Skip to content

v0.1.3

Choose a tag to compare

View all tags
@adiprathapa adiprathapa released this 17 Aug 03:23
· 32 commits to main since this release
v0.1.3
10768bf

Gate runs untrusted pull request code in a hardened sandbox, captures the preview deploy, and publishes a design review as a sticky comment and a Check Run. It does not produce the critique itself; you point it at a critique service such as apatureai/verdict.

Upgrade if you use verify_stability

v0.1.2 rejects verify_stability in .gate.yml with Unrecognized key, and publishes a neutral "The .gate.yml file is invalid, so Gate skipped this review." It does not fail your PR, but you get no reviews and no hint that the tag is the cause. @v1 now points here.

A green check can no longer mean nothing was verified

An engine can now retract its own grade. grade is a required field, so an engine whose every finding was deleted before it could be reported still has to put something there and it floors to ship. Coverage cannot catch that case: the route was reviewed, so coverage is full and truthful while the grade means nothing. Gate stripped the engine's retraction at parse and published the green tick anyway, in blocking mode as well as advisory. It now withholds the grade, and treats a retraction reason it has not been taught as a retraction rather than defaulting to a pass.

Two things that were CLI-only now cross the wire

Gate tells the engine which component libraries the repository declares, so the deep prompt carries the right rubric addenda. It sends ids rather than detected text on purpose: package.json is part of the untrusted pull request, and letting its contents into the prompt would make a PR's own manifest an injection channel.

verify_stability: true in .gate.yml asks the engine to capture each page twice and compare the bytes.

Honest limitations

Gate produces no critique on its own. Without a critique service configured it publishes a neutral Check Run saying so, never a pass. Component-library detection reads the root package.json only, so a monorepo declaring its UI dependencies in a workspace package is not detected. The sandbox supervisor's resource caps are Linux-only; on other runners the time ceiling still applies.

Assets 2
Loading