[dependabot]

Bumps pharn-dev/pharn-ci from 0.2.0 to 0.4.0.

Release notes

Sourced from pharn-dev/pharn-ci's releases.

v0.4.0

Org policy and the app link-up. The Action can fetch an org policy (policy input) and upload the redacted run bundle (upload input) to the pharn.dev app, a new policy mode reads agent settings and MCP configs (rules P01–P11), agent PRs are detected (meta.isAgentPr), and check A7 scans agent configs for secrets. With no policy and no app the report is the one 0.3.0 produced; nothing was removed or renamed. See Security for the new network surface and file reads.

Added

• Org policy rules P02–P06, and policy mode: with a policy in force the CLI and the Action read the tracked agent settings files (.claude/settings.json and .claude/settings.local.json, root and nested) and, when the policy lists MCP servers, .mcp.json, .cursor/mcp.json and .vscode/mcp.json, at HEAD. P02 flags an allow rule that overlaps a forbidden permission, defaultMode bypassPermissions or auto, and additionalDirectories; P03 a missing required deny rule; P04 an MCP server that is not allowlisted; P05 a forbidden MCP server; P06 a missing required hook. New message codes POLICY_P02 to POLICY_P06 and POLICY_SETTINGS_INVALID (a file the rules could not fully use, or did not read); P09 now judges those edits as a block, warn or info. Nothing read from a file is printed.
• meta.isAgentPr in the Action's report, with meta.prAuthor, meta.prLabels, meta.coAuthors and meta.agentHint: whether the pull request counts as an agent PR, from its author, its commits' authors, committers and Co-authored-by trailers, and its labels (agent and ai-generated by default). Seven known agents are recognized. Evidence that cannot be read in full (an unknown author, unreadable commits, more than 250 commits) counts as an agent PR. Metadata only: the verdict, the messages, the comment and the exit code do not change. In core: detectAgentPr, parseCoAuthorTrailers, agentPrMetaFields, withAgentPrMeta, KNOWN_AGENTS and DEFAULT_AGENT_LABELS.
• schema/policy.v1.json: the JSON Schema (draft 2020-12) for version 1 of the policy document, the file that will tell pharn-ci what "safe to merge" means for a repository, shared with the pharn.dev app. A pure validator in core (validatePolicy, and parsePolicyJson for JSON text) checks a document against it: it never throws, never repeats a value from the document in an error, and bounds its work on any input. The org policy entry below is what reads it.
• Org policy. The Action takes two inputs, policy (auto, never, required or file:<path>, default auto) and app-url (default https://pharn.dev), and the CLI two flags, --policy-file <path> and --no-policy. With policy: auto or required and an OIDC token (permissions: id-token: write), the Action makes one GET of the pharn.dev policy endpoint, sending only the OIDC token and the repository name, and applies the served policy over the workflow inputs and .pharn/ci.yml: it raises the threshold, setup.require and the test-integrity mode, replaces the exclusions and the coverage root, sets per-signal severities and the accept label, and adds setup.expect tools. A file: policy carried by the pull request can only tighten. Two new message codes: POLICY_UNAVAILABLE (warn, error under policy: required) and POLICY_OVERRIDE_IGNORED (warn). With no token, policy: never or no policy, the report is the one it was.
• Check A7, secrets in agent configs. The CLI and the Action read the committed text at HEAD of the machine-readable agent setup files (.mcp.json, .cursor/mcp.json, .vscode/mcp.json, .claude/settings*.json, .codex/config.toml, .gemini/settings.json, opencode.json, .aider.conf.yml, the files under .claude/hooks/ and the .json, .yaml and .yml files under .continue/rules/; never the Markdown kinds) and report ten shapes of secret (GitHub, Anthropic, OpenAI, Google, AWS, Slack, Stripe, private keys, URL passwords and tokens, and secret-like values under secret-named keys). Twelve message codes, AGENT_CONFIG_SECRET_S01 to AGENT_CONFIG_SECRET_S11 and AGENT_CONFIG_SECRET_UNSCANNED: S01 to S09 are error and fail the check, S10 is warn, S11 is info, and files that could not be scanned are named in the unscanned code (error when a drop could hide a secret). Report v2 only gains codes; the message-code description in schema/report.v2.json names them. In the Action, the files are read only for a diff from the local checkout; in PR-number mode and for a compare-API diff the message says nothing was read.
• A redaction module in @pharn-ci/core: findSecretSpans, redactSecrets, truncateUtf8, redactMessage and MESSAGE_MAX_BYTES. Nothing outside check A7 uses it yet.
• Upload of the run to pharn.dev. The Action takes an upload input (auto or never, default auto) and sets a run-url output. With auto, a job that grants id-token: write and an organization that installed the Pharn

... (truncated)

Changelog

Sourced from pharn-dev/pharn-ci's changelog.

