95 releases 129 tags

RSS feed

• v1.5.0 9a3b363c7a

  Compare

  v1.5.0 Stable

  gitchegumi released this 2026-09-08 17:14:05 -05:00 | 256 commits to main since this release

  Build-once environment promotion

  Added

  • Package dev and prod configurations into one signed UDS bundle.
  • Select the environment at deployment time without rebuilding the release.
  • Validate that environment profiles use identical pinned images and separate namespaces, package names, endpoints, and static volumes.
  • Expand deployment logging with selected environment, archive digest, verification, rollout, and health-check progress.
  • Report scanner failure phases and safe diagnostic categories without exposing raw scanner output or secrets.

  Compatibility

  • Preserve existing single-environment deployments and environment-mismatch checks.
  • Retain automatic OpenBao credentials, signature verification, security rescanning, and deployment health checks.

  Adoption

  • Enable promotion through .pipeline/promotion.json and reviewed dev/prod profiles.
  • Apply the required platform RBAC before adopting the expanded deployment permission contract.
  • Existing static persistent volumes remain a platform prerequisite.

  Validation

  • 105 library tests pass.
  • Hosted workflow acceptance, security scanning, and integration checks pass.
  • Live dev-to-prod promotion validation remains pending.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.4.3 e1f05ef63f

  Compare

  v1.4.3 Stable

  gitchegumi released this 2026-09-08 14:14:43 -05:00 | 259 commits to main since this release

  Deployment credential validation

  Adds a credential validation mode that exercises automatic credential issuance without deploying an application.

  Added

  • credential_mode: validate for the reusable deployment workflow.
  • Validation of Forgejo OIDC authentication, OpenBao login, temporary Kubernetes credentials, and required and forbidden permissions.
  • Progress logging for each validation stage, permission check, cleanup, and total elapsed time.

  Fixed

  • Removed the diagnostic startup dependency on PyYAML so inspection and validation work on a fresh runner.
  • Updated two existing scan mitigation fingerprints after code relocation, preserving their controls and expiry dates.

  Validation

  • All 97 unit tests pass, including clean-runner startup, authorization checks, and cleanup failure handling.

  Existing deployment modes remain available. Live credential issuance validation is the next operational acceptance step.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.4.2 46e1bed132

  Compare

  v1.4.2 Stable

  gitchegumi released this 2026-09-08 07:21:39 -05:00 | 263 commits to main since this release

  Reusable workflow OIDC fix

  Fixed

  • Enables OpenID Connect at both workflow and job level so Forgejo preserves it during reusable-workflow expansion.
  • Addresses missing ACTIONS_ID_TOKEN_REQUEST_URL errors during credential inspection and automatic credential setup.

  Validation

  • Adds regression coverage for OIDC enablement.
  • All 93 tests pass locally; live inspection remains the runtime acceptance check.

  Adoption

  Update caller workflow pins to v1.4.2, then start a new inspection run from protected main.

  No new secrets or Forgejo authentication sources are required.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.4.1 c56683e7ec

  Compare

  v1.4.1 Stable

  gitchegumi released this 2026-09-07 22:08:33 -05:00 | 265 commits to main since this release

  Credential inspection diagnostics

  Improves troubleshooting for automatic deployment credential setup.

  Fixed

  • Replaces generic inspection failures with actionable diagnostics for missing configuration, endpoint mismatches, HTTP errors, TLS failures, connectivity problems, and malformed responses.
  • Validates identity-token payloads before processing claims.
  • Keeps credentials, request URLs, response bodies, and sensitive exception details out of logs.

  Validation

  • All 92 tests pass, including new diagnostic and secret-redaction coverage.

  Existing deployment behavior remains compatible. Update caller workflow pins to v1.4.1 before rerunning credential inspection.

  Broader workflow progress logging remains follow-up work.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.4.0 1f86bcfe3a

  Compare

  v1.4.0 Stable

  gitchegumi released this 2026-09-07 21:09:27 -05:00 | 267 commits to main since this release

  Automatic deployment credentials

  Adds automatic deployment credential issuance through Forgejo OpenID Connect and OpenBao, removing the need to manually refresh Kubernetes credentials for each deployment.

  Added

  • Optional OpenBao credential mode for reusable bundle deployments.
  • Inspection mode to review Forgejo identity claims without deploying.
  • Repository-specific permission contracts that verify required access and reject excessive permissions before deployment.
  • Documentation for configuring identity trust and onboarding applications.

  Security

  • Validates the issued service account and remaining credential lifetime.
  • Masks credentials, removes Forgejo identity-request credentials from the deployment subprocess, and revokes the OpenBao token after execution.
  • Fails explicitly when credential issuance or permission validation fails.

  Compatibility and adoption

  Existing kubeconfig-based deployments remain supported. OpenBao mode requires platform configuration and caller workflow updates.

