Add changelog entry for policy violations in PR comments and checks

[fallimic]

Adds a releases changelog entry for pulumi/pulumi-service#48886: pull request comments and commit checks on GitHub, GitLab, Bitbucket, and Azure DevOps now include a Policy violations section listing each mandatory and advisory violation from the policy packs that ran on the preview or update.

• content/releases/changelog/2026-09-14-policy-violations-in-pull-request-comments-and-checks.md
• No edition badge (VCS integrations are available on every edition)
• Markdown lint passes

🤖 Generated with Claude Code

https://claude.ai/code/session_017ESqtgVYkQjmUjaPDSDhGy

[github-actions]

Reviewer's guide v2 — not for the author

Tip

This is the reviewer's guide. Work through the ⚠️ checklist below, then approve — approving asserts only that the ⚠️ items looked right to you. Machine-verified this run: links, shortcodes, page metadata, and every claim marked verified (receipts on the evidence page). Code samples are read, not compiled.

PR author: your to-do list is the other review comment, "Author action guide" — nothing on this card is yours.

Note

What this PR changes:

• Adds one changelog entry announcing that policy pack violations now appear in Pulumi Cloud pull request comments and commit checks.
• States the section lists mandatory and advisory violation counts plus each violation's policy pack, policy name, resource, and message.
• States the coverage: GitHub, GitLab, Bitbucket, and Azure DevOps, for previews and updates.
• States the display limits: up to 40 violations in a pull request comment, the full list in check run details.

The wrongness that would matter here is a misstated capability or limit — a reader who trusts "up to 40" or the list of supported providers and finds otherwise. Link, shortcode, filename/date, and frontmatter checks ran clean, and the claims were checked against public docs and this repo.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	MEDIUM	Two claims about the new feature's behavior have no public source — only the author can confirm them → see F1, F2.
coherence	HIGH

⚠️ Check these before approving

ID	Where	Finding
F1	content/releases/changelog/2026-09-14-policy-violations-in-pull-request-comments-and-checks.md L2	"Pulumi Cloud now includes a 'Policy violations' section in the pull request comment and commit check it posts when a preview or update runs with a policy pack." — verdict: unverifiable — nothing public documents the new section yet, so please confirm the feature name and scope match what shipped. 🛡️ Disputed by fallimic on 2026-09-14, model held. Scope is settled by the author's citation of pulumi-service#48886 — both update_pull_request_comment.tmpl and update_check_run_details.tmpl add the section, GetUpdateLogs streams EngineEventPolicy for previews as well as updates, and the four VCS providers match the shipped changelog fragment. One detail does not settle: the finding asked whether the heading renders literally as "Policy violations", and the author's own quote of the shipping templates says "## Policy Violations" (title case), while the entry writes "Policy violations". Reviewer call: quote the product string verbatim as "Policy Violations", or keep sentence case per the site heading convention since this reads as prose rather than a quoted UI label.

Editorial stances introduced by this PR

Superlative, ranking, or comparative language the diff adds. No verdict — a page's own framing isn't fact-checkable — but confirm each is a stance the docs should take, and that no agent-written rewrite introduced it unasked.

None — the extractor found no positioning or comparison language in this PR's added lines.

✅ What you can rubber-stamp

• Facts: 4 factual claims checked — 2 verified clean, 1 flagged in the ⚠️ list, 1 settled — see the evidence page.
• Mechanics: frontmatter sweep ran; 2 added internal link(s) resolve.
• Style: 0 advisory suggestion(s) left with the author; never blocking.

💡 Pre-existing issues in touched files: 0 — details on the evidence page.

📎 Full evidence: verification trail, investigation log, review history.

_{Review v2 · updated 2026-09-14T15:51:01Z · head commit 02bee8f}

---

For the reviewer: the ⚠️ items above are the minutes that matter — the receipts for everything machine-verified are on the evidence page. The author's open items live on their own card (the comment headed "Author action guide"); while any are open, a Waiting on the author list above tracks them, and merge stays blocked until they're answered. If something here seems off, comment on the PR — @claude <your point> #update-review re-adjudicates with your input.

[github-actions]

Author action guide v2 — nothing blocks merge

Note

Nothing here blocks merge — no open items need an answer from you. A human reviewer still approves the merge.

This PR adds one changelog entry announcing that policy pack violations now appear in Pulumi Cloud's pull request comments and commit checks; the review checked its links, filename/date convention, frontmatter, and the factual claims it makes.

🚨 Fix or disagree

Nothing to fix — this section is empty.

❓ Questions for you

No open questions for you.

✅ Resolved since last review

ID	Where	Finding
F2	content/releases/changelog/2026-09-14-policy-violations-in-pull-request-comments-and-checks.md L11	"Commit check run details include the full list of policy violations, without the 40-item cap applied to pull request comments." — verdict: unverifiable — the 40-violation cap is a specific number a reader will rely on; please confirm it. — concede: Author cited common.RenderPolicyViolations in cmd/service/vcs/common/listeners_output.go: maxRows = min(maxRows, 40) applies only when truncate is true (the pull-request-comment path), while check run details render the untruncated PolicyViolationsFull field, with a unit test asserting the "... and N other violation(s)" suffix on the truncated form. That confirms both the exact 40 cap and the uncapped check run details as written.

📎 Full evidence: verification trail, investigation log, review history.

_{Review v2 · updated 2026-09-14T15:51:01Z · head commit 02bee8f}

---

How to answer

Every 🚨 and ❓ item above needs one of these before merge:

1. Fix it — push the change. If your push lines up with the flagged lines, this card shows a 🔄 banner within a minute and then refreshes itself. No banner? Comment:

   @claude I pushed a fix for F1 #update-review
   

2. Disagree with it — say which item and why; the review re-checks with your input:

   @claude F2: <your reasoning — e.g. where the figure comes from> #update-review
   

   Either way your answer counts: the review marks the item resolved, or keeps it with a 🛡️ note for your human reviewer to weigh — it stops blocking merge in both cases.

3. Accept it as-is — you own the PR; a one-line reason is a valid answer, and your reviewer sees it beside the finding:

   @claude F2: accepting as-is — <your reason> #update-review
   

   To accept every open item at once: @claude accepting all open items — <reason> #update-review.

The #update-review hashtag matters — it routes your reply to this review, and (besides pushing a fix) it is the only reply that unblocks merge. A bare @claude gets you ad-hoc help and leaves this card — and the merge block — untouched.

Please don't edit, hide, or delete this comment — it is the review's record. Full mechanics: CONTRIBUTING.md §AI-assisted contributions.

[github-actions]

🤖 Review updated on @fallimic's request.

[pulumi-bot]

Your site preview for commit 02bee8f is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-21604-02bee8f0.s3-website.us-west-2.amazonaws.com

Changed pages:

• /releases/changelog/2026-09-14-policy-violations-in-pull-request-comments-and-checks/