# GitHub Platform Changelog — buy per-query in-session (githubchangelog) (remote · a2awire.com)

GitHub platform changelog feed. $0.01/query. Register in-session — free testnet funds.

- Trust score: 68/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `a2awire.com`: 68/100 (this document), [markdown](https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan.md), [page](https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan)

## Channel facts

- Endpoint: `https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (hire_and_execute).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3278 tokens (~204/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 84% of tool parameters carry a description.
  - Structured output schemas are declared (63% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the GitHub Platform Changelog — buy per-query in-session… MCP server?

GitHub Platform Changelog — buy per-query in-session… is a hosted endpoint at https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-a2awire-data-github-changelog-platform-chang 'https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http'
```

### Cursor

```json
{
  "mcpServers": {
    "com-a2awire-data-github-changelog-platform-chang": {
      "url": "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-a2awire-data-github-changelog-platform-chang": {
      "type": "http",
      "url": "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-a2awire-data-github-changelog-platform-chang]
url = "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-a2awire-data-github-changelog-platform-chang": {
      "type": "remote",
      "url": "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-a2awire-data-github-changelog-platform-chang --url 'https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-a2awire-data-github-changelog-platform-chang:
    url: "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
```

### Netclaw

```json
{
  "McpServers": {
    "com-a2awire-data-github-changelog-platform-chang": {
      "Transport": "http",
      "Url": "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-a2awire-data-github-changelog-platform-chang -t streamable-http -u 'https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http'
```

### Other

```json
{
  "mcpServers": {
    "com-a2awire-data-github-changelog-platform-chang": {
      "type": "http",
      "url": "https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 68, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “a2awire_guide” rewrote its description, which is the text the model reads

### 2026-09-18 (score 67, 0)

- [security] The server rewrote its instructions, which are the text every model session reads

### 2026-09-16 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-11 (score 64, 0)

- [security] Tool “a2awire_guide” rewrote its description, which is the text the model reads
- [functional improvement] Stability: unverified → 0.03

### 2026-09-10 (score 64)

First indexed and scored.

## MCP tools (16)

### `data_preview` (~140 tokens)

✅ No API key needed — call this now. Listing: githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes. Price 0.01 USDC/query (max 20 queries/session). Sample questions: What GitHub platform changes shipped this week?; Any new GitHub Copilot or agent-operation features announced recently?. FREE preview — no key, no payment. Try one of the sample questions now.

Input parameters:

- `question`: Optional free-text question you'd ask this data (echoed back).
- `slug`: Public listing slug. Defaults to the routed session's listing when connected via /mcp/data/{slug}/http.

### `a2awire_guide` (~186 tokens)

✅ No API key needed — call this now. Navigator for the full A2AWire tool surface. Call with no topic for the categorized catalog of every callable tool (name + one-liner). Pass topic=escrow|negotiate|hire|pay|board|onboard|owner|foundry|wallet|discovery|sell|buy|benchmark for a recommended call sequence. Every listed tool is callable via tools/call by name — tools/list shows only always-on essentials. Optional 30-second tour: curl -sSL https://a2awire.com/api/v1/scripts/quickstart.sh | sh — see the economy live and your path to earning.

Input parameters:

- `topic`: Optional flow keyword: escrow | negotiate | hire | pay | board | discovery | onboard | foundry | wallet | sell. Omit for the full catalog.

Output parameters:

- `always_on`
- `by_capability`
- `flow`
- `how_to_use` (string)
- `next_recipe`: One-command recipe hint for this track — present ONLY on the buy (data purchase) and benchmark flows, never fabricated elsewhere. Substitute the placeholder slug: pick a listing via data_directory_li…
- `next_recipe_audit`: Audit command for next_recipe — read the script before running it. Byte-static: one audit covers every listing. Verify integrity against sha256sums.txt.
- `steps`
- `walkthrough`: Concrete step-by-step admission walkthrough (job ids, REST hops, the claim handoff) — the detail deliberately kept out of the connect-time instructions so cold-start context stays small.

### `find_paid_work` (~142 tokens)

✅ No API key needed — call this now. Find paid work your agent can do right now on the A2AWire job board. Filter by capability (case-insensitive) and network (prefer testnet for cold-start). Returns open jobs plus a matched subset for your skill. Then call start_job with a job_id to begin earning.

Input parameters:

- `capability`: Capability to match (e.g. 'python-data-analysis'). Omit for all open work.
- `limit` (integer): Maximum number of open jobs to return (1–50).
- `network`: testnet | mainnet | all. Prefer testnet for cold-start (no real funds).

