sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 12 Projects Releases 294 Packages Wiki Activity
294 releases 294 tags
  • v0.1.164 749cdb116a

    v0.1.164 Stable

    pipeline-bot released this 2026-07-13 21:39:59 +00:00 | 552 commits to main since this release

    Fixed

    • Revert the release-path Athens routing (0.1.163). Athens (canary image, disk storage,
      DOWNLOAD_MODE=sync) corrupts modules during go's concurrent COLD-fetch of a whole dependency
      graph (zip: not a valid zip file) — the render-installer/envtest cold-fetch the entire codegen
      toolchain at once, and a pre-warm can't avoid it (its own go install does the same concurrent
      cold-fetch, and failed every retry). A corrupt Athens 200 also doesn't trip the ,direct
      fallback. Both steps are back on proxy.golang.org (transient HTTP/2 flake, resubmittable). Athens
      stays build-path-only (buildkit's gomod cache avoids the cold-fetch) until its concurrency
      corruption is fixed — likely pinning off the canary image.

    Included changes (v0.1.163 -> v0.1.164)

    • 50719a0646e6 revert(release): Athens routing corrupts concurrent cold-fetch (breaks image releases)
    Downloads
  • v0.1.163 8f6fd3f292

    v0.1.163 Stable

    pipeline-bot released this 2026-07-13 19:51:04 +00:00 | 556 commits to main since this release

    Changed

    • Release-path Go steps route through the in-cluster Athens proxy (reliability). The envtest gate
      (pipeline-test-envtest) and the image-release render-installer (make build-installer) both
      fetched modules from the public proxy.golang.org — an HTTP/2 stream INTERNAL_ERROR on
      k8s.io/apimachinery failed a release 2026-07-13. Both now use
      GOPROXY=http://athens.athens.svc.cluster.local:3000,direct — the exact proxy the buildkit build
      path already uses — so cached modules come from in-cluster Athens and anything uncached falls
      through to direct. go.sum still gates integrity (a bad Athens zip fails loud, never poisons the
      build). No more public-proxy dependency on the release path.

    Included changes (v0.1.162 -> v0.1.163)

    • 184cfd78da40 perf(release): route envtest + render-installer through Athens, not proxy.golang.org
    Downloads
  • v0.1.162 1fc0a18ae1

    v0.1.162 Stable

    pipeline-bot released this 2026-07-13 18:44:06 +00:00 | 560 commits to main since this release

    Fixed

    • envtest gate: clone into $HOME/src, not /src. The baked envtest-tester:v1 image runs as
      a non-root user (writable $HOME for GOCACHE/GOMODCACHE, but / is not writable), so the gate's
      git clone … /src failed with could not create work tree dir '/src': Permission denied — the
      envtest gate never once passed in-cluster, blocking every go-operator/go-library release that
      uses it (forgejo-operator). Now clones under $HOME.

    Included changes (v0.1.161 -> v0.1.162)

    • bf6b2538b2f4 fix(envtest): clone into $HOME/src, not /src (non-root envtest-tester image)
    Downloads
  • v0.1.161 93ddd3d996

    v0.1.161 Stable

    pipeline-bot released this 2026-07-13 18:26:40 +00:00 | 564 commits to main since this release

    Fixed

    • Release regression: pipeline-staging now declares the release-lib volume (audit Wave 3
      Inc 2 follow-up). Inc 2 added the shared-lib mount to pipeline-promote + pipeline-promote-image,
      but those are invoked via templateRef from pipeline-staging, and a templateRef'd template does
      NOT inherit its own WorkflowTemplate's spec.volumes — the referencing workflow must supply them
      (same trap the codeberg/docker/forgejo volumes are declared here for). Its absence failed
      every package + image release at the promote step with volume 'release-lib' not found in workflow spec. release-lib.test.js now asserts any workflow that templateRefs a lib-sourcing
      promote template declares the volume (regression guard).

