MaintainerGuard v0.3.1

MaintainerGuard v0.3.1

Small scanner UX and release consistency patch.

Added

• Added mg scanners to list scanner input families covered by bundled fixtures.
• Added scanner fixture normalization to mg verify, so local smoke checks now cover the documented scanner matrix.

Changed

• Synced public GitHub Action examples and generated workflow templates to xxxquide/MaintainerGuard@v0.3.1.
• Clarified CLI, scanner, and examples docs around fixture-backed scanner support.

Fixed

• The custom build backend now reads the package version from pyproject.toml, preventing wheel metadata from drifting from the CLI version.
• Added regression coverage to keep pyproject.toml, maintainerguard.__version__, and build backend version metadata synchronized.

Safety

No runtime dependency changes, no AI default changes, no comment publishing default changes, and no auto-merge behavior. MaintainerGuard still explains supplied scanner output and does not replace scanners or confirm exploitability.

MaintainerGuard v0.3.0

MaintainerGuard v0.3.0

Scanner trust and fixture-depth release.

Added

• Scanner fixture coverage matrix documenting supported scanner shapes and support levels.
• Sanitized CodeQL-like, Semgrep-like, Gitleaks-like, Dependabot-like, and Trivy configuration scanner fixtures.
• v0.2.x to v0.3.0 upgrade notes.
• v0.3.0 release-readiness sample data and rendered report.

Improved

• SARIF duplicate grouping for matching scanner/rule/title/severity/category results while preserving unique affected locations.
• SARIF severity and category normalization from rule metadata when result-level fields are sparse.
• Scanner docs and examples now distinguish native adapters from generic JSON mappings.
• Public Action examples, CLI defaults, workflows, package metadata, and launch docs are synchronized to v0.3.0.

Preserved

• Trivy vulnerability normalization remains supported and covered by tests.
• Safe defaults remain unchanged: dry-run enabled, AI disabled by default, comment publishing disabled by default, and no auto-merge behavior.
• MaintainerGuard continues to explain supplied scanner output; it does not replace scanners or guarantee security.

Verification

• Full unittest suite passed: 77 tests.
• Compile check passed.
• mg verify passed.
• Wheel build passed for maintainerguard-0.3.0.
• Clean venv install smoke passed.
• GitHub CI and MaintainerGuard PR dry-run checks passed on PR #28.

MaintainerGuard v0.2.0

MaintainerGuard v0.2.0

v0.2.0 is a focused feature release for policy presets and stronger scanner evidence.

Added

• Built-in policy presets: minimal, security, strict, and docs
• mg presets
• mg init --preset minimal|security|strict|docs
• SARIF startLine evidence rendered as path:line
• SARIF path-only fallback when no region line is present
• SARIF rule metadata fallback for sparse scanner results
• SARIF rule default severity support when result-level severity is missing

Preserved

• Trivy vulnerability normalization from v0.1.4
• Safe defaults: dry-run enabled, AI disabled, comment publishing disabled
• Human-in-the-loop wording and evidence-first reports
• No auto-merge behavior

Verification

Validated before release with:

• python3 -m unittest discover -s tests -v
• python3 -m compileall -q maintainerguard
• ./mg verify
• python3 -m pip wheel . --no-deps
• Trivy parser smoke test

No breaking changes are intended.

MaintainerGuard v0.1.4

MaintainerGuard v0.1.4

Maintenance release focused on Marketplace consistency, CI coverage, and documentation navigation.

Changes:

• Public GitHub Action examples now consistently use xxxquide/MaintainerGuard@v0.1.4.
• Generated mg init --github-action workflow templates now use xxxquide/MaintainerGuard@v0.1.4.
• Package metadata and mg version now report 0.1.4.
• Repository workflow examples now use current official actions/checkout@v6 and actions/setup-python@v6 major versions.
• CI smoke coverage now includes ./mg verify, the secret-finding demo, JSON demo output, and PR analysis with scanner input.
• Added docs/README.md and examples/README.md for easier project navigation.

No new runtime dependencies, no auto-merge behavior, no default AI enablement, and no comment publishing by default.

Use:

uses: xxxquide/MaintainerGuard@v0.1.4

MaintainerGuard v0.1.3

MaintainerGuard v0.1.3

Marketplace and documentation consistency release.

Changes:

• Public GitHub Action examples now consistently use xxxquide/MaintainerGuard@v0.1.3.
• Generated mg init --github-action workflow templates now use xxxquide/MaintainerGuard@v0.1.3.
• Package metadata and mg version now report 0.1.3.
• Local uses: ./ examples remain only in clearly labeled local-development notes.

No product behavior changes, no new runtime dependencies, and no safety default changes.

Use:

uses: xxxquide/MaintainerGuard@v0.1.3

Previous public tags remain unchanged.

MaintainerGuard v0.1.2

MaintainerGuard v0.1.2

Documentation-only Marketplace polish release.

Changes:

• Public GitHub Action examples now use the published Action reference instead of local-only uses: ./ examples.
• Local uses: ./ examples are clearly labeled as local development notes.
• README presentation is cleaned up for Marketplace rendering.
• The old root hero image path is no longer tracked; the hero image lives at assets/maintainerguard-hero.png.

No product behavior changes, no new runtime dependencies, and no safety default changes.

Use:

uses: xxxquide/MaintainerGuard@v0.1.2

The previous v0.1.1 tag remains unchanged.

MaintainerGuard v0.1.1

MaintainerGuard v0.1.1 is a GitHub Action metadata patch release.\n\nChanges:\n- Adds top-level GitHub Action branding metadata for Marketplace readiness.\n- Keeps the external composite Action portability path: PYTHONPATH includes GITHUB_ACTION_PATH.\n- Preserves safe defaults: dry-run enabled, comment posting disabled, AI disabled, no auto-merge behavior.\n\nUse:\n\nyaml\nuses: xxxquide/MaintainerGuard@v0.1.1\n

MaintainerGuard v0.1.0

MaintainerGuard v0.1.0

Initial public release of MaintainerGuard.

MaintainerGuard is an evidence-first maintainer assistant for merge, security, issue, and release readiness.

Highlights

• Evidence-backed merge readiness reports
• Security-sensitive change detection
• Scanner result explanation
• Dependency and supply-chain impact analysis
• Documentation and test impact checks
• Issue triage reports
• Release readiness reports
• GitHub Action support
• Friendly CLI commands: mg demo, mg init, mg doctor, mg verify
• Safe defaults: dry-run enabled, AI disabled, no auto-merge, no comment spam

Quick start

pipx install git+https://github.com/xxxquide/MaintainerGuard.git
mg demo
mg init
mg doctor
mg verify