commerce-docs · dshevtsov · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
@@ -17,9 +17,7 @@ name: Lint Code Base
 on:
   pull_request
 
-permissions:
-  contents: read
-  pull-requests: read
+permissions: {}
 
 ###############
 # Set the Job #
@@ -29,6 +27,11 @@ jobs:
     # Set the agent to run on
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      pull-requests: read
+      statuses: write
+
     ##################
     # Load all steps #
     ##################
@@ -37,21 +40,23 @@ jobs:
       # Checkout the code base #
       ##########################
       - name: Checkout Code
-        uses: actions/checkout@v5
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0
+          persist-credentials: false
 
       ################################
       # Run Linter against code base #
       ################################
       - name: Lint Code Base
-        uses: github/super-linter/slim@v7
+        uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8
         env:
           DEFAULT_BRANCH: main
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_GITLEAKS: false
+          VALIDATE_JSON_PRETTIER: false
           VALIDATE_MARKDOWN_PRETTIER: false
           VALIDATE_NATURAL_LANGUAGE: false
           VALIDATE_YAML_PRETTIER: false
diff --git a/.gitignore b/.gitignore
@@ -16,3 +16,5 @@
 /output/
 *.gem
 .cursor/
+.claude/
+.scout/
diff --git a/.markdownlint.json b/.markdownlint.json
@@ -1,8 +1,8 @@
 {
-  "MD013": {
-    "line_length": 120,
-    "code_blocks": false,
-    "tables": false,
-    "headings": false
-  }
+	"MD013": {
+		"line_length": 120,
+		"code_blocks": false,
+		"tables": false,
+		"headings": false
+	}
 }
diff --git a/.rubocop.yml b/.rubocop.yml
@@ -0,0 +1 @@
+.github/linters/.ruby-lint.yml
diff --git a/.simplecov b/.simplecov
@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+SimpleCov.start do
+  add_filter '/spec/'
+  add_filter '/features/'
+end
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.1.0
+
+### New features
+
+- Added a `custom` `output_format` that renders rows through a project-supplied Mustache template (`templates.custom` / `custom_output` config keys)
+- `markdown` output now renders through a Mustache template instead of hand-built strings
+
+### Testing
+
+- Added RSpec coverage (SimpleCov, WebMock) across Config, Client, EnterpriseClient, Pulls, RowCollector, Row, Runner, CLI, and the output formatters
+- Added network-free Cucumber scenarios for config validation, all output formats, and the enterprise SSRF guard
+- Added VCR-backed Cucumber scenarios (tagged `@vcr`, excluded from the default run) that replay recorded GitHub API responses
+
 ## 2.0.0
 
 ### Breaking changes

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,16 +1,30 @@
 PATH
   remote: .
   specs:
-    whatsup_github (2.0.0)
+    whatsup_github (2.1.0)
       dotenv (~> 3.0)
       faraday-retry (~> 2.2)
+      mustache (~> 1.1)
       netrc (~> 0.11)
       octokit (~> 10.0)
       thor (~> 1.3)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    activesupport (8.1.4)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     aruba (2.3.3)
@@ -19,10 +33,16 @@ GEM
       cucumber (>= 8.0, < 11.0)
       rspec-expectations (>= 3.4, < 5.0)
       thor (~> 1.0)
+    ast (2.4.3)
     base64 (0.3.0)
     bigdecimal (4.1.1)
     builder (3.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
     contracts (0.17.3)
+    crack (1.0.1)
+      bigdecimal
+      rexml
     cucumber (10.2.0)
       base64 (~> 0.2)
       builder (~> 3.2)
@@ -49,8 +69,10 @@ GEM
     cucumber-messages (32.2.0)
     cucumber-tag-expressions (8.1.0)
     diff-lcs (1.6.2)
+    docile (1.4.1)
     dotenv (3.2.0)
-    faraday (2.14.1)
+    drb (2.2.3)
+    faraday (2.14.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
@@ -61,19 +83,38 @@ GEM
     ffi (1.17.4)
     ffi (1.17.4-arm64-darwin)
     fileutils (1.8.0)
-    json (2.19.3)
+    hashdiff (1.2.1)
+    i18n (1.15.2)
+      concurrent-ruby (~> 1.0)
+    json (3.0.2)
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
     logger (1.7.0)
     memoist3 (1.0.0)
     mini_mime (1.1.5)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     multi_test (1.1.0)
+    mustache (1.1.3)
     net-http (0.9.1)
       uri (>= 0.11.1)
     netrc (0.11.0)
     octokit (10.0.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
+    parallel (2.2.0)
+    parser (3.3.12.0)
+      ast (~> 2.4.1)
+      racc
+    prism (1.9.0)
     public_suffix (7.0.5)
+    racc (1.8.1)
+    rack (3.2.7)
+    rainbow (3.1.1)
     rake (13.3.1)
+    regexp_parser (2.13.1)
+    rexml (3.4.4)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -87,14 +128,60 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
+    rubocop (1.91.0)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-github (0.27.0)
+      rubocop (>= 1.76)
+      rubocop-performance (>= 1.24)
+      rubocop-rails (>= 2.23)
+    rubocop-performance (1.27.0)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.89.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
+    rubocop-rails (2.38.0)
+      activesupport (>= 4.2.0)
+      lint_roller (~> 1.1)
+      rack (>= 1.1)
+      rubocop (>= 1.89.0, < 2.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
+    ruby-progressbar (1.13.0)
     sawyer (0.9.3)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
+    securerandom (0.4.1)
+    simplecov (0.22.0)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.13.2)
+    simplecov_json_formatter (0.1.4)
     sys-uname (1.5.1)
       ffi (~> 1.1)
       memoist3 (~> 1.0.0)
     thor (1.5.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
     uri (1.1.1)
+    vcr (6.4.0)
+    webmock (3.26.4)
+      addressable (>= 2.8.0)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
 
 PLATFORMS
   arm64-darwin-22
@@ -107,6 +194,10 @@ DEPENDENCIES
   fileutils (~> 1.7)
   rake (~> 13.1)
   rspec (~> 3.12)
+  rubocop-github (~> 0.27)
+  simplecov (~> 0.22)
+  vcr (~> 6.2)
+  webmock (~> 3.19)
   whatsup_github!
 
