2026.09.59 — 2026-09-29

Breaking

• Verify pull requests once and release only what changed (42588ce2)

  Pull requests now carry the whole verification. Every check runs in parallel and only when its inputs changed: the backend suite in three shards, the frontend, the plugin template end to end, the image build, the site build, OSV when a manifest changed, and actionlint when a workflow changed. ci-ok is the one required check.

  A merge to main no longer re-runs the tests; the ruleset requires an up-to-date branch, so the merge commit is the tree CI verified. A release publishes the plugin API to Maven Central and the SDK to npm only when their inputs changed since the newest version there, and a CI- or Docker Hub description-only change releases nothing.

  Actions are pinned to commit SHAs, issue templates are forms, and OpenSSF Scorecard runs weekly.

Ci

• Verify pull requests once and release only what changed (42588ce2)

  Pull requests now carry the whole verification. Every check runs in parallel and only when its inputs changed: the backend suite in three shards, the frontend, the plugin template end to end, the image build, the site build, OSV when a manifest changed, and actionlint when a workflow changed. ci-ok is the one required check.

  A merge to main no longer re-runs the tests; the ruleset requires an up-to-date branch, so the merge commit is the tree CI verified. A release publishes the plugin API to Maven Central and the SDK to npm only when their inputs changed since the newest version there, and a CI- or Docker Hub description-only change releases nothing.

  Actions are pinned to commit SHAs, issue templates are forms, and OpenSSF Scorecard runs weekly.