sean/pipelines-operator
Watch
1
0
Fork
You've already forked pipelines-operator
 0
Code Issues Pull requests 3 Projects Releases 58 Packages Wiki Activity
58 releases 58 tags
  • v0.1.28 0ecbdcffe5

    v0.1.28 Stable

    pipeline-bot released this 2026-07-10 16:41:32 +00:00 | 137 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.27 -> v0.1.28)

    • f11365dd3c95 fix(maxsec-3c): requireSignedCommits is TRUNK-ONLY, not trunk+main
    Downloads
  • v0.1.27 90e0bb0632

    v0.1.27 Stable

    pipeline-bot released this 2026-07-10 07:31:21 +00:00 | 141 commits to main since this release

    • Per-project branch-protection security dials. New spec.branchProtection.security
      (BranchSecuritySpec: statusCheck/statusCheckContexts/requiredApprovals/requireSignedCommits/
      blockOnOutdatedBranch/dismissStaleApprovals) lets a project opt into stronger ForgejoBranchProtection.
      PR-gate dials apply to trunk only (main is releases-only); requireSignedCommits to both. Unset =
      byte-identical to the historical render (goldens unchanged). Foundation for the max-repo-security rollout.

    Included changes (v0.1.26 -> v0.1.27)

    • 5f7b23025c63 feat(crd): per-project branch-protection security dials
    Downloads
  • v0.1.26 1a29ea5f48

    v0.1.26 Stable

    pipeline-bot released this 2026-07-09 21:24:10 +00:00 | 145 commits to main since this release

    Removed

    • The scheduled release-cadence cron (the "cadence" idea). Dropped ReleaseSpec.Cadence and
      TaxonomySpec.CadenceStyle from the CRDs, the cadence render partial (the per-project
      <project>-release-cadence CronWorkflow/CronJob) + its skeleton gate, and the seeded
      cadenceStyle values. Releases are now purely on-demand (pipectl ship): the ReleaseSubmitter
      drives every declared release regardless of taxonomy (stage-1 resolves the version + fast-forward
      lands the release commit on trunk; operator-submittable shapes also get an operator-submitted
      stage-2, non-submittable shapes fall back to their trunk-push sensor). The operator prunes the
      now-unrendered CronWorkflows on reconcile. Kept: ReleaseSpec.Changelog, the cadence DeclaredBy
      enum (historical-CR validation), the CadenceWorkflow status field, and the release-cadence/<v>
      release-prep branch/template (the on-demand mechanism, unchanged). go test ./... green incl. envtest.

    Included changes (v0.1.25 -> v0.1.26)

    • 94fc07907d6c feat(release): remove the scheduled release-cadence cron (the cadence idea)
    Downloads
  • v0.1.25 8569a61c36

    v0.1.25 Stable

    pipeline-bot released this 2026-07-09 12:56:39 +00:00 | 149 commits to main since this release

    • Add a config/seanfarm deployment overlay that bases config/default and folds in the two
      prerequisites previously delivered by the separate sean/pipelines infra/operator-prereqs
      ArgoCD app: the registry-pull-secret ExternalSecret and the controller CiliumNetworkPolicy.
      The seanfarm ArgoCD app now sources config/seanfarm, making one app the single owner of
      pipelines-operator-system (retires the two-app split + its $patch:delete-namespace workaround).

    Included changes (v0.1.24 -> v0.1.25)

    • 8e9d53e65076 feat(config): add config/seanfarm overlay folding in operator prereqs
    Downloads
  • v0.1.24 9de5c85778

    v0.1.24 Stable

    pipeline-bot released this 2026-07-09 02:38:04 +00:00 | 154 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.23 -> v0.1.24)

    • 1810ea7dcd7b feat(render): per-project spec.test.template override for the staging test gate
    • 64dc0abab085 docs(crd): lifecycle contracts across the pipeline CRDs (kubectl explain)
    Downloads
  • v0.1.23 f92c387d93

    v0.1.23 Stable

    pipeline-bot released this 2026-07-08 22:36:22 +00:00 | 161 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.22 -> v0.1.23)

    • ae63605de265 feat(chain): typed Build<-Release<-Deploy chain refs
    • c27b1582e088 style(render): gofmt
    • 5ac8b68a6f24 refactor(render): delete 7 legacy template dirs, retire templateDir knob
    • 77be27ea5b00 refactor(render): migrate all 8 shapes to the data-driven skeleton
    • 7dd1ff6d781c refactor(render): data-driven sensor skeleton + provision/CM partials (pilot: dockerfile-set)
    • c760b00c26dd refactor(render): extract branch/tag protection into shared partials
    • 3369e072e757 test(render): golden snapshot of full object set per taxonomy
    Downloads
  • v0.1.22 3c394ec4ea

    v0.1.22 Stable

    pipeline-bot released this 2026-07-08 19:58:59 +00:00 | 172 commits to main since this release