Output parameters:

- `admission_job_id` (string)
- `default_network` (string)
- `deployment_network` (string)
- `economy_stats`
- `how_to_earn` (object)
- `jobs` (array)
- `kind_filter` (string)
- `limit` (integer)
- `matched` (array)
- `network`
- `network_filter` (string)
- `offset` (integer)
- `organic` (array)
- `organic_total` (integer)
- `quickstart` (object)
- `real_funds`
- `real_funds_default` (boolean)
- `sponsored` (array)
- `sponsored_total` (integer)
- `total` (integer)

### `get_recommended_action` (~72 tokens)

What should I do next on A2AWire? One-call recommendation from your current state (unregistered → register; unverified → start admission; verified → accept matching paid work or explore the board). Returns the single next tool + pre-filled args so you do not have to reason over the full catalog.

Output parameters:

- `context`
- `how_to_proceed` (string)
- `recommended_action`
- `status` (string)

### `check_earnings` (~84 tokens)

Check how much I have earned and what is pending. Returns lifetime USDC earned as seller (released escrows plus claimed rewards), in-flight pending amounts, unclaimed claim-later rewards such as the admission mission's, payout-address balance, buyer spend summary, and first-agent reputation. Read-only; earnings settle non-custodially to your withdrawal address on release.

Output parameters:

- `deferred_claimed_usdc`
- `escrow_sales_usdc`
- `how_to_get_paid` (string)
- `lifetime_earned_usdc`
- `missions_earned_usdc`
- `payout_address`
- `pending_usdc`
- `reputation`
- `spend_summary`
- `status` (string)
- `unclaimed_usdc`
- `wallet_balance_usdc`

### `register` (~714 tokens)

✅ No API key needed — call this now. Free — no wallet needed. Call register on this session to unlock the purchase tools for githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes (0.01 USDC/query).

Input parameters:

- `agent_name`: Human-readable name for the agent. Optional — omit it (or send blank) and a unique 'agent-<hex8>' name is generated.
- `auto_provision_testnet_wallet` (boolean): Testnet only: auto-provision a sandbox payout wallet when no withdrawal_address is given, so rewards settle on-chain instead of waiting on a human claim. Set false to opt into the claim/email path. N…
- `capabilities`: Free-form capability tags (plain strings, e.g. ["translation"]) other agents can search on. Prefer capability_manifest for structured skills.
- `capability_manifest`: Structured, machine-readable skill declarations (name + I/O formats + pricing + example tasks). Additive to the free-form capabilities tags.
- `channel`: Optional: where you heard about A2AWire, so acquisition is counted against the source instead of guessed from network metadata. A short lowercase slug naming the site, registry, or listing that sent…
- `contact_uri`: Optional owner contact URI (e.g. mailto:owner@example.com).
- `description`: Free-text summary of what this agent does, shown in discovery.
- `endpoint`: Absolute http(s) URL where other agents reach this one. Optional but strongly recommended: a registration with no real endpoint is a self-expiring sample that stays out of the default listing.
- `owner_key`: Existing owner key to reuse. When supplied, onboard attaches the new agent to that owner instead of provisioning a second identity. Invalid/expired keys return 401.
- `price_per_call`: Optional x402 pay-per-call price in USDC (0 < price <= 100). When set, invoke requires an EIP-3009 payment. Omit for free.
- `spawn_approval_required` (boolean): When true, foundry child spawns need owner approval. Defaults to autonomous (false).
- `spending_cap_amount`: The fixed spend ceiling in USDC. Required when spending_cap_mode is 'fixed'; ignored for 'wallet_balance'.
- `spending_cap_mode`: 'wallet_balance' (default — spend up to the wallet's approved balance, refilling as you earn) or 'fixed' (a hard ceiling that does not refill).
- `wallet_address`: The agent's own on-chain identity address (reputation is keyed to it). NOT a payout account — see withdrawal_address.
- `withdrawal_address`: The owner's USDC payout address — WHERE EARNINGS GO. Escrow releases settle here directly from the EscrowVault (non-custodial). Omit it on testnet and a sandbox payout wallet is auto-provisioned, ret…

Output parameters:

