Skip to content

v0.4.1

Choose a tag to compare

View all tags
@sjh9714 sjh9714 released this 25 Jul 11:24
Immutable release. Only release title and notes can be modified.
v0.4.1
This tag was signed with the committer’s verified signature.
sjh9714 JinHyuk Sung
SSH Key Fingerprint: jxzJfFZuFoDsfhHUT1MIZcSqXZrcbO0ZJo9FxHnJOk8
Verified
Learn about vigilant mode.
ccef994
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MergeWarden v0.4.1 adds commit trailer rules and makes the pull request comment short enough to live with.

Both changes came from reading and using the thing: one from surveying the AI-contribution policies MergeWarden is meant to enforce, the other from the first outside maintainer who tried the Action and said the bot comment was too long.

No policy behaviour changes for an existing repository until it opts in.

npx --yes mergewarden@0.4.1 scan owner/repo#123

Commit trailer rules

commit/trailer-missing and commit/trailer-forbidden, under a new commit_trailers key. Real AI-contribution policies express disclosure as a commit trailer and disagree on which one — Fedora and Mesa require Assisted-by:, Kubernetes forbids it, QEMU and FreeBSD require a DCO Signed-off-by: — and every one of those clauses is decidable from commit metadata alone, with no heuristics and no model.

commit_trailers:
  required:
    - any_of: [Assisted-by, Generated-by]
      applies_to: agent # agent | all — `all` is what a DCO rule needs
      severity: warn
  forbidden:
    - name: Co-authored-by
      value_patterns: ["*claude*", "*copilot*"]
      severity: error

Both lists default to empty. See the rule guide.

A pull request comment you can read

Detailed findings now sit behind a <details> fold in the PR comment. A 12-finding report goes from 371 rendered lines to 33 before the fold. The findings, evidence snapshots, finding IDs and remediation are all still there, one click away; report files, job summaries and the CLI are unchanged.

New documentation

What a checker can actually enforce — real policy clauses mapped to what is decidable, including the clauses MergeWarden does not and will not attempt.

Compatibility

  • The default policy digest changed because the config schema gained the commit_trailers key. Digests recorded against v0.4.0 will differ. No finding IDs changed, so existing waivers remain valid.
  • The collector now enumerates PR commits. GitHub caps that listing at 250; when MergeWarden cannot collect all of them it omits commits entirely and the trailer rules stay inert rather than run against a partial list that could only under-report.
  • Trust boundary unchanged: one additional read-only API call, no checkout, no execution of PR code, no head-branch policy loading, no LLM.

Full changelog and release notes.

Assets 3
Loading