mcp-github-crunchtools 1.1.0__tar.gz → 1.3.0__tar.gz

mcp_github_crunchtools-1.3.0/.github/workflows/ashigaru.yml

@@ -0,0 +1,98 @@
+# Ashigaru — issues in, fixed bugs out. ONE file enrolls a repo.
+#
+# Drop this in at .github/workflows/ashigaru.yml. The organization supplies the
+# secrets (CLAUDE_CODE_OAUTH_TOKEN, ASHIGARU_APP_ID, ASHIGARU_APP_KEY,
+# OPENROUTER_API_KEY) and the switch (variable ASHIGARU_ENABLED = true).
+#
+# What happens:
+#   • a new issue is triaged: bug, documentation and performance issues are
+#     labeled ready-to-code and fixed; features are labeled triaged and left
+#     for you; unclear ones get needs-info
+#   • an issue from someone without write access is triaged too, but is never
+#     fixed until a maintainer adds ready-to-code
+#   • the fix arrives as a pull request from ashigaru/issue-N with auto-merge on
+#   • Gatehouse reviews it like any other; Ashigaru answers each finding
+#     (`fixed in <sha>` or `not a bug: <reason>`) for up to five rounds, then
+#     labels the pull request needs-human and stops
+#   • GitHub merges when the required checks pass. No job here can merge.
+#
+# To steer it by hand: add `ready-to-code` to have an issue fixed,
+# `ready-for-triage` to have it looked at again.
+#
+# Where the checks are. This file only routes events. The workflows it calls
+# do the checking, at the pinned release, before any agent runs:
+#   • the switch: every called workflow stops at its first job unless the
+#     organization variable ASHIGARU_ENABLED is true
+#   • who may reach an agent: scripts/guard.py asks the API for the write
+#     access of the issue's author and of whoever triggered the event
+#   • which pull requests are touched: fix.yml acts only on ashigaru/ branches
+#     in this repository, opened by the Ashigaru app
+#   • what the secrets can do: the job that runs the model gets a read-only
+#     token; the app key is used only by jobs that run no model
+#
+# Copy unchanged apart from the pins, which Dependabot keeps current.
+
+name: Ashigaru
+
+on:
+  issues:
+    types: [opened, labeled]
+  workflow_run:
+    workflows: [Gatehouse]
+    types: [completed]
+
+permissions: {}
+
+# One run at a time per issue or per pull request branch; a second event waits.
+concurrency:
+  group: ashigaru-${{ github.event.issue.number || github.event.workflow_run.head_branch }}
+  cancel-in-progress: false
+
+jobs:
+  triage:
+    name: Triage
+    if: >-
+      github.event_name == 'issues' &&
+      (github.event.action == 'opened' || github.event.label.name == 'ready-for-triage')
+    permissions:
+      contents: read
+      issues: write
+    uses: crunchtools/ashigaru/.github/workflows/triage.yml@v2
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+  code:
+    name: Code
+    needs: triage
+    # After a triage that said ready-to-code, or when a maintainer adds the label.
+    if: >-
+      always() && github.event_name == 'issues' &&
+      (needs.triage.outputs.auto_code == 'true' ||
+       (github.event.action == 'labeled' && github.event.label.name == 'ready-to-code'))
+    permissions:
+      contents: read
+      issues: read
+    uses: crunchtools/ashigaru/.github/workflows/code.yml@v2
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      ASHIGARU_APP_ID: ${{ secrets.ASHIGARU_APP_ID }}
+      ASHIGARU_APP_KEY: ${{ secrets.ASHIGARU_APP_KEY }}
+      OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+
+  fix:
+    name: Fix
+    if: >-
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.event == 'pull_request_target' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      startsWith(github.event.workflow_run.head_branch, 'ashigaru/')
+    permissions:
+      contents: read
+      pull-requests: read
+      checks: read
+      actions: read
+    uses: crunchtools/ashigaru/.github/workflows/fix.yml@v2
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      ASHIGARU_APP_ID: ${{ secrets.ASHIGARU_APP_ID }}
+      ASHIGARU_APP_KEY: ${{ secrets.ASHIGARU_APP_KEY }}