Changelog

All notable changes to pharn-ci are recorded here. The format follows Keep a Changelog, and versions follow Semantic Versioning. Before 1.0, a breaking change bumps the minor version. Releases are cut by a maintainer; see docs/RELEASING.md.

[Unreleased]

Added

• The Action input fail-on-verdict, the new name of fail-on-threshold (review 2026-11-01, finding 27): it gates on the verdict, whatever made it fail, not only on the coverage threshold. fail-on-threshold still works when fail-on-verdict is not set, with a deprecation warning, and is ignored (with a warning) when both are; both stay declared in action.yml, which no longer gives either a default (the default, true, is applied in code, so a set old name is never shadowed).

Changed

• The Action applies two things the pharn.dev app contract already named (review finding 15 f and g). No schema change, no new input, no new message code and no new host.

  • The app's settings.messageMaxBytes now lowers the upload's per-message cap: the cap is the smaller of 2048 bytes and that setting, taken only from a policy response that validated whole in the same run (never under policy: never or a file: policy). The app's other settings (uploadJunit, redactMessages) and its quarantine list are validated and still not applied.
  • meta.mergeBase is recorded for a run with a local diff: the merge base of the resolved base and meta.headSha (the pull request's head, so on a pull_request run the fork point, not the base tip), one extra local git merge-base per run at most. Every other run, and a git merge-base that fails or prints no object id (a shallow checkout), records null and changes nothing else. Matrix legs of one job remain a documented limit (docs/LIMITS.md).

• The Action's packages/action/dist/index.js shrinks from about 11.7 MB to about 1.7 MB: the TypeScript parser no longer sits inside it. scripts/bundle.mjs copies typescript@5.9.3's lib/typescript.js byte for byte beside the bundle as packages/action/dist/typescript.js (9.1 MB, the dist's second committed file), and the Action loads it only when a pull request makes it parse a test file or test config, after checking its sha256 against a pin in packages/action/src/vendored-typescript-pin.ts. A file that does not match the pin fails the step with an error naming the file and both hashes, and nothing is reported. A run that parses no test file never reads it. The CLI still inlines the parser. No schema change and no new message code. See docs/THREAT-MODEL.md, G1.

• One source for three text rules in @pharn-ci/core (text.ts): the code-unit comparator byCodeUnit (about 50 copies, in core, node-io and the tests, are gone), the surrogate-safe cut cutCodeUnits (the … inside the limit, an option for a cut without it, never inside a surrogate pair) and utf8ByteLength. No limit number, message code or schema changes. Two byte-level effects: a TI09 value (base/head) is now cut to at most 80 code units, … included (it was 81), and a key text to at most 100 (it was 101); and the three cuts that could leave a lone surrogate (TI01 and TI06 details, the 500-unit test name) no longer do.

• The Action's run.ts items of the 2026-11-01 review. No schema change and no new message code.

  • A PR comment or job summary cut as a last resort (the messages alone over the limit) now closes every collapsed <details> section it cuts into before the truncation note, so the note is no longer hidden inside it (37).
  • Fewer GitHub API calls (47): a pull request is read once per run (in pr-number mode it was read up to three times: the target, the agent PR detection and the accept label), and the comments and the token's login are listed once for the upload's comment link, the pointer and the sticky comment (they were listed twice when an

... (truncated)

