diff --git a/CHANGELOG.md b/CHANGELOG.md index 94c8d71..1955630 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,54 @@ this file. This project follows the spirit of [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +## v0.10.2 - 2026-08-06 + +### Fixed + +- **`mergewarden triage` counted its own failures as work waiting for a + maintainer.** Run against a public repository with no token, it printed + `20 open pull request(s) read. 14 have something a maintainer checks by hand.` + where nine of those fourteen rows read `could not be read`. They were not pull + requests needing attention; they were GitHub refusing the request after 60 + unauthenticated calls an hour. The process exited `0`. + + Every failure became `notes: ["could not be read"]`, the same shape a finding + has, so it was counted in the headline and sorted among real findings. This + repository fails closed rather than presenting a partial pass and ships an + `ANALYSIS INCOMPLETE` state for exactly this; the command people run first was + the one place that ignored it. + + Unreadable pull requests are now tracked separately, reported on their own + line, excluded from the count, and the run exits non-zero. An exhausted quota + stops the loop instead of attempting every remaining pull request, and the + advice differs by cause: set `GH_TOKEN` when unauthenticated, wait or lower + `--limit` when it was the token's own quota. + +- The listing no longer retries an exhausted hourly quota. That backoff waited + 20, 40 and 60 seconds, so an unauthenticated caller sat through two minutes of + silence before getting the error anyway. GitHub marks this case with + `x-ratelimit-remaining: 0`, which the secondary rate limit, still retried, + does not. It also no longer tells somebody who has not set a token that GitHub + is rate limiting "this token". + +- `runTriageCli` was never executed by the test suite, which is why the above + shipped. All 90 tests passed while the command's error handling was wrong. + `packages/cli/test/triageRun.test.ts` now runs it against stubbed GitHub + calls; five of its cases fail against the previous code. + +### Documentation + +- The README leads with the check nothing else appears to make: a pull request + that edits the files coding agents read as instructions. Verified against a + real run before the copy was written, not after. It also says in the first + three lines that nothing is ever closed. +- Install drops from four options to one. `github-token`, `mode: warn` and + `fail-on-block: false` were all doing nothing: the first is already the + Action's default, the second is already the schema's default, and the third + only fires on a `block` decision, which warn mode never produces. +- `triage`'s token requirement moved above the command, with a link to create + one and the fact that no scopes are needed. + ## v0.10.1 - 2026-08-06 v0.10.0 was tagged and never published. The release workflow audits dependencies diff --git a/README.md b/README.md index a6be367..e55c500 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ jobs: mergewarden: runs-on: ubuntu-latest steps: - - uses: sjh9714/mergewarden@v0.10.1 + - uses: sjh9714/mergewarden@v0.10.2 with: comment: auto ``` @@ -144,7 +144,7 @@ with **no scopes selected** is enough, since nothing here writes. ```bash export GH_TOKEN=github_pat_... -npx --yes mergewarden@0.10.1 triage owner/repository +npx --yes mergewarden@0.10.2 triage owner/repository ``` ``` diff --git a/README.zh-CN.md b/README.zh-CN.md index 8016a6d..7d71b1a 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -45,7 +45,7 @@ Next: Review the agent instruction/tooling change before merging. 不需要令牌、不需要仓库、不联网，先看看它能抓到什么： ```bash -npx --yes mergewarden@0.10.1 demo +npx --yes mergewarden@0.10.2 demo ``` 这条命令会分析一个内置在 CLI 里的示例 PR，用的是**默认策略**——也就是说，它输出的 13 条检查结果，就是零配置安装时你实际会得到的东西。 @@ -57,8 +57,8 @@ _上图是真实的 `npx` 执行（用 `head` 截断以便完整显示开头） 然后扫描一个真实的 PR，用 `owner/repo#number` 或完整 URL 都可以： ```bash -npx --yes mergewarden@0.10.1 scan owner/repository#123 -npx --yes mergewarden@0.10.1 scan https://github.com/owner/repository/pull/123 +npx --yes mergewarden@0.10.2 scan owner/repository#123 +npx --yes mergewarden@0.10.2 scan https://github.com/owner/repository/pull/123 ``` 私有仓库或需要更高 API 速率限制时，用 `GH_TOKEN` 或 `GITHUB_TOKEN` 环境变量。