v1.12.0

New Collectors

• gitlab (experimental) — collects GitLab project settings, protected-branch and approval rules, access permissions, and merge-request metadata. Populates the same .vcs.* schema as the GitHub collector, so VCS and ticket policies work on GitLab-hosted repositories (#274).

Improvements

• vcs: .vcs.pr is now split along producer/consumer lines. A source collector (GitHub or GitLab) produces .vcs.pr.*, and the ticket collectors (jira, linear) and change-management checks consume it — so the same policies run unchanged regardless of which forge hosts the repo (#274).
• backstage collector: validates catalog-info.yaml tags against Backstage's own tag rules, catching invalid tags before they reach the catalog (#275).
• backstage cataloger: adds include/exclude filters for type, lifecycle, domain, and system, so you can scope which entities are cataloged (#272).
• jira collector: resolves the PR's ticket from the description as well as the title, validated against Jira before it is collected (#271).

Fixes

• nodejs policy (engines-pinned): a project that correctly pins engines.node no longer false-fails (#273).