Commits

• a9314e9 chore: release 0.4.0 (#118)
• 3a74cc1 feat(core): policy rule P07, setup consistency of agent instructions (E3 item...
• 463a1be feat(core): policy rules P02–P06, agent settings and MCP config (E3 item 23) ...
• c6b685b feat(core): policy rule P11, protected paths for agent PRs (E3 item 24a part ...
• 93376a9 feat(core): policy rules P01, P08, P09, P10 and the Policy section (E3 item 2...
• c8fdc65 feat(action): upload the redacted run bundle to the app (E3 item 21) (#113)
• f563d7d feat(action): policy fetch, policy input and precedence (E3 item 20) (#112)
• 502f290 test: make growth-ratio tests robust under host load (#111)
• 2d625eb feat(action): agent-PR detection, meta.isAgentPr (E3 item 24a part A) (#110)
• 3ed722f feat(core): secrets in agent configs S01–S11 and redaction (E3 item 26) (#109)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b5cf25f7-0330-4659-a7aa-60cd3801517e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[github-actions]

🛡️ pharn-ci · ⚠️ Warn

Warning

Warn · This change adds no coverable lines; 38 agent setup files found.

Verdict	Diff coverage	Test integrity	Agent setup
⚠️ Warn	no coverable lines	none (block)	38 files

🧪 Diff coverage

No coverable lines changed.

🔍 Test integrity

No test-integrity findings (mode: block).

💬 Messages (3)

• ℹ️ NO_COVERABLE_CHANGES No added lines are tracked by the coverage report; nothing to measure.
  • Hint: Nothing to do if the change has no code; otherwise check that the coverage report includes the changed files.
• ℹ️ COVERAGE_PATHS_PARTIALLY_UNMATCHED 122 file paths in the coverage report are not tracked files in the repository; their coverage is not used.
  • Hint: Nothing to do if those files are generated or outside the repo; if changed files are missing from the table, check the coverage root.
• ⚠️ CONFIG_CHANGED_IN_DIFF This change edits files that configure this check: `.github/workflows/ci.yml`, `.github/workflows/pharn-ci-comment.yml`. Review them before trusting the verdict.
  • Hint: Review the config and workflow changes before trusting the verdict; protect .pharn/ci.yml and .github/workflows/ with CODEOWNERS.

🤖 Agent setup (38 files)

Agent setup: 38 files · claude-code

Agent setup files (38)

Path	Kind
.claude/agents/pharn-review-lens.md	claude-agent
.claude/commands/pharn-build.md	claude-command
.claude/commands/pharn-dev-build.md	claude-command
.claude/commands/pharn-dev-eval.md	claude-command
.claude/commands/pharn-dev-grill.md	claude-command
.claude/commands/pharn-dev-memory-promote.md	claude-command
.claude/commands/pharn-dev-plan.md	claude-command
.claude/commands/pharn-dev-regress.md	claude-command
.claude/commands/pharn-dev-review.md	claude-command
.claude/commands/pharn-dev-ship.md	claude-command
.claude/commands/pharn-dev-verify.md	claude-command
.claude/commands/pharn-grill.md	claude-command
.claude/commands/pharn-loop-close.md	claude-command
.claude/commands/pharn-loop-quick.md	claude-command
.claude/commands/pharn-loop.md	claude-command
.claude/commands/pharn-memory-promote.md	claude-command
.claude/commands/pharn-plan.md	claude-command
.claude/commands/pharn-regress.md	claude-command
.claude/commands/pharn-review.md	claude-command
.claude/commands/pharn-ship-close.md	claude-command
.claude/commands/pharn-ship-quick.md	claude-command
.claude/commands/pharn-ship-stages.md	claude-command
.claude/commands/pharn-ship.md	claude-command
.claude/commands/pharn-spec.md	claude-command
.claude/commands/pharn-test.md	claude-command
.claude/commands/pharn-verify.md	claude-command
.claude/hooks/enforce-writes-scope.cjs	claude-hook
.claude/hooks/enforce-writes-scope.test.cjs	claude-hook
.claude/hooks/hook-wiring.test.cjs	claude-hook
.claude/hooks/protect-trusted-paths.cjs	claude-hook
.claude/hooks/protect-trusted-paths.test.cjs	claude-hook
.claude/hooks/require-loop-record.cjs	claude-hook
.claude/hooks/require-loop-record.test.cjs	claude-hook
.claude/hooks/set-writes-scope.cjs	claude-hook
.claude/hooks/set-writes-scope.test.cjs	claude-hook
.claude/hooks/writes-scope-release.test.cjs	claude-hook
.claude/settings.json	claude-settings
CLAUDE.md	claude-md

---

_{pharn-ci 0.2.0 · report schema v2 · coverage format lcov}