v0.4.7

• A PR in a repo with issues turned off is watched instead of reported as gone. GitHub answers
  every issues/ path there with 404 while pulls/ still reads, so explain said "not found"
  and a run could not follow the PR. The item now reads through pulls/N, without the issue
  comments and cross-references GitHub will not serve there; reviews still alert. When such a
  repo's check and status reads also 404, CI is none instead of unknown. Anywhere else a CI 404
  is still unknown, never "passed".

v0.4.6

• A mention alerts only when something new names you. GitHub keeps a thread's reason "mention" for
  every later update (CI, a label, an approval, the merge), so semantic-router#4658 raised 21
  "someone mentioned you" in a day with one real mention among them. The lookup now reads a PR's
  reviews and inline comments too, and when nothing since the last handled update names you, the
  update is not an alert, on any thread, not only a megathread. Replaying the logged alerts on
  #4658, #4802 and #4539: 34 become 3, each saying who asked. A lookup that cannot finish still
  alerts.
• An item's body counts as a mention only when the item is new since the last handled update, or
  it newly names you. GitHub points latest_comment_url at the item itself for any update that is
  not a comment, so that never meant the body changed. The state remembers, per thread, which
  reviews and body named you (notifications.named), so a review or body edited to add your name
  still alerts though its timestamp is old (found by Codex in review).
• An assignment notification alerts only when the thread has an assigned event for you since the
  last handled update (one call); #4555 said "someone assigned you" again when it closed.
• Your issue closed as completed (by the merged PR that fixes it, say) is news, not "CLOSED without
  merging: check why".
• Label rules (IN-PROGRESS label missing, NEEDS REBASE) apply only to open items.
• From review (Codex, Opus): a record starts only from a complete look; a new item's body alerts
  once; a PR's reviews are read whole (a busy PR passes 100, every lone inline reply being one), so
  it is not "unknown" on every update; a reply that is not a list makes the lookup unknown instead
  of failing the notifications source; your PR closed without merging alerts whatever its reason.

v0.4.5

• inbox puts your own open item under what waits on you when a maintainer's last comment or
  COMMENTED review came after your last word, even with no @you (Switchyard#855): "maintainer
  replied after you". An approval does not count.
• Review bodies and inline review comments are read for mentions. An inline reply naming you after
  your last word is an unanswered mention (semantic-router#4658). Inline comments cost one call a
  run, only on your own open PRs with a human review.
• A notification thread you already read on your phone or the web still alerts when it updates
  (all=true). The first run after the upgrade records the threads already read without alerting.
• A push after a change request answers it, as a reply does: the head commit's date counts, read
  only while the request is unanswered (one call). "waiting N days" counts it too.
• Your own issue or PR closed by someone else without a merge alerts as an action (closed), and
  so does someone else being assigned to it (assigned_other).
• inbox marks a row whose item could not be read for over an hour, next to the newest read:
  "stale: last read 3 h ago".

v0.4.4

• A semantic-router /accept from a maintainer who comments as MEMBER now alerts. The gate also
  passes once the bot's accepted label is on, since the bot applies it only after checking the
  commenter's access. Xunzhuo's /accept on #4555 never fired the gate before. MEMBER alone still
  does not count, because any org member can type /accept. A pack gate can name such a label with
  the new label key. The label counts only on issues you filed. A gate that first appears on a
  closed item is recorded without an alert.
• The merge check behind maintainer touches reads up to 20 of a person's reviewed, merged PRs (was
  5). Switchyard maintainers' own merges sit as deep as 13th.

v0.4.3

• On Python 3.9 (stock macOS python3), the gh extension's error now names the two quick fixes,
  brew install python or uv tool install gh-upstream-watch (uv brings its own Python), before
  the option to pin v0.3.3.
• A maintainer whose org membership is private now counts as a maintainer. GitHub labels such a
  person CONTRIBUTOR, so inbox said "no maintainer touch yet" after one had commented. A CONTRIBUTOR's
  comment or review newer than the last labeled maintainer touch now counts if that person merged one
  of their 5 most recent reviewed PRs in the repo. It is still GET-only: one search plus up to 5 PR
  reads per person, only on your own open work (the only place inbox shows it), and none when a
  labeled maintainer spoke last. Each answer is kept in the state file (mergers) and asked again
  after a week. Rule-pack gates are unchanged.

