This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+5 more
Affected surfaces
Summary
AI summaryRelease branches now stay notice-only under AIRECEIPTS_REQUIRE_PR_RECEIPT=true
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Added `AIRECEIPTS_RECEIPT_EXEMPT_GLOBS` repo variable to exempt globs from PR receipt checks. Added `AIRECEIPTS_RECEIPT_EXEMPT_GLOBS` repo variable to exempt globs from PR receipt checks. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Medium |
Introduced hidden `pr-check --exempt-globs` flag for specifying exempt glob patterns. Introduced hidden `pr-check --exempt-globs` flag for specifying exempt glob patterns. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Low |
Implemented linear-time two-pointer glob matching without using regular expressions. Implemented linear-time two-pointer glob matching without using regular expressions. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Release branches now stay notice-only without PR receipt instead of failing the check. Release branches now stay notice-only without PR receipt instead of failing the check. Source: llm_adapter@2026-07-15 Confidence: low |
— |
| Bugfix | Medium |
Fixed dogfood attach pipeline by adding `core.hooksPath` self-heal and exempt-glob support. Fixed dogfood attach pipeline by adding `core.hooksPath` self-heal and exempt-glob support. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Resolved issue that silently dropped PR receipts for a week due to hooksPath handling. Resolved issue that silently dropped PR receipts for a week due to hooksPath handling. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Refactor | Low |
Consolidated glob exemption logic into a single reusable implementation across workflows and CLI. Consolidated glob exemption logic into a single reusable implementation across workflows and CLI. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Minor: enforcement learned about release branches (PRs #259, #261, SPEC-0036
R2 amendment). With AIRECEIPTS_REQUIRE_PR_RECEIPT=true, branches matching
release/* now stay notice-only instead of failing the check: release checkouts
are authored without a capturable agent session, so no receipt can exist for
them. Override with the AIRECEIPTS_RECEIPT_EXEMPT_GLOBS repo variable or the
hidden pr-check --exempt-globs flag (space-separated anchored globs, *
wildcards only; set it to an empty string to enforce everywhere, restoring the
old strict behavior). The matcher is a linear-time two-pointer scan, no RegExp,
so pathological patterns cannot blow up matching; the logic exists once per
runtime (scripts/check-pr-receipt.mjs for the reusable workflow,
src/pr/exemptGlobs.ts compiled into pr-check) with a parity suite pinning
the two to identical verdicts. The adopter caller snippet and
aireceipts integrations output forward the new variable. Also in this range
(#259, repo infra, not in the npm artifact): the dogfood attach pipeline got a
core.hooksPath self-heal and exempt-glob support in the reusable check
workflow, closing the failure class that silently dropped PR receipts for a
week (an absolute hooksPath plus a parked main checkout). Receipt rendering
untouched: 102 goldens byte-identical.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Aireceipts
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]