The portfolio table has a score column, and orders by it where every run has one. “Which of my twenty sites is worst” is the only question a portfolio exists to answer, and counting errors weighs a site-wide failure the same as a warning on one page of four hundred. A run that never answered prints a dash, never a zero.

Fixed

• <title> and every heading arrived with their HTML entities undecoded. attr() has decoded since it was written, so meta descriptions were always fine — but a title and an <h1> are element text and went through none of it. So Widgets & Co was the title in the terminal, in the CSV, in the JSON, and in the length title-long measures against what Google shows, where it was five characters too long. Hexadecimal numeric references were not handled at all, and ’ is what a CMS emits for the apostrophe in Widget’s.

  Found by generating an llms.txt for a real site and reading the first line of it — not by the test suite, which is the usual way round here.

• Every export dropped the score except the two that were written first. It reached the terminal and the HTML and stopped there: the CSV had no column for it, the portfolio had no column for it, the Raycast extension’s exports did not pass it to the writers, and the PDF the macOS app draws itself did not know about it.

  Worst of the four: the window re-encoded the report from its own Swift models on the way to /render, which silently dropped every field it had not been taught about — so an HTML report exported from the window lost the score panel the window itself was showing. The JSON export has written the engine’s bytes verbatim since it shipped, with a comment saying exactly why; the other three formats now do the same. There is a test per writer.

• --against never ignored hosts, though it said it did. Comparing a rebuild against the site it replaces is the same question as comparing yesterday against today — did this change anything — but diff() keys a finding on its whole URL, and every URL on new.example.com differs from its twin on example.com by the host. The flag has passed { ignoreHost: true } since it shipped and diff() has never read a third argument, so the answer came back with every finding fixed and every finding added at once, which is no answer at all.

  Two runs of different origins are now matched by path — trailing slash ignored, query kept, since /search?q=a and /search?q=b are two pages on any host. It decides for itself when it is not told, so the hosted /diff and the macOS window get it without either having to know the rule.

• The macOS window could only compare two runs of the same site. Its Compare menu filtered the library by host, so a rebuild kept beside the site it replaces greyed the button out — the exact comparison somebody keeps two reports around to make. Runs of other sites are now offered under their own heading, and the sheet says it matched by path when the hosts differ.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Odin Scan GitHub Action is an AI-powered tool that performs security analysis on CosmWasm, Solana, and EVM projects. It integrates with GitHub to detect vulnerabilities before they reach production through SARIF uploads and inline comments. The action supports automatic platform detection or explicit specification, offers configurable thresholds for severity levels, and allows comment-triggered scans.

What’s Changed

🎉 Initial Release

AI-powered smart contract security analysis, now integrated directly into your GitHub workflow.

✨ Features

Multi-Platform Support

• CosmWasm - Rust-based smart contracts for Cosmos SDK
• Solana (SVM) - Anchor and native Solana programs
• EVM - Solidity and Vyper contracts
• Auto-detection - Automatically identifies platform from your repo

GitHub Integration

• Code Scanning - SARIF upload for native security alerts in the Security tab
• PR Comments - Severity summary and top findings posted directly on pull requests
• Inline Annotations - Critical/high findings appear as errors, medium/low as warnings on diffs
• Artifact Upload - Full JSON report available as workflow artifact

Customization

• Severity Thresholds - Fail builds at critical, high, medium, or low severity
• Platform Override - Force specific platform detection when auto-detect isn’t enough
• Timeout Control - Configurable analysis timeout (default: 30 minutes)
• Flexible Triggers - Run on push, PR, schedule, or manual dispatch

🚀 Quick Start

name: Security Scan
'on':
  pull_request:
    branches:
      - main
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: odin-scan/odin-scan-action@v1
        with:
          api-key: '${{ secrets.ODIN_SCAN_API_KEY }}'

📋 Requirements

• Odin Scan Pro subscription - Required for API access
• API Key - Generate at https://odinscan.ai/dashboard/settings
• GitHub Permissions - contents: read, security-events: write (for SARIF), pull-requests: write (for comments)

🔧 Configuration

All Inputs

| ┌────────────────────┬─────────────────────┬──────────────────────────────────────────────┐ | | │ Input │ Default │ Description │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ api-key │ Required │ Your Odin Scan API key (odin_sk_*) │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ platform │ auto │ Target platform: auto, cosmwasm, solana, evm │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ severity-threshold │ high │ Fail at: critical, high, medium, low, none │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ fail-on-findings │ true │ Whether to fail workflow on findings │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ comment-on-pr │ true │ Post summary comment on PRs │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ upload-sarif │ true │ Upload SARIF to Code Scanning │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ upload-artifact │ true │ Upload full report as artifact │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ timeout │ 1800 │ Max analysis wait time (seconds) │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ github-token │ ${{ github.token }} │ Token for PR comments and SARIF │ | | └────────────────────┴─────────────────────┴──────────────────────────────────────────────┘ |

All Outputs

• analysis-id - Unique analysis identifier
• status - Analysis status (completed, failed)
• total-findings - Total number of findings
• critical-count, high-count, medium-count, low-count - Counts by severity
• report-url - Link to full report on Odin Scan
• sarif-file - Path to generated SARIF file

📝 Example Workflows

Basic (Auto-detect)

  - uses: odin-scan/odin-scan-action@v1
    with:
      api-key: ${{ secrets.ODIN_SCAN_API_KEY }}

EVM with Medium Threshold

  - uses: odin-scan/odin-scan-action@v1
    with:
      api-key: ${{ secrets.ODIN_SCAN_API_KEY }}
      platform: evm
      severity-threshold: medium

Only on Solidity Changes

on:
  pull_request:
    paths:
      - '**.sol'
      - foundry.toml

🔒 Security & Privacy

• All API communication over HTTPS (TLS 1.2+)
• API keys automatically masked in logs
• No data stored by the action (stateless)
• See https://github.com/Odin-Scan/odin-scan-action/blob/main/PRIVACY.md for details

📖 Documentation

• Action README - https://github.com/Odin-Scan/odin-scan-action
• Odin Scan Docs - https://docs.odinscan.ai
• Get API Key - https://app.odinscan.ai/settings

🐛 Known Limitations

• Private repos - Requires github-token with repo access
• Large repos - May need increased timeout for complex codebases
• Code Scanning - Requires GitHub Advanced Security on private repos

🙏 Support

• Issues - https://github.com/Odin-Scan/odin-scan-action/issues
• Email - support@odinscan.ai
• Docs - https://docs.odinscan.ai

Full Changelog: https://github.com/Odin-Scan/odin-scan-action/commits/v1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the synchronization of markdown files in a repository with Confluence pages, using a YAML manifest file to manage page IDs and handle auto-creation. It supports Markdown features like headings, lists, tables, and inline code. The action triggers on push events and performs a one-way sync, converting Markdown to Confluence Storage Format and managing page identity through the manifest. If conflicts occur with manual edits, it logs warnings or fails the build.

What’s Changed

Fixes

• Manifest write-back is now per-page, not per-batch. Previously, an unexpected error on one file in a batch (e.g. a non-UTF8 file) could crash the whole run before the manifest was saved, losing an earlier file’s already-created page_id and causing a duplicate page on the next run. The manifest is now saved after every file.
• create_page no longer retries on 5xx/429. A lost response after Confluence had already created the page could previously cause a retried request to create a second, duplicate page. Page creation now fails fast instead of silently duplicating.
• space_id is validated at manifest load time. A page with no resolvable space_id (its own override or defaults.space_id) now fails clearly before any API calls, instead of a confusing error deep inside a network request.
• Ordered list start= is preserved. 3. foo / 4. bar no longer silently renders as 1, 2 in Confluence.
• Table column alignment is preserved. :---, ---:, and :---: now carry through to Confluence instead of always rendering left-aligned.
• Raw HTML now actually raises a build error, as documented. ⚠️ Potentially build-affecting: HtmlSpan/HtmlBlock were never registered with the Markdown parser, so raw HTML previously fell through silently as escaped literal text instead of failing the build per the README’s documented behaviour. If your docs contain raw HTML tags, this release will now correctly fail those builds – convert them to Markdown syntax.
• Manifest comments now survive automated write-back. confluence-manifest.yaml is written via a comment-preserving YAML round-trip (ruamel.yaml, new dependency) instead of plain PyYAML, which silently deleted all comments on every automated commit.

Docs

• docs/MANIFEST_SPEC.md corrected: space_id is always a Confluence space key, never the numeric Cloud space ID.

Also in this release (since v1.0.2)

• confluence-publisher@v1 now resolves correctly (major tag moved forward).

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

GSC is a GitHub Action that performs SAST (Static Application Security Testing) and security audits on code repositories, providing features like PoC auto-generation, proof-of-fix, self-healing CI, and LLM-verification. It helps developers identify and fix vulnerabilities in their projects efficiently, and offers BYO-LLM support to customize the risk assessment process.

What’s Changed

Self-learning code audit: 50 detectors, SQLi/XSS/NoSQL, PoC generation, BYO-LLM revalidation

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the onboarding process for new API repositories, using Postman’s API to bootstrap a workspace, upload an OpenAPI specification, generate collections and tests, sync artifacts to a repository, and run built-in smoke and contract checks. It provides a comprehensive solution that includes automated testing and CI/CD integration, ensuring that the repository adheres to standards-grounded tests and contract assertions.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/91
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/92
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/93
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/94
• chore(deps): pin Insights onboarding v2.2.1 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/95
• fix: consume Insights human-session normalization by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/96
• fix: consume repo-sync v2.2.0 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/97
• fix: expose mock environment and refresh Azure pins by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/98
• feat: pass mock visibility policy through to repo-sync by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/99
• chore: pin repo-sync v2.4.0 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/100
• fix: document private mock credential paths for consumers by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/101
• fix(deps): advance the bootstrap pin to v2.13.2 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/102
• fix(deps): advance bootstrap and repo-sync pins by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/103
• fix(deps): advance repo-sync pin to v2.6.7 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/104
• fix(deps): advance repo-sync pin to v2.6.8 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/105
• fix(deps): advance bootstrap pin to v2.13.7 by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/106
• fix(deps): advance sibling pins to the latest released tags by @github-actions[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/107
• fix(ci): validate sibling pins without local checkouts by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/111
• feat(azure-devops): forward an explicit workspace squad id from the Windows template by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/112
• fix(release): harden composite pin and E2E releases by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/113
• fix(release): supersede stale aliases with pending cuts by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/114
• fix(release): wait for correlated E2E run names by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/115
• fix(release): keep pin ratchet synchronized by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/116
• fix(ci): preserve pin updater test fixtures by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/117
• fix(release): reconcile failed release completions by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/118
• fix(release): emit automated completion events by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/119
• fix(release): bound failed release recovery by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/120
• fix(release): hold auto release through E2E completion by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/121
• feat: expose spec-only onboarding scope by @sean-riney in https://github.com/postman-cs/postman-api-onboarding-action/pull/123
• docs: add service-account workspace permission preflight by @andrewpostymt in https://github.com/postman-cs/postman-api-onboarding-action/pull/122
• chore(deps-dev): bump the npm-minor-patch group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/108
• fix(ci): make cache pin assertion semantic by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/124
• chore(deps): bump actions/cache from 4.2.0 to 6.1.0 in the actions group across 1 directory by @dependabot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/109
• feat: publish as @postman/onboarding-api with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/127
• fix(release): gate alias advance on npm publish output, not job result by @pavan-nelakuditi in https://github.com/postman-cs/postman-api-onboarding-action/pull/128
• fix(release): keep alias gates on publish job result by @pavan-nelakuditi in https://github.com/postman-cs/postman-api-onboarding-action/pull/129
• feat: add monorepo working-directory by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/130
• fix(release): require pull requests for pin advances by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/131
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/134
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-api-onboarding-action/pull/139
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/142
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/143
• fix(deps): advance sibling pins to the latest released tags by @postman-suite-pin-bot[bot] in https://github.com/postman-cs/postman-api-onboarding-action/pull/144

New Contributors

• @github-actions[bot] made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/107
• @andrewpostymt made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/122
• @postman-suite-pin-bot[bot] made their first contribution in https://github.com/postman-cs/postman-api-onboarding-action/pull/134

Full Changelog: https://github.com/postman-cs/postman-api-onboarding-action/compare/v2.1.8...v3.5.7

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Postman Onboarding: AWS Spec Discovery action automates the discovery and export of API specs from AWS services using your existing credentials. It solves problems by automatically resolving and exporting specs from AWS, reducing the need for manual configuration and providing a source-of-truth for Postman onboarding. The action is part of the Postman API Onboarding suite and supports various providers, ensuring seamless integration with other Postman actions.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/53
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/54
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/55
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/56
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/57
• chore(deps): bump the actions group and follow the pins by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/58
• fix(ci): split dist parity and add Dependabot writeback by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/62
• fix(ci): use checkout v7 tag for writeback by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/64
• fix(ci): trigger writeback on dependabot branches by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/65
• fix(ci): pin writeback actions to immutable SHAs by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/66
• fix(ci): address Codex writeback feedback by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/67
• fix(ci): use ESM execSync and update permission test by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/68
• docs: make gate commands independently verifiable by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/69
• feat: publish as @postman/onboarding-aws-spec-discovery with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/73
• fix(release): tolerate npm registry propagation by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/74
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/75
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/77
• fix(security): harden untrusted spec processing by @jaredboynton in https://github.com/postman-cs/postman-aws-spec-discovery-action/pull/78

Full Changelog: https://github.com/postman-cs/postman-aws-spec-discovery-action/compare/v3.1.4...v3.3.3

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Postman Onboarding: Workspace Bootstrap GitHub Action automates the process of provisioning a Postman workspace from an OpenAPI specification, generating baseline, smoke, and contract collections with executable tests. This action simplifies the setup of testing environments by automating the import, linting, and testing of API specifications. It supports various protocols and provides comprehensive enforcement layers to ensure test accuracy and reliability.

What’s Changed

What’s Changed

• chore: normalize multifile receipt after v2.21.2 by @github-actions[bot] in https://github.com/postman-cs/postman-bootstrap-action/pull/218
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/220
• chore: rebind multifile receipt to source by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/221
• fix(security): harden untrusted input boundaries by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/222
• fix(preview): stabilize concurrent collection markers by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/224
• fix(release): refresh E2E registry revision by @jaredboynton in https://github.com/postman-cs/postman-bootstrap-action/pull/225

Full Changelog: https://github.com/postman-cs/postman-bootstrap-action/compare/v2.21.2...v2.21.5

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the linking of services discovered by Postman Insights to a user’s Postman workspace and environment, ensuring that every service lands in the catalog with a collection, repo link, and live telemetry. It supports linking to specific workspaces and environments and requires human-user credentials for authentication. The action does not deploy any resources but focuses on updating existing ones after deployment.

What’s Changed

What’s Changed

• ci(release): port automatic release cut from bootstrap by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/66
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/67
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/68
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/69
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/70
• feat: ship self-contained SEA binary (no npm/Node) by @mmorales-post in https://github.com/postman-cs/postman-insights-onboarding-action/pull/64
• fix: accept live human Insights sessions by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/71
• fix(ci): split dist parity and add Dependabot writeback by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/76
• fix(ci): use checkout v7 tag for writeback by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/78
• fix(ci): trigger writeback on dependabot branches by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/79
• fix(ci): pin writeback actions to immutable SHAs by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/80
• fix(ci): address Codex writeback feedback by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/81
• fix(ci): use ESM execSync and update permission test by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/82
• fix(ci): keep gate logs outside the checkout by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/83
• feat: publish as @postman/onboarding-insights with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/87
• fix(release): tolerate npm registry propagation by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/88
• fix(release): recover workflow-bearing aliases by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/89
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/90
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/92
• fix(security): bind trusted runtime and artifact inputs by @jaredboynton in https://github.com/postman-cs/postman-insights-onboarding-action/pull/93

New Contributors

• @mmorales-post made their first contribution in https://github.com/postman-cs/postman-insights-onboarding-action/pull/64

Full Changelog: https://github.com/postman-cs/postman-insights-onboarding-action/compare/v2.1.8...v2.5.2

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Postman Onboarding: Repo Sync GitHub Action exports Postman collections and environments into a repository and automates CI, mocking, and monitoring. It solves the problem of maintaining API documentation and infrastructure in sync with changes to Postman projects, providing a streamlined approach to integrating APIs into development workflows. The action supports various input configurations, including workspace-specific IDs, baseline collections, and runtime URLs, making it versatile for different use cases.

What’s Changed

What’s Changed

• ci(release): port automatic release cut by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/102
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/103
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/104
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/105
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/106
• chore(deps): bump the actions group and follow the pins by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/107
• Fix public mock validation before reuse by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/108
• feat: add manual mock validation environment by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/109
• fix: pin preview test branch context by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/110
• feat: support private mocks with runtime credential injection by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/111
• fix: bind private mock runtime auth in production by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/112
• feat: make private mock credentials self-service across CI, app, and runner by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/113
• fix: execute private mock auth hooks for segmented hosts by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/114
• fix: resolve templated private mock URLs before auth by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/115
• docs: make gate commands independently verifiable by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/134
• feat: publish as @postman/onboarding-repo-sync with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/140
• ci: install restricted dependencies without npm token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/141
• fix(deps): move private @postman platform packages to devDependencies by @pavan-nelakuditi in https://github.com/postman-cs/postman-repo-sync-action/pull/144
• feat: support monorepo working directories by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/145
• fix(release): repair stale rolling alias by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/146
• fix(release): use workflow-capable tag token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/147
• fix(release): use writable workflow token by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/148
• fix(release): scope workflow token to repository by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/149
• fix: fail when artifact commit is rejected by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/150
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/151
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/153
• fix(security): harden secret persistence checks by @jaredboynton in https://github.com/postman-cs/postman-repo-sync-action/pull/154

Full Changelog: https://github.com/postman-cs/postman-repo-sync-action/compare/v2.1.15...v2.10.3

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Postman Onboarding: Smoke Flow action reshapes a generated Postman Smoke collection into an ordered journey, automatically determining the flow path using postman/flow.yaml or deriving it from an OpenAPI spec if it’s absent. It supports auto-curation of a manifest and runtime auth injection for OAuth2 and API keys. The composite action is part of the larger Postman API Onboarding suite and requires inputs such as project name, workspace ID, spec ID, Smoke collection ID, flow path, spec path, access token, and region.

What’s Changed

What’s Changed

• ci(release): cut immutable tags only after gates pass on main by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/57
• fix(release): recover unpublished immutable tags by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/58
• chore(deps): take patched transitive versions from npm audit by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/59
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/60
• fix(release): reconcile incomplete cuts before new tags by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/61
• docs: make gate commands independently verifiable by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/76
• feat: publish as @postman/onboarding-smoke-flow with best-effort npm publish by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/80
• feat: support monorepo working directories by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/81
• fix(release): tolerate npm registry propagation by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/82
• fix: activate CLI working directory once by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/83
• fix(deps): migrate automation core scope by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/84
• chore: ignore local plans by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/86
• fix: harden untrusted flow inputs by @jaredboynton in https://github.com/postman-cs/postman-smoke-flow-action/pull/87

Full Changelog: https://github.com/postman-cs/postman-smoke-flow-action/compare/v2.1.7...v3.7.4

• This action is used across all versions by 5 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action action-semantic-release is a tool for automating the release process using semantic versioning. It simplifies the workflow by handling the generation of release notes, tagging, and publishing on various platforms like npm, PyPI, or Docker Hub. This action helps developers streamline their release process, ensuring that versions are correctly managed according to semver rules.

What’s Changed

3.21.0 (2026-08-28)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the management of Xcode Swift Package Manager (SPM) dependencies. It resolves all SPM packages, detects changes, and generates an HTML dependency report with version diffs, repo links, and type badges. Optionally, it outputs a CycloneDX SBOM for machine-readable bill of materials and classifies packages as App or Development automatically. The action is useful for maintaining consistent and secure dependencies across projects.

What’s Changed

• Merge pull request #84 from quver/release/v4.0.3 (d209aee)
• release: v4.0.3 (b2736c3)
• Merge pull request #83 from quver/dependabot/npm_and_yarn/dev-dependencies-2534e80e37 (11f366b)
• build(deps-dev): bump the dev-dependencies group with 5 updates (01a177a)
• Merge pull request #82 from quver/dependabot/npm_and_yarn/dev-dependencies-dcfd69fc34 (493cc51)
• build(deps-dev): bump globals in the dev-dependencies group (e1a7ae8)
• Merge pull request #81 from quver/release/v4.0.2 (f0aa022)
• release: v4.0.2 (3767881)
• Merge pull request #80 from quver/dependabot/npm_and_yarn/dev-dependencies-e1dac8ee3a (82acb6b)
• build(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates (84c588e)

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

sbomlyze is an open-source GitHub Action that compares Software Bills of Materials (SBOMs) to detect changes between builds, versions, or releases. It uses component hashes instead of version strings, which helps in identifying package swaps without bumping the version number. This tool is particularly useful for security teams to ensure integrity and compliance in their software supply chain processes.

What’s Changed

Changelog

• fdb5e2b99b7d7d162a0c269c7cd6c2da2f48b9c7 update pkgs (#50)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The AI Shipcheck action automates the security scanning of Node.js applications to identify potential vulnerabilities such as hardcoded secrets, insecure routes, and open redirects. It helps developers ensure their application is secure before deployment by running static code analysis locally.

What’s Changed

AI Shipcheck tells you whether a JavaScript or TypeScript project is ready to deploy, with evidence for every finding. It runs locally: no signup, no API key, and nothing from the scanned repository is executed or uploaded.

npx ai-shipcheck .

- uses: sinceaihq/ai-shipcheck@v1
  with:
    fail-on: critical
    min-score: 80

See the changelog for everything in this release, and corpus/TRIAGE.md for how the rules were validated against twenty real public repositories.

This is static analysis of source code. It is not a security certification, and a clean report means the checks it knows how to make found nothing — not that the code is correct. The limitations are documented.

• This action is used across all versions by 2 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Smyklot is a GitHub App that automates pull request approvals and merges based on the repository’s CODEOWNERS file. It supports multiple command formats, allows for explicit merge methods, provides reaction-based commands, and includes features for cleanup and approval deduplication. The action minimizes permissions and can be run as a GitHub Action or as a webhook service covering all repositories where it is installed.

What’s Changed

1.50.0 (2026-08-28)

Features

• sync: configure preserve-first file formatting (#333) (c88a4cc)

Bug Fixes

• deps: update github.com/tailscale/hujson digest to b80ff77 (#334) (f21349c)
• panel: stabilize frontend release validation (#336) (bb2ab68)

Smyklot v1.50.0

Docker image: ghcr.io/smykla-skalski/smyklot:1.50.0

Changelog

• bb9b3b5115be814fa580487c07403b60413302cd chore(release): bump version to 1.50.0
• bb2ab68332b7bd1118ce71524fa61464c373cffc fix(panel): stabilize frontend release validation (#336)
• 1e386a78a8a5776418cd64d17196d1898e10c627 chore(deps): update dependency @tanstack/svelte-query to v6.1.44 (#335)
• f21349cb7c6b7a5d11b2886d33040cdb57c1a521 fix(deps): update github.com/tailscale/hujson digest to b80ff77 (#334)
• c88a4cc5cd33a492988809141defb4998679657f feat(sync): configure preserve-first file formatting (#333)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Graceful Boundaries is an open specification that grades API responses based on their conformance to a set of standards. It provides proactive discovery, structured refusal, and constructive guidance to help autonomous agents understand and act on operational limits efficiently. The action automates the process of checking response codes and providing actionable feedback for improving API reliability.

What’s Changed

Graceful Boundaries 1.5.4

Graceful Boundaries 1.5.4 is a maintenance and adoption-tooling release. It does not change the normative conformance levels, required fields, or response classes.

Highlights

• The checker now reports the single smallest change that raises a service’s confirmed conformance level, with matching human-readable and JSON output.
• The README leads with the dependency-free npx check and CI integration, includes verified Level 4 output, and makes RFC 9457 compatibility visible at the first specification mention.
• Adopter registration now starts with a URL-only issue. Validation remains evidence-led, and unanswered directory proposals remain gated on maintainer confirmation.
• The RFC 9457 profile, comparative caller benchmark protocol, roadmap, conformance counts, and root-skill layout records are reconciled with current repository behavior.
• SECURITY-AUDIT.md adds concrete safer and unsafe examples for SC-2 through SC-6.
• The published limits schema no longer reserves the roadmap-only agentCapable field.
• ClawHub preparation now produces a deterministic three-file audit-only package from build/clawhub-graceful-boundaries/; repository-root packaging fails closed to SKILL.md, and the card reflects the repository’s actual license split.

Verification

• 270 offline tests pass.
• The offline search contract passes with zero defects.
• The npm tarball installs in a clean consumer directory and its installed CLI confirms https://siteline.to/ at Level 4.
• The generated ClawHub bundle contains only SKILL.md, MANIFEST.yaml, and skill-card.md.

Full details are in CHANGELOG.md.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Agent Vigil is a tool that ensures the integrity and accuracy of code changes by verifying them against predefined rules. It checks if a proposed commit or pull request complies with expected behavior, including ensuring that all necessary tests are run and that no unintended changes have been made to other parts of the codebase. The action can be used to ensure that tasks are completed correctly before they are merged into a repository.

What’s Changed

Agent Vigil v0.22.0 makes the first useful result visible in one command.

• vigil protect now chooses an immutable reviewed Action commit when no SHA is supplied.
• The first run reports PREPARED — not active yet instead of showing expected pre-commit doctor failures as if setup were broken.
• A disposable differential rehearsal proves that a real regression test fails on old code and passes on proposed code, while a planted weak test that passes on both versions is blocked.
• vigil check <public-pr-url> uses the exact commit embedded in the release package; a conflicting --tool-ref is rejected.
• Public distribution records now keep GitHub and npm publication states separate.

Exact main validation: https://github.com/sulmusic2-star/agent-vigil/actions/runs/33213167172

The attached package is built from commit 5925e8bcbaf97f08c8c840252f486e96bf3f9775. Its SHA-256 is recorded in the attached checksum file. This GitHub release does not by itself prove npm or Marketplace publication, outside adoption, payment, or revenue.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Delivery Autopilot to automate the development process by taking a ticket from your tracker all the way to a reviewed pull request. It automates code writing, quality checks, and PR management using an AI pipeline within your own GitHub Actions environment. The key capabilities include checking out repository content, running AI coding, performing quality checks, creating pull requests, reporting status, and verifying signed instructions.

What’s Changed

Runner-dist synced from AutoPilot 6b136b6fb492. @v1 now points here.

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of running Tessl Code Review on pull requests in a repository and publishing the results as native comments in the Pull Request. It handles various tasks such as checking out the head of the pull request, setting up the Tessl CLI, running reviews, managing stale branches, ensuring idempotency, sending failure notices, and archiving result artifacts. The action provides flexibility to configure profiles and lenses for specific checks, and it supports posting reviews under a different identity if needed.

What’s Changed

Pin the Action to this release’s commit SHA:

uses: tesslio/code-review-action@68497531d3454174dfca5cd25627757b881f2b66 # v1.5.0

This revision installs the current Tessl CLI release. Set the cli-version input to pin an exact one.

The major tag now points here, so a caller on that tag is on this revision.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The LoadBearing GitHub Action automates the detection of architectural decisions in pull requests by analyzing code changes and raising alerts if they introduce significant changes that deserve human attention before merging. It uses an AI coding agent to explain detected architectural impacts, ensuring teams are aware of potential risks or dependencies introduced by new features or changes.

What’s Changed

What is LoadBearing?

LoadBearing is a local-first, deterministic architecture gate for pull requests. It flags PRs that introduce a consequential architectural decision - a new persistent schema, a new deployable, a public contract change, a new external dependency, or a new infrastructure resource - and can require an explicit human sign-off before merge, only when one of those actually happens. No account, no hosted service, no telemetry, no LLM in the loop for 0.1. Every finding is backed by evidence from your diff, not a black-box score.

What’s in this release

Five deterministic detectors, each with its own default severity and documented false positives/negatives:

Three ways to run it, same engine underneath:

• CLI (@loadbearing/cli) - review, init, explain, version
• GitHub Action (this release) - a required check that fails on a HIGH-impact PR and clears automatically once an authorized reviewer approves the current commit
• MCP server (@loadbearing/mcp) - native tools for Claude Code, Cursor, and other MCP clients

Quick start

name: LoadBearing
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  pull_request_review:
    types: [submitted, dismissed]
permissions:
  contents: read
  pull-requests: read
jobs:
  architecture:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: vishweshji/loadbearing@v0.1.0
        with:
          github-token: ${{ github.token }}

Full setup for the CLI and MCP server is in the README.

Testing

177 automated tests, plus manual verification against six real, unmodified public repositories (Terraform, Kubernetes, Django, Go, Rust tooling) across both broad-history diffs and 60-150-commit stress tests per repo. Details in CHANGELOG.md.

Known limitations

• No AsyncAPI or standalone JSON Schema contract detection yet (LB004)
• No team-based reviewers - a GitHub Actions token can’t reliably resolve org team membership without extra permissions this project deliberately doesn’t request
• First release: not yet exercised on external pull requests beyond this repository’s own history

See docs/roadmap.md for what’s next and explicit non-goals.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automatically moves closed issues to the top of a specified project column in GitHub Project V2. It checks if an issue belongs to a specific project, updates its status to the specified column (default: “Done”), and moves it to the top of that column. This ensures visibility of recently closed issues on the project board.

What’s Changed

uses: wozaki/project-closed-issue-move-to-top-action@c6464c429f9e50da8434e06473ad2c5157ef8c40 # v1.27.0

What’s Changed

• chore(deps): update int128/release-typescript-action action to v1.81.0 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/190
• chore(deps): update dependency @tsconfig/node24 to v24.0.5 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/191
• chore(deps): update int128/update-generated-files-action action to v2.109.0 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/192
• chore(deps): update int128/wait-for-workflows-action action to v1.94.0 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/193
• chore(deps): update pnpm to v11.22.0 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/194
• chore(deps): update dependency vitest to v4.1.11 by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/195
• chore(deps): lock file maintenance by @renovate[bot] in https://github.com/wozaki/project-closed-issue-move-to-top-action/pull/196

Full Changelog: https://github.com/wozaki/project-closed-issue-move-to-top-action/compare/v1.26.0...v1.27.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that automates accessibility checks in CI/CD pipelines by mapping and analyzing guidelines against target audiences. It helps companies ensure their code meets WCAG standards, reducing learning curve costs and improving product accessibility for a larger audience. The action uses AI to measure and report on guideline compliance, enabling developers to fix issues before pushes are accepted.

What’s Changed

• Update geminiService.ts (688e09b)
• Update README.md (dbe3d74)
• Update README.md (0f117a4)
• Update README.md (45026e8)
• Merge pull request #2 from YuriFAToledo/documentation (04a0849)
• Update README.md (8bb0621)
• Update README.md (efeffcc)
• feat: add pr flow (2bf86c4)
• feat: new gemini properties (0d597b1)
• fix: enforce properties at gemini json (313ff7b)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automatically fixes CI failures by reproducing them in isolated sandboxes, races candidate repairs, and audits evidence. It uses AI agents for diagnosis and proposes patches before opening a PR for human review. Sutura ensures safety by rejecting unsafe shortcuts and provides an HTML case file for evidence. It is built for the Nebius x NVIDIA Global AI Hackathon and can be tried with a judge demo.

What’s Changed

Sutura v0.1.1 gives the GitHub Action a unique Marketplace name.

It repairs actionable failures from pull requests, pushes, schedules, and manual dispatches. Direct runs receive evidence on the failing commit.

Sutura rejects stale branch heads before repair. The installer publishes as sutura@0.1.1 through npm trusted publishing.

• This action is used across all versions by 11 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

NeuroLink is a universal AI integration platform that unifies 30+ AI providers and 100+ models under one consistent API, providing a practical, TypeScript-first way to integrate AI into any application. It supports extraction from production systems at Juspay, offering switchable providers with built-in tools and enterprise features like Redis memory and multi-provider failover.

What’s Changed

12.3.0 (2026-08-28)

Features

• (providers): onboard SambaNova as the second post-gate catalog provider (4184700), closes #33 1583/#1584

• This action is used across all versions by 1 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, ctxloom PR review, automates security risk assessment and reviewer suggestions on pull requests. It uses a local dependency graph to identify high-risk modules and files in the diff, suggesting reviewers from past commits. This tool helps maintain code quality by flagging potential issues before they are merged into the main branch.

What’s Changed

Auto-generated release for ctxloom-pr-bot v1.7.13. Source: https://github.com/kodiii/ctxloom/releases/tag/v1.7.13

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of managing and integrating various language syntax highlighting, linting, and formatting tools into a single binary. It simplifies the installation and management of multiple VSCode extensions by providing a unified solution that can be shared between development environments and CI pipelines. The action manages multiple languages, including custom grammars and external toolchains for linting and formatting, ensuring consistent results across different platforms and environments.

What’s Changed

Full Changelog: https://github.com/linzeyan/vscode-syntax/compare/v0.4.2...v0.4.3

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Git Velocity is a GitHub Action that analyzes your Git repository activities and generates a beautiful, gamified dashboard to track developer velocity. It automates tasks such as analyzing commit, pull request, code review, issue, and meaningful line counts, providing a comprehensive view of development performance through metrics and achievements.

What’s Changed

Changelog

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of releasing React Native over-the-air updates using Aether. It simplifies the deployment workflow by wrapping the @aetherpush/cli commands and exposing the necessary package metadata as outputs. The action supports various inputs such as API key, app name, release command, and platform, allowing for customization based on specific needs.

What’s Changed

0.4.0 (2026-08-28)

⚠ BREAKING CHANGES

• the blob-url and manifest-blob-url outputs are removed, and there is no replacement output. The presigned URL is deliberately no longer published. Workflows that referenced either output need updating.

