v1

MergeJudge runner Action v1

• GitHub Action: run reviews in your own GitHub Actions with your own AI key (uses: gauravsharmaGG/mergejudge-runner@v1).
• Deep mode: with actions/checkout and review.mode: deep, reads surrounding code from the workspace (no hosted indexer).
• Learning: collect lessons from PR feedback and open proposal PRs on a schedule or manual dispatch.

The review engine (core/) is open source under MIT. The hosted MergeJudge GitHub App is a separate product.

See the README for the workflow snippet and setup.

v0.7.0

0.7.0

Action release for the "answer every finding" gate (#46). Git tag v0.7.0; the Action major tag v1 points here.

• Optional "answer every finding" and round cap. review.answer_findings: true keeps the lane from being auto while an AI inline comment is unanswered: answered means the thread is resolved or a person replied with a reason (at least 8 characters). The lane is only ever raised to review, and the summary says why. If the threads cannot be read, the check is skipped with a note. Replies starting with dismiss:, dismissed: or won't fix: now count as dismissals for the learning loop. review.max_rounds: N (0 to 10, default 0 = off) makes the AI review only the files changed since the last reviewed commit once a PR passes N reviewed commits; the rules still run on every file, comments on the other files are left alone, and the round count lives in a hidden marker in the summary comment. Both are off by default and change nothing then. Action/CLI only for now: the hosted Worker does not pass threads or rounds yet. The Action now posts under its own hidden summary marker and only ever touches its own comments and threads: next to the hosted MergeJudge app on the same PR it keeps a separate summary comment (so the rounds counter is not lost), its answer gate counts only its own findings, and it never edits or resolves the app's inline comments.

• "Not checked" no longer claims policy files are missing when one was loaded. The default policy files are alternatives (REVIEW_POLICY.md, REVIEW.md, APPROVAL_POLICY.md, AGENTS.md, CLAUDE.md). If any of them was read, the comment no longer lists the others as "missing or empty". The line appears only when none was found, and then it lists every configured file, REVIEW.md included.

• Optional "Where it sits" strip. comment.where_it_sits: true adds a collapsed table under the PR story listing, for up to five changed code files, which files import them and which files they import, and flags importers that use an export the PR removed. It uses import lines and code search only (no AI call), is off by default, and never changes lanes or findings.

• REVIEW.md is a default policy file. policy_files now defaults to REVIEW_POLICY.md, REVIEW.md, APPROVAL_POLICY.md, AGENTS.md, CLAUDE.md (read from the base branch, same caps). A missing REVIEW.md only adds its name to the existing "Policy files missing or empty" line. An explicit policy_files list still replaces the defaults. Example template: examples/REVIEW.md (evidence rule and a nit cap).

• Default budget.max_tokens_per_pr raised from 28000 to 40000. Set it explicitly in .mergejudge.yml to keep the old cap.

• Big PRs: fair diff sharing, honest "Not checked", one cumulative token cap. (1) The review prompt shares the diff budget fairly (short patches whole, long ones cut at hunk boundaries) instead of an even split, marks each cut patch with [... truncated by MergeJudge: K of N diff lines not shown; code outside the shown hunks exists and was not reviewed ...], and, only when something was cut, adds a note after the data block telling the model not to report a symbol as undefined or a function as unused from a truncated patch. Prompts for PRs that fit are byte-identical to before. The comment lists the trimmed files under "Not checked"; ReviewResult.trimmedFiles carries them (additive). (2) The PR story diff gives every file a header (path, status, previous name, +/-) and shares its 24000 characters by file kind (code, then tests, docs and config, lockfiles last); the story prompt says when it was trimmed and the comment shows one line. (3) A failed story call (cut off, timed out, invalid reply, provider error, budget) now shows one line under "Not checked"; reasoning models get a 4000-token story cap (1200 otherwise). (4) budget.max_tokens_per_pr is cumulative over the review, its retry, the second pass and the story, measured on provider-reported usage when available. A call that would pass the cap is skipped and listed under "Not checked", and the footer counts the retry. A retry now happens only when the first call left room for it. (5) DeepSeek v4+ (for example deepseek-v4.1-flash) counts as a reasoning model for the default output limit. (6) WorkersAiProvider and createProvider accept optional requestExtras / aiRequestExtras, merged into the ai.run input (per-model fields such as reasoning_effort).

• PR story: text fallback, usage purpose, footer tokens. (1) Under the chart the steps now live in the image alt text and in a collapsed "Steps as text" numbered list instead of a visible Steps: line; without a chart (no host, or over the size cap) the numbered list stays open. (2) LlmCallUsage has an optional purpose ("review" or "story"); the story call is labelled story, every review call review. (3) The footer token count includes the story call and shows the split, e.g. ~4801 tokens (story 1606), using provider-reported usage when available, else an estimate; usage.tokens and the LLM cache stay review-only.

