gitea_admin
released this
2026-07-05 09:02:32 +00:00
| 265 commits to main since this release
Added
- Read-only query service — the ONE server-side Build→Release→Deploy join (traceability Phase C
back-end). A new HTTP surface embedded in the operator (internal/query, a non-leader manager
Runnable on :9090, so every replica serves) reads the projected Change CRs straight from the
manager cache and answers:
GET /trace?project=&ref= — resolves ref (a commit sha, vX.Y.Z, or a Forgejo /commit/
permalink) and returns the joined chain: build + release (incl. the first tagged release
containing a non-release commit via a Forgejo compare walk) + deploys, plus — the capability
no single-project client surface has — the cross-project carrier leg: it follows a deploy's
carrierProject/carrierSha into the carrier gitops project's own deploy CR (e.g. an operator's
v0.6.1 → the seanfarm@<sha> deploy that moved its Flux pin).GET /status?project= — the latest build/release/deploy + tracked counts.
This is the single implementation the dashboard SPA and pipectl will consume, replacing the three
hand-synced client copies of the join (SPA JavaScript, pipectl python, the poller go-templates).
Reachable only via the dashboard nginx (same-origin, behind oathkeeper) and the RBAC-gated apiserver
service-proxy — plain in-pod HTTP, no new RBAC (the manager already has get/list/watch on the CRs).
Changed
- Forgejo client lifted to a shared
internal/forgejo package (New/Get/Raw/TagSHA/Tags/
Compare) so the pin resolver AND the query service use ONE anon-read client with one CA-trust
setup — never two copies. Pure move: pin-resolver behavior unchanged (its envtest coverage still
passes against the shared client).
Downloads