Release 2.1.163 (2026-07-24)

Features

• add --exclude-rule; exempt github-actions-mutable-action-tag fleet-wide (#2514) vrg-semgrep-scan could only add rulesets (--extra-config); it had no way to suppress a single rule. The recent semgrep ruleset release added github-actions-mutable-action-tag, which flags every uses: ...@vN action ref and now blocks CD PRs fleet-wide.

Add a rule-exclusion capability: run_scan now emits --exclude-rule for a module-level fleet default (DEFAULT_EXCLUDED_RULES) plus any caller-supplied ids, and vrg-semgrep-scan gains a repeatable --exclude-rule CLI arg. Caller-supplied ids are added on top of the fleet defaults, never in place of them.

github-actions-mutable-action-tag is exempted fleet-wide as a deliberate interim pending vergil-project/.github#194 (pin third-party action SHAs once pin-advancement tooling exists); our own vergil-actions@v2.1 refs are a permanent exception. All other rules stay enforced.

CI Evidence: All gates passed — full audit bundle available. Download →