Features

• stop publishing signed bundle URLs as step outputs (#27) (7ca1e8e)

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 35 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action setup-testpilot by Oracle helps automate the setup and management of Oracle Test Pilot for Third-Party Software within GitHub workflows. It provides various actions to provision, delete, create a registration token, and skip testing based on changes in specific files or folders. The action supports Linux platforms and offers customizable inputs and outputs to streamline the integration process.

What’s Changed

What’s Changed

• Add input parameter to always send a fully qualified hostname and service name (useful for autonomous) by @loiclefevre in https://github.com/oracle-actions/setup-testpilot/pull/22

Full Changelog: https://github.com/oracle-actions/setup-testpilot/compare/v1.0.30...v1.0.31

• This action is used across all versions by 2 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the execution and monitoring of Orchestra pipelines. It supports running both backed by Orchestra or Git-backed pipelines, allowing users to choose specific branches and tasks to run. The action provides options for polling pipeline status at regular intervals and managing environments, making it useful for continuous integration workflows that integrate with Orchestra projects.

What’s Changed

What’s Changed

• fix - Handle SKIPPED pipeline run status to stop infinite polling by @gthesheep-orchestra in https://github.com/orchestra-hq/run-pipeline/pull/17

New Contributors

• @gthesheep-orchestra made their first contribution in https://github.com/orchestra-hq/run-pipeline/pull/17

Full Changelog: https://github.com/orchestra-hq/run-pipeline/compare/v1.5.0...v.1.6.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action automates the validation, building, and publishing process for Otzaria plugins. It performs static checks using pack-plugin, builds the .otzplugin file, and automatically publishes new versions to otzaria.org upon push to the main branch. It requires OTZARIA_USER and OTZARIA_PASSWORD secrets for authentication. The action also supports pull request validation without publishing.

What’s Changed

Full Changelog: https://github.com/Otzaria/otzaria-plugin-validator/compare/v1.16.0...v1.16.1

• This action is used across all versions by 1 repositories.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of building a Debian package from an upstream git tag and a custom debian/ directory. It resolves build dependencies, runs dpkg-buildpackage, checks the result with lintian, and collects artifacts. The action can be used to build packages for different Debian suites and architectures and is reusable for validating packaging repositories.

What’s Changed

[1.2.0] - 2026-08-27

Added

• DEP8_EXTRA_DEBS in package.conf: packages from this archive that the DEP-8 testbed needs, fetched and handed to autopkgtest alongside the built package. The testbed is Debian only, so a dependency Debian does not carry cannot otherwise resolve. Space-separated; a value that is not a list of Debian package names fails the build before anything is installed.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Prowler automates the discovery and assessment of security risks in cloud environments by running predefined checks against various AWS services, helping organizations identify potential vulnerabilities and ensure compliance with industry standards.

What’s Changed

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

💬 Slack Integration — Alert Channel Destinations

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Alerts can now reach Slack. Connect a Slack workspace from the Integrations page, authorize one or several destination channels (the connection check confirms each channel with a one-time message and names any channel Slack refuses), and pick those channels in the alert modal’s “Destination channels” selector, next to the “Recipients” selector for email. The alerts list summarizes both in a single “Destinations” column, showing a rule’s email recipients and Slack channels at a glance. Disconnecting the workspace and recovering from revoked credentials are handled from the same page.

Read more in the Slack integration documentation and the Alerts documentation.

🤖 Lighthouse AI — Answer Feedback

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Every Lighthouse AI answer can now be rated with a 👍 or 👎, with an optional field to describe what worked or what did not. Feedback is collected per answer, directly in the chat, and tells the team where Lighthouse should improve next.

Read more in the Lighthouse AI documentation.

📥 Providers — Imported Findings Indicator

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Providers whose findings were imported with the Prowler CLI now show an “Imported provider” indicator next to their connection status in the providers table. In accounts that mix connected providers with Import Findings uploads, the table now tells them apart at a glance.

Read more in the Import Findings documentation.

📚 Compliance — NCSC Cyber Essentials 3.3

Cyber Essentials is the UK National Cyber Security Centre (NCSC) scheme certifying the baseline technical controls an organization must implement, and cloud services are explicitly in scope and cannot be excluded from an assessment. Prowler now includes NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) as a universal framework, with its 28 requirements organized in the five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection.

Sixteen requirements map to Azure checks covering the controls the applicant organization owns under the shared responsibility model. The remaining twelve apply to end-user devices, on-premises network appliances, or organizational process, which cloud control-plane evidence cannot observe, so they are reported as Manual.

Contributed by @m-khan-97. Thank you!

Read more in the Compliance documentation.

🔍 Checks

Fifteen new checks land across seven providers in this release.

AWS

• ecr_repository_image_no_secrets scans the latest image of each ECR repository, both its configuration and its filesystem layers, for hardcoded secrets. Thanks to @esquaredsec!
• Four new Amazon Bedrock checks, thanks to @tamg-aws!
  • bedrock_guardrail_contextual_grounding_filter_enabled verifies that guardrails enable both contextual grounding filters, blocking responses that are not supported by the retrieved source or do not answer the question asked.
  • bedrock_custom_model_encrypted_with_cmk verifies that custom models are encrypted at rest with a customer-managed KMS key instead of an AWS-owned key the organization cannot audit, rotate, or revoke.
  • bedrock_knowledge_base_encrypted_with_cmk verifies that each knowledge-base data source encrypts with a customer-managed KMS key the transient storage used while documents are chunked and embedded.
  • bedrock_agent_role_not_shared_across_agents verifies that every agent has a dedicated execution role, so no agent inherits another’s permissions.
• rolesanywhere_profile_restricts_session_permissions flags IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies.

Explore all AWS checks at Prowler Hub.

GCP

• iam_workload_identity_pool_provider_attribute_condition flags Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals.

Explore all GCP checks at Prowler Hub.

GitHub

Three new checks harden GitHub Actions defaults, all contributed by @Edneam. Thank you!

• organization_default_workflow_permissions_read_only and repository_default_workflow_permissions_read_only verify that workflows get a read-only default GITHUB_TOKEN at the organization and repository level.
• organization_actions_pull_request_approval_disabled verifies that organizations prevent GitHub Actions from creating and approving pull requests.

Explore all GitHub checks at Prowler Hub.

Microsoft 365

• defender_domain_dmarc_records_published checks that every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject). Thanks to @Rishi943!

Explore all Microsoft 365 checks at Prowler Hub.

Alibaba Cloud

• oss_bucket_versioning_enabled verifies that OSS buckets keep versioning enabled, allowing recovery from accidental or malicious object overwrite and deletion. Thanks to @abidedavana!
• oss_bucket_server_side_encryption_enabled verifies that OSS buckets define a default server-side encryption rule, either AES256 or KMS. Thanks to @alexchen-sys!

OSS bucket logging, versioning, default encryption, and ACL configurations are also now read correctly from the Alibaba Cloud SDK, so the checks reading them no longer report every bucket as unconfigured.

Explore all Alibaba Cloud checks at Prowler Hub.

Huawei Cloud

• vpc_security_group_open_egress flags VPC security groups that allow open egress to the internet. Thanks to @tomitobio!

Explore all Huawei Cloud checks at Prowler Hub.

STACKIT

• ske_cluster_no_public_endpoint flags SKE clusters whose Kubernetes API endpoint is reachable from the whole internet, because the ACL extension is disabled or its allowed CIDR list contains 0.0.0.0/0 or ::/0. Thanks to @johannes-engler-mw!

Explore all STACKIT checks at Prowler Hub.

🔐 Security Updates

• The API and SDK container images upgrade OpenSSL to 3.5.7-1~deb13u2, patching ten high CVEs; the UI image upgrades libcrypto3 and libssl3 to 3.5.8-r0, patching seven high CVEs; the MCP Server image patches CVE-2026-14456 (OpenSSL), CVE-2026-11822, and CVE-2026-11824 (SQLite).
• sqlparse upgraded to 0.6.0 in the API, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491.

🙌 External Contributors

Thank you to our community contributors for this release!

• @Edneam: GitHub organization_default_workflow_permissions_read_only (#12122), repository_default_workflow_permissions_read_only (#12143), and organization_actions_pull_request_approval_disabled (#12394) checks
• @tamg-aws: four AWS Bedrock checks covering guardrail grounding, CMK encryption, and agent role isolation (#12459)
• @esquaredsec: AWS ecr_repository_image_no_secrets check (#12123)
• @Rishi943: Microsoft 365 defender_domain_dmarc_records_published check (#11936)
• @abidedavana: Alibaba Cloud oss_bucket_versioning_enabled check (#11913)
• @alexchen-sys: Alibaba Cloud oss_bucket_server_side_encryption_enabled check (#11981)
• @tomitobio: Huawei Cloud vpc_security_group_open_egress check (#12209)
• @johannes-engler-mw: STACKIT ske_cluster_no_public_endpoint check (#11943)
• @gabrielfrdev: cluster name in Kubernetes compliance report outputs (#12506)
• @jfgmesquita: AWS FSBP compliance mapping fix for IAM.9 and EKS.1 (#12372)
• @hackertwinten: ec2_securitygroup_not_used no longer flags security groups held only by scaled-down AWS Batch compute environments (#12458)
• @0xTaoZ: ECS task-definition checks no longer report PASS when DescribeTaskDefinition fails, shipped early in v5.39.1 (#12217)
• @ye11oc4t: ses_identity_not_publicly_accessible now evaluates every identity authorization policy, shipped early in v5.39.1 (#12464)
• @Zuhef: IaC provider raises typed exceptions instead of sys.exit when cloning the scanned repository or running Trivy fails (#12227), Kubernetes kubelet checks no longer disappear from the scan when a kubelet-config ConfigMap is broken (#12225), and the CLI --slack summary is sent for scans with no findings instead of failing with ZeroDivisionError (#12229)
• @m-khan-97: NCSC Cyber Essentials 3.3 compliance framework with Azure provider coverage across the five Cyber Essentials themes (#11588)

UI

🚀 Added

• NCSC Cyber Essentials 3.3 compliance support with its dedicated mapper, details panel, and icon (#11588)
• Thumbs-up and thumbs-down feedback form for Lighthouse assistant answers with optional details (#12419)
• Display the default one-scan free trial and trial expiration in the existing sidebar banner (#12420)
• Slack integration: connect a Slack workspace from the Integrations page (Prowler Cloud only) (#12435)
• Prowler Cloud indicator for providers created via Import Findings alongside every connection status (#12447)
• Slack integration: authorize several destination channels at once — the connection check confirms each authorized channel with a one-time message and names the one Slack refuses (#12491)
• Slack channels confirmed on the Slack integration as alert rule destinations, selectable in the alert modal alongside email recipients (#12492)
• Cancelled-subscription variant in the sidebar trial banner (Prowler Cloud only) (#12538)

🔄 Changed

• Alerts list Recipients column becomes Destinations, summarizing a rule’s email recipients and Slack channels at a glance (#12493)

🐞 Fixed

• Scan auto-refresh no longer overlaps slow client refreshes and now signals when scan execution settles (#12455)
• The compliance “Across providers” section builds its framework list from the API catalog instead of a hardcoded set of ids, so a universal framework registered by an installed package renders like a shipped one (#12536)
• The compliance “Across providers” section reports a failed catalog request instead of rendering the “no data yet” empty state (#12536)
• Returning from Slack after approving the install now reliably lands on the Slack integration page instead of getting stuck on the callback screen (Prowler Cloud only) (#12572)

🔐 Security

• libcrypto3 and libssl3 upgraded to 3.5.8-r0 in the UI container image, patching seven high OpenSSL CVEs (#12549)

API

🐞 Fixed

• FINDINGS_TABLE_PARTITION_MAX_AGE_MONTHS is now applied in months instead of days, and negative values are rejected (#12580)

🔐 Security

• sqlparse upgraded to 0.6.0, patching CVE-2026-54284, CVE-2026-59893, and CVE-2026-71491 (#12509)
• openssl, libssl3t64 and openssl-provider-legacy upgraded to 3.5.7-1~deb13u2 in the API container image, patching ten high OpenSSL CVEs (#12549)

SDK

🚀 Added

• NCSC Cyber Essentials 3.3 compliance framework with Azure provider coverage across the five Cyber Essentials themes (#11588)
• oss_bucket_versioning_enabled check for Alibaba Cloud provider, verifying that OSS buckets have versioning enabled to allow recovery from accidental or malicious object overwrite and deletion (#11913)
• defender_domain_dmarc_records_published checks that every Exchange Online domain publishes a DMARC record with an enforcing policy (p=quarantine or p=reject) (#11936)
• ske_cluster_no_public_endpoint check for STACKIT provider, flagging SKE clusters whose Kubernetes API endpoint is reachable from the whole internet because the ACL extension is disabled or its allowed CIDR list contains 0.0.0.0/0 or ::/0 (#11943)
• oss_bucket_server_side_encryption_enabled check for Alibaba Cloud provider, verifying that OSS buckets have a default server-side encryption rule (AES256 or KMS) (#11981)
• organization_default_workflow_permissions_read_only check for GitHub provider, verifying that organizations grant GitHub Actions workflows a read-only default GITHUB_TOKEN (#12122)
• ecr_repository_image_no_secrets check for AWS provider, scanning the latest ECR repository image’s configuration and filesystem layers for hardcoded secrets (#12123)
• repository_default_workflow_permissions_read_only check for GitHub provider, verifying that repositories grant GitHub Actions workflows a read-only default GITHUB_TOKEN (#12143)
• vpc_security_group_open_egress check for Huawei Cloud provider: VPC security groups do not allow open egress to the internet (#12209)
• organization_actions_pull_request_approval_disabled check for GitHub provider, verifying that organizations prevent GitHub Actions from creating and approving pull requests (#12394)
• Add the iam_workload_identity_pool_provider_attribute_condition check to flag GCP Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals (#12416)
• Add the rolesanywhere_profile_restricts_session_permissions check to flag AWS IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies (#12416)
• bedrock_guardrail_contextual_grounding_filter_enabled, bedrock_custom_model_encrypted_with_cmk, bedrock_knowledge_base_encrypted_with_cmk and bedrock_agent_role_not_shared_across_agents are four new AWS Bedrock checks covering guardrail contextual grounding, custom model encryption, knowledge-base data-source encryption, and non-shared agent execution roles. (#12459)
• Cluster column in Kubernetes CIS, ISO27001, Prowler ThreatScore, and universal compliance outputs, populated with the resolved cluster name so multi-cluster scans can be told apart in the output (#12506)

🐞 Fixed

• Kubernetes kubelet checks no longer disappear from the scan with TypeError: 'NoneType' object is not iterable when a kubelet-config ConfigMap is broken: one with malformed YAML is logged and skipped while the valid ones are still evaluated, one without kubelet data is evaluated with an empty configuration instead of crashing the checks, and the apiserver, controllermanager, etcd and scheduler pod gatherers now always return a list (#12225)
• IaC provider now raises typed IacBaseException errors (repository clone, Trivy missing, scan and output processing failures) instead of calling sys.exit(1); the CLI still stops with the logged message, and API scans fail as regular task errors instead of a SystemExit escaping the worker (#12227)
• CLI Slack integration (--slack) no longer fails when a scan produces no findings: the pass and fail percentages are guarded against a findings_count of 0, which previously raised ZeroDivisionError and sent blocks=None to Slack instead of the summary (#12229)
• AWS FSBP compliance mapping for IAM.9 and EKS.1 referenced missing/renamed checks; both now point to their real, existing check IDs (#12372)
• ec2_securitygroup_not_used no longer reports a false positive for security groups attached only to an AWS Batch compute environment, which holds them in configuration without creating a network interface while scaled down to zero instances (#12458)
• Bedrock Agent ARNs are now built from the audited partition instead of a hardcoded arn:aws:, so findings in GovCloud and China carry a resolvable ARN and --resource-arn scoping matches agents in those partitions. (#12459)
• push-to-cloud now validates Private Cloud TLS certificates with the operating system trust store without changing provider HTTP clients (#12485)
• prowler.compliance.universal entry point directories are resolved through a single shared helper and deduplicated by resolved path, so a directory reached through two entry points is parsed once and a package that fails to import no longer hides the rest (#12536)
• OSS bucket logging, versioning, default encryption and ACL configurations are now read correctly from the Alibaba Cloud SDK, so oss_bucket_logging_enabled, oss_bucket_versioning_enabled, oss_bucket_server_side_encryption_enabled and oss_bucket_not_publicly_accessible no longer report every bucket as unconfigured (#12546)

🔐 Security

• openssl, libssl3t64 and openssl-provider-legacy upgraded to 3.5.7-1~deb13u2 in the SDK container image, patching ten high OpenSSL CVEs (#12549)

MCP

🚀 Added

• Failures shared by every tool - a rejected credential, a missing permission, a rate limit, an outage, an unreachable API, a bad argument - are now explained with a message that says what went wrong and what to do about it (#12531)

🐞 Fixed

• prowler_docs_search returns results again: it calls the search endpoint docs.prowler.com moved to, since the one it used no longer exists, and each result now names the page’s title, the section it matched and a URL anchored at that section (#12578)

🔐 Security

• Stop relaying upstream response bodies to agents: a failed request now reaches the caller as a sentence this server wrote, with the full body kept to the logs, so a gateway error page or a debug traceback can no longer be replayed into a model’s context (#12531)
• sqlite-libs upgraded to 3.53.4-r0 in the container image, patching CVE-2026-11822 and CVE-2026-11824 (#12537)
• libcrypto3 and libssl3 upgraded to 3.5.8-r0 in the container image, patching CVE-2026-14456 (#12547)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is a simple tool that prints “Hello World” or a personalized greeting to the console. It takes an optional input parameter, who-to-greet, which allows users to specify the name they want to greet. The action also provides the current time when it runs.