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
 
   gourmand:
     name: Code Quality (Gourmand)
-    uses: crunchtools/gatehouse/.github/workflows/gourmand.yml@v0.15.3
+    uses: crunchtools/gatehouse/.github/workflows/gourmand.yml@v0
 
   build-container:
     runs-on: ubuntu-latest

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.22.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.24.0

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.22.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.24.0

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.github/workflows/gatehouse-retriage.yml

@@ -20,4 +20,4 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request_review_comment'
     permissions:
       actions: write   # re-run the triage job; nothing else
-    uses: crunchtools/gatehouse/.github/workflows/retriage.yml@v0.15.3
+    uses: crunchtools/gatehouse/.github/workflows/retriage.yml@v0

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.github/workflows/gatehouse.yml

@@ -90,7 +90,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: crunchtools/gatehouse/.github/workflows/review.yml@v0.15.3
+    uses: crunchtools/gatehouse/.github/workflows/review.yml@v0
     # Advisory by default — findings post as comments, the check always passes.
     # Uncomment to let critical/high findings fail the check (still not required):
     #   with:
@@ -107,4 +107,4 @@ jobs:
     if: always()
     permissions:
       pull-requests: read
-    uses: crunchtools/gatehouse/.github/workflows/triage.yml@v0.15.3
+    uses: crunchtools/gatehouse/.github/workflows/triage.yml@v0

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
         types: [python]
         stages: [pre-commit, pre-merge-commit]
   - repo: https://github.com/crunchtools/constitution
-    rev: v1.22.0
+    rev: v1.24.0
     hooks:
       - id: validate-constitution
 

{mcp_github_crunchtools-1.1.0 → mcp_github_crunchtools-1.3.0}/.specify/memory/constitution.md

@@ -1,10 +1,10 @@
 # mcp-github-crunchtools Constitution
 
-> **Version:** 1.1.0
+> **Version:** 1.3.0
 > **Ratified:** 2026-06-14
-> **Amended:** 2026-10-02
+> **Amended:** 2026-10-14
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.22.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.24.0
 > **Profile:** MCP Server
 
 This file holds what is specific to mcp-github. The fleet rules and the MCP
@@ -15,17 +15,34 @@ restated here.
 
 ## Security Model Specifics
 
-- **Credentials:** `GITHUB_TOKEN` (required), held as `SecretStr`, read from
-  the environment only. `GitHubApiError` scrubs it from messages, and
-  `Config.__repr__()`/`__str__()` never expose it.
+- **Credentials:** `GITHUB_TOKEN`, held as `SecretStr`, read from the
+  environment only; required unless `GITHUB_ACCEPT_REQUEST_TOKEN` is on, in
+  which case an HTTP request's `Authorization: Bearer <token>` is used for
+  that request (strict format, malformed refused, never stored on the shared
+  client). `GitHubApiError` scrubs both tokens from messages, and
+  `Config.__repr__()`/`__str__()` never expose the token.
+- **Merge gate:** `merge_pull_request` merges only when every required
+  status check of the base branch (rulesets and classic protection) passes
+  on the head commit, pinned to that head; it fails closed when checks
+  cannot be read, and when none are required unless the caller passes
+  `allow_no_required_checks=True`.
 - **Input limits:** Pydantic models with `extra="forbid"`; issue and PR
-  states are allowlisted (`open`, `closed`, `all`); owner and repo names are
+  states are allowlisted (`open`, `closed`, `all`), as are merge methods
+  (`merge`, `squash`, `rebase`); owner and repo names are
   checked for injection characters; git refs follow check-ref-format
-  rules (no `..`, `//` or leading/trailing `.` or `/`). `NotFoundError`
+  rules (no `..`, `//` or leading/trailing `.` or `/`); an expected head SHA
+  is a full 40 or 64 character hex SHA. `NotFoundError`
   truncates long identifiers.
 - **API:** `Authorization: Bearer` header, never the URL; the
   `X-GitHub-Api-Version` header is pinned to `2022-11-28`; path parameters
   are URL-encoded; requests time out after 30s; responses are capped at 10MB.
+- **Redirects:** the API client follows none. A job log, which GitHub serves
+  as a redirect to a pre-signed storage URL, is fetched by a separate client
+  that has no token, over HTTPS to a named host only, streamed, with only its
+  tail kept. The signed URL is never logged or put in an error message.
+- **Result caps:** tools that gather several pages say when they cut:
+  300 items per kind for pull request comments, 300 jobs per run, and for
+  failed-job logs 1000 lines per job, 5 jobs and 256 KiB per result.
 - **Surface:** pure API wrappers. No filesystem access, shell execution or
   code evaluation.
 
