Release 2.1.164 (2026-07-24)

Documentation

• document explicit least-privilege CD secrets and semgrep rule exclusions (#2518) Capture epic #189's CD-secrets model and the semgrep --exclude-rule capability in the CI/CD architecture guide, the closest existing home. Documents the per-ecosystem explicit least-privilege secrets map that replaces secrets: inherit in generated cd.yml, and the DEFAULT_EXCLUDED_RULES fleet exemption of github-actions-mutable-action-tag (pending #194; our own @v2.1 refs a permanent exception).

Features

• allow read-only 'gh search' in the wrapper allowlist (#2520) Add search (code/commits/issues/prs/repos) to the vrg-gh subcommand allowlist for the human/user identities. gh search is read-only across all its subcommands, so it fits the wrapper's no-mutation safety model and adds no write capability. This unblocks cross-org GitHub code search (e.g. vrg-gh search code '<query>' --owner <org>) needed for fleet-wide sweeps.

The audit identity stays barred (search is absent from its allowlist, per least privilege).

CI Evidence: All gates passed — full audit bundle available. Download →