v2.16.1

Changed

  • Every third-party GitHub Action in this repo’s workflows and in examples/workflows/ is now pinned to a full commit SHA with a # vX.Y.Z comment (issue #955). A tag can be repointed by a compromised action publisher, and publish-image.yml pushes the container image with a write token, so the mutable @vN tags were the real exposure. renovate.json now extends helpers:pinGitHubActionDigests and also covers examples/workflows/, so Renovate keeps the SHAs and comments current. Workflows copied from the examples are now pinned as well. Snippets in docs/ still show @vN tags because Renovate cannot maintain them, so pin those to commit SHAs yourself if you copy them.
  • The e2e-gate check is now a required branch-protection status check on main. A push to a non-draft release/* PR now runs the live e2e legs on that SHA, where before it reported a passing gate without running them. workflow_dispatch and scheduled runs report e2e-gate (manual) so they cannot satisfy the required check.
  • The e2e-live deployment environment gate is removed from the live e2e matrix job, and the weekly credential check can now also be started with workflow_dispatch. max_cost_usd still caps spend per run.

Fixed

  • The deep-preflight git clone-auth check no longer fails with “Repository not found” in CI (issue #962). git ls-remote inherited the checked-out repo’s working directory, so the job’s own GITHUB_TOKEN header was sent alongside the reviewer token’s header. The check now runs isolated from ambient checkout credentials.
  • The e2e verifier no longer reports a false product_failure for a finding that overflowed into the review body. The body-fallback check is now scoped to individual bullets in the body’s “Findings not attached to specific lines” section.
  • Python (3.14) no longer gets stuck at “Expected” on PRs that touch no Python files. The paths: filter on lint.yml’s pull_request trigger is removed.

There are no changes to the review engine or to action inputs and outputs in this release.

See CHANGELOG.md for full technical detail.