    Included changes (v0.1.160 -> v0.1.161)

    • 181fbb0ffbbf fix(staging): declare release-lib volume (Inc-2 templateRef regression)
    Downloads
  • v0.1.160 317f1dfbb4

    v0.1.160 Stable

    pipeline-bot released this 2026-07-13 16:22:18 +00:00 | 568 commits to main since this release

    Changed

    • Push-head ff-main callers on the shared lib (audit Wave 3, Inc 2). pipeline-promote (P1,
      package releases) and pipeline-promote-image (PI1, image releases) drop their inline
      PR-open + retry-merge + delete + verify blocks for ff_main. Each keeps its own git push -f
      of the _promote/v<ver> temp branch (it needs the /tmp/prov clone) and its CURMAIN
      idempotent skip; the lib owns everything after the push. New lib param --settle S (default 0,
      a byte-noop for the Inc-1 callers) sleeps once after the PR resolves so a freshly-pushed head's
      background-computed mergeability finishes before the first merge POST. P1 runs
      --mode best-effort --backoff fixed:3 --attempts 3 (byte-faithful to its set +e WARN
      contract); PI1 runs --mode fail-loud --backoff linear:4 --settle 3 --attempts 8. Declared
      deltas: PI1's separate FINAL GUARD is removed (redundant — ff_main --mode fail-loud's own
      post-merge want-guard is the superset; the idempotent path self-guards via CURMAIN); the
      dead sleep after the final failed attempt is gone (Inc-1 behavior); PR reuse now trusts only an
      open+unmerged PR (Inc-1 #710 fix); failure error text carries the promote: prefix but is
      reworded. pipeline-promote-tag's multi-round loop (fresh head per round + 404 poison-head
      classifier) stays inline — its --rounds/--held conversion is a later increment.

    Included changes (v0.1.159 -> v0.1.160)

    • ce537dcfccce refactor(release-lib): push-head ff-main callers on the lib (audit Wave 3, Inc 2)
    Downloads
  • v0.1.159 927ba9a0cf

    v0.1.159 Stable

    pipeline-bot released this 2026-07-13 15:22:11 +00:00 | 572 commits to main since this release

    Added

    • docs/RELEASE-LIB.md — the shared release-path lib's contract (delivery via the fixed-name
      ConfigMap, ff_main params + hardening, per-caller shapes, the guard tests, and the later-
      increment plan for push-head/--rounds/the merge escalation ladder).

    Included changes (v0.1.158 -> v0.1.159)

    • f9a61151e334 docs(release-lib): document the shared ff_main lib contract + increment plan
    Downloads
  • v0.1.158 68b1d9b1aa

    v0.1.158 Stable

    pipeline-bot released this 2026-07-13 15:13:22 +00:00 | 576 commits to main since this release

    Changed

    • Shared release-path bash lib — ff_main (audit Wave 3, Inc 1). New fixed-name ConfigMap
      pipeline-release-lib (kustomize configMapGenerator, disableNameSuffixHash) carrying
      templates/base/pipeline-release-lib.sh; pipeline-deploy + pipeline-deploy-flux replace their
      drifted inline ffpr() copies with a one-line shim over the lib, and pipeline-release-prepare
      replaces its inline PR+ff-merge+delete block with ff_main --attempts 1 --delete-head on-success.
      Declared behavior deltas from the inline copies: PR-reuse pins head AND base via the exact
      GET /pulls/{base}/{head} endpoint but trusts the number ONLY for an open unmerged PR (the
      endpoint has NO state filter and returns merged historical PRs — proven live on #710), with the
      old pipeline-deploy state=open jq list lookup kept as the stranded-open-PR self-heal; the merge
      POST verifies TLS via --cacert only (the old -k is gone); curl network failure counts as a
      retried attempt instead of killing the run; idempotent already-at-want skip is now default (a
      re-run rollback ffpr against an already-advanced trunk/main now succeeds instead of failing
      "could not open/find PR"); per-attempt retries are logged EPIPE-safe (deploy-flux trap '' PIPE
      convention); the dead sleep after the final failed attempt is gone; the post-merge want-guard
      (new for release-prepare) retries an EMPTY read ~3x but fails a non-empty wrong sha on the first
      read, and the head branch is reaped only AFTER the guard confirms the advance; --head/--base
      are charset-validated (refname+JSON/URL-safe) and release-prepare pre-validates the derived
      version; failure diagnostics are redacted.
      Guards: tests/check-release-lib.sh (offline behavioral unit tests of ff_main via stubbed curl;
      wired into check.sh + pipeline-validate) and tests/release-lib.test.js (caller/CM contract
      goldens; wired into the in-cluster guard list). Push-head materialize, --rounds, and the
      merge/squash escalation ladder land in later increments WITH their callers.

