Release Notes: v0.4.0¶
Release Date: 2026-08-02
Overview¶
VersionConductor v0.4.0 adds a Cedar-based policy engine for evaluating dependency PR quarantine and approval decisions, PR comment and go.mod diff analysis on the collector, structured logging via omniobserve, and GitHub App/GITHUB_TOKEN authentication for CI usage. It also migrates GitHubCollector, GitHubMerger, GitHubReleaser, and the dependency graph Builder off go-github onto gogithub's version-isolated clientv1.Client, dropping github.com/google/go-github to a transitive dependency.
This is a non-breaking, additive release.
Highlights¶
Cedar policy engine¶
Dependency PR quarantine/approval decisions are now evaluated against Cedar policy bundles, split by concern, with structured decision outcomes (PolicyDecision) and a human-readable comment formatter. A quarantine profile implements the N+5 rule, and a new policy evaluate CLI command runs the engine directly.
GitHubCollector, GitHubMerger, GitHubReleaser, and Builder migrated to gogithub/clientv1.Client¶
All four GitHub-facing components now go through gogithub's version-isolated clientv1.Client and stable gogithub.* types instead of a raw *github.Client. github.com/google/go-github is now only a transitive dependency, pulled in indirectly by gogithub itself.
The custom rate limiter and retry-transport HTTP client are unchanged in behavior — the rate limiter now reads clientv1.GetRateLimit and detects rate-limit errors via gogithub/errors.IsRateLimitError instead of go-github's raw rate-limit types, and its response-inspecting helpers take the stdlib *http.Response instead of go-github's *github.Response wrapper.
One behavior note: GetMergedPRsSinceTag previously stopped paginating early once it found PRs older than the target tag's commit date. clientv1.ListPullRequests always fetches every matching PR before returning (it has no early-exit hook), so this can mean more API calls for repos with a very long closed-PR history — the returned results are unaffected, just potentially slower for that specific case.
GitHub App and GITHUB_TOKEN authentication¶
CI usage can now authenticate via a GitHub App or the ambient GITHUB_TOKEN, in addition to a personal access token. See the GitHub App creation guide in the docs site.
Structured logging and observability¶
Structured logging is now available via omniobserve.
Collector Enhancements¶
- PR comment methods — create, update, and find-by-marker, used for the bot to post and update status comments on dependency PRs
- go.mod diff analysis — detects
replace/exclude/retract/toolchain/godirective changes and new/removed direct dependencies in a PR's diff - Rate limit handling — proactive rate-limit checks before batches of API calls, plus exponential-backoff retry on rate-limited responses
Documentation¶
A full MkDocs site was added, using the PlexusOne unified theme, covering Cedar policy documentation, JSON Schema and configuration reference, and a GitHub App creation guide (including a web UI option for adding secrets).
The CLI flag reference (docs/commands/*.md, docs/configuration/cli.md) was also audited against the actual cobra.Command definitions and corrected: several fabricated flags and single-letter shorthands that never existed were removed, real flags that were missing were added, and two examples showing a nonexistent review --policy flag were fixed — review/merge decide via built-in merge profiles, not Cedar; Cedar policies are only evaluated via policy evaluate --policies.
Installation¶
Or build from source:
git clone https://github.com/plexusone/versionconductor.git
cd versionconductor
go build -o versionconductor ./cmd/versionconductor
Dependencies¶
| Module | Version | Change |
|---|---|---|
github.com/grokify/gogithub |
v0.17.0 | Upgraded from v0.13.0 |
github.com/google/go-github |
v89 (indirect) | No longer a direct dependency |
github.com/cedar-policy/cedar-go |
v1.8.0 | New |
github.com/plexusone/omniobserve |
v0.12.0 | New, upgraded from v0.11.0 during development |
See CHANGELOG.md for the full categorized commit list.