sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 12 Projects Releases 294 Packages Wiki Activity
294 releases 294 tags
  • v0.1.144 8264639bad

    v0.1.144 Stable

    pipeline-bot released this 2026-07-12 11:12:57 +00:00 | 633 commits to main since this release

    • Deploy pipelines-operator v0.1.29. Auto-bump the operator app pin (targetRevision + controller image) v0.1.28 -> v0.1.29 in apps/applications.yaml; rides the next pipelines release to main, where the pipelines-deploy sensor syncs the operator.

    Included changes (v0.1.143 -> v0.1.144)

    • 6412899939a8 deploy(operator): pin pipelines-operator v0.1.28 -> v0.1.29
    Downloads
  • v0.1.143 5b3397cd49

    v0.1.143 Stable

    pipeline-bot released this 2026-07-12 10:59:10 +00:00 | 637 commits to main since this release

    Added

    • Temporary bootstrap alias pipeline-release-cadence — an old-named, self-certifying copy of
      pipeline-release-prepare so the still-running OLD operator can cut the ONE release that deploys the
      cadence-excised NEW operator; removed right after the operator cuts over. See cadence-excision cutover.

    Fixed

    • release-prepare self-certifies its version-bump commit (unblocks status-check-protected trunks).
      When a project's trunk enables branchProtection.security.statusCheck (contexts pipeline/ci),
      the release-prepare's ff-merge was rejected — its strip-dev + changelog commit rides a _release/*
      branch that is deliberately CI-excluded, so pipeline/ci never posts a status. The trusted
      release-prepare (Forgejo token, merge mutex, no project code) now POSTs pipeline/ci=success on
      that commit before merging — the same trust boundary as the ff-merge itself. Fixes a permanent
      release block on operator + package projects introduced by the max-security dials.

    Changed

    • Excise the "cadence" misnomer from the release engine. The scheduled-cron cadence is
      retired; the word lingered as the name of the live release-orchestration stage that
      pipectl ship drives. Renamed in lockstep with the operator: the
      pipeline-release-cadence CWT → pipeline-release-prepare, its release-cadence/
      version-bump branch → _release/ (adopting the _xxx/ plumbing convention), the
      <proj>-release-cadence purpose → -release-prepare, and the dashboard row-classifier +
      shipd VAP + linux CI sensor + docs to match. Stage 1 prepares the release (resolve
      version, promote changelog, ff-merge to trunk); stage 2 runs it. Retired the now-invalid
      "re-add release: { cadence: … } to restore" notes (the CRD field is gone). All dashboard
      guard tests + the TLA release contract model-check pass on the rename.

    Included changes (v0.1.142 -> v0.1.143)

    • d14b991e55bc chore(cutover): temporary self-certifying pipeline-release-cadence alias
    • 3b193c4d9b16 fix(release-prepare): self-certify version-bump commit on CI-excluded branch
    • 657b489006f7 refactor(release): excise 'cadence' misnomer (pipelines side)
    Downloads
  • v0.1.142 bd82c98ae1

    v0.1.142 Stable

    pipeline-bot released this 2026-07-12 09:36:56 +00:00 | 645 commits to main since this release

    Changed

    • zdns/zig builder pins → AlmaLinux v3 (Phase 2c). All 7 pins move off the pre-Alma
      Debian builders to zdns-builder:v3 / zig-builder:v3 (AlmaLinux 10): the zdns build
      (project-crs/zdns.yaml), the zelnet + zerotea builds, the two zerotea guard crons, and
      the operator-pin merge image (bin/pipectl MERGE_BUILDER + pipeline-deploy-operator-pin
      mergeImage). Safe now that promote no longer rides builderImage (it's on
      debian-repo-signer), so the Alma builders — which have no apt-ftparchive on the compile
      path — can't break deb/rpm repo-signing. Verified live before the bump: zig-builder:v3 has
      every tool pipeline-merge invokes (bash/curl/git/jq/mc/sed) + zig/nfpm; zdns-builder:v3 is
      jq-less but its consumers (build/staging/pkg-install) invoke no jq. Completes the deb-path
      leg of AlmaLinux-everywhere: no pipeline step fetches a tool at run time.

    Included changes (v0.1.141 -> v0.1.142)

    • fd0ab5684830 feat(builders): zdns/zig builder pins -> AlmaLinux v3 (Phase 2c cascade)
    Downloads
  • v0.1.141 9ae59f263a

    v0.1.141 Stable

    pipeline-bot released this 2026-07-12 09:23:46 +00:00 | 649 commits to main since this release

    Changed

    • promote runs on the baked debian-repo-signer image (Phase 2c). The TRUSTED
      deb+rpm repo-build+GPG-sign+publish step (pipeline-promote) moves off the project's
      compile builderImage onto a dedicated debian-repo-signer:v2 image with
      apt-ftparchive + createrepo-c + rpm + gnupg + jq + git + mc all baked — deleting the
      runtime apt-get install gnupg jq. Single-responsibility: project builders compile,
      this image builds+signs the repo. This also decouples promote from the builder so the
      next step (bumping zdns/zig builders to AlmaLinux, which lacks apt-ftparchive on the
      compile path) can't break deb/rpm repo-signing. Image validated end-to-end (apt Release
      clearsign/detach, createrepo_c indexes real rpm headers, all promote coreutils present).