    • Add the PipelineTaxonomy CRD: a pipeline SHAPE as data. The five taxonomy switch statements in
      internal/render (template dir, build-script-required, default keyset/builder image/promote
      template/staging deadline, operator-submittable) collapse to reads off a resolved PipelineTaxonomy.
      The operator seeds the builtin set (render.BuiltinTaxonomies) into workflows-alice at startup and
      resolves it there for every project; the parity test proves the table renders byte-identical to the
      hand-authored reference dirs. render.Objects/dataFor/StagingArgs now take the taxonomy; the
      PipelineProject reconciler watches PipelineTaxonomy to re-render on change.
    • Fix: a declared release whose taxonomy read fails no longer closes the intent as a false
      Succeeded — NotFound requeues (bootstrap window), other errors back off; only a present,
      non-submittable shape stays on the sensor path.

    Included changes (v0.1.21 -> v0.1.22)

    • 0bfc9bdcbd94 feat(taxonomy): PipelineTaxonomy CRD — pipeline shape as data
    Downloads
  • v0.1.21 dc0efdf849

    v0.1.21 Stable

    pipeline-bot released this 2026-07-08 16:26:34 +00:00 | 177 commits to main since this release

    Changed

    • Follow the pipelines land → merge verb rename: the autoland sensor now submits pipeline-merge
      (was pipeline-land) with <proj>-merge-auto- workflow names + <proj>-merge purpose, and the
      PipelineBuild.status.trigger enum is push;merge;manual (was land). The autoland feature
      name (spec.deploy.flux.autoland, the <proj>-autoland sensor) is unchanged.

    Added

    • PipelineRelease.status.deployable + a /active query endpoint — "Releases are Deployable", and
      the dashboard pulse becomes CR-sourced.       Deployable mirrors PipelineBuild.status.releasable: a
      sticky bool the WorkflowProjector latches true once the release run Succeeds (tag/artifacts
      published), never cleared by a later Failed/Running re-projection. Adds a Deployable printcolumn +
      ReleaseLeg.deployable in the query API. New GET /active returns every project with a
      Running/Pending Change CR (one per line, text/plain, matching the old active.txt wire format) so
      the dashboard sidebar pulse can read the SAME Change CRs the panes do — making pulse ⟺ a visible Running/Pending row true by construction. Envtest asserts the sticky latch; a query unit test
      asserts active(p) ⟺ ∃ non-terminal row in panes(p).

    Included changes (v0.1.20 -> v0.1.21)

    • 8c7f7bd72cd8 refactor(pipeline): follow land->merge verb rename
    • e79c4105e66b ci: re-trigger (buildkitd restarted for rotated token)
    • 6c8e4e5ea6fa ci: re-trigger (pipeline-bot token rotated post-migration)
    • 0e58f1474571 ci: re-trigger (forgejo back up)
    • 2065b983f444 ci: re-trigger (forgejo git-fetch recovered post-migration)
    • 803174126630 ci: re-trigger (compile leg hit a forgejo git-fetch 403)
    • 352e03d350d6 feat(cd-state): PipelineRelease.Deployable + /active endpoint (pulse ⟺ running)
    Downloads
  • v0.1.20 535531de78

    v0.1.20 Stable

    pipeline-bot released this 2026-07-07 07:26:05 +00:00 | 189 commits to main since this release

    Fixed

    • Manager RBAC grants forgejotagprotections (create/update/patch/…). v0.1.19 rendered the new
      ForgejoTagProtection per project but the operator's own ClusterRole only covered
      forgejobranchprotections, so every tag-protection apply failed forbidden ... cannot patch forgejotagprotections. Adds the kubebuilder RBAC marker + regenerated role.

    Included changes (v0.1.19 -> v0.1.20)

    • b26594dbea57 fix(rbac): grant manager access to forgejotagprotections
    Downloads
  • v0.1.19 032d9a2fb6

    v0.1.19 Stable

    pipeline-bot released this 2026-07-07 07:06:17 +00:00 | 194 commits to main since this release

    Added

    • Rendered protections lock trunk/main + tags to pipeline-bot (every taxonomy). Each project's
      main/trunk ForgejoBranchProtection now sets enableMergeWhitelist: true +
      mergeWhitelistUsernames: [pipeline-bot] — with enablePush:false already blocking direct pushes,
      the branch advances ONLY via a bot-merged PR (a non-whitelisted merge, incl. the repo owner /
      site-admin, is refused). Each project also renders a new ForgejoTagProtection <project>-tags
      (namePattern: "**", whitelistUsernames: [pipeline-bot]) so cutting a release (a tag) is a
      pipeline-only operation — verified live: a non-whitelisted tag create returns HTTP 422, the bot
      gets 201. Completes the pipeline-bot de-admin: humans propose via PR; only the pipeline integrates
      and releases.

    Included changes (v0.1.18 -> v0.1.19)

    • 126f74d0e999 feat(render): lock trunk/main merge + tag creation to pipeline-bot
    Downloads