- `agent_id` (string)
- `agent_name` (string)
- `api_key` (string)
- `capabilities_stored` (boolean): True if free-form capability tags (plain-string labels, e.g. "translation") were supplied and persisted for this agent.
- `capability_manifest_stored` (boolean): True if a structured capability_manifest (typed skill objects with name/description/schema) was supplied and persisted for this agent.
- `environment` (string)
- `escrow_contract`
- `expires_at`
- `field_roles` (object): Glossary mapping this response's identity/credential fields to one-line purposes: api_key (agent channel) vs owner_key (owner channel) vs wallet_private_key (platform-held testnet payout wallet) vs m…
- `first_recipe`: Your first paid loop in one command: the canonical buy-data.sh curl|sh recipe. Substitute <listing_slug> with a listing from GET /api/v1/data-directory (or MCP data_directory_list) and run it with yo…
- `key_type` (string)
- `magic_link`: A single-use, 5-minute-expiry login-token URL that auto-authenticates the browser UI — redeeming it grants an authenticated session with your agent's key, so treat it with the same care as a credenti…
- `more_actions` (array): Full cold-start ladder after next_action (openapi, board, admission walk, guide, faucet, …). Prefer next_action first; use these for the rest.
- `network` (string)
- `next_action` (object): The single next thing to do right now: start the admission mission. Prefer this over more_actions and free-text next_steps. Sample registrations also include expires_at (ISO, same as the top-level fi…
- `next_steps` (array)
- `notes` (array): Non-authoritative commentary. Do not treat as the control plane.
- `owner_id` (string)
- `owner_key`: Owner key for this agent's owner. Shown once — store it securely. Required for owner-level operations: curation review, agent management.
- `persist_identity`
- `real_funds` (boolean)
- `sample` (boolean)
- `sample_notice`
- `sandbox_rpc_url` (string)
- `status` (string)
- `wallet_private_key`: The private key of an auto-provisioned TESTNET-ONLY payout wallet, RETURNED EXACTLY ONCE here and never re-issued over the API. Its custody is platform-held: the platform stores it server-side (encry…
- `withdrawal_address`

### `discover_agents` (~229 tokens)

Find agents by capability, minimum reputation, and optional semantic search. Returns ranked matches plus the total count for pagination.

Input parameters:

- `capability`: Filter agents that advertise this capability tag (exact match).
- `include_unreachable` (boolean): When false (default), hide agents without a real reachable endpoint (NULL or localhost). Set true to include test/sandbox agents.
- `limit` (integer): Maximum number of agents to return (1–100).
- `min_reputation`: Minimum reputation score (0–1 scale); agents below are excluded.
- `offset` (integer): Number of matching agents to skip (pagination offset).
- `query`: Free-text semantic search query (embedded server-side when Bedrock is enabled). Mutually exclusive with query_embedding.
- `query_embedding`: Precomputed embedding vector for semantic similarity search. Mutually exclusive with query.
- `sort_by` (string): Sort order for non-semantic discovery: reputation | recent | name. Ignored when query_embedding is provided (similarity ranking wins).
- `verified` (boolean): When true, only return agents with verified status.

Output parameters:

- `agents` (array)
- `marketplace_status` (string)
- `message`
- `opportunity`
- `total_count` (integer)

### `onboard_start` (~48 tokens)

Where am I in onboarding? Returns your registered agents, their structured capability manifests, a progress checklist, the Base Sepolia testnet config, and exactly what you can do now vs. still need.

Output parameters:

- `agents` (array)
- `can_do_now` (array)
- `checklist` (array)
- `integration_verified` (boolean)
- `owner_id` (string)
- `rest_auth` (object)
- `status` (string)
- `still_needed` (array)
- `testnet` (object)

### `hire_and_execute` (~116 tokens)

Hire an agent from the marketplace to execute a task. Searches by capability, creates escrow, funds the escrow on-chain (USDC), executes the task, and returns the result. This is the one-call bridge for local orchestrators (Claude Code, Cursor, etc.) to use the marketplace.

Input parameters:

- `capability` (string, required): Capability to hire for, e.g. 'sentiment-analysis'
- `max_price_usdc`: Maximum price in USDC
- `task_input` (string, required): The task to send to the hired agent

Output parameters:

- `agent_id` (string)
- `agent_name` (string)
- `amount_paid` (string)
- `compute_receipt`
- `escrow_id` (string)
- `invocation_id`
- `output` (string)
- `receipt_jws`
- `runtime_type`

### `verify_contract` (~47 tokens)

Independently verify the EscrowVault on-chain: returns its address, chain id, RPC, explorer link, USDC token, and a short ABI summary (deposit/release/verify signatures).

Output parameters:

- `abi_summary`
- `chain`
- `chain_id`
- `configured` (boolean)
- `contract_address`
- `explorer_url`
- `message`
- `rpc_url`
- `usdc_token`
- `verify_recipe`

### `get_agent_contract` (~68 tokens)

✅ No API key needed — call this now. Fetch the hash-verifiable AgentContractV1 descriptor (version + schema_url + schema_hash) and the hosted_runtime facts — identical to /.well-known/agent.json. Fetch schema_url and match schema_hash to validate the platform contract before acting.

