v1.25.0

Display details about predicates and approval requirements in the UI (#407, #413, #414)

Each rule in the UI now has an expandable "Details" section that includes information about why a rule was selected or skipped as well as details about the users, teams, or organizations required to approve the rule. This makes it easier to understand why certain approval is required and who needs to approve without having to find and read the policy YAML file. Contributed by @yiweny.

Other Changes

• When debug logging is enabled, include GraphQL query bodies in GitHub request logs (#391)
• Build with Go 1.18.1 (#386, #409)
• Fix typo in rule description (#406)
• Upgrade dependencies and build tooling

Full Changelog: v1.24.0...v1.25.0

v1.24.0

Add option to ignore edited comments (#357)

Set the ignore_edited_comments option on a rule to exclude all modified comments from influencing the rule state. This may be useful in environments with certain compliance requirements. Contributed by @devinburnette.

Add comment matching support for review comments (#361)

Set the github_review_comment_patterns approval method to require that reviews contain specific text in addition to having the correct type. This allows rules to distinguish between approving reviews that fulfill different purposes. Contributed by @devinburnette.

Post a successful status check on app installation (#370)

Policy Bot now posts a successful status check on the default branch of a repository when installed. This makes it possible to immediately require the policy-bot status check in the protected branch UI. Contributed by @devinburnette.

Other Changes

• Support environment variables for additional server configuration options (#364)
• Fix evaluation triggering when using the comment_patterns option (#365)
• Fix spelling mistakes (#358)
• Build with Go 1.17 (#374)
• Fix possible panic when handling issue_comment events (#379)
• Upgrade dependencies and build tooling

Full Changelog: v1.23.3...v1.24.0

v1.23.3

Other Changes

• Fix panic when processing commits with unverified or invalid signatures (#345)
• Fix detection of PR open/closed state (#350)
• Update google/go-github to v40 (#341)

v1.23.2

Other Changes

• Update validate endpoint to check local and remote policies (#329)

v1.23.1

Other Changes

• Support remote references in default config (updated go-githubapp to v0.9.1) (#328)

v1.23.0

Add support for shared organization policies (#321)

Refactor configuration loading to use the go-githubapp/appconfig package. This mostly adds support for shared organization policies (in the .github repository by default), but should also make error messages more accurate.

It also changes the policy link in the details view to point to the resolved policy, instead of the local policy file.

Other Changes

• Update google/go-github to v38 (#326)
• Upgrade build dependencies

v1.22.1

Other Changes

• Fix potential re-request loop for team reviewers (#306)
• Skip reviewer assignment on events that can't change the assigned reviewers (#307)

v1.22.0

Add signature verification predicates (#285)

Policies can now use the has_valid_signatures, has_valid_signatures_by, and has_valid_signatures_by_key to enable rules based on the GPG signatures of commits in the pull requests.

Add support for triage and maintain permissions (#294)

Policies can use the requires.permissions option to specify the minimum permission a collaborator must have to approve a rule. This option replaces the existing admins and write_collaborators options, which are now deprecated.

As a result of this change, policies that still use the admins and write_collaborators options will behave slightly differently:

• Rules that set write_collaborators: true can also be approved by users with maintain and admin permissions
• Rules that set admins: true and enable review requests will now request direct admins in addition members of admin teams

Other Changes

• Return a 404 error when trying to view details for a repository where policy-bot is not installed (#303)
• Include comparison expressions in policy validation (#300)
• Fix potential re-request loop for user reviewers (#302)
• Upgrade build dependencies

v1.21.4

Other Changes

• Build with Go 1.16.3
• Clarify errors for title predicates (#275)
• Remove Bintray publishing and using GitHub Actions for CI (#278, #279)

v1.21.3

Avoid updating state on closed PRs (#270)

• Skips updating the status check for evaluations on pull requests that are not in an "open" state. This will avoid the situation where policy-bot attempts to update the status for a PR which has been closed/merged, causing errors or confusion if successful.

Other Changes

• Add note to README about double quoted/plain YAML string escape characters (#273)
• Enable CodeQL vulnerability scanning (#271)