gh-before-you-contribute v1.2.0

Native Action outputs

The composite Action now exposes three validated scalar outputs for downstream workflow steps:

• verdict: READY, REVIEW, or BLOCKED
• policy_verdict: the contribution-policy verdict
• issue_verdict: FREE, REVIEW, TAKEN, or SKIPPED when no issue was requested

The Action performs one audit, preserves the requested text or JSON output byte-for-byte, and writes only those enums to GITHUB_OUTPUT. Reports, source excerpts, comments, tokens, and full JSON do not become outputs. Strict blockers still publish truthful verdicts before exiting 1; API, validation, rendering, and output-preflight failures leave outputs unset.

Support and security

• repository Discussions now provides an answerable Q&A channel for real usage questions
• Issues remain the path for reproducible bugs and features; vulnerabilities stay private
• the schema test validator no longer accepts an arbitrary file path
• CodeQL alert #1 was fixed through code, not dismissed; the release has zero open CodeQL alerts

Validation

The merge commit passed 62 deterministic regressions, exact text/JSON compatibility checks, JSON Schema format validation, ShellCheck 0.11, Actionlint, CI, and both CodeQL language analyses. A GitHub-hosted runner executed the composite Action itself and verified READY / DISCLOSE / SKIPPED through native step outputs.

The immutable v1.2.0 tag and stable v1 alias both point to the verified merge commit.

gh-before-you-contribute v1.1.0

Structured, attributable evidence

The JSON interface now publishes schema version 1 with bounded, typed evidence for policy findings and issue-availability signals. Every match identifies its source and role, so integrations can explain why an audit returned READY, REVIEW, BLOCKED, FREE, or UNAVAILABLE without parsing prose.

Compatibility and safety

• preserves existing text reports, verdicts, and exit behavior
• fails closed when GitHub returns incomplete or malformed evidence
• distinguishes decisive signals from advisory context
• keeps GitHub access read-only and adds no telemetry
• validates every deterministic JSON variant against the checked-in schema
• documents the bounded-excerpt privacy consideration for private repositories

Validation

The release commit passed 46 deterministic regression tests, 27 exact compatibility comparisons, ShellCheck 0.11, Actionlint, JSON Schema format validation, CI, CodeQL, and an independent adversarial review with no P0-P2 findings.

The immutable v1.1.0 tag and the stable v1 alias both point to the verified merge commit.

gh-before-you-contribute v1.0.2

Correctness and contributor-safety patch.

• Ambiguous pull-request mentions now return REVIEW instead of falsely classifying an issue as taken.
• Strict mode preserves that ambiguity without turning it into a false blocker.
• The deterministic regression suite now covers 16 policy, timeline, availability, and ambiguity paths.
• Evidence-first issue forms collect a minimal redacted reproduction, environment details, public evidence, and explicit safety checks.
• The pull-request template records fail-closed, read-only, privacy, test, and AI-disclosure boundaries.

The exact release commit passed CI and CodeQL on master with zero open code-scanning, Dependabot, or secret-scanning alerts.

gh-before-you-contribute v1.0.1

Security and correctness patch for issue availability and policy discovery.

• Closed and assigned issues are now immediately classified as TAKEN.
• Required GitHub API failures stop with exit code 2 instead of becoming missing evidence.
• Genuine Contents API 404 responses remain a valid NO-DOCS / REVIEW result.
• Policy files use GitHub raw media responses; the platform-specific base64 step is gone.
• actions/checkout v7.0.1 is pinned to its verified release commit.
• Regression fixtures cover closed, assigned, 404, 403, 503, metadata, and timeline failure paths.

The stable v1 tag now points to this signed patch release. CI and CodeQL pass with zero open alerts.

gh-before-you-contribute v1.0.0

The first reusable release turns the original policy and issue checks into a GitHub CLI extension and composite Action.

Highlights:

• one gh before-you-contribute OWNER/REPO [ISSUE] command
• explainable READY, REVIEW, and BLOCKED outcomes
• text and structured JSON output
• strict automation exit codes
• read-only GitHub Action available through the stable v1 tag
• deterministic fixtures, ShellCheck, actionlint-compatible CI, support and security policies

Install with:

gh extension install SirHegel/gh-before-you-contribute

The integration performs read-only GitHub API requests and sends no telemetry.