sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 12 Projects Releases 294 Packages Wiki Activity
294 releases 294 tags
  • v0.1.134 adc2f48d6b

    v0.1.134 Stable

    pipeline-bot released this 2026-07-11 10:52:11 +00:00 | 680 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.133 -> v0.1.134)

    • 6eade07bbaab feat(maxsec): fleet-roll branch-protection dials to the remaining 15 projects
    Downloads
  • v0.1.133 d9637aafa3

    v0.1.133 Stable

    pipeline-bot released this 2026-07-11 10:20:46 +00:00 | 684 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.132 -> v0.1.133)

    • ae1e2397494c feat(maxsec): expand branch-protection canary to libseanfarm-operator
    Downloads
  • v0.1.132 30fceeded7

    v0.1.132 Stable

    pipeline-bot released this 2026-07-11 06:03:48 +00:00 | 688 commits to main since this release

    • Move the two OCI retag-by-digest steps (pipeline-promote-images,
      pipeline-promote-kernel) off the multi-GB sysadmin:v8 image onto minimal
      pipeline-tools:v3, which now bakes crane (go-containerregistry v0.21.7) at
      build time alongside mc/kubectl/skopeo. sysadmin is fully out of the promote
      path. Unify every templates/base pipeline-tools ref on :v3 (v3 = v2 + crane;
      no version skew).

    Included changes (v0.1.131 -> v0.1.132)

    • 50f46beaaa60 feat(pipeline): move OCI retag steps off sysadmin onto pipeline-tools:v3 (crane baked)
    Downloads
  • v0.1.131 7f16945f00

    v0.1.131 Stable

    pipeline-bot released this 2026-07-11 05:26:01 +00:00 | 692 commits to main since this release

    • Pin the pipeline's baked toolchain to the released pipeline-tools:v2 tag
      instead of a raw @sha256: digest across all templates/base steps (promote,
      deploy-kernel, build-images, build-backfill, pkg-install, provisioner). The
      :v2 tag resolves to the same content, now cut through builder-images'
      release pipeline (cosign-signed provenance) rather than a hand-pinned digest;
      also upgrades pipeline-promote-tag off its stale Phase-1 build.

    Included changes (v0.1.130 -> v0.1.131)

    • 53c76493c641 fix(pipeline): pin baked toolchain to released pipeline-tools:v2 tag
    Downloads
  • v0.1.130 e291a86b40

    v0.1.130 Stable

    pipeline-bot released this 2026-07-10 17:34:58 +00:00 | 697 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.129 -> v0.1.130)

    • 6329d741a803 fix(pipeline-merge): 409 head_commit_id can be transient, not just a tip-move
    • a695296dac52 feat(maxsec-3c): hello-lib opts into requireSignedCommits (canary)
    Downloads
  • v0.1.129 8473bedb9f

    v0.1.129 Stable

    pipeline-bot released this 2026-07-10 16:44:31 +00:00 | 703 commits to main since this release

    • Deploy pipelines-operator v0.1.28. Auto-bump the operator app pin (targetRevision + controller image) v0.1.27 -> v0.1.28 in apps/applications.yaml; rides the next pipelines release to main, where the pipelines-deploy sensor syncs the operator.

    Included changes (v0.1.128 -> v0.1.129)

    • 3c6f4ef503da deploy(operator): pin pipelines-operator v0.1.27 -> v0.1.28
    Downloads
  • v0.1.128 d9bde1f76e

    v0.1.128 Stable

    pipeline-bot released this 2026-07-10 16:39:40 +00:00 | 707 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.127 -> v0.1.128)

    • fd8630369b74 feat(maxsec-3b): dial-gated Do:squash for signed-commit trunks
    Downloads
  • v0.1.127 3da48eba59

    v0.1.127 Stable

    pipeline-bot released this 2026-07-10 12:33:11 +00:00 | 711 commits to main since this release

    • Max-security Phase 2: outdated-branch self-heal + hello-lib dials. pipeline-merge now
      reacts to Forgejo's blockOnOutdatedBranch 405 by server-side-rebasing the PR
      (update?style=rebase), waiting for CI to re-green the rebased sha (new build + new
      pipeline/ci status), then retrying the merge bound to the new tip (max 2 updates; a rebase
      conflict fails loud). Reactive — zero behavior change for repos without the dial. hello-lib
      (canary) turns on blockOnOutdatedBranch + dismissStaleApprovals (inert until approvals).

    Included changes (v0.1.126 -> v0.1.127)

    • 75b7b24c856f feat(merge): outdated-branch self-heal + hello-lib Phase-2 dials
    Downloads
  • v0.1.126 91bf4a9c0a

    v0.1.126 Stable

    pipeline-bot released this 2026-07-10 12:12:33 +00:00 | 715 commits to main since this release

    • provision.sh: guarded mc curl — never apk add mc (that is Midnight Commander). The apk
      "fix" installed Alpine's mc = the file manager, breaking every provision run ("TERM
      unset"). Now: use baked mc when present (pipeline-tools), else curl dl.min.io (healthy again
      after its cert renewal) as fallback.

    Included changes (v0.1.125 -> v0.1.126)

    • 2042914e0ee1 fix(provisioner): guarded mc curl — never 'apk add mc' (Midnight Commander trap)
    Downloads
  • v0.1.125 f8b8ac9a7a

    v0.1.125 Stable

    pipeline-bot released this 2026-07-10 11:51:12 +00:00 | 719 commits to main since this release

    • Max-security canary: hello-lib trunk gates merges on the pipeline/ci status. First project
      to set spec.branchProtection.security.statusCheck — the operator renders its trunk
      ForgejoBranchProtection with enableStatusCheck:true + statusCheckContexts:[pipeline/ci], so a
      trunk merge now requires the commit-status CI posts. Trunk only (main is releases-only).

    Included changes (v0.1.124 -> v0.1.125)

    • c9d56ca532df feat(hello-lib): max-security canary — gate trunk merges on pipeline/ci status
    Downloads