@@ -42,8 +59,9 @@ The server works with github.com and GitHub Enterprise Server:
 
 ## Tool Groups
 
-Issues, pull requests, Actions, files and search. Client error handling is
-tested for 401, 404, 429 and 204 responses in `TestClientErrorHandling`.
+Issues, pull requests, Actions, releases, files and search: 25 tools, of which
+14 only read. Client error handling is tested for 401, 404, 429 and 204
+responses in `TestClientErrorHandling`.
 
 ## Instance
 
@@ -62,3 +80,5 @@ tested for 401, 404, 429 and 204 responses in `TestClientErrorHandling`.
 | 1.0.0 | 2026-06-14 | Initial constitution (ported from mcp-gitlab-crunchtools) |
 | 1.0.1 | 2026-09-25 | Inherit constitution v1.17.0 (Gatehouse gates) |
 | 1.1.0 | 2026-10-02 | Manifest under constitution v1.18.0: profile restatement removed, mcp-github specifics kept; `..` rule moved from file paths to git refs to match the code |
+| 1.2.0 | 2026-10-12 | Seven tools for pull requests, Actions runs and logs, and releases (spec 001): redirect handling, result caps, merge-method and SHA validation, releases tool group |
+| 1.3.0 | 2026-10-14 | Per-request token (`GITHUB_ACCEPT_REQUEST_TOKEN`) and the merge gate (spec 002) |