    Included changes (v0.1.157 -> v0.1.158)

    • a80aa9dc63cf refactor(release-lib): shared ff_main lib, first 3 callers (audit Wave 3, Inc 1)
    Downloads
  • v0.1.157 132cf1cfa1

    v0.1.157 Stable

    pipeline-bot released this 2026-07-13 13:48:22 +00:00 | 580 commits to main since this release

    Changed

    • Extracted the shared pipeline-publish leaf ClusterWorkflowTemplate (audit Wave 3, Increment 4B).
      pipeline-build / -build-buildkit / -build-ibmi / pipeline-validate / -validate-flux each
      redefined a near-identical publish mc-upload template; they now templateRef the one shared
      pipeline-publish (fixed quay.io/minio/mc image, powerless build-untrusted SA, build key via
      secret env). Byte-preserved the canonical upload body (mc cp → builds/<short>/, trunk-latch
      mirror → builds/latest); dropped the dead version input; converged build-ibmi's best-effort
      || true latest-mirror to the strict majority form. Net ~120 LOC of duplication removed. Not
      operator-emitted (an internal templateRef'd leaf), so the Increment-0 tripwire is unaffected;
      pipeline-build-desktop's bespoke 3-way-gather publish is left untouched.

    Included changes (v0.1.156 -> v0.1.157)

    • d470bce04e89 refactor(publish): extract shared pipeline-publish leaf CWT (audit Wave 3, Inc 4B)
    Downloads
  • v0.1.156 020160ec54

    v0.1.156 Stable

    pipeline-bot released this 2026-07-13 13:27:04 +00:00 | 584 commits to main since this release

    Changed

    • Consolidated the "open next dev cycle" devbump (audit Wave 3, Increment 3). The shared
      pipeline-devbump ClusterWorkflowTemplate — already run as pipeline-staging's last release
      step — is now the SOLE devbump. First upgraded its merge-style from the oldest Do:merge to
      ff-only + reactive instance-signed Do:squash fallback for requireSignedCommits trunks
      (grafted from pipeline-promote-tag, harmonized with pipeline-merge); THEN deleted the ~171
      lines of drifted inline devbump epilogue from pipeline-promote / pipeline-promote-tag /
      pipeline-promote-image (kept promote-image's redact() helper). Runs after promote with
      continueOn — cannot corrupt a published release; failure is at worst a silent stale-trunk.
      Guarded by the Increment-0 tripwire (no template renamed/orphaned).

    Included changes (v0.1.155 -> v0.1.156)

    • 57c19e48fcbb refactor(devbump): consolidate to the shared pipeline-devbump (audit Wave 3, Inc 3)
    Downloads
  • v0.1.155 85497e1d24

    v0.1.155 Stable

    pipeline-bot released this 2026-07-13 13:00:30 +00:00 | 588 commits to main since this release

    Added

    • Cross-repo template tripwire (audit Wave 3, Increment 0): tests/check-emittable-templates.sh
      asserts every ClusterWorkflowTemplate referenced BY NAME — the pipelines-operator's
      sensors.go/taxonomies.go emissions, intra-repo default template params (e.g.
      pipeline-staging's promoteTemplate), and CR test.template overrides — exists in
      templates/base/. A rename/delete there otherwise silently orphans a per-project sensor at
      runtime with no other coverage (this is the exact class the Wave-2 pipeline-promote "orphan"
      near-miss lived in — now guarded). Wired into tests/check.sh (pre-push) and the
      pipeline-validate gate (in-cluster; SKIPs if the operator source is unreachable). Passes today:
      21 referenced ⊆ 29 defined.

    Included changes (v0.1.154 -> v0.1.155)

    • 5918d1c8fc04 feat(gate): cross-repo template tripwire (audit Wave 3, Increment 0)
    Downloads