[github-actions]

Automated pin bump (ADR 0049).

bump: project_board v0.47.0 -> v0.61.3
bump: github v0.7.0 -> v0.8.0

Merging requires the verify job green — the pin only moves through a passing verification.

[protoreview]

QA panel review — PASS

code-review · head 9139a5b78339 · formal

Low-risk change: two bundled plugin version bumps in protoagent.bundle.yaml (project_board v0.47.0→v0.61.3, github v0.7.0→v0.8.0). The only finding is a minor convention question — no changelog.d/ fragment was added alongside the bumps. The verifier confirmed the diff facts but found that the cited convention sources (changelog.d/README.md, PROTO.md) do not exist in this repository, so the original claim that CI will block is unsupported. The finding is retained as "uncertain" and re-qualified to "no fragment added; convention unverified." No panel disagreement; no coverage gaps.

Findings

	Severity	Location	Finding	Verified
🟡	minor	changelog.d/	The PR bumps two bundled plugin versions (project_board v0.47.0→v0.61.3, github v0.7.0→v0.8.0) but adds no changelog.d/ fragment. Whether a fragment is require…	⚠️ uncertain

findings JSON (machine-readable)

[
  {
    "file": "changelog.d/",
    "line": 0,
    "severity": "minor",
    "category": "conventions",
    "claim": "The PR bumps two bundled plugin versions (project_board v0.47.0\u2192v0.61.3, github v0.7.0\u2192v0.8.0) but adds no changelog.d/ fragment. Whether a fragment is required by repo convention is unverified \u2014 the cited sources (changelog.d/README.md, PROTO.md) do not exist in this repository.",
    "evidence": "The diff changes only protoagent.bundle.yaml: '-  - { id: project_board, ... ref: v0.47.0 }' \u2192 '+  - { id: project_board, ... ref: v0.61.3 }' and '-  - { id: github, ... ref: v0.7.0 }' \u2192 '+  - { id: github, ... ref: v0.8.0 }', with no fragment added. The repo's main branch contains only .github/workflows, scripts, README.md, and protoagent.bundle.yaml \u2014 no changelog.d/ directory and no PROTO.md file exist.",
    "verdict": "uncertain",
    "note": "Diff facts confirmed (v0.47.0\u2192v0.61.3, v0.7.0\u2192v0.8.0, no fragment added), but the cited convention sources (changelog.d/README.md, PROTO.md) do not exist in this repo \u2014 the normative claim that a fragment is required and CI will block is unsupported."
  }
]

---

1 finding(s) excluded from the verdict by in-diff confinement (file not among this PR's changed paths):

• changelog.d/ (minor) — The PR bumps two bundled plugin versions (project_board v0.47.0→v0.61.3, github v0.7.0→v0.8.0) but adds no changelog.d/ fragment. Whether a fragment is required

[mabry1985]

Superseded by #21 (project_board v0.65.0, github v0.9.1).