v0.15.0

Minor Changes

• 30709ee: release-per-merge.yml takes two optional inputs, release-files and after-version, so a caller can carry files into its release. release-files names an artifact the caller uploaded earlier in the same run: the version job downloads it, and the tag job downloads it and attaches its assets/ files to the lone package's Release, in the one gh release create call, so the Release never exists without them. after-version is a shell command run in the version job, in the repository root, with RELEASE_FILES set to the downloaded artifact, after changeset version and before the release commit, only when a releasable package moved: what it writes is in the commit that is tagged and published, and a non-zero exit fails the job before any commit. Both default to empty, and a caller that sets neither releases exactly as before.

v0.14.0

Minor Changes

• 0ed1a5b: The generated .github/workflows/dependabot-auto.yml has a concurrency block (A11-254): the runs for one pull request share a group, and a newer pull-request event cancels the older run, so a rebase or a burst of pushes leaves one run and a person's push cancels an approve still running for the push before it. A ci completion is its own group, keyed by its run id, and is never cancelled, so a red gate is always commented. The template changed, so a consumer's dependabot-config --check goes red on this release until dependabot-config --write is run there.

v0.13.0

Minor Changes

• d69a40e: dependabot-config --write also writes .github/workflows/dependabot-auto.yml (A11-254), and --check fails when it has drifted. The workflow approves a Dependabot patch, minor or non-major GitHub Actions update as the Octo STS App when every commit on the pull request is Dependabot's, and hands it to auto-arm.yml's arm-approved, so it merges when gate is green with no person. A major is never approved. It dismisses its own approvals when someone else pushes to the branch, reruns an infrastructure failure of ci once, and comments any other red gate with the failing jobs' error lines. --check also reads the repository's two hand-written Octo STS policies (.github/chainguard/dependabot-approve.sts.yaml, pinned to dependabot[bot]'s id and main's copy of the workflow, and dependabot-guard.sts.yaml), fails when auto-arm.yml has no arm-approved job, and fails when any other workflow submits an approving review. A repository adopting this release needs the two policies before its --check passes.

v0.12.0

Minor Changes

• 89c8aa9: dependabot-config writes the directory of each local composite action (.github/actions/<name>/action.yml) into the repository's github-actions entry, beside /, as directories: of the one entry. Dependabot reads a local action's uses: only when its directory is named, so control's actions/cache pin inside its ansible-collections action, which the hand-written file covered, stays covered after A11-253 (a11ign/control#144). A repository with no local action gets the same file as before; the template changes only for one that has one, so a consumer's drift check goes red on this release only in control.

v0.11.0

Minor Changes

• 0a4b607: dependabot-config writes and checks every repository's .github/dependabot.yml from one template (A11-253): weekly at one fixed time, one <ecosystem>-minor-and-patch group per ecosystem with majors apart, the deps commit prefix, a seven-day cooldown, Dependabot's default labels, and the packages frozen by policy (FROZEN, exported as ./dependabot-frozen) ignored in every npm entry beside the workspace's own packages. --check fails, with the diff and the --write command, when the committed file is not what --write produces. A repository's .github/dependabot-extra.json can add only an ignore with its reason, npm directories and a versioning strategy. The conventions A11-254 and A11-255 read are exported as DEPENDABOT_GROUP_SUFFIX, DEPENDABOT_COMMIT_PREFIX and dependabotGroupName. readLayoutTree takes the names of further files to read as text, and workspacePackageNames is exported from ./layout-check.

v0.10.2

Patch Changes

• 007fb8f: New export @a11ign/toolchain/refusal-owners-are-open: the reader that checks a release gate's REFUSED strings and ::error lines name an OPEN owning row. refusalsInPackageJson, refusalsInWorkflow, refusalsInTree, ownersOf, findings, failures, describe and readIssueState are the reader; readIssueState(repo) takes the repository a bare #n names, so the caller supplies its own. A CLOSED or unreadable owner fails, and only OPEN passes.

v0.10.1

Patch Changes

• 235d885: withGitSandbox throws SandboxNotRemovedError, naming the directory and the pid, when the sandbox directory is still there after its removal, so a surviving sandbox fails the test that made it instead of surfacing in another process's teardown. Removal is an optional third argument, { remove }, a seam for that test; the default is unchanged. Closes a11ign/a11ign#5520.

v0.10.0

Minor Changes

• 2df8c57: isolation-gate no longer reads layers.json: it packs every packages/* directory that is not private, and a layer's checkout is no longer special-cased. The export leftOutLayerCheckouts is removed with it, and the gate's CLI no longer prints a "leaving out" line. A consumer that still calls leftOutLayerCheckouts must drop the call; a repository that keeps a layer checkout under packages/ and does not want it packed must keep that checkout out of packages/ itself.

v0.9.0

Minor Changes

• 1054d19: lib/ci-changed no longer classifies an ansible category: ClassifyResult loses the ansible field, jobsFor never returns "ansible", and the CLI's output block no longer prints ansible=. The category was a change to layers.json, and each repository now checks its own playbooks. A consumer that read steps.<id>.outputs.ansible gets an empty value; the core's ci.yml reader is removed by a11ign/a11ign#4920.

v0.8.0

Minor Changes

• 20ed0ca: walk-scope takes the project's root from A11IGN_PROJECT_ROOT when it is set, so a repository can import @a11ign/toolchain/lib/walk-scope instead of keeping a declared copy of it. Without it REPO_ROOT is the directory two levels above the module, which installed as a dependency is the toolchain's own copy under the consumer's node_modules: a guard's WALK_SCOPE was then relative to the wrong tree and reads of the project were not observed. The value must be an absolute path to an existing directory (it is resolved to its real path, as the package-relative root is); a value that is not -- missing, a file, relative, or empty -- throws at import and names the value, rather than falling back to the toolchain's own tree. Unset, nothing changes (a11ign/a11ign#4873, following #4718 and agent-org#522).