Sourced from pharn-dev/pharn-ci's releases.

v0.4.0

Org policy and the app link-up. The Action can fetch an org policy (policy input) and upload the redacted run bundle (upload input) to the pharn.dev app, a new policy mode reads agent settings and MCP configs (rules P01–P11), agent PRs are detected (meta.isAgentPr), and check A7 scans agent configs for secrets. With no policy and no app the report is the one 0.3.0 produced; nothing was removed or renamed. See Security for the new network surface and file reads.

Added

• Org policy rules P02–P06, and policy mode: with a policy in force the CLI and the Action read the tracked agent settings files (.claude/settings.json and .claude/settings.local.json, root and nested) and, when the policy lists MCP servers, .mcp.json, .cursor/mcp.json and .vscode/mcp.json, at HEAD. P02 flags an allow rule that overlaps a forbidden permission, defaultMode bypassPermissions or auto, and additionalDirectories; P03 a missing required deny rule; P04 an MCP server that is not allowlisted; P05 a forbidden MCP server; P06 a missing required hook. New message codes POLICY_P02 to POLICY_P06 and POLICY_SETTINGS_INVALID (a file the rules could not fully use, or did not read); P09 now judges those edits as a block, warn or info. Nothing read from a file is printed.
• meta.isAgentPr in the Action's report, with meta.prAuthor, meta.prLabels, meta.coAuthors and meta.agentHint: whether the pull request counts as an agent PR, from its author, its commits' authors, committers and Co-authored-by trailers, and its labels (agent and ai-generated by default). Seven known agents are recognized. Evidence that cannot be read in full (an unknown author, unreadable commits, more than 250 commits) counts as an agent PR. Metadata only: the verdict, the messages, the comment and the exit code do not change. In core: detectAgentPr, parseCoAuthorTrailers, agentPrMetaFields, withAgentPrMeta, KNOWN_AGENTS and DEFAULT_AGENT_LABELS.
• schema/policy.v1.json: the JSON Schema (draft 2020-12) for version 1 of the policy document, the file that will tell pharn-ci what "safe to merge" means for a repository, shared with the pharn.dev app. A pure validator in core (validatePolicy, and parsePolicyJson for JSON text) checks a document against it: it never throws, never repeats a value from the document in an error, and bounds its work on any input. The org policy entry below is what reads it.
• Org policy. The Action takes two inputs, policy (auto, never, required or file:<path>, default auto) and app-url (default https://pharn.dev), and the CLI two flags, --policy-file <path> and --no-policy. With policy: auto or required and an OIDC token (permissions: id-token: write), the Action makes one GET of the pharn.dev policy endpoint, sending only the OIDC token and the repository name, and applies the served policy over the workflow inputs and .pharn/ci.yml: it raises the threshold, setup.require and the test-integrity mode, replaces the exclusions and the coverage root, sets per-signal severities and the accept label, and adds setup.expect tools. A file: policy carried by the pull request can only tighten. Two new message codes: POLICY_UNAVAILABLE (warn, error under policy: required) and POLICY_OVERRIDE_IGNORED (warn). With no token, policy: never or no policy, the report is the one it was.
• Check A7, secrets in agent configs. The CLI and the Action read the committed text at HEAD of the machine-readable agent setup files (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings*.json, .codex/config.toml, .gemini/settings.json, opencode.json, .aider.conf.yml, the files under .claude/hooks/ and the .json, .yaml and .yml files under .continue/rules/; never the Markdown kinds) and report ten shapes of secret (GitHub, Anthropic, OpenAI, Google, AWS, Slack, Stripe, private keys, URL passwords and tokens, and secret-like values under secret-named keys). Twelve message codes, AGENT_CONFIG_SECRET_S01 to AGENT_CONFIG_SECRET_S11 and AGENT_CONFIG_SECRET_UNSCANNED: S01 to S09 are error and fail the check, S10 is warn, S11 is info, and files that could not be scanned are named in the unscanned code (error when a drop could hide a secret). Report v2 only gains codes; the message-code description in schema/report.v2.json names them. In the Action, the files are read only for a diff from the local checkout; in PR-number mode and for a compare-API diff the message says nothing was read.
• A redaction module in @pharn-ci/core: findSecretSpans, redactSecrets, truncateUtf8, redactMessage and MESSAGE_MAX_BYTES. Nothing outside check A7 uses it yet.
• Upload of the run to pharn.dev. The Action takes an upload input (auto or never, default auto) and sets a run-url output. With auto, a job that grants id-token: write and an organization that installed the Pharn

... (truncated)

Sourced from pharn-dev/pharn-ci's changelog.

