gitea_admin
released this
2026-07-04 10:39:41 +00:00
| 1212 commits to main since this release
Security
- buildkit + ibmi publish no longer xtrace-leak the MinIO build key.
pipeline-build-buildkit
and pipeline-build-ibmi ran set -eux before mc alias set … "$AK" "$SK", so bash printed the
work-bucket access/secret key into the archived pod log (archiveLogs: true) on every buildkit- and
ibmi-taxonomy build — a supply-chain vector (anyone reading logs could poison builds/<sha>/). Now
set -eu → alias → set -x, matching the pipeline-build/-desktop twins that already did this.
- shipd hardens the
X-User-Email identity. POST /api/ship now rejects a blank/malformed header
(must match a basic email shape) before stamping the audited actor; nginx.conf documents why the
header cannot be safely cleared at that hop. Still trusted transitively — the proper close (verify a
signed oathkeeper id_token) remains accepted debt, bounded by the shipd-guard VAP + cadence idempotency.
Fixed
- deploy-flux no longer green-skips a REGRESSED trunk. The superseded check treated any
trunk-tip != sha as "superseded → exit 0"; a Forgejo ff-race regressing the ref backward then stranded a release
undeployed while the row showed Succeeded. Ported the compare-API discrimination from pipeline-deploy
(sha AHEAD of tip ⇒ regression ⇒ exit 1 loud) and added an empty-tip guard (transient API failure now
fails loud, not green). Protects the gitops-flux spine (seanfarm / platform-seanfarm).
- promote PR-fallbacks match by base AND head. The ff-main and dev-cycle-bump fallbacks in
promote,
promote-tag, and promote-image selected the first open PR by base only, so an unrelated concurrent PR
could be ff-merged onto a protected main/trunk. Now use the by-base/head lookup the codebase already
uses in pipeline-land.
- image + tag promote enforce version monotonicity.
promote-tag and promote-image overwrote
releases/latest unconditionally; a lower clean version reaching trunk could roll the latest pointer
backward. Ported the sort -V no-downgrade guard from pipeline-promote.
- desktop release fails closed on a missing macOS SDK.
fetch-sdk logged a warning and exited 0, so a
release build could ship a signed zelnet package silently missing its .app/.pkg. Now exit 1 when a
required SDK object is absent on a release build (dev/feature-branch CI still skips gracefully).
- land binds the merge to the verified sha.
pipeline-land merged by branch name; a machine branch
(image-bumps) could advance between the green-check and the merge and land an unvalidated tip. Now
re-asserts the tip and passes head_commit_id (Forgejo 409s on any move).
- releases-only
main is push-protected on the rpg + zelnet repos. branch-protection rendered
enablePush: true for main on rpg-hello/demo/lemonade/munchers + zelnet, contradicting their
main: releases-only. Set to false (the ff-only merge-API promote works fine under protection).
- ibmi deploy integrity gate no longer masks a failed query. Added
set -o pipefail + a non-empty
assertion so a failing zelnet sql in the piped integrity check can't be swallowed into a false "differs".
- trunk-name resolver is failure-safe fleet-wide (11 sites). Replaced
ls-remote --exit-code … || TRUNK=staging — which misread any transient ls-remote failure as "repo uses the dead staging name" —
with a single dual-head query that picks the present ref and defaults to the live trunk on error, across
build/build-buildkit/build-ibmi/build-desktop, validate/validate-flux, promote-image, deploy-ibmi,
test-ibmi-behavioral, and the two zerotea crons.
rollback-* CI reservation narrowed to the machine pattern. The gitops CI filters excluded any
rollback-… branch (so a human rollback-cnpg-migration got no CI); tightened to rollback-[0-9a-f]{7,}$
so only the ephemeral rollback-<sha> branches the deploy creates are skipped.- devbump reads only the
.version field for zig-zon. The "already -dev" idempotency guard grepped the
whole build.zig.zon and false-matched a nightly minimum_zig_version = "…-dev.N", which would wedge
auto-releases; now extracts .version the way the cadence template does.
- validate dropped the dead
staging remap left by the staging→trunk rename, and shipd's config
parser strips YAML quotes so a quoted kind: "none" is honored by the no-release guard (matching pipectl).
Downloads