v0.4.2

• Each GitHub Release carries signed build provenance for the wheel and sdist
  (gh_upstream_watch-X.Y.Z.sigstore.json; check a file with gh attestation verify FILE --repo colinmcnamara/gh-upstream-watch). The release's tests now run in their own job, away from the
  signing token. GitHub Releases are immutable from this release on.
• The repository has a Code of Conduct, issue and PR templates, an OpenSSF Scorecard workflow and
  badges, and a "Status and support" section in the README.

v0.4.1

Exit codes that match the README, from fact-checking the docs against the code:

• A bad --hook path (relative, or not executable) exits 2, a config error, instead of 1. If a
  script checks for 1 here, change it to 2.
• migrate with a missing or unreadable --from file exits 2 with a message, not a traceback.
• A state file from a newer version exits 2 and stays where it is (it is never moved aside).
• migrate writes the state file under the same lock a run holds: while a run is in progress it
  exits 3 and writes nothing.
• init --schedule on a machine with neither launchd nor systemd refuses an --interval cron
  cannot run (one that does not divide 60). --interval's help now says init --schedule uses it.

v0.4.0

Quality and supply chain:

• Python 3.10 or newer (3.9 reached end of life in October 2025). On 3.9, install
  gh-upstream-watch<0.4.
• Releases carry PEP 740 attestations: PyPI shows each file's signed provenance from this
  repository's release workflow. The TestPyPI smoke test now runs in a job that holds no publishing
  token, and the release tests the exact wheel it publishes.
• A failed webhook delivery (a redirect or a 5xx) no longer leaks its socket.
• The gh extension says plainly when python3 is older than 3.10 (stock macOS has 3.9).
• Tests refuse to run the real gh, launchctl, systemctl, notifiers or claude through
  subprocess or os.system, with tripwires for child processes, and run with a temporary home
  directory and no GitHub credentials (limits in CONTRIBUTING). Strict pytest (warnings are
  errors, a 30s timeout), a branch-coverage floor, mypy, a wider ruff rule set, workflow linting
  with zizmor, CodeQL (GitHub's code-scanning default setup), contract tests on real GitHub reply
  shapes, and tests against the built wheel and sdist. See CONTRIBUTING, "Quality gates".

v0.3.3

For a laptop that sleeps:

• Scheduled runs wait for the network: --wait-network SECONDS (the scheduler entries pass 180)
  waits for GitHub to answer before the run and skips the run, with one offline: log line and no
  state change, if it never does. Before, the first run after wake often met a network that was not
  up yet and called every source unknown.
• Runs every 15 minutes by default (was 30).
• The stuck alert is set in time, not runs: escalate_after_hours (default 3), so it means the same
  at any interval. A config that still sets escalate_after_runs keeps the old run-count rule.
• The launchd agent uses calendar slots (:00, :15, :30, :45 by default) when the interval divides 60.
  launchd runs a slot missed during sleep once on wake; StartInterval did not, so a Mac could go
  hours after waking with no run. Regenerate it with gh-upstream-watch init --schedule.
• init --schedule checks --interval too (0 or a negative number used to get through).

v0.3.2

From a day of real use:

• done OWNER/REPO#N: you handled what waits on you there (a thank-you mention, say). It leaves
  inbox until a new reason, mention or review arrives.
• Packs can name CI checks that are red by design (ci_by_design): such a failure waits on a
  maintainer, not on you, and raises no ci_failed. The new bundled vllm pack lists
  pre-run-check, red on a first-time contributor's PR until a maintainer starts CI.
• Packs can quiet labels a bot flips back and forth (quiet_labels). semantic-router's
  pr/needs-review and pr/needs-rebase flips no longer alert; the bot adding pr/needs-rebase
  still does, once, as NEEDS REBASE.
• inbox and done read your rule packs (local files), so a broken pack now stops them with the
  same error run gives.