Skip to content

Changelog

All notable changes to this project are documented here. The format follows Keep a Changelog. From 0.2.0 on, entries are generated by release-please from Conventional Commit messages.

1.0.0 (2026-09-14)

⚠ BREAKING CHANGES

  • remove the check-run option; the commit status is the signal

Added

  • checks: approving review can satisfy review.human_verified (a660f60)
  • checks: approving review can satisfy review.human_verified (aac963a)
  • checks: evaluation-run check for prompt and model changes (551748a)
  • checks: evaluation-run check for prompt and model changes (0e79bf1), closes #50
  • checks: evidence.artifacts with pair, single and set kinds (16021b2)
  • checks: evidence.artifacts with pair, single and set kinds (0c06980), closes #47
  • cli: doctor checks the policy, the workflow and the branch rules (b92103d)
  • cli: doctor checks the policy, the workflow and the branch rules (85acc8b), closes #49
  • cli: keep shell checks visible; document when one should become a plugin (3c938c3)
  • cli: keep shell checks visible; document when one should become a plugin (0038f66), closes #53
  • cli: replay a policy against merged pull requests (c778417)
  • cli: replay a policy against merged pull requests (bdd6614), closes #44
  • policy: extends pulls rules from pinned base policies (9b8d138)
  • policy: extends pulls rules from pinned base policies (94aa654), closes #45
  • receipt: store the final report on a branch when the pull request merges (312172c)
  • receipt: store the final report on a branch when the pull request merges (ad9c3b7), closes #43
  • remove the check-run option; the commit status is the signal (f71b8f8), closes #48
  • report: review comments on the files concerned; one truth for counts (adc32c6)
  • report: review comments on the files concerned; one truth for counts (bd7a41b)
  • report: scorecard comment (69dd3b4)
  • the 1.0 contract: policy schema, version check, frozen public API (e6d685e)
  • the 1.0 contract: policy schema, version check, frozen public API (c8af670), closes #52
  • verifiers: results carry provenance (4fc9f28)
  • verifiers: results carry provenance (a3a1ec0), closes #46

Fixed

  • cli: publish review comments when asked (ded5b26)
  • report: publish review comments when asked; integration assertion follows the new header (453615a)

Documentation

  • checkout ref in block style; the flow form was not valid YAML (3160ccd)
  • checkout ref in block style; the flow form was not valid YAML (bbbd5e5)
  • documentation site with MkDocs Material, README revamp (ae7989c)
  • documentation site with MkDocs Material, README revamp (b736eff)
  • documentation site with MkDocs Material, README revamp (0cf0642)
  • how-it-works diagram drawn with D2 (509865c)
  • how-it-works diagram drawn with D2, used by the README and the docs site (71d9ad5)
  • readme: absolute image and link URLs so PyPI renders it (6156555)
  • readme: real screenshots, a flow diagram and a script that regenerates them (5bd6be8)
  • readme: real screenshots, a flow diagram and a script that regenerates them (2deb265)
  • readme: same wordmark as the docs site (24aa865)
  • readme: size screenshots to their content; plain-text mermaid labels (a5dbec3)
  • render octicon shortcodes on the landing page (321989a)

Chores

0.6.0 (2026-09-12)

Added

  • action: the commit status is the required signal; annotations come from the job (c2ceb4a)
  • action: the commit status is the required signal; annotations come from the job (b0988f5)

Fixed

  • cli: workflow commands only alongside text output (4218fd7)

0.5.0 (2026-09-12)

Added

  • checks: tests.changed existing_only (2f35869)
  • plugins: Braintrust verifier plugin (7080d6c)
  • plugins: mergeproof-braintrust verifier and braintrust.traces check (13bcfff)

0.4.0 (2026-09-12)

⚠ BREAKING CHANGES

  • the mergeproof mcp command and the mcp and otel extras are removed.

Added

  • action: one mergeproof row in the checks list (5d41125)
  • action: one mergeproof row; manual dispatch for the publish workflows (d9ec0f6)
  • drop the MCP server and OpenTelemetry export (97ac367)

0.3.0 (2026-09-12)

Added

  • report: shield mark on check and status rows, and on the job name (0fbb1d3)
  • report: shield mark on the check, status and job rows (b840382)

Fixed

  • report: keep the commit status description plain (408cef7)

Documentation

  • format the Python samples the way ruff wants (a9cb946)
  • short README with reference pages under docs/ (7182fd5)
  • short README, reference pages under docs/ (5250153)

[Unreleased]

[0.2.0] - 2026-09-13

Added

  • Plumbing commands context, report, comment and template; contexts and reports are JSON and pipe between them.
  • mergeproof mcp: an MCP server (stdio) exposing explain, check, evidence_block, validate_policy, list_checks and agent_instructions.
  • mergeproof[otel]: the MCP server exports OpenTelemetry spans over OTLP/HTTP when OTEL_EXPORTER_OTLP_ENDPOINT is set (Langfuse, Jaeger, Phoenix, any collector).
  • evidence.links: vendor-neutral before/after link pairs with pluggable verifiers (mergeproof.verifiers entry-point group); http verifier built in.
  • files.changed check.
  • Reporting through the commit status (--status) and a Check Run with file annotations (--check-run); the action enables both by default.
  • -f junit and -f rdjson renderings, written by the action, so test-result reporters and reviewdog can present the gate.
  • Container image ghcr.io/aryamanz29/mergeproof with the CLI and MCP server: :edge on every push to main, :X.Y.Z, :X.Y, :X and :latest on release tags.
  • Example projects with scenario fixtures that the integration suite executes, and a mergeproof-langfuse verifier plugin.
  • Fixed exit codes: 0 pass or warn, 1 fail, 2 pending, 3 usage or policy error.

Changed

  • PR comment redesigned: logo, status badge and links in the header, one plain sentence, one table with a Status column in words, numbered next steps only when something is missing, and no comment at all when no rule applies.
  • ci.job_passed considers only the newest check run per name, so runs cancelled by a newer push no longer count as failures.
  • mergeproof checks marks checks that only produce results in GitHub mode.

Removed

  • Braintrust-specific trace check (evidence.traces). Use evidence.links with a verifier plugin.

[0.1.0] - 2026-09-12

Added

  • First cut: policy file, built-in checks, check / explain / agent-prompt, composite GitHub Action.