What’s Changed

Full Changelog: https://github.com/RivieraKid/gha-kaniko/compare/v1...v0.0.1

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the migration of a third-party plugin from one DeepSeek Harness version to another. It resolves the target harness version (dsh-v*), performs mechanical tests, runs two DSH review sessions (DeepSeek V4 Pro and dsh-anchored-standard), and then creates an Issue and PR if the plugin tree is dirty. The Action skips migration if the same version has already been processed successfully. It requires permissions to write to repository contents, open issues, and pull requests, with GitHub Actions permission enabled for creating pull requests. The action uses a cron schedule or manual workflow dispatch to trigger migrations.

What’s Changed

Full Changelog: https://github.com/royenheart/dsh-migrate-bot/compare/v0.2.0...v0.2.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

IconKit is a Swift library and CLI tool designed to work with Apple .icon bundles and Android adaptive icons. It enables the creation, inspection, modification, and validation of these icon formats using SF Symbols and provides features like adding environment ribbons to existing icons and generating adaptive icons in modern vector drawable and bitmap formats. The action supports full document models and is available as a command-line tool or embeddable library for Swift applications.

What’s Changed

What’s Changed

Bug Fixes

• resolve adaptive icon safe-zone positioning, legacy icon alpha masking, and vector gradients (a893100)
• fallback to building from source when pre-built binary is not found (6b97e0d)

Other Changes

• Merge pull request #3 from rozd/feat/android-vector-drawables (02c8c37)
• expand unit tests for gradients, safe-zone viewports, content bounds, and alpha masking (6b37d5c)

Full Changelog: https://github.com/rozd/icon-kit/compare/v1.2.0...v1.2.1

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action scaleway/scaleway-containers-deploy automates the deployment and teardown of container services on Scaleway. It integrates seamlessly with Scaleway’s Container Registry, allowing users to deploy their applications efficiently using predefined configurations or custom settings. This action solves common deployment challenges by providing a simple interface for managing containers within CI/CD pipelines.

What’s Changed

What’s Changed

• fix(container): await ready container before update by @philibea in https://github.com/scaleway/scw-serverless-container-action/pull/7

Full Changelog: https://github.com/scaleway/scw-serverless-container-action/compare/0.0.7...0.0.8

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Bernstein is a deterministic multi-agent CLI orchestration tool that automates and orchestrates complex workflows, ensuring consistency across different environments. It simplifies the management of microservices, pipelines, and tasks by providing a comprehensive framework for defining and executing multi-step processes efficiently.

What’s Changed

Sixty-four commits since the last patch, most of them the machine finding its own mistakes. That is the arrangement working, not failing.

Receipts that outlive what they describe

A finished run’s journal now maps onto a signed TRACE 0.2 Trust Record through the install Ed25519 identity, behind the optional bernstein[trace] extra (#4666). The record names its own signing key — the subject is a self-certifying did:key URI — states the runtime it was produced under, and binds a delegated execution to its parent by the hash of the parent’s own signed record; three vectors minted from real runs verify offline (#4692). Sealed audit segments carry content-addressed hash tiles beside them (#4629). A refused read-set emits a receipt that verifies with no network and no repository (#4650). Journal verification is bound to plan rendering, so an approval binds to the rendering the reviewer actually saw (#4655). Task context packs are byte-deterministic, content-addressed containers (#4646), and sequential evaluation statistics gain time-uniform bounds computed in exact arithmetic (#4651).

The swarm stops stepping on itself

Migration checkpoints record chunk completion, so a restarted migration no longer re-spawns finished work and the reduce step can run at all (#4541). A re-run reuses a chunk whose task is still in flight instead of spawning a second owner for the same files (#4624). A run whose planning failed closes instead of idling to its wall-clock timeout (#4529). Fair scheduling caps the age boost, so an old task can no longer starve a fresh urgent one (#4675). Drain stops re-admitting a dead agent from a previous run’s agents.json (#4479), and any unmerged agent branch is rescued to refs/rescue/<run-id>/ before a forced delete (#4677). A spawn supervisor that exhausted its respawns records the failure on park, where a pruned store used to lose it (#4637). Issue-intake runs have no coordinator, so they now share a claim vocabulary two of them can read off each other’s comments (#4521).

bernstein pr says what happened

A description built from a git command that failed used to report that the branch changed nothing. It now reports the failure, and provenance is computed only from a diff that exists (#4669). The anchoring step no longer exits non-zero after the pull request is already open (#4686), and the description is composed against the base the request merges onto (#4693).

Adapters, plugins, volunteers

The goose adapter passes through the model it was told to use — a role bound to a specific model had been running on whatever the CLI defaulted to — parses the stream, and reports usage like the other adapters (#3679). Aider writes a per-spawn analytics log (#3674). Declared third-party trigger and reporter entry points load at runtime, and a malformed entry is named in a warning rather than becoming a silent no-op (#4531). Volunteer runs gain a second independent reviewer (#4685) and issue comments filtered so the model receives what the reviewer read (#4652).

Housekeeping

Modules nothing reached are gone, with the documentation rows that advertised them (#4683, #4643). The team-hub page documented a loader that had been deleted as unreachable; it now documents the manifest parser that ships, and deleting a file the drift playbook names as a doc’s source of truth fails on the pull request that deletes it rather than on the push afterwards (#4696). Committed coverage shards and scratch files are out of the tree, ignored by shape rather than by name (#4695). Context-file staleness on a pull request is attributed to that request’s own commits (#4634), and CONTRIBUTING documents how milestones are targeted, which had been folklore (#4285). Three gates were failing for reasons no code change could fix: the lint gate called ruff outside uv run on a project that never activates its virtualenv (#4547); a required status check filtered its trigger on paths, so every pull request outside the filter waited forever on a run that never started (#4556); and a completion signal named its test by a path written when the task was planned rather than one that exists (#4554).

Contributors

• Chirag Honnyal — branch rescue on drain (#4681), the priority age-boost cap (#4680), spawn-supervisor failure records (#4662), staleness attribution (#4664).
• Amir Fathi — swarm checkpoint completion (#4618), the drain liveness check (#4621), the reaper patch-target fix (#4688).
• Sujeito Operator — a producer for the parked-session store (#4636), in-flight chunk reuse (#4625).
• Jesus Esquer — agent timeout extension reaching the spawned process (#4608), reaper caller coverage (#4613).
• Abishek N — the deterministic TaskContextPack container (#4694), dead-module removal (#4696).
• Atirna — plugin entry-point registries (#4614).

What’s Changed

• fix(release): publish the version’s own release notes on the release page by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4606
• fix(ci): release the andon once main is green again by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4607
• chore(deps): update dependency @types/vscode to v1.134.0 by @renovate[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4604
• fix(#4571): agent timeout extension reaches the spawned process by @jm27 in https://github.com/sipyourdrink-ltd/bernstein/pull/4608
• docs: document _MAX_FLUSH_ATTEMPTS drop policy in metric_collector docstring by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4611
• fix(plugins): load the declared bernstein.triggers and bernstein.reporters entry-point groups by @atirna in https://github.com/sipyourdrink-ltd/bernstein/pull/4614
• fix(#4541): wire swarm migration checkpoint completion and reduce by @AmirF194 in https://github.com/sipyourdrink-ltd/bernstein/pull/4618
• test(#4610): cover the reaper caller, not just the adapter contract by @jm27 in https://github.com/sipyourdrink-ltd/bernstein/pull/4613
• fix(security): restrict redirect destinations for third-party-derived URLs by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4619
• feat: add claim comment format constants and helpers for issue-intake runs by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4609
• fix(replay): ensure plan.graph.full nodes are sorted by task_id in board projection by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4622
• chore(deps): update dependency @vitejs/plugin-react to v6.1.0 by @renovate[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4620
• fix(#4479): stop drain from re-admitting a dead prior-run agent from agents.json by @AmirF194 in https://github.com/sipyourdrink-ltd/bernstein/pull/4621
• test: state the sandbox precondition instead of inferring it from the env by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4626
• feat(adapters): drive more of the goose CLI and parse its stream by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4616
• feat(quality): empirical confidence helper with a Hoeffding confidence sequence by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4612
• test(security): pin a computed capability delta across the recording seam by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4627
• fix(orchestrator): bound the planning window so a failed plan does not run to timeout by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4617
• fix(#4624): reuse in-flight swarm chunks instead of double-spawning owners by @sujeito-operator in https://github.com/sipyourdrink-ltd/bernstein/pull/4625
• feat(review): show the reviewer the conventions already filed for this repo by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4631
• feat(audit): write content-addressed hash tiles beside the sealed segments by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4629
• docs: refresh the curated context files against their subtrees by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4632
• fix: wire task resume checkpoint writer into orchestrator step-completion handling by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4615
• chore(deps): update dependency vite to v8.2.2 by @renovate[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4623
• feat: wire –analytics-log into aider spawn command by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4630
• fix(#3453): give the parked-session store a producer, and key the park on something that survives a retry by @sujeito-operator in https://github.com/sipyourdrink-ltd/bernstein/pull/4636
• feat: extend AutofixReceipt with thread resolution tracking by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4635
• feat: add CounterfactualAuditError and EquivalenceAttestation models by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4638
• fix(tasks): report an unreachable spawn supervisor instead of suppressing it by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4640
• fix(quality): handle exit 127 in import_cycle gate command path by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4639
• test: state the sandbox premise instead of inheriting it from the host by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4658
• docs: regenerate adapter last-green table from canary receipts by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4657
• fix(docs): attribute context-file staleness only to PR-contributed commits (#4634) by @Chirag6722 in https://github.com/sipyourdrink-ltd/bernstein/pull/4664
• fix(core): persist spawn supervisor failure records on park for pruned store fallback (#4637) by @Chirag6722 in https://github.com/sipyourdrink-ltd/bernstein/pull/4662
• feat: add exact-arithmetic time-uniform ConfidenceSequence primitive by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4651
• feat: wire comment filtering into volunteer runner (task 5959ed75355c) by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4652
• test: add SSRF protection tests for fetcher call sites by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4654
• feat: bind journal verification to plan rendering by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4655
• feat: add sample_evidence field to FailurePatternDraft by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4659
• fix: report git failures in PR descriptions instead of claiming no changes by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4670
• fix(lint): move Path import to TYPE_CHECKING block in context_policy.py by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4653
• fix(autoheal): remove orphan cost_guard module by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4679
• feat: add tool output digesters registry and ruleset models by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4656
• feat: add compute_observations_hash function by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4663
• fix(orchestration): cap priority age boost to prevent starvation of fresh P1 tasks (#4675) by @Chirag6722 in https://github.com/sipyourdrink-ltd/bernstein/pull/4680
• feat: add milestone triage guidance to CONTRIBUTING.md by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4660
• feat: aider adapter parses prose while upstream already emits structured events: wire –analytics-log by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4661
• fix(orchestration): rescue unmerged agent branches before forced deletion on drain (#4677) by @Chirag6722 in https://github.com/sipyourdrink-ltd/bernstein/pull/4681
• feat: add test for three-level chain revocation propagation (A ← B ← C) by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4682
• fix(pr): anchor the description without aborting the command by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4686
• feat: volunteer: independent review pass — a second donor reviews every submission by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4685
• fix(test): patch the correct _is_process_alive binding in test_ownership_released_on_reap by @AmirF194 in https://github.com/sipyourdrink-ltd/bernstein/pull/4688
• fix: audit cost and agents for unreachable modules: wire or delete, one verdict per module by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4683
• feat(protocols/volunteer): add shared document substrate (documents.py) by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4689
• feat: controller state sidecar persists adaptive parallelism and claim conflict cooldowns by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4687
• feat: add trust_record.py with TRACE 0.2 emitter API by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4684
• fix(pr): compose the description against the base the pull request merges onto by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4693
• feat: deterministic TaskContextPack container (#4646) by @AbishekCoder1 in https://github.com/sipyourdrink-ltd/bernstein/pull/4694
• chore: remove committed coverage shards and scratch files by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4695
• chore: remove dead code modules from plugins_core and routing (#4643) by @AbishekCoder1 in https://github.com/sipyourdrink-ltd/bernstein/pull/4696
• feat: add read-set refusal receipt with offline verification by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4650
• chore: move README translations to docs/i18n and clear run scratch from the root by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4702
• fix(docs): document the team-hub manifest that ships, gate deleted sources on the PR by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4703
• fix(observability): align trust record field surface with TRACE 0.2 draft by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4704
• feat: volunteer: hub HTTP surface — scoped endpoints over the lease store by @bernstein-orchestrator[bot] in https://github.com/sipyourdrink-ltd/bernstein/pull/4700
• chore(release): v3.18.2 by @chernistry in https://github.com/sipyourdrink-ltd/bernstein/pull/4707

Full Changelog: https://github.com/sipyourdrink-ltd/bernstein/compare/v3.18.1...v3.18.2

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the build process for a Docker Swarm service by running npm ci and npm run bundle, then commits the resulting distribution files to the repository. It helps streamline the development workflow by ensuring that the necessary dependencies are installed and the service is ready for deployment with just a push to the repository.

What’s Changed

• feat: Update to latest Docker version (6435c1d)
• feat: Explicitly set traefik inbound network (70d83f9)
• feat: Automatically set placement preferences based on placement constraints to spread containers of a service across nodes (51af2c2)
• feat: Add support for depends_on (688c023)
• feat: Add support for service labels (a36e5ea)
• fix: Fix restart policy to always restart because containers sometimes exit with code 0 even though they had an error (01b34f4)
• feat: Add support for multiple external routes (d99208c)
• feat: Improve update config (3c87f67)
• feat: Add support for mounts, max replicas per node and stop signal and grace period (90fa02a)
• feat: Add support for resource limits and reservations (b33b12f)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates Google Sheets with GitHub Classroom to automatically update assignment results. It requires setting up Google Cloud credentials and sharing access, then configuring a secret in your repository to use the integration. The action supports automated grading of tasks in GitHub Actions workflows and updates the corresponding columns in the specified Google Sheet.

What’s Changed

• Updated comments (bf17880)
• Updated .dockerignore (498a6f7)
• Updated readme (bbb6b5a)
• Changed dockerfile to docker pull (8c8584b)
• Changed dockerfile to docker pull (23fa131)
• Fixed inputs (844c583)
• Merge pull request #5 from SPGC/using-result-base64-string (042d99f)
• Fixed input name (92dd201)
• Merge pull request #4 from SPGC/using-result-base64-string (79dad97)
• Code cleanup and fix bug with empty env variables (b474731)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The PAWL (Prowl) GitHub Action is designed to act as a quality gate by comparing metric measurements across codebase commits. It helps identify regressions in metrics such as coverage, test passes, lint findings, and file lengths, ensuring that changes do not make the repo worse than it already is. The action records the current baseline of each metric and compares them against future changes to ensure no metric regresses. This ensures that improvements are tracked and only genuine changes pass through CI, preventing the introduction of new mess while maintaining existing quality standards.

What’s Changed

Changes since v0.8.0 — npm i -D @pawl-tools/cli@0.8.1

Prebuilt binaries are attached below.

• chore: prepare v0.8.1 release (#44) (db848d2)
• fix: run codeql on pull requests (#43) (77316e1)
• chore: address repository security findings (#37) (8d54856)
• feat: harden report freshness and baseline guards (#36) (9f69071)
• docs: rewrite the doc set in pawl’s own voice (#35) (9ce5f96)
• docs: refresh OpenSSF Scorecard badge (041e8ba)
• ci: publish OpenSSF Scorecard results (0a9f780)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, grype_me, automates the scanning of dependencies to detect vulnerabilities using Anchore Grype. It provides a quick and efficient way to scan repositories, container images, or directories for known security issues by leveraging pre-downloaded vulnerability data within a Docker image. The action generates detailed reports and shields.io badges, which can be linked directly from Markdown text in the README. Users can configure various options such as scan mode, fail build behavior, and output format to suit their needs.

What’s Changed

v1.3.21-release

Architectural Changes

• Migrated to Go 1.27 (from 1.26.6). Building and testing grype_me now requires a Go 1.27+ toolchain.
• Adopted encoding/json/v2, newly available in the standard library without GOEXPERIMENT=jsonv2 as of Go 1.27, across gist.go, scanner.go, types.go, and their tests. Streaming JSON now goes through json.UnmarshalRead/json.MarshalWrite instead of json.NewDecoder/json.NewEncoder.
• Test suite migrated to Go 1.27’s httptest.NewTestServer in gist_test.go: the mock GitHub Gist API server is now bound to the test’s lifecycle (in-memory fake network, auto-closed when the test ends) instead of manually created via httptest.NewServer + defer server.Close().
• Applied go fix-driven idiom cleanups: a C-style index loop in git.go’s tag-version parser became for i := range nums; a manual strings.Index/slice split in gist.go’s URL-stripping helper became strings.Cut.

