pm-github v2026.10.23

Changelog

2026.10.23 - 2026-10-23

Added

• Let reusable workflows carry their own release version (pm-github-znig)
• Preserve imported GitHub lifetimes, closure evidence and release attribution while linking cross-provider items (pm-github-c093)
• Refresh only already-linked GitHub items without importing new ones (pm-github-ullj)

Fixed

• A publish spelled through a package runner was invisible to the attestation gate, so an unattested one read as clean (pm-github-5igz)
• PM CLI filtered native Bun tests falsely report an empty run (pm-github-2ao1)
• Track pm-changelog rendering closed historical incidents as Fixed (pm-github-n0mm)
• Stabilize the watchdog startup probe under concurrent coverage (pm-github-sah1)
• Explain privacy matches and distinguish bare-root regex literals during gated sync (pm-github-xhtp)
• The changelog gate stamps an untagged version with the current date, so its verdict flips every midnight with no commit (pm-github-m8vj)
• Closeout workflow tests race the detached telemetry flush when removing their temporary global root (pm-github-aplb)
• Keep reusable workflow operands out of executable positions in attestation scans (pm-github-7c95)
• Keep automated sync and closeout PRs current and dispatch caller checks (pm-github-8r7c)
• Reject malformed effective-rule discriminators before closeout (pm-github-b141)
• Preserve legacy GitHub ownership across copied provider examples (pm-github-b143)
• Release timeout must report current workflow approval state (pm-github-b145)
• The daily release regenerates the changelog with a different status filter than release:check, so an open changelog-unreleased item delivered since the last tag fails the release (pm-github-l1ot)
• Require explicit delivery attribution before merged-PR closeout (pm-github-uqjf)
• Closeout changelog generation attributes new deliveries to an old package release (pm-github-lfcf)
• The release job authenticated with a stored npm token that expired, so publishing stopped while every other gate stayed green (pm-github-m8u2)
• A release run bumped and committed a new version every night while publishing was impossible, because the only externally-failable step runs last (pm-github-yq1d)
• The daily release cannot build a changelog once the tracker outgrows the default output budget (pm-github-ypi5)

Security

• Gate historical identities and host-path privacy across every Git object (pm-github-zqad)

Other

• Enable GitHub CodeQL code scanning (pm-github-sx18)
• Certify pm-github with PM CLI SDK 2026.9.26 (pm-github-6vcq)
• Certify pm-github on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates (pm-github-julo)
• Audit copied fleet release workflows for canonical generation and one daily publication (pm-github-sagl)
• Adopt the released gated sync caller in fleet repositories (pm-github-aiok)