v1.14.2

Diagnose unsatisfiable review requirements: when an owner/required team is empty or unknown, the PR comment now says so (⛔ 'unsatisfiable; fix owners') instead of a misleading 'needs approval', and the unresolvable team is dropped from the auto-request. Closes HANDOFF Part 2 item D. omarss/frodo-ci@v1 resolves here.

v1.14.1

Fix: toolchain detection aggregates engines.node across all workspace package.json (highest wins), so a pnpm workspace pinning Node in sub-packages (not root) is detected -- no root .nvmrc needed. Explicit .nvmrc still authoritative; node_modules ignored. omarss/frodo-ci@v1 resolves here.

v1.14.0

Declarative registry auth: root config registries: (gcp-wif / ghcr / docker) -> SHA-pinned login steps generated into a managed, drift-checked workflow block by init/sync-workflow, credentials from repo vars/secrets. Completes HANDOFF.md. omarss/frodo-ci@v1 resolves here.

v1.13.0

Manage security suppressions via CLI: suppress add (future --expiry enforced) / list / prune. No hand-edited suppressions.yml; a real finding re-surfaces on expiry. HANDOFF #5. omarss/frodo-ci@v1 resolves here.

v1.12.0

Declare review requirements via CLI: init-module --review owners=1,expert=1 and --review-path glob:teams=security:1; scaffold derives a default owner rule from CODEOWNERS. HANDOFF #4. omarss/frodo-ci@v1 resolves here.

v1.11.0

Declarative job env: root config workflow.env: emits a managed, drift-checked job-level env block in the generated workflow (init/sync-workflow, --check). HANDOFF #6. omarss/frodo-ci@v1 resolves here.

v1.10.1

sync-workflow --action-ref pins and drift-checks the Frodo CI action uses: ref, so the action version bumps via CLI with --check enforcement (HANDOFF #7). omarss/frodo-ci@v1 resolves here.

v1.10.0

Toolchain versions resolved from repo metadata

The generated workflow no longer hardcodes Node 22 etc. init and sync-workflow now resolve versions from the repo itself — engines.node/.nvmrc/.node-version, packageManager (pnpm), .java-version/pom.xml (maven.compiler.release), go.mod — and let them win over template defaults. A detected version overrides a module's setup: version, and a toolchain the repo uses is included even without a module. init applies it automatically.

So a repo on Node 24 + pnpm 10.34.1 gets exactly that in the managed setup block, no template edit; sync-workflow --check passes. omarss/frodo-ci@v1 resolves here.

v1.9.1

Node templates use --if-present (no more red runs on missing scripts)

Stock node-app/node-library/typescript-app ran pnpm -s typecheck|test|build with no --if-present, so a package missing a typecheck/test script failed out of the box. They now use pnpm -s --if-present <script>: a missing script skips (exit 0), a present one runs, a real failure still fails. A module with only a build script passes validate/test with no template edit. omarss/frodo-ci@v1 resolves here.

v1.9.0

Auto-request reviewers + name them in the comment

An unmet review is now actionable, not a dead end.

• run requests the resolved reviewers on the PR (owner teams + the expert) via the GitHub API — best-effort, fail-closed gate unchanged.
• The PR comment names who should review: should be reviewed by @platform, @charlie (review requested).
• Precise via the new reviews.Suggest: only the still-short parts (owners/expert/which teams) are requested, so satisfied reviewers aren't re-pinged and the author is never asked.

Adds github.Client.RequestReviewers. omarss/frodo-ci@v1 resolves here. Binaries attached.