dunn.dev/pipeline 4.4.0 Minor: secret detection that can actually fail a pipeline. One new component (secret-verdict) and one new optional input on automerge-gate (secret_job). Nothing removed or renamed, and "secret" is deliberately absent from the required-checks default, so an existing consumer that upgrades renders an identical materialized job set and an identical gate verdict. Adoption is opt-in, per repo. Added - secret-verdict: GitLab's own Security/Secret-Detection template cannot block a leak. Its analyzer shells out to gitleaks with --exit-code 0, so the job exits clean even when it finds a credential -- the findings go into gl-secret-detection-report.json and nowhere else. Flipping that template's allow_failure to false does not fix it; it only makes operational faults blocking. This component runs the same analyzer over the same scan surface, so migration is a swap of the include rather than a change in what gets flagged, then parses the report itself and derives its own verdict. It emits CHECK_SECRET=pass|fail as a dotenv for automerge-gate and also exits nonzero on a finding -- unlike osv-verdict, which always exits 0 and leaves blocking to the gate. That divergence is deliberate: a verdict-only component would leave a repo with no automerge-gate still unable to fail, reproducing the exact bug. Fail-closed throughout: a missing, zero-length, schema-foreign, or non-array report, and any nonzero analyzer exit, all emit fail and exit 1 -- absence is never read as cleanliness. Scope control is excluded_paths, visible in the diff. There is deliberately no severity knob and no allow_failure input. Proven with a planted-secret probe. Changed - automerge-gate: new secret_job input plus a matching needs: entry, handled exactly like osv_job. Consumers opt in by adding "secret" to required-checks once they include the component. Because secret-verdict reddens the pipeline itself, the gate is skipped rather than run-and-blocking when a leak is found -- GitLab skips the dependents of a failed needs: job. The pipeline is red, and automerge blocked, either way. - The catalog meta-pipeline dogfoods the new slot: secret-verdict runs for real alongside osv-verdict, and this repo's own automerge-gate sets required-checks "osv,secret". - check-principle-image-tracking-version gains a second documented exception for the GitLab secret-detection analyzer image, pinned tag@digest and Renovate-tracked. Fixed - Renovate: security-fix automerge now requires a real pipeline rather than a green dashboard park. vulnerabilityAlerts keeps automerge true but now also sets platformAutomerge false, so the merge runs through Renovate's own checkAutoMerge instead of GitLab native automerge, which registers a branch carrying zero status checks as mergeable immediately. Scoped to vulnerabilityAlerts only; every other automerge lane is untouched. No consumer migration ships with this tag. patinate, kits, iac and qobuz still include the fail-open upstream template; moving them is a separate decision. Tag convention unchanged since 2.0.0: bare semver, no v-prefix. See CHANGELOG.md for the full entry.