Changed Behavior

• The db.status field in the internal GrypeOutput JSON struct dropped its omitempty tag as part of the json/v2 migration. This has no observable effect on parsing — struct-typed fields were never treated as “empty” under either JSON implementation — but is a cleanup of a previously ineffective tag.

Source Code Updates

• Go toolchain 1.26.6 → 1.27.0 (major version). Go 1.27 is Go’s regular six-month feature release, not itself billed as a security release; the fixes already backported into 1.26.6 in the previous release cycle (module sum-database/GOSUMDB tile-verification bypass, encoding/xml stack exhaustion, net/http header-timeout gap, net/url quadratic path resolution) are included as a baseline. I found no CVEs specific to the 1.27.0 release beyond those already covered.
• github.com/skeema/knownhosts (indirect, via go-git’s SSH known-hosts handling) 1.3.2 → 1.3.3. I could not find published release notes for this version; treating it as a routine maintenance bump.

CI Updates

• Docker build-stage base image bumped to golang:1.27.0-bookworm (with a follow-up digest-only refresh of the same tag).
• github/codeql-action v4.37.7 → v4.37.9.
• docker/setup-buildx-action v4.2.0 → v4.3.0.
• step-security/harden-runner v2.20.1 → v2.21.0.
• Python tooling: platformdirs (yamllint CI dependency) 4.11.3 → 4.11.5.
• Refreshed the self-referential TomTonic/grype_me action digest pin used in this repository’s own dogfooding workflow.

New Features

None — this release is an internal toolchain/idiom modernization; observable action behavior for consumers is unchanged.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

TookEffect Verified Merge is a GitHub Action that uses Tookeffect to verify if a pull request has been merged correctly into a branch. It provides an authoritative final verdict by executing the merge through TookEffect and ensuring that the change was applied as intended on the destination branch. The action binds a unique idempotency key to each exact PR head and base commit, retries only the identical request if needed, and returns success for a completed APPLIED verdict. It also provides detailed outputs about the Effect ID, verdict, reason, receipt URL, and keys, ensuring transparency in the verification process.

What’s Changed

First public release of TookEffect Verified Merge.

Executes an exact GitHub pull request merge through TookEffect and independently verifies the authoritative GitHub state before returning APPLIED, NOT_APPLIED, or AMBIGUOUS.

Production end-to-end smoke verified with a real GitHub merge and TookEffect Effect receipt.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Win RDP Enabler GitHub Action automates the setup of Remote Desktop Protocol (RDP) access and network connectivity using Tailscale on Windows GitHub Actions runners. It simplifies configuring RDP by automatically setting up Tailscale, allowing users to connect to the runner via RDP without manual intervention. The action handles both default runneradmin credentials and custom admin or user accounts with optional passwords.

What’s Changed

• Update action.yml (8a6a007)
• Fix formatting of Win RDP Enabler workflow step (bcecee1)
• Update README.md (036e52e)
• Update action.yml (a495b61)
• Update action.yml (b115754)
• Update README.md (e15c9d3)
• Create action.yml (76f4802)
• Initial commit (af922ab)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The N-Plus-One Guardian GitHub Action is designed to analyze and protect Pull Requests against the N+1 database performance issue by detecting and preventing incorrect use of lazy loading or index loss in loops. It supports multiple programming languages, including PHP, TypeScript, JavaScript, and Python, using Tree-sitter for parsing ASTs. The action automatically detects N+1 queries and index loss within loops and comments on PRs to prevent these issues.

What’s Changed

Inclusão da identificação e alertar sobre o uso de conversões de tipo (casts) em consultas de banco de dados, que podem causar a invalidação de índices e resultar em problemas de performance (como full table scans).

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action generates a list of Apex tests that need to be run based on comments or specified metadata, automating the process of identifying and running necessary test classes. It supports both custom comment annotations (@Tests:) and using a centralized metadata filter file (.test-dependencies.yml), making it easier for developers to manage and execute test cases efficiently.

What’s Changed

1.14.1 (2026-08-28)

Bug Fixes

• handle YAML comments in yamlParser (regression from 1.14.0) (#402) (05b91b1)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action B.IA automates accessibility checks in a CI/CD pipeline by mapping and analyzing guidelines to ensure code complies with WCAG standards. It provides flexibility in defining audiences and guideline percentages, allowing companies to focus on higher revenue audiences while improving product accessibility. The action uses AI for abstract guideline analysis and determines whether pull requests are accepted or blocked based on compliance.

What’s Changed

• feat: add parse debug (229d26d)
• feat: json response schema (3d2a1fe)
• feat: update build (1646112)
• feat: update code (41bf74f)
• feat: update dist (5ffd432)
• feat: add githubToken in action (b20caef)
• feat: add logs for debug (a29f11d)
• fix: order (75ba53e)
• feat: add runController (7338606)
• feat: add service (34c25e0)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub action automates the setup and execution of a ttyd server on a GitHub Actions runner, providing an interactive terminal session for debugging or accessing system services remotely. It is designed to resolve issues with SSH access being blocked during GitHub actions by enabling remote terminal connections securely.

What’s Changed

Full Changelog: https://github.com/zongou/run-ttyd-server/compare/0.0.1...0.0.2

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Vizb GitHub Action automates the creation of interactive HTML reports from CSV, JSON, and benchmark data. It simplifies the process by generating self-contained charts and statistical summaries without requiring a server or additional dependencies. This tool is useful for developers and data scientists who need to quickly visualize and analyze their datasets in a user-friendly format.

What’s Changed

What’s Changed

• chore(ui): trim dead-weight UI tests by @fahimfaisaal in https://github.com/goptics/vizb/pull/379
• feat(action): add optional cmd retries by @fahimfaisaal in https://github.com/goptics/vizb/pull/378
• fix(action): skip download when the resolved tag is cached by @fahimfaisaal in https://github.com/goptics/vizb/pull/380
• refactor(ui): delete unused helpers and collapse duplicate chart/settings code by @fahimfaisaal in https://github.com/goptics/vizb/pull/381
• fix(ui): align heatmap visual map with logo green by @fahimfaisaal in https://github.com/goptics/vizb/pull/382
• feat(cli): split stdin spinner and report collected records by @fahimfaisaal in https://github.com/goptics/vizb/pull/390
• ci: cache embed UI gen across workflows by @fahimfaisaal in https://github.com/goptics/vizb/pull/391
• ci: rebuild embed UI on push by @fahimfaisaal in https://github.com/goptics/vizb/pull/392
• ci: rebuild embed UI only when ui/ changes by @fahimfaisaal in https://github.com/goptics/vizb/pull/393
• chore(deps): bump sharp from 0.34.5 to 0.35.3 in /docs by @dependabot[bot] in https://github.com/goptics/vizb/pull/283
• feat(ui): render bar background onto echarts series by @fahimfaisaal in https://github.com/goptics/vizb/pull/396
• feat(cli): add bar –bg flag with chart object props by @fahimfaisaal in https://github.com/goptics/vizb/pull/394
• feat(api): accept background on BarChartConfig by @fahimfaisaal in https://github.com/goptics/vizb/pull/395
• docs: document bar –bg / chart bg object form by @fahimfaisaal in https://github.com/goptics/vizb/pull/397
• feat(cli): show download progress on vizb update by @fahimfaisaal in https://github.com/goptics/vizb/pull/411
• feat(ui): apply per-axis log scale and logBase by @fahimfaisaal in https://github.com/goptics/vizb/pull/419
• feat(ui): add read-only log-scale info hover by @fahimfaisaal in https://github.com/goptics/vizb/pull/422
• fix(ui): restrict line charts to slider-only dataZoom by @fahimfaisaal in https://github.com/goptics/vizb/pull/425
• fix(ui): restore line canvas zoom and keep horizontal bar slider working by @fahimfaisaal in https://github.com/goptics/vizb/pull/426
• feat(cli): parse –scale bag onto chart Scale by @fahimfaisaal in https://github.com/goptics/vizb/pull/418
• feat(api): accept per-axis scale object on REST by @fahimfaisaal in https://github.com/goptics/vizb/pull/421
• docs: document per-axis –scale bag and chart braces by @fahimfaisaal in https://github.com/goptics/vizb/pull/420

Full Changelog: https://github.com/goptics/vizb/compare/v0.19.0...v0.20.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action sets up a MySQL database in Docker and provides various options to configure and execute MySQL. It supports specific MySQL options like character set, collation, version, and binds container port to host port. The action works on Linux environments and can be used to run complex MySQL setups while avoiding issues with the Default MySQL installed by GitHub Actions.

What’s Changed

• Update Dockerfile (88923f6)
• Update Dockerfile (958fe5b)
• Update Dockerfile (76bb5fc)
• Update action.yml (2f7c2ae)
• Update entrypoint.sh (149624a)
• Update action.yml (76f218b)
• Update Dockerfile (94ea8c5)
• Improve documentations (700bd56)
• Add restart option (c2f734e)
• Add test code (82ee48a)

• This action is used across all versions by 58 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the security, publishability, runtime readiness, and trust signal analysis of AI plugins across Codex, Claude, Gemini, and OpenCode ecosystems. It emits structured reports, SARIF, policy results, and submission metadata while aligning with the main scanner release train. The action supports different execution modes, output formats, and features such as live network probing and SARIF upload to GitHub code scanning for enhanced security monitoring.

What’s Changed

Published automatically from https://github.com/hashgraph-online/hol-guard/tree/6ecf11ff0aecb5af1b7b75bbcd273758a87ca0a0 with plugin-scanner 3.0.11.

Full Changelog: https://github.com/hashgraph-online/ai-plugin-scanner-action/compare/v1.2.547...v1.2.548

• This action is used across all versions by 13 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the security, publishability, runtime readiness, and trust signals scanning of AI plugin repositories across Codex, Claude, Gemini, and OpenCode ecosystems. It emits structured reports, SARIF, policy results, and submission metadata while staying aligned to the main scanner release train. The action supports various execution modes, input parameters, and output formats, including text, JSON, markdown, and SARIF.

What’s Changed

Full Changelog: https://github.com/hashgraph-online/hol-codex-plugin-scanner-action/compare/v1.2.547...v1.2.548

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Summary: Hayward is a security scanner designed to identify potentially unsafe model files by analyzing pickle files, which can execute arbitrary code. It helps teams detect malicious or risky models before loading them into their environments, ensuring compliance with security policies and preventing unauthorized execution of code on user machines.

What’s Changed

Shortens the GitHub Action’s Marketplace description to under 125 characters (a Marketplace requirement). No scanner change: the code is identical to 1.2.0.

• This action is used across all versions by 25 repositories.

Action Type

This is a Node action using Node version 12.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This Slack Build Notifier automates the process of sending notifications to a Slack channel or DM upon the completion of a GitHub Actions job, with support for customizing various parameters such as status, text, author information, and notification methods. It also supports legacy webhook features for setting the author name and emoji icon, and provides more compact default templates while retaining all relevant information. Future directions include using Slack’s block formatting for improved presentation and supporting test failure analysis summaries in the message.

What’s Changed

• [npm] run publish (2f5973e)
• Merge branch ‘master’ into v2 (830b880)
• Merge pull request #13 from case/patch-1 (ad67a2b)
• Fix a typo (e348b4b)
• Merge pull request #10 from 8398a7/master (a3883bc)
• Merge pull request #9 from smknstd/master (653db42)
• fix legacy syntax in README (d833ff7)
• [npm] run publish (a7f2c1c)
• Merge branch ‘master’ into v2 (2e18bc8)
• Merge pull request #8 from 8398a7/feature/7 (b0f3156)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action provides a local workbench for agents to perform continuous work. It automates the process of setting up and managing an agent’s workspace, organizing tasks, and handling events in a structured manner. The key capabilities include maintaining state across sessions, using explicit task models, and maintaining clear context boundaries between different types of inputs or outputs.

What’s Changed

Runtime line

Holon v0.33.0 is part of the Rust runtime line. The Rust runtime is now the main holon binary.

This release adds the observer-sync foundation for resilient browser clients, first-class Ollama support, richer provider model discovery and reasoning controls, and stronger runtime lifecycle and recovery guarantees.

Supported binary assets for this release are Linux amd64, macOS amd64, and macOS arm64. The Linux amd64 binary supports Ubuntu 22.04 or newer (glibc 2.35 or newer).

Changes

• Add the observer-sync contract and canonical per-agent projection pipeline, including durable event ingestion, roster snapshots, recovery boundaries, browser-local read state, multi-tab merging, and unread state (#2617, #2619, #2623, #2625, #2626, #2627, #2628, #2629, #2630, #2631, #2634).
• Harden browser synchronization with persisted payload validation, bounded replay and roster lookups, v3 session event support, scoped observed heads, and deterministic real-daemon Chromium coverage (#2639, #2652, #2653, #2658, #2659, #2661, #2664, #2665, #2668, #2669, #2692).
• Add read-only runtime database auditing and strengthen retention, verification-proof reuse, and runtime search indexing boundaries (#2644, #2650, #2651, #2656).
• Make task, turn, WorkItem, and scheduler recovery transitions more robust, including terminal settlement, pending web-read retries, legacy WorkItem completion, execution-source recovery routing, and quarantine for unmatched task results (#2624, #2646, #2682, #2689, #2691, #2693).
• Complete timer lifecycle surfaces and improve timer rendering in the operator timeline (#2663, #2683).
• Add first-class Ollama provider support with credential-free Web GUI discovery and automatic vision-model discovery for ViewImage (#2677, #2679, #2684).
• Expand provider interoperability with default model discovery for custom OpenAI-compatible routes, per-route reasoning effort, preserved provider server-tool blocks, and new GLM-5.3 and Qwen 3.8 catalog entries (#2640, #2670, #2673, #2674, #2696, #2697).

Install

Homebrew:

brew tap holon-run/tap
brew install holon

Direct binary:

curl -L "https://github.com/holon-run/holon/releases/download/v0.33.0/holon-linux-amd64.tar.gz" | tar -xz
chmod +x holon
./holon --help

Replace holon-linux-amd64.tar.gz with holon-darwin-amd64.tar.gz or holon-darwin-arm64.tar.gz on macOS.

Docker:

docker pull ghcr.io/holon-run/holon:0.33.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

offsec-ai is an AI/ML-driven security toolkit that combines classic network reconnaissance with modern security testing. It performs full-stack infrastructure security assessments, actively attacks Model Context Protocol (MCP) servers for known CVEs, and integrates with Postman collections for comprehensive API vulnerability scanning and exploitation. The tool is designed to help authorized red teams identify and mitigate vulnerabilities in systems using LLM endpoints.

What’s Changed

• fix: bound pending task count in batch_check for hybrid identity and security headers (2041948)
• feat: add Postman Collection v2.x security scanner and attacker (v2.7.0) (e4668e8)
• ci: publish container to GitHub Container Registry (ghcr.io) (46d755c)
• fix: remove undefined OwaspScanResult string annotation in test_cli.py (F821) (8e750e3)
• feat: add A2A protocol security support (v2.6.0) (1b99a1b)
• fix: define OUTPUT_ARGS before use; -o was silently dropped (v2.5.9) (889e688)
• chore: replace all example.com targets with simpleportchecker.com (676106d)
• fix: –format not -f for ai-owasp-scan; use simpleportchecker target (v2.5.8) (504b6e8)
• fix: skip –timeout for ai-owasp-scan which does not support it (v2.5.7) (67a28cd)
• chore: use Gemini public endpoint in ai-owasp-scan job (6a13857)

• This action is used across all versions by 11 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

NeuroLink is a universal AI integration platform that unifies 30+ AI providers and 100+ models under one consistent API, making it easy to integrate AI into any application with confidence. It supports switching providers with a single parameter change and offers built-in tools and enterprise features like Redis memory and multi-provider failover.

What’s Changed

12.2.6 (2026-08-27)

Bug Fixes

• (localUsage): a window longer than history means everything, not nothing (396553c)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

AI and Security: Agent Computer Security Plane

What’s Changed

AIShield v4.3.0 — Closed-Loop Automation

新增能力

• 9-point version gate: sync_version.py 从 7→9 点，修复 server.py/openapi_spec.py 版本漂移
• Local Ollama LLM backend: 本地 127.0.0.1/localhost 自动启用，无需 API key
• Differential scan: 对比两次扫描差异，区分新增/已修复/不变
• Fuzzing engine: 编码逃逸/结构变异/语义混淆三种策略
• arXiv→Rule pipeline: 安全论文自动转扫描规则
• AIP agent-card: AIP-AC/v1 协议字段

自动化闭环

• ci-state bus: ci.yml 写入 data/state/ci.json，下游 workflow 共享
• feature-closed-loop: Python 3.11→3.13，修复崩溃
• issue-labeler: 升级到 peter-evans/issue-labeler@v3

测试

• 590 tests passing / 0 failures
• 460 rules (227 MCP + 233 Skill)
• Zero third-party dependencies

已知问题

• aishield.tools 线上站需 CF Dashboard Retry 重建
• publish-npm / publish-mcp-registry 本 Release 触发

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates adversarial code review processes by integrating a controlled disagreement method. It helps in verifying and validating findings through CI gates and residue declarations. The action supports generating adversarial briefs, packages full reviews, and validates artifacts against a predefined schema. It also provides a guide for filling the artifact and rendering comments.