 BUNDLED WITH

diff --git a/README.md b/README.md
@@ -1,8 +1,6 @@
 # whatsup_github
 
-[![Gem version](https://img.shields.io/gem/v/whatsup_github.svg?style=flat)](https://rubygems.org/gems/whatsup_github)
-
-This tool helps updating data for [Whats New on DevDocs](http://devdocs.magento.com/whats-new.html).
+This tool helps updating data for What's New section on the public Adobe Commerce technical documentation resources.
 It filters GitHub pull requests and generates a data file.
 One pull request sources one data entity.
 All filtering parameters are set in a configuration file, except dates.
@@ -26,7 +24,27 @@ Options:
 
 ## What's generated
 
-A resulting YAML file `tmp/whats-new.yml` is generated from GitHub data.
+Output is controlled by `output_format` in `.whatsup.yml`, which accepts one or more of:
+
+- `yaml` — writes `tmp/whats-new.yml`.
+- `markdown` — writes headerless Markdown table rows to `tmp/whats-new-on-devdocs.md` with description, versions, type, and date (`YYYY-MM-DD`). With no matching pull requests, the file is empty.
+- `custom` — renders rows through a project-supplied [Mustache](https://github.com/mustache/mustache) template.
+
+```yaml
+output_format:
+  - yaml
+  - custom
+templates:
+  custom: path/to/your-template.mustache
+custom_output: tmp/whats-new-custom.txt
+```
+
+For `custom`, `templates.custom` must point to a file inside the project directory (relative to where
+`whatsup_github` is run), and `custom_output` sets the destination path. The template receives
+`{{#rows}}`, each with `description`, `versions`, `type`, `date`, `link`, `merge_commit`, `contributor`,
+and `labels`.
+
+The fields below describe each row, as produced for the `yaml` and `custom` formats.
 
 ### `description`
 
@@ -53,8 +71,12 @@ Set as a list of `labels` in `.whatsup.yml`. There are two types of labels in co
 
 ### `versions`
 
-Any GitHub label that starts from a digit followed by a period like in regular expression `\d\.`.
-Examples: `2.3.x`, `1.0.3-msi`, `2.x`
+Generated from pull request labels that begin with one or more digits followed by a period, matching `\A\d+\.`.
+Examples: `2.3.x`, `1.0.3-msi`, `2.x`, `12.4`.
+
+Matching labels are kept unchanged and joined with a comma and a space in their original order.
+For example, labels `whatsnew`, `2.4`, and `12.4` produce `2.4, 12.4`.
+If no labels match, `versions` is an empty string.
 
 ### `date`
 
@@ -206,6 +228,9 @@ To run rspec tests:
 rake spec
 ```
 
+Specs disable real network access ([WebMock](https://github.com/bblimke/webmock)) and generate a
+[SimpleCov](https://github.com/simplecov-ruby/simplecov) coverage report at `coverage/index.html`.
+
 #### features
 
 To run Cucumber tests:
@@ -223,6 +248,18 @@ bundle exec cucumber features/since.feature
 
 NOTE: Cucumber tests will use the configuration file from code `lib/template/.whatsup.yml`.
 
+Scenarios tagged `@vcr` (in `features/since_vcr.feature`) replay HTTP interactions recorded by
+[VCR](https://github.com/vcr/vcr) into cassette files under `features/cassettes/`, and are excluded
+from `rake features`/`bundle exec cucumber` by default (see `cucumber.yml`). Run them explicitly with:
+
+```bash
+bundle exec cucumber -p vcr
+```
+
+To (re-)record a cassette, delete the corresponding file under `features/cassettes/`, export a
+valid `WHATSUP_GITHUB_ACCESS_TOKEN`, temporarily switch the record mode from `:none` to `:once` in
+`features/support/vcr.rb`, then run the command above and switch the record mode back.
+
 #### Individual files
 
 Individual files can have tests at the end of a file in a format like:

diff --git a/Rakefile b/Rakefile
@@ -10,7 +10,8 @@ RSpec::Core::RakeTask.new(:spec)
 task default: :test
 
 Cucumber::Rake::Task.new(:features) do |t|
-  t.cucumber_opts = '--format pretty' # Any valid command line option can go here.
+  # @vcr scenarios need a recorded cassette (see features/since_vcr.feature) and are excluded by default.
+  t.cucumber_opts = '--format pretty --tags "not @vcr"'
 end
 
 task test: %i[spec features]
diff --git a/cucumber.yml b/cucumber.yml
@@ -0,0 +1,4 @@
+# @vcr scenarios replay recorded HTTP interactions and need a real cassette
+# recorded first (see features/since_vcr.feature); excluded by default.
+default: --tags 'not @vcr'
+vcr: --tags @vcr