MergeWarden 有意不提供传令牌的命令行参数。 @@ -84,7 +84,7 @@ jobs: mergewarden: runs-on: ubuntu-latest steps: - - uses: sjh9714/mergewarden@v0.10.1 + - uses: sjh9714/mergewarden@v0.10.2 with: comment: auto ``` diff --git a/docs/cli.md b/docs/cli.md index 470c551..8e17e10 100644 --- a/docs/cli.md +++ b/docs/cli.md @@ -17,7 +17,7 @@ mergewarden --version Run without installing: ```bash -npx --yes mergewarden@0.10.1 scan owner/repository#123 +npx --yes mergewarden@0.10.2 scan owner/repository#123 ``` ## Demo diff --git a/docs/getting-started.md b/docs/getting-started.md index a4baa3b..a3d3b39 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -9,7 +9,7 @@ You can run MergeWarden against any public pull request without installing anything and without a token: ```bash -npx --yes mergewarden@0.10.1 scan owner/repository#123 +npx --yes mergewarden@0.10.2 scan owner/repository#123 ``` Try it on a pull request you already know well. If the report tells you nothing @@ -21,7 +21,7 @@ open pull request and lists only the ones with something a maintainer checks by hand: ```bash -npx --yes mergewarden@0.10.1 triage owner/repository +npx --yes mergewarden@0.10.2 triage owner/repository ``` It needs no write access and writes nothing back, but it does need `GH_TOKEN` @@ -57,7 +57,7 @@ jobs: mergewarden: runs-on: ubuntu-latest steps: - - uses: sjh9714/mergewarden@v0.10.1 + - uses: sjh9714/mergewarden@v0.10.2 with: comment: auto ``` diff --git a/docs/history/releases/release-notes-v0.10.2.md b/docs/history/releases/release-notes-v0.10.2.md new file mode 100644 index 0000000..5c584e9 --- /dev/null +++ b/docs/history/releases/release-notes-v0.10.2.md @@ -0,0 +1,60 @@ +# v0.10.2 + +**Released 2026-08-06.** + +A bug fix for the command this project tells people to run first. + +## What was wrong + +Run against a public repository with no token, `triage` printed this: + +``` +20 open pull request(s) read. 14 have something a maintainer checks by hand. + +#10586 gci-fun-1 could not be read +#12046 feat/detect-nested-any-in-… could not be read +#12086 strict-void-return-fixer could not be read +... +``` + +With a token the same repository returns five rows. Nine of those fourteen were +not pull requests needing attention. They were GitHub refusing the request: +60 unauthenticated calls an hour, which one queue uses up. + +Every failure became a note in the same shape a finding has, so the tool's own +broken state was counted as the repository's problem, sorted among real +findings, and the process exited `0`. + +## What it does now + +Unreadable pull requests are counted separately, reported on their own line, and +the run exits non-zero: + +``` +9 open pull request(s) read. 3 have something a maintainer checks by hand. +11 could not be read, so this is a partial answer. GitHub allows 60 +unauthenticated requests an hour, which one repository's queue exhausts. +Set GH_TOKEN to a personal access token and run it again. +``` + +An exhausted quota stops the run rather than attempting every remaining pull +request, and the hourly quota is no longer retried: that backoff spent two +minutes on a wait that could not have helped. + +## Why it shipped in the first place + +`runTriageCli` was never executed by the test suite. Every triage test was a +pure function or an assertion about the source text, so all 90 passed while the +command's error handling was wrong. There is now an integration test that runs +it against stubbed GitHub calls, and five of its cases fail against the previous +code. + +## Documentation + +The README leads with the one check nothing else appears to make: a pull request +that edits the files coding agents read as instructions. It was verified against +a real run before the copy was written. + +Install drops from four options to one. Three of them were doing nothing. + +The full list is in the [changelog](../../../CHANGELOG.md). diff --git a/package.json b/package.json index 20e1ecd..a835c54 