v4.0.3

4.0.3 (2026-10-29)

Documentation

• add the standard badge row to the README (ec3bf4f)

v4.0.2

4.0.2 (2026-10-29)

Bug Fixes

• list every commit type in the release notes (7cad2af)

Documentation

• list the commits behind each release that had an empty changelog entry (a8e96ed)

v4.0.1

4.0.1 (2026-10-03)

Continuous Integration

• let Dependabot propose npm updates after a week's cooldown (61e0d17)
• lint workflows with actionlint and zizmor (55471b2)
• stop persisting checkout credentials and expanding needs into shell (a87d391)

v4.0.0

4.0.0 (2026-10-03)

Bug Fixes

• check: model a settings violation as about the repository, not a file (750277b)
• workflow-merge-group: treat a plan without rulesets as no merge queue (2c58bed)

BREAKING CHANGES

• check: a violation from settings-merge-methods,
  settings-required-checks or settings-review-thread-resolution now has
  repository (owner/name) in place of file, in the library and in the
  json output, and Violation is FileViolation | RepositoryViolation, so
  code that reads violation.file must handle it being undefined.
  GitHubCheckFunction returns RepositoryViolation, the other check
  function types return FileViolation, and githubAnnotation takes only
  the violation.

v3.0.0

3.0.0 (2026-10-03)

Bug Fixes

• import-graph: exempt imports declared only in fields the layout does not read (28671ce)
• settings-merge-methods: treat required linear history as blocking merge commits (4898443)
• workflow-credentials: require blanking only the token variables a publish reads (18015f0)
• workflow-job-ordering: read a junction's results through its environment variables (6a789fa)
• workflow-merge-group: require the trigger only where a merge queue exists (49ddccb)
• workflow-runner-resolution: export the hosted label default and name the unhosted fallback (3ef9bca)
• workflow-runner-resolution: read a format() fallback through the reusable workflow's inputs (40ef206)

BREAKING CHANGES

• workflow-merge-group: BranchRules has a required mergeQueue field. A custom
  GitHubClient must return it from branchRules: true when a merge_queue
  rule applies to the branch, else false. With a client, a run now asks
  it for the rules of the branch when a workflow lacks the trigger, so
  set the repository option of workflow-merge-group where the origin
  remote does not name the repository.
• settings-merge-methods: BranchRules has a required requiredLinearHistory field.
  A custom GitHubClient must return it from branchRules: true when a
  required_linear_history rule applies to the branch, else false.

v2.0.2

2.0.2 (2026-10-03)

Performance Improvements

• type-level: parse the default library once and skip checking it (9bfcf78)

v2.0.1

2.0.1 (2026-10-03)

Continuous Integration

• pin third-party actions by commit SHA (33d95fa)

v2.0.0

2.0.0 (2026-10-03)

Bug Fixes

• eslint: accept a working directory relative to the process (0d13200)
• eslint: note how many files the lint covered (24c5b7f)
• eslint: report a message without a position at its file (95b7e6e)
• imports: check the root package and fail when no package is found (d91ea0e)
• instruction-symlinks: ask for a link only beside a tracked README (c1c1096)
• settings: name GitHub's message and report a plan without rulesets (d51d30b)

chore

• deps: migrate to @exadev/config 2 (34b1151)

Features

• cli: print the result as JSON or GitHub Actions annotations (e504b0c)

BREAKING CHANGES

• deps: the configFiles option of runChecks is the
  ConfigFileOptions of @exadev/config 2, so merge and presetSchema are no
  longer top-level options; pass them per file shape as
  unified: { merge, presetSchema } and standalone: { merge, presetSchema }.

v1.7.0

1.7.0 (2026-10-03)

Bug Fixes

• judge a peer dependency only when its range admits one version (3ed2af3)

Features

• add the engines-floor check (074d554)

v1.6.0

1.6.0 (2026-10-03)

Features

• add workflow-release-job check for the publishing job's credentials (0bd2928)