* feat: advisory AI review of needs-human and scout PRs with OpenCode V2
A scheduled workflow runs `opencode run` (V2, pinned and checksummed)
with a read-only catalog-reviewer agent over evidence bundles for open
PRs labeled needs-human or scout and for unreviewed scout candidates.
PRs get one verdict comment and an ai-* label; confident scout accepts
get a bot PR. It never merges or closes.
The model runs in a job with no GitHub token; the agent may only read,
glob and grep inside the repository (a self-test proves it before each
run); verdicts are schema-validated and rendered by our own code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* fix(ai-review): address CodeQL and SonarCloud security findings
Enforce HTTPS on the OpenCode download, run opencode by absolute path,
escape summary cells with escapeCell, rely on HTML escaping instead of
comment-stripping regexes, validate item IDs before routing API calls,
and bound verdict parsing on runaway output.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
* feat(health): re-check V1 plugins nightly and guard the sunset removal
Listed plugins kept their classified compat forever, so a plugin that
migrated after the V1 sunset notice would still be removed on 2027-01-01.
The nightly health job now re-detects every plugin not marked v2, opens a
bot/health-compat PR for the ones now on V2, removes V1 plugins after the
sunset only when the re-check still says V1, and keeps the v1-sunset
tracking issue current (one reminder 31 days before the sunset).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
* fix(health): sanitize logged values flagged by SonarCloud
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
---------
Co-authored-by: John Smith <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
needs-human is a maintainer gate (e.g. a project held for using the V1 SDK); re-running triage on a push used to replace it with ready.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GitHub creates pull_request runs for PRs opened or updated by github-actions[bot] as action_required, and that run (not a workflow_dispatch run on the same commit) is what the required check on main binds to. The README workflow, openPullRequest (submissions, scout, health) and reprobe now approve the held validate run. Generated files are allowed only on PRs opened by github-actions[bot] from this repo's bot/readme-* branches.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GitHub rulesets reject direct pushes while a status check is required, even when the pushed commit's check passed (verified: GH013 'Required status check "validate" is expected' on a commit with a successful validate run). The README workflow now opens a PR from bot/readme-<sha>, dispatches validate on it and squash-merges it once green; older bot README PRs are closed as superseded.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Deploy keys are disabled for this org and GitHub Actions cannot be a ruleset bypass actor, so main is protected by requiring a passing validate check on every commit. The README workflow stages its regenerated commit on bot/readme-<sha>, dispatches validate there (allowed to touch generated files only for that bot branch), waits for success and fast-forwards main. Adds a catalog policy link to the README header and documents the branch protection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/policy.md is the reference the bots link to (admission, V2 rule, V1 sunset, health and removal, discovery, automation map). contributing.md documents the issue form, scaffolder and fields. The review-loop prompts now defer schema/duplicate/V2 checks to CI, drop the 6-month activity rule, and require merging through PRs instead of pushing to main. Translated READMEs link to this repo's contributing guide.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Relocates all example YAML files from the `examples/` directory to `data/examples/`.
Updates `docs/schema-design.md` to reflect the new path for example files.
- Introduce `scope`, `tags`, `min_version`, `homepage`, and `installation` fields for enhanced discoverability and guidance.
- Remove `install` and `compatibility` objects, replacing them with a simplified `installation` string field.
- Add `examples/` directory with full exemplar files for each extension type.
- Update `schema-design.md` to reflect new schema, clarify field definitions, and improve documentation structure.
- Renames the `description` field to `tagline` in schema and data files.
- Renames the `full_description` field to `description` in schema and data files.
- Updates all relevant YAML data files, documentation, and templates to reflect these changes.
- Adjusts character limits and descriptions for the new fields.