• Optional PR story chart. comment.flow_chart now uses a separate small advisory AI call after final findings, leaving review prompts unchanged. The default svg style is an animated subway chart (CSS only) with light/dark and reduced-motion support; mermaid is explicit opt-in. comment.flow_chart_animate: false emits static output. Text lists work without hosting, on mobile, or in private repositories. The Action's opt-in comment.flow_chart_host: branch publishes public SVG assets on mergejudge-assets with contents: write. Validated titles and diff refs, deterministic content hashes, isolated story/upload failures, a strict per-request Codex story schema, and story preservation during runner secret-scan re-rendering keep this independent of lanes and findings. Cache-only and rules-only reviews skip the extra call.

• Shepherd (Watch and auto-fix), beta, tier 1. Turn it on per PR with the comment /mergejudge shepherd (off: /mergejudge shepherd off) or the shepherd label. While it is on, MergeJudge's inline review comments can carry GitHub "suggested changes" (single-line replacements) you apply with "Commit suggestion", and each batch is logged in one Shepherd comment on the PR. New optional shepherd: block in .mergejudge.yml (enabled, max_attempts, protected_paths, suggestions); read from the base branch. Protected paths (.github/, deploy and rollback scripts, auth and secrets files, .mergejudge.yml) never get a suggestion. With Shepherd off, prompts and review output are unchanged. Shepherd never merges.

• Shepherd tier 2: Action mode: shepherd. In your own Actions and with your own model key, Shepherd pushes small fixes for failed CI and real merge conflicts on PRs that have the shepherd label (or /mergejudge shepherd). It never merges, deploys or force-pushes, works on same-repo branches only, and mode: auto routes the new events (Shepherd comments, shepherd and needs-human label changes, workflow_run, check_suite) to it. Hard stop rules in code: retry budget counted from Shepherd's own commits (L1), same failure twice (L2), ping-pong (L3), fixes must shrink the failures (L4), review findings get one pass (L5), protected paths (H1), size limits shepherd.max_fix_lines and shepherd.max_fix_files (H2), not a code problem such as a flaky test, missing secrets or an outage (H3), and judgment calls such as logic merge conflicts (H4). A stop adds needs-human and posts one hand-off comment naming the rule; nothing more is pushed until a human clears it. New Action inputs shepherd_fix_command, shepherd_commit_name, shepherd_commit_email and the workflow examples/shepherd-workflow.yml.

• Shepherd follow-ups. /mergejudge shepherd retry grants exactly one more fix attempt (write, maintain or admin; logged in the Shepherd comment; the cap is max_attempts plus grants; plain re-enable never adds attempts). Merging the base branch now checks every file the merge brings in against the protected paths and hands off on H1 instead of pushing. L4 compares failing checks across all check runs and statuses on the head commit (required checks, else all but Shepherd's own), and waits while a counted check is pending. The Shepherd state comment is only trusted from Shepherd's own bot login when it is known.

• Shepherd waits for checks and comes back. When L4 cannot decide because a counted check on the head is still pending, Shepherd now records a "waiting for checks" row (head commit and failed run, once per run) and re-evaluates that run through the normal decision and loop breakers on the next finished workflow run, check suite or status event for the same head commit (add status: to the workflow triggers). A moved head drops the row. A merge that is both oversized and touches protected files now reports H1 before H2.

• Shepherd live-trial fixes. (1) The "what failed" text and the failure fingerprint now come from the failing step's own output (cut at the ##[error] that ended the step, or the first "Post job cleanup."), not from the job's cleanup tail, so two different lint errors no longer share a fingerprint. File names are kept when errors are normalised. (2) One concurrency group per PR for every event in examples/shepherd-workflow.yml, and Shepherd always uses the oldest of its own state comments: grants from duplicates are merged on read, a create race is detected by listing again and merged into the older comment, and the duplicate is deleted. (3) The whole-merge protected-path check (H1) now runs right after the merge starts, before conflict classification and the size check, so a logic conflict plus an incoming .github change reports H1, not H4. (4) New base-branch trigger: a push to the base branches (plus optional schedule and workflow_dispatch) sweeps the open, non-draft, same-repo PRs ...

v0.5.2: docs only

Docs only: the API key secret is now documented as AI_API_KEY (your own provider key, e.g. Anthropic/OpenAI/Z.ai). MJ_API_KEY still works: api_key_env names whichever secret you use, so existing setups need no change.

No engine changes. uses: gauravsharmaGG/mergejudge-runner@v1 now points at this release.