Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

prompt_file input: load review instructions from one or more files (newline-separated paths, relative to repo root)
Instructions are merged in order: prompt_file files first, inline prompt appended last
Missing files emit a warning but do not fail the action

prompt input description clarified: inline instructions appended after prompt_file content

Initial release of cortex-code-action
Composite GitHub Action powered by the Cortex Code Agent SDK (Bun runtime)
Three execution modes: review (PR review), mention (@cortex in comments), fix (auto-fix commits)
Defense-in-depth security via SDK canUseTool callback:
- SQL execution permanently blocked (all tools, fuzzy-matched)
- Sensitive file paths blocked (~/.ssh, ~/.snowflake, .env, *.p8, *.pem, credentials)
- read-only / read-write permission modes
Real-time progress tracking comment
Output sanitization before posting to GitHub
27 security gate unit tests
Concise README with docs/ folder (security, configuration, usage, auto-fix, architecture, troubleshooting, comparison, contributing)
Example workflows: basic review, mention reply, full-featured
Self-review dogfood CI workflow