release: PRFlow v2.38.1 — security fix and shipped-comment corrections

[The01Geek]

Restores main's own integrity check and ships the fork-bypass fix that landed on the base branch.

Security

A pull request from a fork could obtain a green required status check on a tree that was never verified. The judge-change exemption keyed on the branch name, which a fork chooses. Fixed on the base branch in the preceding policy-update pull request; this release carries those bytes.

Also

• The private repository's name was published in the verifier's own leak pattern.
• Both shipped consumer workflows now declare permissions: contents: read — they had none, so a consumer whose default is read-and-write handed every job a full token.
• The implement gate's checkout is pinned to the default branch.
• CODEOWNERS for the integrity-critical paths (advisory — no approval is required).
• 20 comments in the shipped workflows pointed at docs/internal/* paths no consumer has; each now points at its published equivalent.
• The two cloud pages about pinning correctly carried a stale example version.

Verify it yourself

python3 .github/verify-release.py --candidate <a checkout of this branch>

438 files, 13 paths changed. This also regenerates .release/, which the preceding policy-update commit left inconsistent with the tree.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
pr-flow	🟢 Ready	View Preview	Aug 29, 2026, 10:16 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.