v0.4.21

What's Changed

• 🔄 chore: update pinned gh-aw schema URL to v0.88.7 by @github-actions[bot] in #12786
• [Repo Assist] refactor(rust-guard): add tool_names::SEARCH_CODE constant by @github-actions[bot] in #12805
• [Repo Assist] docs(config): add godoc comments to GuardPolicy/AllowOnlyPolicy JSON methods by @github-actions[bot] in #12806
• [test] Add tests for proxy.handleDelegatedRequest by @github-actions[bot] in #12812
• [log] Add debug logging to internal/delegation/store.go by @github-actions[bot] in #12768
• [test-improver] Improve tests for cmd (delegation helpers) by @github-actions[bot] in #12774
• [log] Add debug logging to delegation Envelope validation by @github-actions[bot] in #12820
• Honor proxy environment settings in custom HTTP transports by @lpcox with @Copilot in #12832
• Document why isDynamicTOMLPath can't use Decoder.SetStrict yet by @lpcox with @Copilot in #12830
• Consolidate duplicate delegation control-plane logic between proxy and server by @lpcox with @Copilot in #12831
• [test-improver] Improve tests for delegation (Envelope) by @github-actions[bot] in #12828
• [Repo Assist] fix(rust-guard): add tool_names constants for list_issues/search_issues literals by @github-actions[bot] in #12875
• [test] Add tests for delegation.HandleControl by @github-actions[bot] in #12877
• Document Cobra flag validation guidance by @lpcox with @Copilot in #12879
• Centralize validation-aware duplicate detection by @lpcox with @Copilot in #12880
• Pin GitHub Actions to commit SHAs by @github-security-bot in #12895
• Bump astral-sh/setup-uv from 5.4.2 to 10.0.1 by @dependabot[bot] in #12901
• Bump docker/build-push-action from 6.19.2 to 7.3.0 by @dependabot[bot] in #12902
• Bump docker/setup-buildx-action from 3.12.0 to 4.3.0 by @dependabot[bot] in #12903
• Bump docker/setup-qemu-action from 3.7.0 to 4.3.0 by @dependabot[bot] in #12904
• Bump actions/setup-python from 5.6.0 to 7.0.0 by @dependabot[bot] in #12905
• [log] Add debug logging to delegation control_handler by @github-actions[bot] in #12908
• Fix delegation control success logging by @lpcox in #12923
• Document delegation control feature and MCP_GATEWAY_DELEGATION_* environment variables by @lpcox with @Copilot in #12900
• [test-improver] Improve tests for internal/server guard_policy_parsing by @github-actions[bot] in #12919
• [Repo Assist] fix(rust-guard): dedup governance_tools test array + add COMMENT_NODE_ID constant by @github-actions[bot] in #12960
• [test] Add tests for guard.tryCallWasmFunction by @github-actions[bot] in #12966
• Centralize delegation runtime config validation by @lpcox with @Copilot in #12969
• Refactor delegation control request duplication by @lpcox with @Copilot in #12970
• Bump peter-evans/create-pull-request from 7.0.11 to 8.1.1 by @dependabot[bot] in #13022
• Bump docker/metadata-action from 5.10.0 to 6.2.0 by @dependabot[bot] in #13023
• Bump actions/setup-go from 5.1.0 to 7.0.0 by @dependabot[bot] in #13024
• Bump actions/checkout from 4.3.1 to 7.0.1 by @dependabot[bot] in #13025
• Bump docker/login-action from 3.7.0 to 4.6.0 by @dependabot[bot] in #13027
• rust-guard: deduplicate governance test tool set and centralize commentNodeID field key by @lpcox with @Copilot in #12967
• [log] Add debug logging to internal/cmd/delegation.go by @github-actions[bot] in #12988
• [test] Add tests for server.createDelegationFilteredServer by @github-actions[bot] in #13034
• [test-improver] Improve tests for internal/server (agent policy visibility) by @github-actions[bot] in #12989
• [Repo Assist] refactor(rust-guard): dedupe discussion/secret tool-name literals via constants by @github-actions[bot] in #13021
• Centralize delegation control-plane handler wiring by @lpcox with @Copilot in #12968
• build(deps): bump golang.org/x/term to v0.46.0 and golang.org/x/text to v0.42.0 by @lpcox with @Copilot in #13043
• Deduplicate sensitive-field log-hashing in githubhttp collaborator helpers by @lpcox with @Copilot in #13044
• Remove redundant proxy delegationState wrapper and centralize ControlDeps construction by @lpcox with @Copilot in #13045
• Centralize strict single-JSON-value decoding in util.DecodeStrictJSON by @lpcox with @Copilot in #13046
• Fix guard source-catalog drift: re-bucket CLI-only and stale write operations by @lpcox with @Copilot in #13047

New Contributors

• @github-security-bot made their first contribution in #12895

Full Changelog: v0.4.20...v0.4.21