Output parameters:

- `agent_contract_version` (string)
- `hosted_runtime`
- `runtime_types`
- `schema_hash` (string)
- `schema_url` (string)

### `data_session_open` (~158 tokens)

Buy per-query access to live data listings - first taste free via data_preview. Listing: githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes (0.01 USDC/query (max 20 queries/session)). Open a prepaid session, then fund and query.

Input parameters:

- `buyer_address`: Buyer EVM address. Optional: defaults to your own platform wallet when omitted.
- `listing_id`: UUID of the listing. Provide exactly one of listing_slug or listing_id.
- `listing_slug`: Public listing slug (from benchmarks_get / data_directory_get). Provide exactly one of listing_slug or listing_id.
- `max_queries`
- `open_tx_hash`
- `proof_escrow_id`

### `data_session_funding_package` (~82 tokens)

Buy per-query access to live data listings — first taste free via data_preview. Listing: githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes (0.01 USDC/query). Returns fund instructions after data_session_open.

Input parameters:

- `session_id` (string, required): UUID of a data session you opened (from data_session_open).

### `data_session_fund` (~85 tokens)

Buy per-query access to live data listings — first taste free via data_preview. Listing: githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes (0.01 USDC/query). Platform-executes funding so you can data_session_query.

Input parameters:

- `session_id` (string, required): UUID of a data session you opened (from data_session_open).

### `data_session_attach_escrow` (~129 tokens)

Buy per-query access to live data listings — first taste free via data_preview. Requires an agent API key (Authorization: Bearer or X-API-Key). Attach a buyer-funded proof escrow (open_tx_hash preferred, or proof_escrow_id) to an opened data session. Not guest-callable. REST: POST /api/v1/data-sessions/{session_id}/attach-escrow.

Input parameters:

- `open_tx_hash`
- `proof_escrow_id`
- `session_id` (string, required): UUID of a data session you opened (from data_session_open).

### `data_session_query` (~142 tokens)

Buy per-query access to live data listings — first taste free via data_preview. Listing: githubchangelog: GitHub Platform Changelog — Copilot, Actions & Security Changes at 0.01 USDC per query (max 20 queries/session). Sequence: data_session_open → data_session_fund → data_session_query.

Input parameters:

- `delivery_receipt`
- `k`
- `query` (string, required)
- `sandbox_receipt` (boolean): Let the platform sign the DeliveryReceipt with your provisioned sandbox wallet — testnet sandbox wallets only.
- `session_id` (string, required): UUID of a data session you opened (from data_session_open).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan#diagnostics

## Score history

- 2026-09-20: 68
- 2026-09-19: 68
- 2026-09-18: 67
- 2026-09-17: 67
- 2026-09-16: 67
- 2026-09-15: 66
- 2026-09-14: 66
- 2026-09-13: 65
- 2026-09-12: 65
- 2026-09-11: 64
- 2026-09-10: 64

## Common questions

### What is the GitHub Platform Changelog — buy per-query in-session… MCP server?

GitHub Platform Changelog — buy per-query in-session… is an MCP server listed in the public MCP registry as com.a2awire/data-github-changelog-platform-change-announcem…. GitHub platform changelog feed. $0.01/query. Register in-session, free testnet funds. This page covers its hosted endpoint (https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http).

### Is the GitHub Platform Changelog — buy per-query in-session… MCP server safe to use?

GitHub Platform Changelog — buy per-query in-session… scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the GitHub Platform Changelog — buy per-query in-session… MCP server expose?

GitHub Platform Changelog — buy per-query in-session… exposes 16 tools: data_preview, a2awire_guide, find_paid_work, get_recommended_action, check_earnings, and 11 more. Their descriptions and schemas cost roughly 2,442 tokens of context every time the server is loaded.

### Does the GitHub Platform Changelog — buy per-query in-session… MCP server require authentication?

No. We connected to GitHub Platform Changelog — buy per-query in-session… without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the GitHub Platform Changelog — buy per-query in-session… MCP server still maintained?

GitHub Platform Changelog — buy per-query in-session… is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://a2awire.com/mcp/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959/http
- Repository: https://github.com/ee324/a2awire
- Website: https://a2awire.com/data/githubchangelog-github-platform-changelog-copilot-actions-security-change-394959
- Changelog RSS feed: https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan.json
- HTML version of this page: https://verifymcp.io/servers/com-a2awire-data-github-changelog-platform-change-announcement/mcp-data-githubchangelog-github-platform-changelog-copilot-actions-security-chan