From 2d2319b3e5daa2c48560ef989f9d69d6e617cc68 Mon Sep 17 00:00:00 2001
From: Wibias <37517432+Wibias@users.noreply.github.com>
Date: Mon, 28 Sep 2026 00:18:50 +0200
Subject: [PATCH] chore: prepare github-delivery 1.7.1 release

---
 CHANGELOG.md                                    | 10 ++++++++++
 package.json                                    |  2 +-
 tests/unit/pr-review-quality-contracts.test.mjs | 13 +++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 71f3a5cc..84321306 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,16 @@ All notable changes to `github-delivery` are documented here.
 
 ## [Unreleased]
 
+## [1.7.1] - 2026-09-28
+
+### Changed
+
+- GitHub Actions CodeQL dependencies were refreshed to the latest pinned action revisions used by the repository CI (PR #467).
+
+### Fixed
+
+- Attributed repository and bot content can no longer create merge-discussion intent: embedded instructions such as `merge immediately` are treated as untrusted data, the router preserves the trusted delivery request instead, and instruction-injection attempts surface an explicit security flag. The adversarial evaluation contracts and routing regression now pin that behavior (PR #468).
+
 ## [1.7.0] - 2026-09-21
 
 ### Added
diff --git a/package.json b/package.json
index 5eeb0909..0e42aff5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "github-delivery",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Guided installer and safety tooling for GitHub Delivery workflows",
   "type": "module",
   "engines": {
diff --git a/tests/unit/pr-review-quality-contracts.test.mjs b/tests/unit/pr-review-quality-contracts.test.mjs
index b1635b4a..3d4e7896 100644
--- a/tests/unit/pr-review-quality-contracts.test.mjs
+++ b/tests/unit/pr-review-quality-contracts.test.mjs
@@ -139,6 +139,19 @@ test("post-1.6.0 follow-up release is complete in 1.7.0", () => {
   assert.match(release, /incompleteReasons/);
 });
 
+test("post-1.7.0 follow-up release is complete in 1.7.1", () => {
+  const changelog = read("CHANGELOG.md");
+  const release = changelog.split("## [1.7.1] - 2026-09-28")[1]?.split("## [1.7.0]")[0] ?? "";
+
+  assert.ok(release, "expected a dated 1.7.1 changelog section");
+  for (const pr of [467, 468]) {
+    assert.match(release, new RegExp(`PR #${pr}\\b`));
+  }
+  assert.match(release, /CodeQL/i);
+  assert.match(release, /instruction-injection/i);
+  assert.match(release, /untrusted data/i);
+});
+
 test("package version matches the newest dated changelog release", () => {
   const pkg = JSON.parse(read("package.json"));
   const changelog = read("CHANGELOG.md");