mcp_github_crunchtools-1.3.0/.specify/specs/001-pr-merge-logs-release/spec.md

@@ -0,0 +1,141 @@
+# Specification: Pull Request, Run Log and Release Tools
+
+> **Spec ID:** 001-pr-merge-logs-release
+> **Status:** Implemented
+> **Version:** 1.2.0
+> **Author:** crunchtools.com
+> **Date:** 2026-10-12
+
+## Overview
+
+An agent that takes a change from a branch to a release needs to open the pull
+request, read what reviewers and CI said about it, answer them, merge, and
+publish. Until now it did the missing steps with the `gh` CLI, which hands it
+other people's text with no gateway in between. These seven tools close that
+gap so the whole loop runs through the MCP server.
+
+---
+
+## New Tools
+
+| Tool | Method | Endpoint | Description |
+|------|--------|----------|-------------|
+| `create_pull_request_tool` | POST | `/repos/{owner}/{repo}/pulls` | Open a pull request (write) |
+| `merge_pull_request_tool` | PUT | `/repos/{owner}/{repo}/pulls/{pull_number}/merge` | Merge, squash or rebase; optional expected head SHA (write) |
+| `list_pull_request_comments_tool` | GET | `.../issues/{n}/comments` + `.../pulls/{n}/comments` + `.../pulls/{n}/reviews` | One list of everything said on a PR |
+| `reply_to_review_comment_tool` | POST | `/repos/{owner}/{repo}/pulls/{pull_number}/comments/{comment_id}/replies` | Reply in a review thread (write) |
+| `get_workflow_run_tool` | GET | `/repos/{owner}/{repo}/actions/runs/{run_id}` + `.../jobs` | Run status and jobs, no logs |
+| `get_failed_job_logs_tool` | GET | `.../actions/runs/{run_id}/jobs` + `.../actions/jobs/{job_id}/logs` | Tail of each failed job's log |
+| `create_release_tool` | POST | `/repos/{owner}/{repo}/releases` | Create a release and its tag (write) |
+
+The three GET tools publish `readOnlyHint`. Not in scope: creating or forking
+repositories, deleting packages, further search tools.
+
+### Result shapes and caps
+
+| Tool | Cap | How the result reports it |
+|------|-----|---------------------------|
+| `list_pull_request_comments_tool` | 300 items per kind, read oldest first (at most 9 requests) | `truncated`, `truncated_kinds` |
+| `get_workflow_run_tool` | 300 jobs | `jobs_truncated` |
+| `get_failed_job_logs_tool` | `tail_lines` at most 1000 (default 200); 5 failed jobs; 256 KiB of log text per result, split evenly between jobs; 20 MB per download | `tail_lines` (value used), `failed_jobs_omitted`, per-job and overall `truncated` |
+
+A job is failed when its conclusion is `failure` or `timed_out`. Cancelled
+jobs are left out: in a failed run they are mostly siblings stopped by
+fail-fast, and their logs say nothing about the cause.
+
+---
+
+## Security Considerations
+
+### Layer 1 — Token Protection
+
+- GitHub serves a job log as a 302 to a pre-signed URL on a storage host. The
+  API client is created with `follow_redirects=False`; the redirect target is
+  fetched by a second client that has no default headers, so the token is not
+  sent there.