    Included changes (v0.1.140 -> v0.1.141)

    • 2645a005c4ff feat(promote): run release step on baked debian-repo-signer (Phase 2c)
    Downloads
  • v0.1.140 ee6581998c

    v0.1.140 Stable

    pipeline-bot released this 2026-07-12 08:31:07 +00:00 | 653 commits to main since this release

    Changed

    • pipelines-ci → v4 (AlmaLinux) (Phase 2c). The self-hosting pipelines validate
      builder (kustomize dry-run + TLA model-check) moves off the pre-Alma image to
      pipelines-ci:v4. Verified on the Alma image before shipping: real kubectl kustomize
      renders and TLC model-checks a spec clean (it's the CI system's own builder).

    Included changes (v0.1.139 -> v0.1.140)

    • 2514000c9303 feat(cascade): pipelines-ci v1->v4 (AlmaLinux) — verified kustomize+TLC first
    Downloads
  • v0.1.139 02b9bda26f

    v0.1.139 Stable

    pipeline-bot released this 2026-07-12 07:59:20 +00:00 | 657 commits to main since this release

    Changed

    • Consumer cascade (Phase 2c, part 1). Repoint cast-render (v2→v4, in
      pipeline-test-ibmi-behavioral) and ibmi-builder (v8→v9, the 4 rpg CRs) to their
      released AlmaLinux images (tag+digest). Makes those Alma builds actually used.
      pipelines-ci + the zdns/zig-builder deb-cascade (needs the Debian repo-signer
      first) follow separately.

    Included changes (v0.1.138 -> v0.1.139)

    • 3fe4485ea60f feat(cascade): cast-render v4 + ibmi-builder v9 consumers to AlmaLinux (Phase 2c pt1)
    Downloads
  • v0.1.138 b5f4acc1a9

    v0.1.138 Stable

    pipeline-bot released this 2026-07-12 07:32:42 +00:00 | 661 commits to main since this release

    Changed

    • envtest gate stops fetching its control plane at run time (Phase 2b). The
      pipeline-test-envtest step ran go install setup-envtest + setup-envtest use 1.35.0
      (downloading a tool + the kube-apiserver/etcd/kubectl binaries) on every run. It now
      runs on the new envtest-tester:v1 AlmaLinux image, which bakes Go 1.26.5
      (GOTOOLCHAIN=local), setup-envtest, and the envtest 1.35.0 assets at a fixed
      KUBEBUILDER_ASSETS path — zero runtime tool fetch. Go modules still come from
      GOPROXY (source data, not a tool); egress-lock + Athens remain a follow-up.

    Included changes (v0.1.137 -> v0.1.138)

    • 380feb174c5d feat(envtest): test gate runs on baked envtest-tester:v1 (no runtime setup-envtest fetch)
    Downloads
  • v0.1.137 869e3474ae

    v0.1.137 Stable

    pipeline-bot released this 2026-07-12 06:57:20 +00:00 | 665 commits to main since this release

    Changed

    • Kernel-path steps stop fetching tools at run time (Phase 2a). The kernel-build
      verify step (crane from GitHub) and the deploy verify-sig step (cosign from
      GitHub) now run on pipeline-tools:v4 (which bakes crane + cosign + kubectl) with
      the runtime curl … releases/download lines deleted. These fired on every kernel
      roll — the same runtime-fetch SPOF class as the dl.min.io outage, now removed from
      the security spine. Also dropped a redundant apt-get install jq in
      pipeline-promote-image (jq is already baked). Seanfarm-side kernel-stager +
      cosign-key-extractor get the same treatment in a companion seanfarm change.

    Included changes (v0.1.136 -> v0.1.137)

    • 6ba13b855fac feat(kernel): verify/deploy steps use baked pipeline-tools:v4 (no runtime crane/cosign fetch)
    Downloads
  • v0.1.136 5232e41f17

    v0.1.136 Stable

    pipeline-bot released this 2026-07-12 06:21:42 +00:00 | 669 commits to main since this release

    Added

    • build-images hard deadline — the pipeline-build-images ClusterWorkflowTemplate
      now sets activeDeadlineSeconds: 3600, so the controller force-terminates any build
      that runs past 1h regardless of what it's stuck on. Defense-in-depth after the no-op
      hang (v0.1.135): a wedged workflow in an unresolvable-reference requeue loop can't be
      killed by a UI "Terminate" (the controller never re-evaluates it), but the deadline
      check fires on every reconcile and kills it. ttlStrategy only GCs completed
      workflows; this caps running ones. A no-op build is ~40s, so 1h is deep headroom.

    Included changes (v0.1.135 -> v0.1.136)

    • 9e79e6be041a feat(build-images): hard activeDeadlineSeconds cap so a wedged build self-terminates
    Downloads
  • v0.1.135 57e10c34ad

    v0.1.135 Stable

    pipeline-bot released this 2026-07-11 23:11:21 +00:00 | 673 commits to main since this release

    Fixed

    • build-images no-op hang: a seanfarm/builder-images commit touching no
      onboarded (VERSION-carrying) image wedged CI forever — the empty build fan-out
      had no aggregated built output, so gather hung on unresolvable-reference
      requeue and never wrote the smoke=pass MANIFEST, blocking the merge (12h-stuck
      builds observed). prepare now emits a __none__ sentinel leg so the fan-out is
      never empty, build-one early-exits on it, and a single always-run gather
      filters the empty entry. Unblocks base-image-only changes (kernel-builder,
      orphan-image deletion). The count>0 path is unchanged.

    Included changes (v0.1.134 -> v0.1.135)

    • 2195ee350991 fix(build-images): no-op commit no longer hangs CI (sentinel fan-out leg)
    • 0ff1a881571f revert(maxsec): remove requireSignedCommits fleet-wide (incident)
    • 9cf3a59f95b6 fix(maxsec): reactive Do:squash fallback for the de-admined bot
    • c0f6a133b3f3 feat(maxsec): statusCheck for zdns + zerotea (server-package uses buildkit CI)
    Downloads