v2.23.1

Added

Bitbucket verdict commands are authorized from .bitbucket/CODEOWNERS (#1068). Bitbucket allows the permission lookup only for repository admins, so a bot account with write access got HTTP 403 for every commenter and no verdict command could be applied. The review now reads the owners first from the * lines of .bitbucket/CODEOWNERS. An owner can be an @nickname (ASCII), an Atlassian account_id, or a {uuid}. A listed commenter is authorized with no API call, and anyone else goes through the old lookup. The file is read from the source that AI_POLICY_SOURCE selects. Under workspace, a commenter who is listed only in the file of the pull request is still authorized and the reply says so. AI_BITBUCKET_VERDICT_MIN_ROLE=admin turns the file off. See Bitbucket setup.

Bitbucket finding numbers are kept across runs (#1065). Bitbucket keeps one summary comment and rewrites it on every run. The hidden id-map marker used to hold only the findings of the current run. An incremental run that did not report a finding again dropped its F<n>, so a waiting verdict command got “F was not found in the current review". A run with no findings restarted the numbering at F1, so a waiting command could apply to a different finding. The marker now keeps earlier entries within a size budget (4,000 bytes of JSON, about 5.4 KB in the comment). The lowest numbers go first and the highest number always stays. A finding that returns after a run without it keeps its number and no longer gets the "new" badge. A WARNING in the job log shows when earlier entries were dropped. GitHub and GitLab are unchanged. See [Bitbucket setup](../bitbucket-setup).
A 403 from the permission lookup gets its own reply (#1068). The old reply said to try again, but a 403 does not go away on a retry. The reply now says what to fix, and the command applies on the first run after the fix.

Container image tool updates (#1061, #1062, #1063). The image uses ruff 0.17.1, golangci-lint 2.15.0, and a newer digest of the Ubuntu 26.04 base image.