+- The signed URL is a short-lived credential. It is not logged, not put in an
+  error message, and not kept in an exception chain.
+
+### Layer 2 — Input Validation
+
+- `MERGE_METHODS` allowlist; `validate_commit_sha` for the expected head;
+  `validate_head` for `branch` or `owner:branch`; `validate_ref` for base,
+  tag and target.
+- `CreateReleaseInput` for the release title and notes. Pull request title
+  and body reuse `CreateIssueInput`, and a review reply reuses
+  `CreateIssueCommentInput`: the limits are the same.
+- Blank optional values (`sha`, `target_commitish`, `name`) mean "not given".
+
+### Layer 3 — API Hardening
+
+- The redirect target must be HTTPS, name a host rather than an IP address,
+  and carry no embedded credentials. It is not redirected further and must
+  answer 200. The host is not held to a list of names: GitHub documents no
+  stable set of log-storage hosts, and GHES storage is the operator's.
+- The download is streamed with a rolling 256 KiB tail and abandoned past
+  20 MB. Paging loops are bounded by a page count, not by what the server
+  says.
+
+### Layer 4 — Dangerous Operation Prevention
+
+- No filesystem, shell or code evaluation. Logs are held in memory only.
+- Comments, reviews and logs are text written by others. The server returns
+  them as data and bounds their size; it does not interpret them.
+
+---
+
+## Module Changes
+
+### New Files
+
+| File | Purpose |
+|------|---------|
+| `tools/releases.py` | `create_release` |
+
+### Modified Files
+
+| File | Changes |
+|------|---------|
+| `client.py` | `_send` split out of `_request`; `get_redirected_tail`; `follow_redirects=False` |
+| `models.py` | `MERGE_METHODS`, `validate_head`, `validate_commit_sha`, `CreateReleaseInput` |
+| `tools/pull_requests.py` | `create_pull_request`, `merge_pull_request`, `list_pull_request_comments`, `reply_to_review_comment` |
+| `tools/actions.py` | `get_workflow_run`, `get_failed_job_logs` |
+| `tools/__init__.py` | Exports |
+| `server.py` | Seven `@mcp.tool` wrappers |
+
+---
+
+## Testing Requirements
+
+### Mocked API Tests
+
+- [x] Happy path, validation refusal and GitHub error path for each tool
+- [x] Caps: comments per kind, jobs per run, `tail_lines`, bytes, failed jobs
+- [x] The storage request carries no `Authorization` header (real httpx
+      client over a mock transport, so the assertion is on the request as sent)
+- [x] Redirects that are not HTTPS, carry credentials or address an IP are
+      refused; storage errors and transport failures do not expose the
+      signed URL
+
+### Input Validation Tests
+
+- [x] `validate_head`, `validate_commit_sha`, `CreateReleaseInput`
+
+### Tool Count Update
+
+- [x] `test_tool_count` is 25; `READ_ONLY` and `WRITES` updated
+
+---
+
+## Dependencies
+
+- Depends on: 000-baseline
+- Blocks: none
+
+---
+
+## Changelog
+
+| Version | Date | Changes |
+|---------|------|---------|
+| 1.2.0 | 2026-10-12 | Implemented |