What’s Changed

Deja escrito cuándo sube el pin de la propia Action del gate: viaja en el próximo PR de trabajo real, salvo que la release corrija la seguridad del gate o cambie la versión del esquema. Y dice que eso es una convención, no un control: las reglas de protección de rama de GitHub no alcanzan a los administradores salvo que se deshabilite el bypass. Cierra #17.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Odin Scan GitHub Action automates smart contract security analysis for CosmWasm, Solana, and EVM projects. It integrates with GitHub workflows to detect vulnerabilities before deployment, providing alerts in pull requests and inline comments on affected files. The action supports platform detection and customizable severity thresholds, allowing users to configure its behavior according to their needs.

What’s Changed

• feat: add comment-triggered PR scans (ac72e5f)
• docs: expand findings-visibility section with threat model and annotation rationale (0404708)
• feat: add findings-visibility input for graduated public disclosure control (f18df59)
• fix: show findings detail in PR comment with fallback to medium (c2e43c8)
• fix: new comment per run, show only critical/high findings, rebuild dist (e237b62)
• feat: use GitHub App installation token for branded PR comments (3abce4e)
• feat: enrich PR comment with emojis, descriptions, and fix report URL (27cc2f2)
• fix: gzip SARIF before base64 encoding for Code Scanning upload (d9eed9f)
• fix: include sourcemap-register.js in dist (bd265af)
• docs: add privacy policy (b78db44)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Plori agent review action creates and manages persistent review workspaces for GitHub repositories. It automates the process of checking out pull request commits, analyzing surrounding code, and running targeted tests to provide detailed feedback on code changes. The action ensures that each repository has a dedicated workspace for reviews, enhancing precision and reducing noise in automated feedback.

What’s Changed

Persistent remote pull-request review with GitHub Actions OIDC and isolated comment permissions.

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates Healthchecks.io into workflows to monitor the health of scheduled jobs and workflows by sending pings at both the start and end of a job’s execution. It automatically sends pings to a specified URL, allowing for real-time monitoring and alerts. The action supports various inputs to customize ping behavior based on run status and workflow triggers.

What’s Changed

• Merge pull request #83 from reecetech/chore/dependabot-rollup-2026-08-27 (962e6b8)
• Bump project dependencies (ce8aea9)
• Merge pull request #66 from reecetech/dependabot/github_actions/EndBug/add-and-commit-10 (be7086c)
• Merge branch ‘main’ into dependabot/github_actions/EndBug/add-and-commit-10 (5fe9907)
• Merge pull request #69 from reecetech/dependabot/npm_and_yarn/types/node-25.5.2 (7aad411)
• Update README (2db2d12)
• Merge branch ‘main’ into dependabot/npm_and_yarn/types/node-25.5.2 (ac6f9ee)
• Merge pull request #71 from reecetech/optional-skip-pings (def3b0f)
• Update compiled action source (dist/*.js) (1e1edac)
• Potential fix for pull request finding (c8ebb2d)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints “Hello World” or “Hello” + a specified name to the log and also outputs the current time. It solves the problem of automating greetings with dynamic names and timestamps in CI/CD pipelines. The action is designed to be simple and reusable for various projects.

What’s Changed

• My first action is ready (5619594)
• Initial commit (2a56a2a)

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Scaleway Serverless Containers GitHub Action simplifies deploying and managing containerized applications on Scaleway by integrating with their platform directly from a CI/CD pipeline. It automates the deployment of containers to a specified registry, namespace, and region, while also providing options for scaling and resource limits. The action supports both simple deploy and teardown workflows using input parameters for configuration.

What’s Changed

What’s Changed

• fix(build): add workflow to check build by @philibea in https://github.com/scaleway/scw-serverless-container-action/pull/5

Full Changelog: https://github.com/scaleway/scw-serverless-container-action/compare/0.0.5...0.0.6

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the analysis of PR files using Amazon Bedrock Agent, enhancing code quality and security assessments. It allows customization of prompts, integrates with Amazon Bedrock Knowledge Bases for context-aware insights, and seamlessly integrates into the PR process with comments posted in markdown format.

What’s Changed

What’s Changed

• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/29
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/30
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/31

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.9.0...v0.10.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI-driven deployment automation tool that simplifies infrastructure setup by translating human-readable descriptions into cloud-native configurations. It enables developers to define their deployment needs in natural language, and Sherpa automatically creates and configures the necessary resources (e.g., servers, DNS, SSL, CDN) to meet these requirements. The tool supports a wide range of cloud providers, frameworks, and deployment scenarios, making it suitable for various projects.

What’s Changed

AI-powered deployments in plain English

Sherpa transforms any cloud provider into a deployment platform. Just describe what you want and let the AI handle the infrastructure.

prompt: “Deploy my Next.js app on AWS Lambda with CloudFront CDN”

Highlights

• Plain English Infrastructure - No YAML configs, no Terraform, no DevOps expertise required
• Multi-Cloud - AWS and Cloudflare supported, with more providers coming
• GitHub Actions Integration - Push-to-deploy workflows with memory persistence
• Claude Code CLI Support - Test locally before committing

Supported Features

Quick Start

- uses: sherpa-sh/sherpa-action@v1.0.0-alpha
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: "Deploy my app to Cloudflare"
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

Alpha Notice

This is an early release. Expect breaking changes and rough edges. We'd love your feedback—please https://github.com/sherpa-sh/sherpa-action/issues or https://discord.com/invite/Pn7N2Wwbjy.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

greenbump is a tool that automatically upgrades dependencies and fixes breaking code changes in your project. It uses AI to detect issues during the upgrade process and provides a loop to fix any errors, ensuring your build and tests pass successfully. The action supports multiple ecosystems and offers features like automatic code repair, multi-round verification, and customizable models for fixing issues.

What’s Changed

Added

• Expanded codemod library: tier-1 free fixes grew from 6 to 24, covering the highest-frequency breaking upgrades reported by users — Express 4→5 (app.del, res.send(status)), Zod 3→4 (error.errors→error.issues, .email()/.url()/ .uuid() shorthand), Node 20→22 (util.is* removal), Lodash 4 (_.pluck, _.contains), React Router 5→6 (<Switch>→<Routes>, useHistory→useNavigate), Mongoose 6→8 (doc.remove()→doc.deleteOne()), plus assert.deepEqual.
• Guidance-only codemods: for breakages too risky to regex-rewrite (ESLint 9 flat config, Axios 1.x, Webpack 5 polyfills, Jest 29+ jsdom split, TypeScript 5 verbatimModuleSyntax, Prettier 3 defaults, Socket.IO 4), tier 1 now matches the failure and surfaces a migration note instead of guessing at a code change. These never mark the tier as “fixed” — they escalate to tier 4 like a miss, but the agent (and the user, via logs) starts with the right context.
• Codemod creates: codemods can scaffold a companion file after a successful transform (e.g. ESLint 9’s eslint.config.js starter). Skipped if the file already exists, so it never clobbers user config.
• Codemod versionRange.toMajor: a codemod can now cover a span of majors (e.g. Mongoose 6→7 and 6→8 both match doc.remove()), not just a single bump.
• Usage & cost report (greenbump --stats [days], default 30-day window): every run appends a local record (~/.greenbump/runs.jsonl, override with GREENBUMP_STATS_DIR) — dep, tier, tokens, cache hit, fixed/needsReview. --stats aggregates them into fix-tier breakdown, LLM calls avoided, actual tokens/cost spent, and an estimated dollar amount saved by tiers 1-3 (labeled as an estimate, never presented as a bill). --stats --json prints the raw summary for scripting. Fully local — no network calls, no telemetry.
• New CLI flags: --stats [days], --json (with --stats).
• New modules:
  • src/engine/stats/recorder.ts (append-only JSONL run log)
  • src/engine/stats/report.ts (aggregation + terminal report + $/M-token pricing table)
• 33 new tests (145 total): 13 new codemod cases (transform, guidance-only, creates, multi-major versionRange), recorder round-trip/corrupt-line-tolerance, and report aggregation (tier counts, window filtering, cost estimation, empty state).

Changed

• tryBuiltinCodemods no longer treats “advice printed” as “applied” — a guidance-only codemod match now returns applied: false with an advice[] list, so the fix loop correctly escalates to tier 4 instead of running a wasted verification check. (Previously this case didn’t exist; called out here since it’s the load-bearing invariant the new guidance codemods depend on.)
• RunSummary/batch group runs now record to the local stats log on every exit path (clean upgrade, unverifiable, and fixed-or-not), not just the LLM fix path.

Impact

• Higher tier-1 hit rate: 4x more codemods means more real-world upgrades resolve at $0 without ever calling an LLM.
• Visible savings: greenbump --stats answers “how much has this tool saved me” with real numbers instead of a single run’s summary.
• Verified end-to-end: Express 4→5 (app.del) and Zod 3→4 (error.errors) both fix with 0 input / 0 output tokens; --stats correctly aggregates both runs.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Canary is a GitHub Action that automates deterministic regression testing and compatibility intelligence for Claude Code. It helps users identify what broke in their codebase, which release first introduced the issue, and compares releases to detect regressions. Canary supports CI workflows and provides detailed reporting on tool/token/reported-cost/duration metrics and deterministic assertions.

What’s Changed

What’s Changed

• ci: add published consumer smoke coverage by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/46
• ci: add stable required status gate by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/47
• docs: sharpen install and distribution README by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/50
• chore: harden community issue intake by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/51
• docs: add community conduct and support standards by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/52
• ci: validate local documentation links by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/54
• chore: add CODEOWNERS routing by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/55
• docs: synchronize public distribution status by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/56
• docs: strengthen pull request checklist by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/57
• docs: make roadmap release reference dynamic by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/58
• docs: consolidate roadmap entry point by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/59
• fix: shorten Marketplace action description by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/60
• docs: mark Marketplace publication live by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/61
• docs: replace roadmap with post-v1.2 product direction by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/62
• feat: release Claude Code Canary v2 compatibility platform by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/63
• fix: pin Claude version in live release E2E by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/64
• chore: retrigger v2.0.0 release candidate by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/65

Full Changelog: https://github.com/SLP-DEV1/claude-code-canary/compare/v1.2.0...v2.0.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a Docker Swarm service. It ensures that all necessary files are bundled and pushed to the repository before deploying, solving the need for manual steps in the CI/CD pipeline. The action simplifies the process by handling dependencies and bundling, allowing developers to focus on application deployment tasks.

What’s Changed

• fix: Update dependencies (5336574)
• fix: Update dependencies (e9c2fe7)
• fix: Update dependencies (0b48905)
• fix: Update dependencies (7cff14c)
• fix: Improve error output (7cd1d73)
• fix: Improve error output (92f3eca)
• fix: Improve error output (4db44f1)
• fix: Update dependencies (0ff3213)
• Create README.md (e1316ba)
• fix: Run bundle in Linux container to ensure dist is the same locally and on github (eb002ab)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates GitHub Classroom results into Google Sheets. It automates the process of updating a specific Google Sheet with student names and task results as they are submitted through GitHub Classroom. The integration uses Google Sheets API credentials stored as secrets in your repository. Users can configure their workflow to automatically update the sheet whenever a new submission is made, making it easier to track and monitor student progress.

What’s Changed

First working version with basic functionality

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the setup of ccache/sccache for C/C++ projects in GitHub Actions, improving build speed by caching compiled binaries. It supports Linux, macOS, and Windows environments and provides options to cache specific jobs or targets separately, offering verbose logging for debugging purposes. The action installs ccache if necessary and sets it as the compiler launcher for C and C++ builds.

What’s Changed

• Support platforms without upstream ccache/sccache releases (#439) (d62db5f)
• update code (05e1c04)
• Bump brace-expansion (#438) (46cafa7)
• Update ccache to 4.13.3 (#441) (1f2fc71)
• Bump @types/node from 25.5.0 to 25.6.0 (#440) (a488765)
• Bump handlebars from 4.7.8 to 4.7.9 (#436) (c97afba)
• update code (3352247)
• Bump fast-xml-parser from 5.4.1 to 5.5.7 (#434) (e44a23f)
• Bump picomatch (#435) (bb3037d)
• update code (1bbbcda)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of fixing Markdown links in a documentation repository. It ensures that links remain valid even after changes are made, such as moving files or folders. The action uses UUIDs to anchor links and automatically updates them if necessary. It also provides an option to convert plain links into robust ones that self-heal in the future. The main purpose of this action is to maintain a reliable reference system for documentation content over time.

What’s Changed

Everything since 0.24.0 — the 0.25.0 / 0.25.1 / 0.26.0 CHANGELOG sections were never tagged on their own; this is the first release that carries them. Consumers pin by SHA or tag: nothing changes for a repo until its darnlink-gate.json ref moves (and recipe_sha256 with it, in the same commit).

Consolidates everything since 0.24.0: the 0.25.0 / 0.25.1 / 0.26.0 sections that had been written ahead of a tag were never released on their own; this is the first tag that carries them.

The gate recipe: verified downloads, recipe_sha256, Windows CR

The shipped CI templates downloaded the recipe and executed it without verifying a byte — both of them, at every released version. recipes/examples/github-actions-darnlink-gate.yml and recipes/examples/Jenkinsfile-stage.groovy now compare recipe_sha256 before chmod +x, warn loudly (instead of silently) when the key is absent, reject a value that is not a 64-hex digest with a message about placeholders rather than crying tampering, and fall back to shasum -a 256 where sha256sum does not exist.

New config key recipe_sha256 — and “new” understates it: consumers had been using the key for months while it appeared nowhere in this repo, so every surface that verified had invented it locally. It is now documented in the recipe’s CONFIG header and in recipes/README.md, including the rule that prevents the failure it is most likely to produce: ref and recipe_sha256 move in the same commit. It is the one key the recipe never reads — whoever fetches the script consumes it, because a downloaded script cannot vouch for its own download. It does not cover darnlink-gate.ps1, which is a different file with a different digest.

Fixed

• recipes/darnlink-gate: the three remaining Python heredocs (finding filter, README-offender count and staged summary) now set sys.stdout.reconfigure(newline="\n"), as read_cfg and read_cfg_len do since #97. On Windows the offender count came back as "N\r", so the [ "$cr" -gt 0 ] test failed with “integer expression expected” and the gate aborted; the finding details carried a trailing CR. Behaviour on POSIX is byte-identical.

• A JSON false turned include_mermaid ON, and default_branch: false reached the tool as --default-branch False, a branch that exists nowhere. read_cfg renders a JSON boolean as the string "False", and [ -n "$X" ] is true for any non-empty string. Five other keys were already normalised; the two that were not sat directly above a case belonging to a key assigned thirteen lines earlier, which is how both were missed. Normalisers now live beside their own assignment.

• A docstring in frontmatter_index.py claimed a leading BOM survives the read. utf-8-sig consumes it. Documentation only — and the same reader’s other docstring already said the opposite, correctly.

• tools/check.sh run as a git hook redirected the suite’s git calls at this repository. git exports GIT_DIR to hooks; tests that build their own repo in a temp dir were silently pointed here, and one ordinary git commit produced a commit that deleted the entire tree. It also made four tests fail only when the suite was acting as the gate.

An inert rung now says so

An inert rung now says so. When the pending-on-default-branch rung cannot identify the repo or its default branch it disables itself — correct — but it did so SILENTLY, and a disabled rung looks exactly like one that ran and found a real break: same web_not_found, same exit 4. Three attempted fixes each looked like they had never arrived, when they had arrived and were switching themselves off. One line on stderr turns that mystery into a datum.

New --default-branch NAME, which wins over both automatic sources. It is the only one that cannot fail, and in CI it is often the only one that CAN answer: the checkout has no origin/HEAD (only the PR ref is fetched) and the credentials for ls-remote are usually scoped to the checkout step rather than to what it spawns.

The default-branch read was inert in CI

The pending-on-default-branch rung was inert in CI, which is the only place it mattered. It read the default branch from origin/HEAD — a LOCAL symref that a CI checkout does not create: a multibranch PR job fetches only +refs/pull/<n>/head:refs/remotes/origin/PR-<n>, so there is no refs/remotes/origin/master and symbolic-ref fails. Every ordinary clone HAS that symref, which is why it looked correct.

The local read stays first (free); the remote is asked with ls-remote --symref only when it fails. Unknown default branch still means inert — guessing main would forgive links in every repo whose default is something else.

A link pending on the default branch is not a broken link

A blob/<default-branch>/<path> URL to a file that exists in the working tree but has not reached the default branch yet was classified web_not_found -> exit 4. In a blocking gate that is a deadlock: the red blocks the merge that would make the link resolve. Measured in the field as not-found 6 on a branch that could not go green before merging and could not merge while red.

