sean/pipelines-operator
Watch
1
0
Fork
You've already forked pipelines-operator
 0
Code Issues Pull requests 3 Projects Releases 58 Packages Wiki Activity
58 releases 58 tags
  • v0.1.48 db5c786733

    v0.1.48 Stable

    pipeline-bot released this 2026-07-21 18:43:50 +00:00 | 46 commits to main since this release

    • Fix the deploy-gate release filter (bool, not string). The <project>-deploy sensor filter compared
      deployable == "true" (string), but PipelineRelease.status.deployable is a bool, so the deployable=true
      event was received but never passed the filter — deploys silently didn't fire on release-green. Now
      (deployable == true || deployable == "true"). Regenerated the 3 deploy goldens + parity references.

    Included changes (v0.1.47 -> v0.1.48)

    • ac867462a91b fix(deploy-gate): compare deployable as bool in the release filter
    Downloads
  • v0.1.47 b7d603a9ec

    v0.1.47 Stable

    pipeline-bot released this 2026-07-21 18:12:32 +00:00 | 50 commits to main since this release

    • Registry pull secret flips to the bare registry store. config/seanfarm/registry-pull-secret.yaml repoints its
      secretStoreRef from zot-alice-registry-credentials → zot-registry-registry-credentials ahead of the XRegistry/alice
      teardown (pull is anonymous; repointed so the ExternalSecret stays healthy after alice is gone).
    • Deploys are GATED on release-green (universal, structural). The rendered <project>-deploy sensors
      (argocd/flux/ibmi taxonomies) now trigger on a new pipeline-release resource EventSource when the
      project's PipelineRelease reaches status.deployable==true — instead of on a git main-push. Because
      deployable latches true only when the WorkflowProjector observes the release-execution Workflow reach
      Succeeded (tag+sign+promote+ff-of-main done), a deploy can no longer start before its release is green
      (the prior main-push trigger raced ahead — main advances mid-release). The deploy consumes the release
      CR's spec.sha (the actually-shipped commit), and a deterministic <project>-deploy-<sha12> Workflow
      name dedups the EventSource's repeat status-update fires. New sensorSpec fields
      (EventSourceName/EventName/FilterFields/DeterministicName) default to the forgejo webhook so every
      build/staging/autoland sensor renders byte-identically. The pipeline-release EventSource + its RBAC ship
      in sean/pipelines bundle/workflows-infra-bare.

    Included changes (v0.1.46 -> v0.1.47)

    • 421abb0ff0b2 feat(deploy-gate): render -deploy sensors on release-deployable, not main-push
    • 1111113687f4 chore(registry): flip pull-secret store to zot-registry-registry-credentials
    Downloads
  • v0.1.46 64e5be6748

    v0.1.46 Stable

    pipeline-bot released this 2026-07-21 14:02:57 +00:00 | 56 commits to main since this release

    • Gate deploy submission on the release being green (Releases are Deployable). A deploy must not START
      before its release goes green. The main-push sensor DECLARES the deploy the instant main is pushed, but that
      ff-of-main is what the release run does near its END — the release can't flip to Succeeded until the workflow
      finishes and the projector reconciles, so the raw push always races ahead of the green status (the "publishing"
      window). DeploySubmitter now holds a declared deploy as Pending (no workflow, no "Running" row) until the
      matching PipelineRelease has latched Status.Deployable (project + SHA match). A release-less deploy (a
      direct/break-glass push to main) is ungated past a 3-min grace so it can't wedge forever. Envtest covers the
      hold-then-submit transition.

    Included changes (v0.1.45 -> v0.1.46)

    • 0c30e02389e1 feat(deploy): gate deploy submission on release Deployable (no deploy before green)
    Downloads
  • v0.1.45 8cc651ce9c

    v0.1.45 Stable

    pipeline-bot released this 2026-07-20 14:35:24 +00:00 | 60 commits to main since this release

    • Flip WorkBucketPrefix platform-workflows → workflows (CI-spine collapse Stage 3). Every project's
      sensor workBucket param and the per-project ci-artifacts log-archive bucket (_partials.tmpl) now target the
      bare workflows bucket. Safe because Stage 1b mirrored the data and Stage 1c triple-granted every per-project
      key the workflows bucket (the old platform-workflows/alice-workflows grants stay a union until Stage 5
      drain). Regenerated the 9 affected golden fixtures + the reference parity sensors. Land this in lockstep with
      the pipelines argo-workflows artifactRepository bucket and the pipeline-merge.sh WORKBUCKET gate, or writers
      and readers split buckets.

    Included changes (v0.1.44 -> v0.1.45)

    • d63abb0c12bb feat(render): flip WorkBucketPrefix platform-workflows -> workflows (Stage 3)
    Downloads
  • v0.1.44 36ea4486c7

    v0.1.44 Stable

    pipeline-bot released this 2026-07-20 08:31:32 +00:00 | 64 commits to main since this release

    Fixed

    • provision.keyset now inherits the taxonomy default. Dropped the
      +kubebuilder:default="build read" on PipelineProject.spec.provision.keyset: the default
      made the field always non-empty, so the render's taxonomy fallback (ks == "" → tax.Keyset)
      was dead code and every package project that didn't restate a keyset silently provisioned
      build+read only — no promote MinIO user, no gpg signing key. A project now sets
      provision.keyset only to OVERRIDE (e.g. linux pins build read); package shapes inherit
      build read promote from the taxonomy. Existing CRs keep their stored value until re-applied.