  Environment selection and promotion of the same tested artifact from dev to prod remain follow-up work.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.3.6 82bc79f527

  Compare

  v1.3.6 Stable

  gitchegumi released this 2026-09-07 16:50:25 -05:00 | 270 commits to main since this release

  Fixes UDS deployment failures caused by renaming bundle archives to bundle.tar.zst.

  • Preserve generated uds-bundle-<app>-amd64-<version>.tar.zst filenames throughout build, publication, verification, and deployment.
  • Support existing signed releases by creating a correctly named local copy after verification. No rebuild required.
  • Reject duplicate or ambiguous archive names and filenames inconsistent with verified app metadata.
  • Disable UDS progress animations and color for clearer deployment logs.
  • Refresh two existing scan-mitigation fingerprints affected by line-number changes; controls and expiration dates remain unchanged.

  Validation: 77 unit tests, scaffold checks, and the updated security scan passed. Live deployment remains to be validated.

  Upgrade: Update both reusable workflow references and library_ref to v1.3.6. Existing signed application releases remain compatible.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.3.5 13d4ebaab5

  Compare

  v1.3.5 Stable

  gitchegumi released this 2026-09-07 15:46:35 -05:00 | 273 commits to main since this release

  Fixes private Forgejo release downloads that failed with HTTP 404 when using the automatic Actions token.

  • Use a dedicated RELEASE_READ_TOKEN for attachment downloads.
  • Keep the automatic token for release metadata and deployment authorization checks.
  • Report missing or invalid download credentials clearly.
  • Add a download-only probe that requires no cluster credentials.
  • Preserve signature, checksum, provenance, mitigation-expiry and scan verification.

  Required configuration: Store a repository-read token as RELEASE_READ_TOKEN and explicitly forward it from each app’s deployment workflow. An organization secret can serve multiple approved app repositories.

  Validation: All hosted checks passed, including 73 unit tests and 16 scaffold cases. A live download of Actual Budget’s private app.json succeeded.

  Existing signed bundles remain compatible; no rebuild is required.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.3.4 f453997031

  Compare

  v1.3.4 Stable

  gitchegumi released this 2026-09-06 10:55:14 -05:00 | 275 commits to main since this release

  v1.3.4

  Fixes release-asset downloads that blocked deployment of signed bundles from private Forgejo repositories.

  Fixes

  • Download assets through Forgejo’s authenticated UUID attachment route instead of browser-facing release URLs.
  • Report the affected asset name and HTTP status when a download fails.

  Security and compatibility

  • Reject external assets, malformed attachment UUIDs, and redirects.
  • Preserve signature verification, artifact checksums, provenance validation, mitigation expiry, and deployment rescanning.
  • Existing signed bundle releases remain compatible; no rebuild is required.

  Validation

  All 68 unit tests, 16 scaffold cases, and hosted CI checks pass. New regression tests cover authenticated downloads, redirect rejection, invalid metadata, and HTTP failures.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.3.3 0533fb7aab

  Compare

  v1.3.3 Stable

  gitchegumi released this 2026-09-06 08:55:34 -05:00 | 277 commits to main since this release

  v1.3.3

  This release fixes scan failures on container-image configuration findings and makes security artifacts more useful for investigation.

  Fixes

  • Handle Trivy image Dockerfile checks that omit source line numbers while preserving strict source-manifest validation.
  • Correct garbled characters in report headings.

  Improved scan artifacts

  • Add summary.md with blockers first, finding explanations, remediation guidance, and advisory links.
  • Add findings.csv for filtering and sharing findings.
  • Enrich decision.json with affected packages, installed and fixed versions, finding categories, policy reasons, and mitigation details.
  • Clearly distinguish CVEs, configuration checks, source checks, and scanner errors.
  • Include readable reports in source, container, bundle, deployment, and PV-provisioning scan artifacts.

  Finding fingerprints and enforcement remain unchanged. No findings are waived, and secret matches and raw source snippets remain excluded.

  Validation

  All 62 unit tests, 16 scaffold cases, and hosted CI checks pass. Regression coverage verifies report generation for successful scans, policy rejection, and scanner failures.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.3.2 665cb0f612

  Compare

  v1.3.2 Stable

  gitchegumi released this 2026-09-06 00:58:46 -05:00 | 282 commits to main since this release

  v1.3.2

  Fixes authorized manual builds and deployments being rejected when Forgejo reports reusable jobs as workflow_call.

  • Verifies the original run’s manual-dispatch event, repository, commit, actor, and branch through Forgejo’s API.
  • Preserves protected-branch and approved-actor requirements.
  • Rejects job reruns because Forgejo does not reliably expose the rerun initiator. Retry using a fresh manual dispatch.
  • Adds regression tests for parent-run verification, rerun rejection, and workflow context wiring.

  All library, workflow acceptance, and security checks passed.

  Upgrade: Update reusable workflow uses references and matching library_ref values to v1.3.2. No signing-key or deployment-credential changes are required.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads