Native Action outputs
The composite Action now exposes three validated scalar outputs for downstream workflow steps:
- verdict: READY, REVIEW, or BLOCKED
- policy_verdict: the contribution-policy verdict
- issue_verdict: FREE, REVIEW, TAKEN, or SKIPPED when no issue was requested
The Action performs one audit, preserves the requested text or JSON output byte-for-byte, and writes only those enums to GITHUB_OUTPUT. Reports, source excerpts, comments, tokens, and full JSON do not become outputs. Strict blockers still publish truthful verdicts before exiting 1; API, validation, rendering, and output-preflight failures leave outputs unset.
Support and security
- repository Discussions now provides an answerable Q&A channel for real usage questions
- Issues remain the path for reproducible bugs and features; vulnerabilities stay private
- the schema test validator no longer accepts an arbitrary file path
- CodeQL alert #1 was fixed through code, not dismissed; the release has zero open CodeQL alerts
Validation
The merge commit passed 62 deterministic regressions, exact text/JSON compatibility checks, JSON Schema format validation, ShellCheck 0.11, Actionlint, CI, and both CodeQL language analyses. A GitHub-hosted runner executed the composite Action itself and verified READY / DISCLOSE / SKIPPED through native step outputs.
The immutable v1.2.0 tag and stable v1 alias both point to the verified merge commit.