    Included changes (v0.1.43 -> v0.1.44)

    • 9ffdc048e0bc fix(provision): keyset inherits taxonomy default (drop build-read CRD default)
    Downloads
  • v0.1.43 f0408fb121

    v0.1.43 Stable

    pipeline-bot released this 2026-07-19 17:46:48 +00:00 | 68 commits to main since this release

    Changed

    • Render into the platform CI/CD singleton (platform-collapse Phase 2, B). WorkflowsNS
      workflows-alice → workflows-platform and the work bucket alice-workflows → platform-workflows
      (new co-located WorkBucketPrefix const + the artifact-repo bucket in _partials.tmpl). ForgejoNS
      stays forgejo-alice (Forgejo not yet collapsed); sdkObject is CR-driven (pass-through), unchanged.
      Goldens + parity references regenerated. Build-only — this ships an image but the cluster keeps
      running the pinned release until the pin is bumped at the cutover, so merging to trunk is inert.

    Included changes (v0.1.42 -> v0.1.43)

    • 45244da8e806 feat(render): Δ-E flip WorkflowsNS -> bare workflows (recut on trunk)
    • fdf9e74df127 feat(render): render into workflows-platform + platform-workflows bucket (Phase 2 B)
    Downloads
  • v0.1.42 26be1a0189

    v0.1.42 Stable

    pipeline-bot released this 2026-07-17 11:10:14 +00:00 | 74 commits to main since this release

    Removed

    • Remove the spec.libBump lib-bump autoland capability: the LibBumpSpec type + LibBump
      field, the libBumpAutoland/tagFilter sensor renderers + their dispatch, and the libbump
      golden case/fixture. Lib bumps into the downstream operators are done by hand now. (The
      spec.libBump config on the libseanfarm-operator PipelineProject and the pipeline-lib-bump
      ClusterWorkflowTemplate are removed in sean/pipelines.)

    Changed

    • Bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).
    • Adopt the lib's canonical operator.mk scaffolding: vendor it and shrink the Makefile to project vars + repo-specific targets (build/docker/e2e/deploy) — the shared dev-loop targets and tool pins (manifests/generate/fmt/vet/test/lint*, Dependencies) now come from the include, re-synced by the lib-bump autoland on every lib release. make test picks up the shared defaults (adds -covermode=atomic).
    • Migrate the shared Forgejo client (internal/forgejo) onto lib httpkit: the hand-built ca-bundle x509.CertPool transport -> httpkit.ClusterCATransport() (same bundle-with-system-fallback trust, plus the shared connection-pool tuning), and the 1 MiB io.LimitReader body read -> httpkit.BoundedRead (same default cap). Behavior identical.

    Included changes (v0.1.41 -> v0.1.42)

    • ffa79a8edeea feat(libbump): remove the spec.libBump lib-bump autoland capability
    • 79d673f4d980 chore(scaffolding): adopt operator.mk + httpkit client plumbing (lib v0.4.12)
    • 7f653c08fadb chore(deps): bump libseanfarm-operator v0.4.11 -> v0.4.12 (lib-autobump)
    Downloads
  • v0.1.41 9821a3c763

    v0.1.41 Stable

    pipeline-bot released this 2026-07-17 09:29:36 +00:00 | 82 commits to main since this release

    Fixed

    • A re-attempted PipelineRelease re-pins its spec identity. A Failed release
      re-attempts via a new staging run on the CURRENT trunk tip, but the versioned CR kept
      the ORIGINAL attempt's sha/short/buildRef (live divergence 2026-07-16: minio 0.3.5
      recorded b2f9267 while shipping a4090f2). upsertRelease now re-pins spec + change
      labels when the incoming run is at-or-newer than the stored one — same started-time
      ordering as the status anti-downgrade guard, so a stale re-delivery can never re-pin
      backward. Envtest red/green.
    • Bundle CNP: metrics 8443 ingress also allows vmagent (the actual scraper since
      2026-07-15; was vmsingle-only).

    Included changes (v0.1.40 -> v0.1.41)

    • 37f30a110a41 fix(projector): re-pin release spec identity on a newer re-attempt + vmagent NP
    Downloads
  • v0.1.40 04f8373fc4

    v0.1.40 Stable

    pipeline-bot released this 2026-07-16 16:31:14 +00:00 | 86 commits to main since this release

    Added

    • Operator metrics via libseanfarm reconcile.Metrics: reconcile counts/durations +
      status-write outcomes per controller — first custom metrics for this operator
      (pipelines_operator_reconcile_total, pipelines_operator_reconcile_duration_seconds,
      pipelines_operator_status_update_total).

    Changed

    • Bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump: rides the shared-library release train; the envtest release gate validates the suite against it on the next ship).

    Included changes (v0.1.39 -> v0.1.40)

    • d0b1f6771e74 feat(metrics): enable libseanfarm reconcile.Metrics
    • 5acb925dd6f7 chore(deps): bump libseanfarm-operator v0.4.10 -> v0.4.11 (lib-autobump)
    Downloads
  • v0.1.39 054d235c77

    v0.1.39 Stable

    pipeline-bot released this 2026-07-16 14:52:54 +00:00 | 92 commits to main since this release

    Fixed

    • libbump sensor fires on the event Forgejo actually sends. Tag pushes arrive as
      PUSH events (ref: refs/tags/vX.Y.Z, before=0000, after=sha) — verified live on the
      v0.4.11 tag; the assumed CREATE-with-ref_type event never arrives, and mapping the
      absent body.ref_type path made the filter discard everything. Standard
      repo/ref/after fields + a refs/tags/ trim; the TagEvent fields variant is gone.

    Included changes (v0.1.38 -> v0.1.39)

    • fb5ec4319469 fix(libbump): tag pushes are PUSH events (refs/tags ref), not CREATE events
    Downloads