mcp_github_crunchtools-1.3.0/.specify/specs/002-request-token-merge-gate/spec.md

@@ -0,0 +1,132 @@
+# Specification: Per-Request Token and Merge Gate
+
+> **Spec ID:** 002-request-token-merge-gate
+> **Status:** Implemented
+> **Version:** 1.3.0
+> **Author:** crunchtools.com
+> **Date:** 2026-10-14
+
+## Overview
+
+Two changes, both about whose authority a call carries.
+
+1. **Per-request token.** GitHub's hosted MCP server takes the caller's
+   personal access token as `Authorization: Bearer <token>` on every HTTP
+   request and acts with it. Behind an opt-in, this server does the same, so
+   it can stand in for GitHub's server without the client changing.
+2. **Merge gate.** The token an agent merges with may belong to an
+   organization owner, and owners can bypass ruleset-required checks: GitHub
+   would merge a pull request whose checks failed. `merge_pull_request_tool`
+   now enforces the required checks itself.
+
+No tools are added; the count stays at 25.
+
+---
+
+## Per-Request Token
+
+| Setting | Incoming `Authorization` | Token used |
+|---------|-------------------------|------------|
+| `GITHUB_ACCEPT_REQUEST_TOKEN` off (default) | ignored | `GITHUB_TOKEN` (required) |
+| on, HTTP request with `Bearer <token>` | used | the request's token |
+| on, HTTP request without the header, or stdio | — | `GITHUB_TOKEN` |
+| on, no header and no `GITHUB_TOKEN` | — | none: error before any API call |
+| on, header present but malformed | refused | none: error, not forwarded |
+
+- The header is read with `fastmcp.server.dependencies.get_http_headers(include={"authorization"})`,
+  which returns `{}` outside an HTTP request.
+- Accepted form: `(?i:bearer) ` followed by 1 to 1024 characters in
+  `\x21`–`\x7e`, matched in full.
+- The token is chosen in `GitHubClient._send` for each call and passed as
+  that call's header. The shared `httpx.AsyncClient` has an `Authorization`
+  default only when `GITHUB_TOKEN` is set.
+- `errors.request_token` (a `ContextVar`) holds the request's token so that
+  `GitHubApiError` scrubs it; each MCP request runs in its own task context.
+- The job-log second hop (`get_redirected_tail`) still sends no token.
+
+## Merge Gate
+
+Before `PUT /repos/{owner}/{repo}/pulls/{n}/merge`:
+
+| Step | Request | Refuses when |
+|------|---------|--------------|
+| 1 | `GET .../pulls/{n}` | caller `sha` is not the head; head or base missing |
+| 2a | `GET .../rules/branches/{base}` (paged) | — |
+| 2b | `GET .../branches/{base}` (`protection.required_status_checks`) | any error, or `protected` with no `protection` shown |
+| 3 | — | no required checks, unless `allow_no_required_checks=True` |
+| 4 | `GET .../commits/{head}/check-runs` and `.../status` (paged) | a required check is missing, pending or failed |
+| 5 | `GET .../pulls/{n}` again | head or base changed since step 1 |
+| 6 | `PUT .../merge` with `sha` = head | (GitHub: 405, 409) |
+
+- A required check is `(context, app id or None)`. Rulesets give
+  `integration_id`; classic protection gives `checks[].app_id`, where -1
+  means any, or bare `contexts`.
+- The most recent check run of the context's name (highest id) decides; it
+  passes when completed with `success`, `skipped` or `neutral`. With an app
+  id, only that app's runs count. With no app id and no run, the commit
+  status of that context must be `success`.
+- Each list is read up to 10 pages of 100; more refuses the merge.
+- Refusals raise `MergeRefusedError` naming every offending check.
+
+---
+
+## Security Considerations
+
+- Token mix-up between concurrent callers: nothing request-specific is
+  stored on the shared client or in a global.
+- A malformed header never falls back to `GITHUB_TOKEN`: a caller that
+  meant to use its own token does not silently act as the server.
+- The gate fails closed on unreadable protection, missing checks, oversized
+  lists and branches without required checks.
+- Required reviews and other rules are not re-enforced; the bypass still
+  applies to them.
+
+---
+
+## Module Changes
+
+| File | Changes |
+|------|---------|
+| `config.py` | `GITHUB_ACCEPT_REQUEST_TOKEN`; `token` may be None |
+| `client.py` | `_incoming_token`, `_auth_headers`; conditional default `Authorization` |
+| `errors.py` | `request_token`, `scrub_tokens`, `MergeRefusedError` |
+| `tools/pull_requests.py` | Merge gate helpers; `allow_no_required_checks` |
+| `server.py` | `allow_no_required_checks` on `merge_pull_request_tool`; docstring |
+
+---
+
+## Testing Requirements
+
+- [x] stdio uses the env token; option off ignores the header (well-formed
+      or not); option on prefers the header; header absent falls back
+- [x] Request-token-only instance: no default `Authorization` on the client
+- [x] No token at all: error and no HTTP request
+- [x] Malformed headers refused and not sent: empty, no scheme, other
+      scheme, extra spaces, tab, control, DEL, non-ASCII, over-long
+- [x] Request token scrubbed from API and transport errors
+- [x] Five concurrent requests with different tokens each send their own
+      (real httpx client over a mock transport)
+- [x] Gate: all green merges pinned to head; failing, pending, missing;
+      newest status of a repeated context decides; unreadable rules, check
+      runs, statuses or PR never merge; the MCP tool forwards the flag;
+      head or base moving during the gate is refused;
+      status pending/failure/error; most recent run decides; app-bound
+      rule; no checks refused and allowed by flag; flag does not waive
+      existing checks; `sha` mismatch; protection 403; classic `checks`
+      and `contexts`; rulesets and classic combined; branch name encoded;
+      check runs, statuses and rules paginated; page cap refuses
+
+---
+
+## Dependencies
+
+- Depends on: 001-pr-merge-logs-release
+- Blocks: none
+
+---
+
+## Changelog
+
+| Version | Date | Changes |
+|---------|------|---------|
+| 1.3.0 | 2026-10-14 | Implemented |