Changelog

All notable changes to pharn-ci are recorded here. The format follows Keep a Changelog, and versions follow Semantic Versioning. Before 1.0, a breaking change bumps the minor version. Releases are cut by a maintainer; see docs/RELEASING.md.

[Unreleased]

Added

• The Action input fail-on-verdict, the new name of fail-on-threshold (review 2026-11-01, finding 27): it gates on the verdict, whatever made it fail, not only on the coverage threshold. fail-on-threshold still works when fail-on-verdict is not set, with a deprecation warning, and is ignored (with a warning) when both are; both stay declared in action.yml, which no longer gives either a default (the default, true, is applied in code, so a set old name is never shadowed).

Changed

• The Action's run.ts items of the 2026-11-01 review. No schema change and no new message code.

  • A PR comment or job summary cut as a last resort (the messages alone over the limit) now closes every collapsed <details> section it cuts into before the truncation note, so the note is no longer hidden inside it (37).
  • Fewer GitHub API calls (47): a pull request is read once per run (in pr-number mode it was read up to three times: the target, the agent PR detection and the accept label), and the comments and the token's login are listed once for the upload's comment link, the pointer and the sticky comment (they were listed twice when an upload was tried, including when the app answered 404). A failed listing is still asked again by the next reader. The config and base-ref inputs are read once, and the coverage file is read from the inputs after the org policy, as the CLI reads it.
  • The base is decided once for the diff and for report.json (45): meta.baseSha is now the base the diff was taken against, recorded only when it is a full commit SHA. With a base-ref branch name, a pull_request run used to record the PR base and a push run the previous commit; both now record null. A 64-character (SHA-256) commit SHA as base-ref is no longer also tried as origin/<sha>.
  • The warning for a truncated PR-head file list in pr-number mode names what may miss files: the agent setup scan, the secret scan and the org policy's forbidden-file rule (P08) (48). docs/THREAT-MODEL.md residual 36 records why a bot's marker comment still counts as pharn-ci's own when the token's login is unknown: no API names an installation token's own login.
  • An unexpected exception in the upload is still failed with the reason internal and never changes the check, and its log line now names the error class (never its message); with debug logging (RUNNER_DEBUG=1) it then fails the step with the message, so it can be found (28). A 413 from the app is still read without its body: the app's API defines none, so maxBytes stays null (29, docs/LIMITS.md).
  • Not changed: finding 39 (the two test-sources tests vi.mock("@pharn-ci/core")) is dropped. The mock is a pinned spy-through to the real check(); replacing it would delete the test that pins it, which TI02 correctly blocks.

• Docs and metadata (second review, 2026-11-01): README says nothing phones home only without id-token: write, the quick precedence sentence no longer claims .pharn/ci.yml "can only tighten" (only the test-integrity mode is merged; an input replaces the config's threshold, file, root, format and setup.require), the token-footprint bullet names the accept-label reads, and the AI-agnostic and "fully stateless" sentences name P11 and the opt-in upload. SECURITY.md best practices name what id-token: write turns on. docs/THREAT-MODEL.md §1 names the pharn.dev app, its responses, app-url and the OIDC token, and §3 gains item 37 (the threshold comes from the PR). docs/LIMITS.md §1 points at TI02, TI05 and TI06 instead of "not detected yet", gains "What P01 misses", and says

... (truncated)

• a9314e9 chore: release 0.4.0 (#118)
• 3a74cc1 feat(core): policy rule P07, setup consistency of agent instructions (E3 item...
• 463a1be feat(core): policy rules P02–P06, agent settings and MCP config (E3 item 23) ...
• c6b685b feat(core): policy rule P11, protected paths for agent PRs (E3 item 24a part ...
• 93376a9 feat(core): policy rules P01, P08, P09, P10 and the Policy section (E3 item 2...
• c8fdc65 feat(action): upload the redacted run bundle to the app (E3 item 21) (#113)
• f563d7d feat(action): policy fetch, policy input and precedence (E3 item 20) (#112)
• 502f290 test: make growth-ratio tests robust under host load (#111)
• 2d625eb feat(action): agent-PR detection, meta.isAgentPr (E3 item 24a part A) (#110)
• 3ed722f feat(core): secrets in agent configs S01–S11 and redaction (E3 item 26) (#109)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)