v1.5.2

Fixes

• Language policies no longer fire on components that merely use a language in CI. A "backend" component that ran npm somewhere in CI — but was never a Node project — was getting the full Node.js policy applied and failing checks like "no lockfile" / "no package.json". Project-structure checks across all 13 language plugins are now gated on actual project detection (.lang.<lang>.project_exists) and skip when the code collector didn't find a project. "Min version in CI" checks stay ungated — observing a runtime/tool in CI is enough to enforce a minimum, no project file required (#209).
• github collector / branch-protection: stop failing open to enabled=false on transient API errors. A mid-collection GH App token rotation (or any 401/403/429/5xx/network blip) was coerced into a confident-but-wrong .vcs.branch_protection.enabled=false / source=none, intermittently flipping vcs report-PR checks (branch-protection-enabled, require-pull-request, disallow-force-push) to FAIL on correctly-protected repos. The collector now distinguishes API errors from genuine absence (captures the HTTP status, retries transient failures with backoff) and marks the run errored — retaining last-known-good .vcs data — instead of overwriting it with a wrong value. [ENG-1005] (#215).

Improvements

• sca policy: clearer max-severity failure message. When the threshold is crossed, the check now names the offending packages/CVEs (most-severe-first, e.g. high: golang.org/x/net — CVE-2023-44487 (fix: 0.17.0)), capped at 20 with an "and N more" tail, instead of only "High vulnerability findings detected". Summary-only collectors (no per-finding data) keep the bare headline. Also drops a stray webhook mention from the policy description (#214).