mcp_github_crunchtools-1.3.0/CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/) and this project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [1.3.0] - 2026-10-14
+
+### Added
+
+- `GITHUB_ACCEPT_REQUEST_TOKEN` (default off): over HTTP, act with the token
+  in each request's `Authorization: Bearer <token>` header, the way GitHub's
+  hosted MCP server takes it, falling back to `GITHUB_TOKEN`. With it on,
+  `GITHUB_TOKEN` is optional. A malformed header is refused, never
+  forwarded; a call with no token at all fails before reaching GitHub.
+  stdio is unchanged.
+- `merge_pull_request_tool` takes `allow_no_required_checks` (default
+  False).
+
+### Changed
+
+- `merge_pull_request_tool` enforces the base branch's required status
+  checks itself before merging: from rulesets and classic branch
+  protection, every required check must have a passing check run (success,
+  skipped or neutral) or a successful status on the head commit, or the
+  merge is refused with each offending check named. A branch with no
+  required checks is refused unless `allow_no_required_checks=True`, and a
+  branch protection that cannot be read is refused. Classic protection is
+  read from the branch itself, so no Administration permission is needed.
+  The merge is always pinned to the checked head SHA. It now needs Pull
+  requests: read and Commit statuses: read as well as Contents: write.
+
+### Security
+
+- An organization owner's token can bypass required checks on GitHub's
+  side; the merge gate closes that for this tool.
+- The request token is scrubbed from error messages like `GITHUB_TOKEN`,
+  and is passed per call, never stored on the shared HTTP client.
+
+## [1.2.0] - 2026-10-12
+
+### Added
+
+- `create_pull_request_tool`: open a pull request, optionally as a draft; the
+  head may be `owner:branch` for a fork.
+- `merge_pull_request_tool`: merge, squash or rebase a pull request. `sha` is
+  the expected head commit; GitHub refuses the merge if the branch has moved.
+- `list_pull_request_comments_tool`: conversation comments, diff comments and
+  reviews in one chronological list, each tagged with its kind, author and id.
+  Each kind is capped at 300 items and the result says when one was cut.
+- `reply_to_review_comment_tool`: reply in the thread of a diff comment.
+- `get_workflow_run_tool`: one run's status, conclusion, head SHA and branch,
+  event and jobs, without logs.
+- `get_failed_job_logs_tool`: the last lines of the log of each failed job in
+  a run, with ANSI escapes and timestamps removed. Bounded to 1000 lines per
+  job, 5 jobs and 256 KiB per result; the result says when something was cut.
+- `create_release_tool`: create a release and, if needed, its tag.
+- README and SECURITY.md list the fine-grained token permission each tool
+  needs.
+
+### Security
+
+- The API client is created with `follow_redirects=False`. GitHub redirects a
+  job log to a pre-signed storage URL; that URL is fetched by a separate
+  client that has no token, over HTTPS only, and is never logged or put in an
+  error message.
+
+### Changed
+
+- README lists all 25 tools; it had stopped at the first eleven.
+
+## [1.1.0] - 2026-10-10
+
+### Added
+
+- The eleven tools that only read (`list_issues`, `get_issue`,
+  `list_pull_requests`, `get_pull_request`, `get_pull_request_diff`,
+  `get_pull_request_checks`, `get_file_content`, `list_repo_tree`,
+  `search_code`, `search_issues`, `list_workflow_runs`) publish
+  `readOnlyHint: true`. A gateway uses it to decide whether an invalid optional
+  argument may be dropped or must refuse the call (crunchtools/constitution#35).
+- Tests pin every registered tool into `READ_ONLY` or `WRITES`, and check that
+  each read-only tool sends GitHub nothing but GET requests.
+
+### Changed
+
+- Inherits constitution v1.22.0; the workflow pins and the pre-commit hook rev
+  move with it.
+
+### Fixed
+
+- `server.json` said 0.1.0 and the Containerfile label said 0.3.0; both carry
+  the release version again.
+
+## [1.0.1] - 2026-10-02
+
+### Fixed
+
+- The package, `__version__` and the MCP server reported 0.4.0 while the
+  v1.0.0 release and image said 1.0.0; all three now carry the release version.
+
+### Changed
+
+- Constitution is now a v1.18.0 manifest: it holds only what is specific to
+  this repo; fleet and profile rules apply by reference.
+- Constitution validation is pinned to the inherited release via
+  `.github/workflows/constitution.yml`.
+- Dependabot auto-merges GitHub Actions minor and patch updates.
+
+## [1.0.0] - 2026-09-20
+
+First tagged release. This image has been running in production since before
+it had version control. No changes are recorded prior to this point --
+RT #1484 added this file on 2026-09-19, before this repo's first tag.