Release 2.1.4 (2026-06-08)¶
Bug fixes¶
- grant actions: read to the security job (#457) ci-security.yml@v2.1.3 requests actions: read from its caller (codeql-action/upload-sarif needs it on private repositories). GitHub validates the request against the calling job's permissions at startup, so the security job must grant it before v2.1 is re-promoted to v2.1.3. The grant is backward-compatible with v2.1.2.
Documentation¶
- clarify pr-template fields and supported YAML (#459) The implement skill's PR-template step showed only a 4-line placeholder skeleton, with no statement of what each field needs or which YAML the template parser actually accepts. An agent could write a template that passed validation but rendered an empty or garbled PR body — e.g. a folded scalar (>-) parsed as the literal value '>-'.
Document the field semantics (summary/notes render verbatim as single bullets, so each must be a self-contained sentence), the linkage field and its sole allowed value (Ref), and the supported YAML subset (flat scalars and | literal blocks only; no folded scalars or nested mappings), and replace the skeleton with a fully-worked example.