It now becomes web_unverifiable — the kind that already existed for “cannot tell from here” — under five conditions, every one of which closes a way a permanently-dead link walked through an earlier draft of this rung, green:

The base of the path join is rev-parse --show-toplevel, not the scanned directory: scanning a subdirectory is supported, and there <path> (repo-relative) compared against the wrong tree. Percent-encoded paths are decoded, so the rung is not silently inert on %2B and %20.

Unknown origin, non-GitHub remote or unknown default branch -> the rung is inert and behaviour is exactly as before. A rung that changed behaviour when it could not identify the repo would be worse than no rung.

⚠️ Consumers pin by SHA, so merging this changes nothing for them until each darnlink-gate.json ref is bumped.

Added

• Feature 017 — the read axis can see a diagram’s click destinations (--include-mermaid, recipe key include_mermaid). Off by default, per repository. A mermaid diagram carries its links in click directives, which live inside a fenced block: feature 002 hides them from every axis, including the read-only ones, so they die silently when a file moves and no gate ever notices. Measured on a real tree, one folder reorganisation killed 14 of a diagram’s destinations at once while everything stayed green.

  • The write operations are unchanged. FR-015 is not amended: repair and robustify still ignore every link inside every fence. This is the read axis only.
  • These links are never anchored — they are report-only. The anchor is a trailing HTML comment, and a diagram treats that as a node rather than a comment, so writing one would corrupt the drawing. A diagram destination that stays plain forever is a normal state.
  • No new dependency. The destination grammar was measured over 2,165 real directives and reduces to three single-line shapes, so it is recognised by a pure textual function; the fenced-region computation is reused rather than reimplemented.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is an unofficial test harness designed to emulate Claude Cowork’s observable runtime contract. It allows developers to script and automate the testing of skills across various scenarios in a headless, CI-friendly environment. The action supports multiple fidelity levels (e.g., replay, full) to capture detailed information about what the agent did, not just its behavior. This helps ensure that skills work as expected within the constraints defined by Cowork’s runtime contract.

What’s Changed

Added

• cowork-harness assertions --list gains a “Skill references (progressive disclosure)” family for the two new keys, so they are not appended to a flat dump nobody reads.

• A guard that a committed cassette’s tool_not_called is actually violable by its own recording. The tool surface at a tier is gate-conditional: at container, mcp__workspace__web_fetch is offered only when coworkWebFetchViaApi is on (17 of 138 measured container runs), and with the gate off WebFetch is offered instead. examples/replays/example-pdf-skill.cassette.json asserts tool_not_called: "mcp__workspace__web_fetch" and passes today only because it was recorded gate-ON — a re-record with the gate off would leave it naming a tool the run could never have called, so it would keep passing while verifying nothing, and nothing in the suite would notice. verify-cassettes’s replaced-builtin note keys on the recorded inventory, never on the assertions, and only covers built-ins being replaced, never the inverse.

  The guard checks every committed cassette’s tool_called/tool_not_called against that cassette’s own frozen init inventory, through the same glob engine the evaluator uses. It deliberately does not cover subagent_tool_absent (judged against the per-dispatch declaredTools, a different inventory) and cannot see alias-class vacuity (tool_not_called: "Task" names a tool that is in every inventory yet never emitted — the agent binary canonicalizes Task to Agent); both are recorded as separate work rather than left implied.

• referencesAccessed — reference access through EVERY tool channel, not just the Read tool. referencesRead counts one channel, and critique’s headline invited a reader to conclude the agent had opened no reference — a claim about reading that a one-channel count cannot support. An agent that cats, greps or globs a reference has reached it just as much. The new RunResult field (and its subagents[] twin) records each file with the channel(s) it was reached through: read (Read.file_path), grep (its path input), and bash (a Bash/mcp__workspace__bash command naming the path).

  All four channels apply the same skillReferenceReadPath() predicate, so a token only counts when it is rooted in the mounted plugin — the agent’s own node scripts/build.js is not a skill-script access, and a non-skill filename never reaches result.json under a field claiming it is skill content. Redirection targets and every argument of a write verb (rm/mv/mkdir/touch/chmod/tee) is excluded, as is a verb that only inspects metadata (ls/test/stat/echo): those are files the command wrote or destroyed.

  It deliberately under-approximates. A cd into the skill dir followed by a bare cat references/x.md, a heredoc body and a $VAR-built path are all invisible, and there are tests pinning them as misses so a later widening is a visible change rather than a silent one.

  Presence is the cannot-verify channel, which is the one way it differs from referencesRead: [] means the drive ran and observed nothing (a real negative); absent means there was no observable drive, and must never be read as “none”. Present on live and replay — cassettes freeze whole tool inputs, so the replay re-drive reconstructs every channel identically.

  referencesRead is unchanged in meaning and is now documented as this field’s read-channel projection, produced by the same capture so the two cannot disagree.

  Scope is main agent ∪ sub-agents, via a single unionReferenceAccesses() derivation shared by the assertion keys, the critique report and --probe dispatch — a dispatcher-shaped skill does all its reading a level down, so judging the top-level list alone would report “never reached” on a run where a sub-agent read the file cover to cover. A truncated cassette (one that could never be driven) reports cannot-verify rather than an empty list, for the same reason.

• reference_read / no_observed_reference_access assertion keys. Gate on whether a skill’s progressive disclosure actually works: a well-partitioned skill and one whose second half is dead look identical from outside. Regex (unanchored, case-insensitive — the same shared helper every regex key uses), main agent ∪ sub-agents, evaluated on replay as well as live.

  The negative key is named no_observed_reference_access, not no_reference_read, because the detector under-approximates by design: it proves nothing was seen, not that the file went unread. Both keys fail evidence-unavailable when the run recorded no observable access list — including the negative one, which is the direction that would otherwise pass vacuously off a missing field. The scenario linter rejects asserting both with the same pattern.

• critique names why the GRADED turn errored — gradedErrorReason in the JSON report and inline in the text NOTE. taskResult: "error" is a legitimate gradeable outcome and the critique still runs, but the report said only “the task run ended in error”, so an exhausted quota or a dropped connection read as a defect in the skill under review.

• critique reports which model produced the GRADED run — gradedModels in the JSON report and graded model(s): in the text header, read back from the graded turn’s own result.json and filtered of the agent’s locally-fabricated <synthetic> entries. The report named the evaluator’s resolved model and no other, so the model that produced the behaviour being graded appeared nowhere. It cannot be inferred from context either: the turns are a subprocess that inherits no model from whatever invoked critique, so an omitted --model silently grades whatever the spawned agent defaults to. A run with nothing recorded now says graded model(s): unknown rather than staying silent. The ids are observed, not requested — read from the model stamped on the graded turn’s assistant messages, not from the flag.

• isLiveModelId (src/types.ts) — the agent-marker filter every consumer of RunResult.models must apply, now declared once beside the field it governs. It replaces three divergent copies, two of which disagreed: src/run/provenance.ts (which renders provenance.model on every JSON envelope) matched the angle-bracket shape, scripts/eval-gate.ts the < prefix — so a malformed or truncated marker such as "<synthetic" was dropped by one and rendered as if it were a model id by the other. The shared rule is the shape.

Changed

• Skill and docs updated for the tier refusal. SKILL.md previously told authors a tier-mismatched tool_not_called “can silently void a web-fetch assertion” when moving a scenario between tiers — the harness now refuses it at load instead, so that guidance described behaviour that no longer exists. The skill’s critique reference gains the referencesAccessed field, its channels, and the []-vs-absent cannot-verify rule.

• subagent_declared_but_unused documents that it fires only on a dispatch that declares a tool list. It reads subagents[].declaredTools, populated from a tools/allowedTools key in the dispatch input. The Agent tool carries neither, so that list is empty and the key passes on every such dispatch — 0 of 1091 real dispatches carry a non-empty list. The key is not wrong, but a green means “not applicable here”, never “no fabrication”, and neither its description nor its docs said so.

• BEHAVIOUR CHANGE: tool_not_called and subagent_tool_absent naming a tool the tier does not serve are now REFUSED at scenario load. tool_not_called: "Bash" at hostloop passed vacuously, always — that tier disallows the built-in shell and aliases it to mcp__workspace__bash, so the run could never have called Bash whatever the agent did. The assertion read as a guarantee and verified nothing. The inverse was equally broken: mcp__workspace__bash at container, where the built-in is served instead.

  The refusal is a UsageError at the point the tier resolves — after fidelity: cowork becomes a real tier, and before any staging, image pull or spawn, so no model spend is wasted. The message names the tool to assert instead, and names the sibling keys that behave differently (tool_called still fails normally; subagent_tool_absent is judged against a per-dispatch inventory this check cannot determine). scenario.py lint WARNs on the same set, before any run at all.

  The table is closed to tools the harness itself removes or registers, and never derived from the launch plan. --tools gates the built-in set alone — the agent binary’s own help says so — while every sandbox tier separately passes --mcp-config. A launch-set-derived check would therefore have rejected tool_not_called: "mcp__example-fs__write_file" for a session using the mcp.config this repo ships an example of, while that tool was registered and callable. Globs are never refused, and the table under-approximates on purpose: REPL at hostloop is vacuous too and is not caught, which is the correct side to err on when the verdict is a hard refusal.

  There is no opt-out, deliberately. The repo’s allow_* modifiers all cover cases where the harness might be wrong about a real signal; a fired reject here cannot be a false positive, so there is no legitimate scenario to rescue. If one is ever found, the table is wrong and the table should change.

  subagent_tool_absent is covered for the same reason tool_not_called is. It reads the tools sub-agents actually USED, not a per-dispatch declared list, so a tool the tier never serves makes it vacuous in exactly the same way — corroborated by the run population, where sub-agent Bash calls appear 20 times, all at container and never at hostloop. Covering one key and not the other would refuse an assertion at hostloop while silently greening the sub-agent form of the identical claim.

  e2e/scenarios/canary-hostloop.yaml carried exactly this defect and is fixed in the same change: its tool_not_called: Bash never proved anything, and its tool_called: mcp__workspace__* already carries the canary’s stated purpose.

• critique’s “no references were Read” headline now says what it observed. It reads the wide signal, names the channels it looked through, and states its own under-approximation in one short clause instead of the load-bearing caveat that did all the work. Where the run recorded no observable tool stream it makes no claim rather than rendering a clean negative. The evaluator’s evidence section moves with it (previously main-agent Reads only — a different population from the headline’s, so widening one without the other would have handed the evaluator a prompt contradicting the report), and the grading prompt now tells the evaluator not to issue a finding whose only support is a path missing from that list. --probe dispatch prints the wide list too.

Fixed

• tool_called: "Task" could never pass and tool_not_called: "Task" always did. The agent binary canonicalizes a set of legacy tool names — Task→Agent, KillShell/KillBash→TaskStop, and nine more — while the spawn tool list still declares the legacy spelling. So the init inventory echoes back Task, every actual dispatch is emitted as Agent, and a literal matcher could never connect the two. Measured across 506 kept runs: Task offered 506 times and called 0; Agent called 188 times and offered 0. The negative form was a permanent vacuous pass in the most common dispatch assertion there is, at every tier.

  All four tool keys (tool_called, tool_not_called, subagent_tool_used, subagent_tool_absent) now match either spelling, through the one shared matcher. Globs see both too — the recorded name is expanded rather than the author’s pattern, so tool_not_called: "Ta*" and "*" are violated by a recorded Agent, which rewriting the pattern would not have fixed.

  Recorded data is unchanged: toolCounts, context.tools and every cassette keep exactly what the agent reported, the same verbatim posture RunResult.models documents. Only matching is alias-aware, so tool_available: "Task" still matches the inventory’s literal Task and no committed cassette changes meaning.

  Still vacuous, and now documented as such: tool_not_called on a tool the tier never offers — Bash at hostloop, or mcp__workspace__bash at container. That is a separate class with a separate fix; the key’s docs and the skill reference now warn about it rather than leaving it implied.

• critique diagnosed an unanswered gate as an infrastructure failure, and named the wrong turn while doing it. A graded run that stopped at an AskUserQuestion gate with no scripted answer exits 2 with a fully-formed {ok:false, error:{category:"unanswered", …}} envelope, but the report read only results[0].outDir and answered “task turn exited nonzero without a parseable result envelope — it crashed before completing a gradeable task” — under a header hardcoded to INFRASTRUCTURE/PROTOCOL FAILURE (reflection turn), though it was the task turn that stopped and no reflection turn had been attempted. Both halves pointed at the wrong subsystem: a reader following the report would audit Docker and the staged agent over what is one scenario flag.

  The report now prefers the failed turn’s own diagnosis, on both turns, carrying its message and hint verbatim (and only once — UnansweredError’s message already contains its hint, so appending it unconditionally printed the whole question, its options and its remedy tip twice). No remedy text is synthesized on top: there are 36 UnansweredError sites and only one is “the skill asked an unscripted question”, so advice keyed on the category is wrong for nearly all of them.

  Two new fields carry the classification — infraFailurePhase (task turn | reflection turn) and infraFailureKind (the harness ErrCategory). The header keys on which category, not on merely having one: unanswered / usage / boundary render as RUN FAILED (<turn>, <kind>); everything else renders as INFRASTRUCTURE/PROTOCOL FAILURE (<turn>) and it fails closed — internal is the CLI’s catch-all for any unexpected throw (Docker down, container start failure, missing staged agent, a harness bug), so an unrecognized category is treated as an instrument failure rather than assumed ordinary.

• A turn that exited 1 was reported as a bare exit code, so an exhausted quota looked like a crash. A turn that RAN and errored exits 1 with a full result envelope whose top-level error is null — its cause lives in results[0], not in an error object. Reading only the error object left the report saying reflection turn exited with code 1 (expected 0) and nothing more, for a run whose actual cause was an exhausted seven-day quota; it was findable only by opening events.jsonl by hand. The failed turn’s resultErrorKind / errorSource / resultSubtype are now read and rendered — usage_limit as “the account’s quota is exhausted; retry after the reset. This is NOT a harness or skill defect”, transport as a retryable tail-end drop — matching how the run renderer has always shown them. usage_limit and transport join the ordinary/actionable set; agent does not, because for critique’s own protocol turn an agent-level failure is the instrument breaking.

What’s Changed

• release: 2.5.0 by @yaniv-golan in https://github.com/yaniv-golan/cowork-harness/pull/161

Full Changelog: https://github.com/yaniv-golan/cowork-harness/compare/v2.4.0...v2.5.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action deploys images to Zenifra and can manage temporary preview environments for pull requests. It supports deploying a main project image, managing preview environments with stable keys, URLs, expirations, and idempotent deletion. The action is secure by using the API key only through GitHub secrets and respects different deployment actions such as auto-upsert or delete based on inputs.

What’s Changed

What’s Changed

• Feat/preview environments by @ramonpaolo in https://github.com/zenifra/action-zenifra-deploy/pull/7

Full Changelog: https://github.com/zenifra/action-zenifra-deploy/compare/v0.0.4...v0.0.5

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action linxDynW/mount-iso automates the process of mounting an ISO image to a specific drive letter and/or folder on Windows. It addresses common issues with identifying the correct volume after mounting, provides failure-proofing features such as atomicity, precondition checks, post checks, and race-free identity verification, and requires Admin privileges and PowerShell 7+ for execution.

What’s Changed

Failure-proof ISO mounting for Windows CI (drive letter and/or folder).

see README for details.

Usage: uses: linxDynW/mount-iso@v1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action analyzes Next.js App Router bundle sizes across pull requests and posts a route-by-route size comparison comment on every PR. It tracks baseline stats for each branch, allowing users to identify changes in bundle sizes and determine if they exceed certain budget thresholds. The action is designed to help developers monitor the performance of their applications over time and ensure that size optimizations are effective.

What’s Changed

What’s Changed

• fix: resolve baseline by base-branch tip SHA instead of the stale branch-indexed run list by @michalsanger in https://github.com/michalsanger/nextjs-turbopack-bundle-size/pull/48

Full Changelog: https://github.com/michalsanger/nextjs-turbopack-bundle-size/compare/v1.9.0...v1.10.0

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

postmortem is an all-in-one supply-chain security scanner for modern software projects that inspects dependencies across multiple ecosystems and flags potential compromises like malicious install scripts, typosquats, and compromised maintainers. It provides reputation intelligence, audit your machine, and deep source inspection, all while ensuring no telemetry or network communication unless explicitly requested.

What’s Changed

Full Changelog: https://github.com/mlab-sh/postmortem/compare/v2.3.0...v2.3.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates adversarial plan and code review with residue declaration. It uses a controlled disagreement method to validate and close reviews automatically with CI gates, ensuring each finding is resolved, refuted with evidence, or escalated to human judgment. The action records how each event ends, including findings’ terminal states and residue, which aims at human reviewer scrutiny instead of quality seals.

What’s Changed

La ronda orquestada: disensor arma el paquete, corre al revisor, mide el árbol y ancla el resultado. El usuario no copia y pega nada entre modelos. Cualquier CLI puede ser el revisor; residue/v0.4 declara la independencia y hace declarable el modo degradado.

• This action is used across all versions by 10 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

AI Review automates code review using AI-powered tools, providing inline comments, summaries, and AI-generated replies directly into merge requests. It supports multiple LLM providers, VCS integrations, customizable prompts, agent mode, and flexible configuration options. This helps teams improve code quality, enforce consistency, and speed up the review process while maintaining human oversight.

What’s Changed

• version (e3e19d6)
• agent (a57145e)
• agent (78c1d98)
• Merge pull request #122 from dansan/fix/agent-loop-unparseable-action (8a59015)
• docs (0e34b81)
• Merge pull request #124 from AlpayY/readme-fix-gitlab-ci-descriptions (d3616aa)
• Fixed GitLab CI/CD deployment descriptions in README (ab9e4da)
• fix(agent): never promote an unparseable action to the final review (be80d10)
• openai (81a1242)
• json (c9fabe9)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The foundry-toolbox-radar-lab GitHub Action is a zero-latency static analyzer that audits Microsoft Foundry Toolboxes before they are deployed. It detects potential security and operational risks related to ungated mutating actions, static credential creep, indirect prompt injection, prompt & context leakage, and scope inflation. The action provides a comprehensive governance defense engine for enterprise AI practitioners deploying autonomous agents on Foundry.

What’s Changed

Foundry Toolbox Radar v0.2.0

Pre-deployment governance, identity auditing, prompt injection detection, and data-leakage scanner for Microsoft Foundry Toolboxes and autonomous AI agents.

Highlights:

• 7-Rule Governance Matrix: Aligned with the OWASP Top 10 for Large Language Models (LLM01, LLM02, LLM06, LLM07).
• Indirect Prompt Injection Detection (RULE-07): Flags instruction overrides, role-hijacks, and exfiltration directives in tool metadata.
• Zero-Dependency CLI (radar): Instant, offline static analysis with clean ASCII reports and machine-readable JSON gates.
• Composite GitHub Action: Seamless integration into automated pull request workflows.
• Pre-Commit Hook Support: Prevents insecure toolbox definitions from entering git history.

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates running Apex unit tests locally on developers’ machines without the need for an org or deployment. It supports all Salesforce Apex features including SOQL, DML, triggers, validation rules, and flows, with comprehensive governor limits enforcement. The action is particularly useful for rapid development feedback cycles and debugging.

What’s Changed

Version v1.2.40

• Enforce MIXED_DML_OPERATION And Gate User Inserts On Manage Users

• Run Platform Event Subscribers With Their Own Mixed-DML State

• Run Async Jobs With Their Own Mixed-DML State

• Lift Manage Users Restrictions For Code Declared Without Sharing

• This action is used across all versions by 18 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Initialize GitHub Job composite action automates the setup steps for initializing a job in GitHub Actions, including security hardening, repository checkout, and multi-language support. It provides features like Node.js, Java, Python, Go, Rust, Swift, build tool setup (Gradle, Task, gomplate, jq, kubectl, Teleport), and automatic caching for dependencies and build artifacts.

What’s Changed

What’s Changed

• chore(deps): Bump step-security/harden-runner from 2.20.0 to 2.20.1 by @dependabot[bot] in https://github.com/PandasWhoCode/initialize-github-job/pull/98
• chore(deps): Bump go-task/setup-task from 2.1.0 to 2.2.0 by @dependabot[bot] in https://github.com/PandasWhoCode/initialize-github-job/pull/99
• chore(deps): Bump testlens-app/setup-testlens from 1.9.3 to 1.9.4 by @dependabot[bot] in https://github.com/PandasWhoCode/initialize-github-job/pull/100
• chore(deps): Bump gradle/actions/setup-gradle from 6.2.0 to 6.3.0 by @dependabot[bot] in https://github.com/PandasWhoCode/initialize-github-job/pull/101
• chore(deps): Bump actions/setup-java from 5.6.0 to 5.7.0 by @dependabot[bot] in https://github.com/PandasWhoCode/initialize-github-job/pull/102
• feat: add kubectl support by @andrewb1269 in https://github.com/PandasWhoCode/initialize-github-job/pull/105
• feat: add teleport client support by @andrewb1269 in https://github.com/PandasWhoCode/initialize-github-job/pull/106

Full Changelog: https://github.com/PandasWhoCode/initialize-github-job/compare/v1.3.1...v1.4.0

• This action is used across all versions by 12 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action customizes the official MegaLinter image to include only specific linters and reduces its Docker image size. It automates the process of checking for new MegaLinter releases, building a customized Docker image with selected linters, and optionally publishing it to both GitHub Container Registry and Docker Hub.

What’s Changed

• build(make): 🔧 common practicalli tasks for projects (fb97086)
• ci(github): 🔧 update actions to latest versions using make dependencies-update (b3a34b2)
• style: delete blank spaces in GitHub workflow config (332a09d)
• ci(megalinter): schedule version check on 1st day of month (34e97d8)
• release(action): latest release of zensical megalinter custom flavor (f3c789b)
• dev: install custom flavor of megalinter for zensical projects (e4fe720)
• Initial commit (a92cd50)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is a framework for building web applications using Go for the backend and Python for the domain layer. It uses UDS+MessagePack for communication between components, with support for Hot Reload in development mode. The action provides a modular structure, includes various modules like authentication, internationalization, admin panel, and notifications, and supports automated updates via GitHub Releases.

What’s Changed

• chore: version interna 2.2.4 (coherente con tag) despues de fix de checksum (5a178e4)
• ci: checksums.txt con nombres sin prefijo dist/ para verificacion portatil (5061dfa)
• ci: release en un solo job - builda 5 binarios + checksums.txt y sube todo junto (8f06be0)
• ci: release workflow con Go 1.26.6 + checksums.txt (cce5aed)
• fix(cli): instalacion/upgrade robusta - binario crudo + checksum (cd65d6e)
• docs: actualizar a v2.2.1 - eliminar rastros v1/DSL y corregir roadmap (c9082ba)
• fix: reparar build roto y tests - unificar module path a ‘pygo-framework’ (f1b4a56)
• v2.2.0: transport layer abstraction - UDS+MessagePack default, gRPC opt-in (cedcece)
• docs: update README.md to v2.1.0 modular architecture and full CLI (274d92a)
• fix(cli): bump version strings to v2.1.0-native in version, info, main (cd27067)

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action starts a secure, trusted OCI registry for a GitHub Actions workflow. It automates the setup of a Kubernetes cluster using Kind, ensuring no need to manually manage certificates or insecure configurations. The action provides various options to customize the cluster and registry settings, making it easy to integrate into CI/CD pipelines securely.

What’s Changed

Default versions:

• kubernetes: v1.37.0
• kind: v0.33.0
• cloud-provider-kind: v0.11.1

What’s Changed

• Track Kubernetes 1.38 development by @scothis in https://github.com/reconcilerio/kind/pull/59
• Bump k8s.io/kubectl from 0.37.0-beta.0 to 0.37.0-rc.0 in /versions/kubernetes/v1.37 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/60
• Bump k8s.io/kubectl from 0.36.3 to 0.36.4 in /versions/kubernetes/v1.36 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/63
• Bump k8s.io/kubectl from 0.37.0-rc.0 to 0.37.0-rc.1 in /versions/kubernetes/v1.37 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/61
• Bump k8s.io/kubectl from 0.36.3 to 0.36.4 in /versions/kubernetes/default by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/62
• Bump k8s.io/kubectl from 0.35.7 to 0.35.8 in /versions/kubernetes/v1.35 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/65
• Bump k8s.io/kubectl from 0.34.10 to 0.34.11 in /versions/kubernetes/v1.34 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/64
• Bump k8s.io/kubectl from 0.37.0-rc.1 to 0.37.0 in /versions/kubernetes/v1.37 by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/66
• Bump k8s.io/kubectl from 0.36.4 to 0.37.0 in /versions/kubernetes/default by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/67
• Bump sigs.k8s.io/kind from 0.32.0 to 0.33.0 in /versions/kind by @dependabot[bot] in https://github.com/reconcilerio/kind/pull/68

Full Changelog: https://github.com/reconcilerio/kind/compare/v1.0.7...v1.0.8

• This action is used across all versions by 4 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The setup-maestro-cli GitHub Action automates the installation and configuration of Maestro, a mobile testing tool for Android. It provides a quick start guide and usage instructions to set up GitHub Actions with Maestro CLI, allowing users to run Maestro commands in their workflows. The action allows specifying a version of Maestro, defaulting to 2.9.0 if not provided.

What’s Changed

1.0.21 (2026-08-27)

Build System

• deps: bump maestro from 2.8.0 to 2.9.0 (#286) (0205438)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action installs the OpenAPI Generator CLI tool and caches it by version, making it easy to automate API client generation tasks in GitHub Actions workflows. It supports generating clients for various languages such as Ruby, Python, Java, etc., and provides options to specify the version and binary name of the tool.

What’s Changed

1.1.14 (2026-08-27)

Build System

• deps: bump actions/setup-java from 5.7.0 to 6.0.0 (#38) (75bf509)

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Amazon Bedrock Agent to analyze files in a pull request (PR), providing customized feedback tailored to your specific requirements. It leverages Amazon Bedrock Knowledge Bases for enhanced context and provides customizable prompts, file ignoring patterns, and language-agnostic analysis capabilities. The integration with AWS enhances the action’s capability by offering more accurate insights and context-aware responses.

What’s Changed

What’s Changed

• 21 closing pr should end agent session by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/27

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.8.0...v0.9.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh automates the deployment of applications by translating human-readable descriptions into cloud infrastructure configurations. It simplifies the process for developers by enabling them to focus on their code without needing to manage complex YAML files or learn DevOps tools. With Sherpa, users can deploy their applications across various clouds like AWS, Google Cloud, and more, while maintaining full control over the infrastructure setup.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Claude Code Canary is a deterministic regression testing and compatibility intelligence tool designed to help developers determine the source of breaking changes in their Claude Code projects. It captures and analyzes metrics, checks deterministic assertions, compares releases, and performs bisection to identify first-bad releases efficiently. Canary supports scenario suites with tags, concurrency, and run budgets, as well as scheduled release watch for regression detection and automatic bisection.

What’s Changed

What’s Changed

• feat: detect efficiency and lifecycle regressions by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/39
• feat: add PR regression checks and committed baselines by @SLP-DEV1 in https://github.com/SLP-DEV1/claude-code-canary/pull/40

Full Changelog: https://github.com/SLP-DEV1/claude-code-canary/compare/v1.0.1...v1.1.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SSG is a fast static site generator written in Go, which converts Markdown with YAML frontmatter into a complete website. It automates tasks such as building the site, serving it locally, and deploying it to various platforms like GitHub Pages, Netlify, Vercel, etc. The action provides features for generating sitemaps, feeds, search indexes, and SEO metadata, among others, making it suitable for creating blogs, portfolios, and other types of websites.

What’s Changed

Installation

Quick Install (Linux/macOS)

curl -sSL https://raw.githubusercontent.com/spagu/ssg/main/install.sh | bash

Package Managers

• Homebrew: brew install spagu/tap/ssg
• Snap: snap install ssg
• Debian/Ubuntu: Download .deb file below
• Fedora/RHEL: Download .rpm file below

Checksums

See checksums.sha256 for file verification.

📖 Full documentation: https://github.com/spagu/ssg#readme

What’s Changed

• 1.8.52 — media the site actually serves, and one front page in the sitemap by @spagu in https://github.com/spagu/ssg/pull/221

Full Changelog: https://github.com/spagu/ssg/compare/v1.8.51...v1.8.52

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates GitHub Classroom with Google Sheets, allowing instructors to automatically update grades and submission status directly into a Google Sheet. The action uses Google Sheets API credentials to authenticate and interact with the spreadsheet, updating specified columns based on task results from GitHub Actions workflows.

What’s Changed

• Updated comments (bf17880)
• Updated .dockerignore (498a6f7)
• Updated readme (bbb6b5a)
• Changed dockerfile to docker pull (8c8584b)
• Changed dockerfile to docker pull (23fa131)
• Fixed inputs (844c583)
• Merge pull request #5 from SPGC/using-result-base64-string (042d99f)
• Fixed input name (92dd201)
• Merge pull request #4 from SPGC/using-result-base64-string (79dad97)
• Code cleanup and fix bug with empty env variables (b474731)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Runward is an open-source delivery methodology that verifies engineering decisions behind AI-generated code. It ensures deterministic verification of architectural, security, and operational aspects during the software delivery lifecycle using plain code. Runward helps developers understand and ensure the correctness of their engineered systems after deployment.

What’s Changed

Every defect says what found it

Each of the register’s entries now carries a found-by field from a closed vocabulary, guarded by test and back-filled from headings and first-hand knowledge; two entries say not-recorded because nobody wrote it down and guessing would be the fabrication the register exists to refuse. Read across all 87 the mix is 59 adversarial-audit, 14 mutation-instruction, 4 while-reproducing, 3 declared, 2 existing-guard, 2 not-recorded, 1 ci-os-leg, 1 conformance-corpus, 1 measurement — and the derivation, with three worked examples and the answer to “we already do code review”, is what-found-them.md. The header mix is recomputed from the rows, never edited by hand.

The author now submits to the constraint the tool sells: the repository’s own Stop hook runs node dist/cli.js check --strict from the tree’s build, and the only bypass appends to a committed log.

compliance instructed: 300 verdicts, re-measured to 289

The module entered the mutation perimeter with 300 surviving mutants and a ratchet that REFUSED (“never instructed”). A seven-agent fleet filed every one — each hole with a mission recipe that was RUN, each equivalence with a sensitivity control, zero contention — and the whole net replayed all 300: seven died against a leg (six smoke, one audit-corpus), six of which the instruction had already filed defence-in-depth with the right leg named. One verdict was reclassed, which is the argument for running the net rather than reasoning about it (ADR-0046 decision 3).

What the concentration taught: the module’s only byte-for-byte guard renders eu-ai-act, pins the OSCAL JSON and never the markdown, on a fresh mission whose gate is red — so nothing walked clean, implemented, the prose depth, or a single byte of the three readiness drafts. The instruction found the one-mutant reintroductions of RWD-2026-0058 (prose implemented) and RWD-2026-0061 (two vocabularies for one fact) before any of them could ship.

After the fixes below changed three source lines, the tree was re-measured (8 CI chunks), the predicted MISMATCH read exactly 1 new survivor and 12 orphan keys — three of them filed holes retired by the new guards themselves — and the register is fresh again: 289 survivors, every one filed, 557 across both modules.

Fixed — two shipped defects the instruction surfaced

• A Windows checkout reported zero agentic-risk coverage (RWD-2026-0083). compliance.ts kept the pre-RWD-2026-0016 frontmatter delimiter while rules.ts and conformance.ts were fixed, and the constant is named FRONTMATTER in all three. Measured on a CRLF-rewritten corpus: runward rules --json reads 10/10 ASI categories, the pack writes 0/10 — same tree, same pass, exit 0. Invisible here because this repository’s own .gitattributes pins every checkout to LF: the fix that made the project’s measurements honest is what hid the defect from them. The guard compiles and runs every FRONTMATTER delimiter found in src/lib against a CRLF document, so a copy of the old pattern under a new name still fails.
• One ADR status line, four readers, four spellings (RWD-2026-0084). On **Status** : accepted — the space French typography requires — the pack printed accepted while the same run counted the decision not ratified, the ADR-0033 reopening watch skipped it, and a draft rejected with that spelling would have been resurrected against ADR-0038. All four readers now go through one exported adrStatusLine in mission.ts, and a recurrence guard asserts no other module in src/lib spells the pattern at all.

The trust apparatus records its own defects

Three defects in the measurement layer itself, found the day the second module landed, filed per the RWD-2026-0060 precedent (RWD-2026-0085..0087): the register generator hard-coded ## Module: evidence and filed 300 compliance survivors under the wrong module — the module is now read off each verdict’s stable key, one section per module; the key-shape guard split on the wrong separator character, compared 1 to 1 and could not fail — pointed at the real SEP it failed at once, for the second reason that its statement was also wrong; and the register test’s heading regex could not parse (top level), so top-level rows were appended to the previous function. None of the three ever put a false byte in a committed artifact, and the register now says so with the same evidence discipline it applies to the product.

The runtime answer, stated as product

docs/positioning.md gains the sibling of its release-stage section: runward’s runtime product is a verification contract, not a process — the attestation at delivery (ADR-0055 layers 1–5), any policy engine verifying it at admission (the Kyverno reference, layer 6), the operator-wired harness hooks in session (ADR-0039) — and the five ADR-0054 boundary crossings stated as a buyer-facing guarantee rather than a roadmap gap. Nothing new is decided; the page that has the charge assembles three ratified decisions into one answer.

The register describes the tree again — and the instruction found three more things

The 2026-08-26 fixes added 148 lines to evidence.ts, and the CI ratchet came back MISMATCH with 75 survivors the register did not carry. A three-agent fleet instructed all of them in isolated worktrees: 32 holes, 35 equivalents, 7 defence-in-depth, 1 display-only, each hole carrying a mission recipe that was RUN, each equivalence carrying a sensitivity control. The register is regenerated at 268 survivors across 22 functions (164 hole, 69 equivalent, 26 display-only, 9 defence-in-depth) and the ratchet is green.