[release] Release Highlights: v0.3.32 #8247

🌟 Release Highlights

This release delivers a targeted security correction to the guard layer and a significant internal code-organization refactor, alongside test coverage improvements.

🐛 Bug Fixes & Improvements

Guard: Reaction operations now correctly classified as writes (#8235)

Three GitHub reaction MCP tools were missing from the guard's WRITE_OPERATIONS list and DIFC label rules:

• add_issue_reaction
• add_issue_comment_reaction
• add_pull_request_review_comment_reaction

Previously these fell through to default label handling rather than receiving the correct S(repo) secrecy and writer(repo) integrity labels. They now behave identically to other repo-scoped write operations. This is a correctness fix for any deployment using guard policies.

Debug logging added to guard policy helpers (#8208)

Guard policy evaluation now emits structured debug log output, making it easier to trace policy decisions when diagnosing unexpected allow/deny behavior. Enable with DEBUG=* or a guard-scoped pattern.

🔧 Internal Improvements

Code organization: semantic function clustering (#8244)

A refactor aligned file and package boundaries with naming conventions and single-responsibility principles:

• internal/strutil/strutil.go split into focused files (deepclone.go, deduplicate.go, util.go, etc.)
• GitHub API–specific HTTP helpers extracted into a new internal/githubhttp/ package (client.go, collaborator.go), cleanly separated from generic HTTP utilities
• config/validation_rules.go consolidated into validation.go (it contained orchestrators, not atomic rules)
• logger/common.go renamed to logger/global_state.go (communicates its actual role: global mutex-protected state)

No behavior changes — this is a structural improvement for maintainability.

Schema URL pinned to v0.81.6 (#8223)

The MCP Gateway schema reference URL is now pinned to a specific version, ensuring consistent validation behavior across builds.

Test coverage improvements (#8239, #8210)

• logger.MarkdownLogger.Log coverage increased from 96.2% → 100%, covering the initializeFile() failure path
• Guard package normalizeLabelListField tests expanded

🐳 Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.3.32
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

For complete details, see the full release notes.

Generated for release v0.3.32 · workflow run 28334288824

Generated by Release · 83.3 AIC · ⊞ 33.9K · ◷