• v0.4.11 b1a77ace25

    v0.4.11 Stable

    pipeline-bot released this 2026-07-16 14:26:48 +00:00 | 8 commits to main since this release

    Added

    • The extraction wave — the shared surfaces every operator hand-rolled:
      • Config.IsRemoteGone: the harness folds "remote already gone" Delete errors into an
        idempotent finalize (the status-lost-CR credential-leak class was fixed independently
        in two repos within 24h; unmatched errors keep today's semantics, so deliberate holds
        like kratos's ambiguous-miss grace still work).
      • reconcile.Metrics (+ Config.Metrics/MetricsController): reconcile passes,
        durations, status-write outcomes, and InstrumentedCall/RecordCall for API
        clients — namespaced so adopting operators keep their metric names; domain gauges
        stay operator-side. Replaces kratos's 173-line kit + openbao's ~300-line middleware,
        and gives forgejo/pipelines-operator/minio coverage for free.
      • SecretValue/HashValue/HashCanonical: the write-only-secret drift leaves,
        supporting BOTH fingerprint conventions (hash for high-entropy material;
        resourceVersion for low-entropy, per kratos's documented security choice).
      • httpkit: ClusterCATransport (trust-bundle + shared pooling tuning),
        CredentialCache[C] (rotation-aware client cache — the VSO/ESO rotated-token
        contract), BoundedRead/ErrorExcerpt (bounded to the condition-message limit).

    Included changes (v0.4.10 -> v0.4.11)

    • adb1dcf72a52 feat(extract): IsRemoteGone delete fold + Metrics kit + secret-drift helpers + httpkit
    Downloads