Sourced from pharn-dev/pharn-ci's releases.

v0.4.0

Org policy and the app link-up. The Action can fetch an org policy (policy input) and upload the redacted run bundle (upload input) to the pharn.dev app, a new policy mode reads agent settings and MCP configs (rules P01–P11), agent PRs are detected (meta.isAgentPr), and check A7 scans agent configs for secrets. With no policy and no app the report is the one 0.3.0 produced; nothing was removed or renamed. See Security for the new network surface and file reads.

Added

• Org policy rules P02–P06, and policy mode: with a policy in force the CLI and the Action read the tracked agent settings files (.claude/settings.json and .claude/settings.local.json, root and nested) and, when the policy lists MCP servers, .mcp.json, .cursor/mcp.json and .vscode/mcp.json, at HEAD. P02 flags an allow rule that overlaps a forbidden permission, defaultMode bypassPermissions or auto, and additionalDirectories; P03 a missing required deny rule; P04 an MCP server that is not allowlisted; P05 a forbidden MCP server; P06 a missing required hook. New message codes POLICY_P02 to POLICY_P06 and POLICY_SETTINGS_INVALID (a file the rules could not fully use, or did not read); P09 now judges those edits as a block, warn or info. Nothing read from a file is printed.
• meta.isAgentPr in the Action's report, with meta.prAuthor, meta.prLabels, meta.coAuthors and meta.agentHint: whether the pull request counts as an agent PR, from its author, its commits' authors, committers and Co-authored-by trailers, and its labels (agent and ai-generated by default). Seven known agents are recognized. Evidence that cannot be read in full (an unknown author, unreadable commits, more than 250 commits) counts as an agent PR. Metadata only: the verdict, the messages, the comment and the exit code do not change. In core: detectAgentPr, parseCoAuthorTrailers, agentPrMetaFields, withAgentPrMeta, KNOWN_AGENTS and DEFAULT_AGENT_LABELS.
• schema/policy.v1.json: the JSON Schema (draft 2020-12) for version 1 of the policy document, the file that will tell pharn-ci what "safe to merge" means for a repository, shared with the pharn.dev app. A pure validator in core (validatePolicy, and parsePolicyJson for JSON text) checks a document against it: it never throws, never repeats a value from the document in an error, and bounds its work on any input. The org policy entry below is what reads it.
• Org policy. The Action takes two inputs, policy (auto, never, required or file:<path>, default auto) and app-url (default https://pharn.dev), and the CLI two flags, --policy-file <path> and --no-policy. With policy: auto or required and an OIDC token (permissions: id-token: write), the Action makes one GET of the pharn.dev policy endpoint, sending only the OIDC token and the repository name, and applies the served policy over the workflow inputs and .pharn/ci.yml: it raises the threshold, setup.require and the test-integrity mode, replaces the exclusions and the coverage root, sets per-signal severities and the accept label, and adds setup.expect tools. A file: policy carried by the pull request can only tighten. Two new message codes: POLICY_UNAVAILABLE (warn, error under policy: required) and POLICY_OVERRIDE_IGNORED (warn). With no token, policy: never or no policy, the report is the one it was.
• Check A7, secrets in agent configs. The CLI and the Action read the committed text at HEAD of the machine-readable agent setup files (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings*.json, .codex/config.toml, .gemini/settings.json, opencode.json, .aider.conf.yml, the files under .claude/hooks/ and the .json, .yaml and .yml files under .continue/rules/; never the Markdown kinds) and report ten shapes of secret (GitHub, Anthropic, OpenAI, Google, AWS, Slack, Stripe, private keys, URL passwords and tokens, and secret-like values under secret-named keys). Twelve message codes, AGENT_CONFIG_SECRET_S01 to AGENT_CONFIG_SECRET_S11 and AGENT_CONFIG_SECRET_UNSCANNED: S01 to S09 are error and fail the check, S10 is warn, S11 is info, and files that could not be scanned are named in the unscanned code (error when a drop could hide a secret). Report v2 only gains codes; the message-code description in schema/report.v2.json names them. In the Action, the files are read only for a diff from the local checkout; in PR-number mode and for a compare-API diff the message says nothing was read.
• A redaction module in @pharn-ci/core: findSecretSpans, redactSecrets, truncateUtf8, redactMessage and MESSAGE_MAX_BYTES. Nothing outside check A7 uses it yet.
• Upload of the run to pharn.dev. The Action takes an upload input (auto or never, default auto) and sets a run-url output. With auto, a job that grants id-token: write and an organization that installed the Pharn

... (truncated)

Sourced from pharn-dev/pharn-ci's changelog.

Changelog

All notable changes to pharn-ci are recorded here. The format follows Keep a Changelog, and versions follow Semantic Versioning. Before 1.0, a breaking change bumps the minor version. Releases are cut by a maintainer; see docs/RELEASING.md.

[Unreleased]

Added

Changed

• TI03 now blocks an unconditional skip added to a test that exists at base however the change writes it (review B1): a test renamed to it.skip(…) or it.skipIf(true)(…) with the same body, a describe.skip wrapped around existing tests, an existing test moved into a skipped describe, and pytestmark = pytest.mark.skip(…) added at module level or in a test class. When the test index compared the files, TI03 now also reads the base-to-head test pairs TI05 reads and the describe, test-class and pytestmark modifiers around each test, giving one finding per line. The Python index and the line reader read pytestmark. Deliberate precision change: an unguarded in-body pytest.skip(), pytest.xfail() or self.skipTest() added to an existing test now blocks when the Python index ran (it warned). The line reader's sentence for a skip in a test the diff shows as new now says only what the diff shows: "A skip was added to a test that no removed line of this file opens, so the diff shows it as new." No schema change and no new message code.

Security

• Unparseable or binary agent settings and MCP files are now errors whatever the policy lists (review A3-F2). A settings file that is too deep, not JSON, not an object or binary used to be only a warning unless the policy set a required deny list or hook list, and such an MCP file was always only a warning, so a pull request could pad .claude/settings.json or .mcp.json past the parser's depth limit, keep it valid for Claude Code and loosen the policy without a block. Now POLICY_SETTINGS_INVALID is an error and the verdict fails, and P09 blocks an edit to such a file. This is a deliberate tightening: a repository with an already broken settings or MCP file under a policy that reads it now fails where it warned (P02 is in force under every policy, so this applies to any policy document). No schema change and no new message code.

[0.4.0] - 2026-10-27

Org policy and the app link-up. The Action can fetch an org policy (policy input) and upload the redacted run bundle (upload input) to the pharn.dev app, a new policy mode reads agent settings and MCP configs (rules P01–P11), agent PRs are detected (meta.isAgentPr), and check A7 scans agent configs for secrets. With no policy and no app the report is the one 0.3.0 produced; nothing was removed or renamed. See Security for the new network surface and file reads.

Added

• Org policy rules P02–P06, and policy mode: with a policy in force the CLI and the Action read the tracked agent settings files (.claude/settings.json and .claude/settings.local.json, root and nested) and, when the policy lists MCP servers, .mcp.json, .cursor/mcp.json and .vscode/mcp.json, at HEAD. P02 flags an allow rule that overlaps a forbidden permission, defaultMode bypassPermissions or auto, and additionalDirectories; P03 a missing required deny rule; P04 an MCP server that is not allowlisted; P05 a forbidden MCP server; P06 a missing required hook. New message codes POLICY_P02 to POLICY_P06 and POLICY_SETTINGS_INVALID (a file the rules could not fully

... (truncated)

• a9314e9 chore: release 0.4.0 (#118)
• 3a74cc1 feat(core): policy rule P07, setup consistency of agent instructions (E3 item...
• 463a1be feat(core): policy rules P02–P06, agent settings and MCP config (E3 item 23) ...
• c6b685b feat(core): policy rule P11, protected paths for agent PRs (E3 item 24a part ...
• 93376a9 feat(core): policy rules P01, P08, P09, P10 and the Policy section (E3 item 2...
• c8fdc65 feat(action): upload the redacted run bundle to the app (E3 item 21) (#113)
• f563d7d feat(action): policy fetch, policy input and precedence (E3 item 20) (#112)
• 502f290 test: make growth-ratio tests robust under host load (#111)
• 2d625eb feat(action): agent-PR detection, meta.isAgentPr (E3 item 24a part A) (#110)
• 3ed722f feat(core): secrets in agent configs S01–S11 and redaction (E3 item 26) (#109)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)