Skip to content

Release 2.1.4 (2026-06-08)

Bug fixes

  • grant actions: read to the security job (#457) ci-security.yml@v2.1.3 requests actions: read from its caller (codeql-action/upload-sarif needs it on private repositories). GitHub validates the request against the calling job's permissions at startup, so the security job must grant it before v2.1 is re-promoted to v2.1.3. The grant is backward-compatible with v2.1.2.

Documentation

  • clarify pr-template fields and supported YAML (#459) The implement skill's PR-template step showed only a 4-line placeholder skeleton, with no statement of what each field needs or which YAML the template parser actually accepts. An agent could write a template that passed validation but rendered an empty or garbled PR body — e.g. a folded scalar (>-) parsed as the literal value '>-'.

Document the field semantics (summary/notes render verbatim as single bullets, so each must be a self-contained sentence), the linkage field and its sole allowed value (Ref), and the supported YAML subset (flat scalars and | literal blocks only; no folded scalars or nested mappings), and replace the skeleton with a fully-worked example.