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "mergewarden-repo", - "version": "0.10.1", + "version": "0.10.2", "private": true, "type": "module", "packageManager": "pnpm@11.5.0", diff --git a/packages/action/dist/index.cjs b/packages/action/dist/index.cjs index f9fa426..4ef78c3 100644 --- a/packages/action/dist/index.cjs +++ b/packages/action/dist/index.cjs @@ -51617,7 +51617,7 @@ async function loadGitHubAnalysis(api, target, options) { } // src/version.ts -var MERGEWARDEN_VERSION = "0.10.1"; +var MERGEWARDEN_VERSION = "0.10.2"; // src/run.ts var MERGEWARDEN_COMMENT_MARKER = ""; diff --git a/packages/action/package.json b/packages/action/package.json index 23409ec..86582c3 100644 --- a/packages/action/package.json +++ b/packages/action/package.json @@ -1,6 +1,6 @@ { "name": "@mergewarden/action", - "version": "0.10.1", + "version": "0.10.2", "private": true, "type": "module", "files": [ diff --git a/packages/action/src/version.ts b/packages/action/src/version.ts index 71bf6ab..bcfa330 100644 --- a/packages/action/src/version.ts +++ b/packages/action/src/version.ts @@ -1 +1 @@ -export const MERGEWARDEN_VERSION = "0.10.1"; +export const MERGEWARDEN_VERSION = "0.10.2"; diff --git a/packages/cli/package.json b/packages/cli/package.json index c9212d3..d82741d 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "mergewarden", - "version": "0.10.1", + "version": "0.10.2", "private": false, "type": "module", "description": "Checkout-free policy scanning for AI-generated GitHub pull requests", diff --git a/packages/cli/src/version.ts b/packages/cli/src/version.ts index 71bf6ab..bcfa330 100644 --- a/packages/cli/src/version.ts +++ b/packages/cli/src/version.ts @@ -1 +1 @@ -export const MERGEWARDEN_VERSION = "0.10.1"; +export const MERGEWARDEN_VERSION = "0.10.2"; diff --git a/packages/core/package.json b/packages/core/package.json index 4a56878..a19d884 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@mergewarden/core", - "version": "0.10.1", + "version": "0.10.2", "private": true, "type": "module", "exports": { diff --git a/packages/core/src/version.ts b/packages/core/src/version.ts index 71bf6ab..bcfa330 100644 --- a/packages/core/src/version.ts +++ b/packages/core/src/version.ts @@ -1 +1 @@ -export const MERGEWARDEN_VERSION = "0.10.1"; +export const MERGEWARDEN_VERSION = "0.10.2"; diff --git a/packages/github/package.json b/packages/github/package.json index 616f42a..2aa3755 100644 --- a/packages/github/package.json +++ b/packages/github/package.json @@ -1,6 +1,6 @@ { "name": "@mergewarden/github", - "version": "0.10.1", + "version": "0.10.2", "private": true, "type": "module", "exports": { diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 3de3c69..b38e455 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "mergewarden-mcp", - "version": "0.10.1", + "version": "0.10.2", "description": "MCP server that checks whether a coding agent's changes stayed inside the scope it was given", "license": "MIT", "type": "module", diff --git a/packages/mcp/server.json b/packages/mcp/server.json index 1be56e8..7ed6d45 100644 --- a/packages/mcp/server.json +++ b/packages/mcp/server.json @@ -2,7 +2,7 @@ "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.sjh9714/mergewarden", "description": "Check whether a coding agent's changes stayed inside the scope it was given.", - "version": "0.10.1", + "version": "0.10.2", "repository": { "url": "https://github.com/sjh9714/mergewarden", "source": "github" @@ -11,7 +11,7 @@ { "registryType": "npm", "identifier": "mergewarden-mcp", - "version": "0.10.1", + "version": "0.10.2", "transport": { "type": "stdio" } diff --git a/packages/mcp/src/version.ts b/packages/mcp/src/version.ts index 71bf6ab..bcfa330 100644 --- a/packages/mcp/src/version.ts +++ b/packages/mcp/src/version.ts @@ -1 +1 @@ -export const MERGEWARDEN_VERSION = "0.10.1"; +export const MERGEWARDEN_VERSION = "0.10.2"; diff --git a/templates/mergewarden-observe.yml b/templates/mergewarden-observe.yml index 7ed232a..fd4928d 100644 --- a/templates/mergewarden-observe.yml +++ b/templates/mergewarden-observe.yml @@ -12,4 +12,4 @@ jobs: mergewarden: runs-on: ubuntu-latest steps: - - uses: sjh9714/mergewarden@v0.10.1 + - uses: sjh9714/mergewarden@v0.10.2