sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 12 Projects Releases 291 Packages Wiki Activity
291 releases 291 tags
  • v0.1.91 730584696d

    v0.1.91 Stable

    gitea_admin released this 2026-07-06 23:31:53 +00:00 | 887 commits to main since this release

    Changed

    • De-admin (data-plane, pass 1): the 8 standard pipeline legs (land, staging,
      promote, promote-tag, promote-image, deploy, deploy-flux, release-cadence) now mount
      the non-admin forgejo-pipeline-bot-token instead of the site-admin
      forgejo-admin-token. Mounted at the SAME path (items: {key: token, path: admin_token}) so the read logic + git URLs are untouched — only the token identity
      changes. pipeline-bot is a write collaborator + (when enabled) merge/tag-whitelisted,
      so it can clone/push, open+merge PRs to protected branches, and cut tags/releases.
      The kernel + builder-images build/promote legs, the provisioner webhook, and
      forgejo-sync still use the admin token (follow-up passes).

    Fixed

    • pipeline-promote-image (go-operator-image taxonomy) now pushes each operator
      release image to codeberg (codeberg.org/someara/<project>:v<version>) in
      addition to registry.sean.farm. The operator Deployments pull from codeberg —
      it is rebuild-durable (survives make destroy, present at cold-rebuild before
      zot exists), whereas a registry.sean.farm-pinned operator would
      ImagePullBackOff-deadlock a cold rebuild. Previously releases only reached
      registry.sean.farm, so every operator (forgejo/openbao/kratos/pipelines) was
      stranded at whatever version was last hand-pushed to codeberg. Uses the existing
      codeberg-push-secret (same cred builder-images uses); same OCI tar → identical
      signed digest.

    Included changes (v0.1.90 -> v0.1.91)

    • 2f9164365e02 feat(de-admin): standard data-plane legs run as pipeline-bot (pass 1)
    • 8ac04f12f7cf fix(promote-image): push operator release images to codeberg too
    Downloads
  • v0.1.90 aeb51ed66c

    v0.1.90 Stable

    gitea_admin released this 2026-07-06 21:06:30 +00:00 | 894 commits to main since this release

    Fixed

    • A Role that patches a CR */status subresource must also grant get. kubectl patch --subresource=status --type=merge GETs the subresource first, so a patch-only grant fails with
      "cannot get resource /status" and the status write silently no-ops. Fixes the per-image
      PipelineRelease RBAC (pipelinereleases/status was [patch] → [get,patch]), which would have
      left every builder-images release row non-terminal. Adds a regression guard
      (tests/rbac-status-subresource.sh, wired into tests/check.sh) that fails if any Role patches a
      */status resource without get.

    Included changes (v0.1.89 -> v0.1.90)

    • b99e9908560f test(rbac): guard that a Role patching */status also grants get
    Downloads
  • v0.1.89 643c13d7bb

    v0.1.89 Stable

    gitea_admin released this 2026-07-06 20:37:13 +00:00 | 899 commits to main since this release

    Changed

    • Incremental release.

    Included changes (v0.1.88 -> v0.1.89)

    • 056970a6e931 fix(backfill): grant get on pipelinebuilds/status + self-heal stuck CRs
    Downloads
  • v0.1.88 4368be2d29

    v0.1.88 Stable

    gitea_admin released this 2026-07-06 20:21:39 +00:00 | 904 commits to main since this release

    Changed

    • Gitops deploys reflect their tagged release + enforce "deployable main". Per the CD model
      (Builds Releasable, Releases Deployable; every release ff's main + tags), gitops deploys now stamp the
      release version so the DEPLOY row shows v0.1.87-style badges like the operator/package deploys:
      • pipeline-deploy.yaml (gitops-deploy): resolve_version now retries ~60s — pipeline-promote-tag
        ff's main (which fires the deploy) before creating the tag, so the one-shot resolve raced empty.
      • pipeline-deploy-flux.yaml (gitops-flux): drop the hardcoded-empty "versionless" assumption; resolve
        • stamp the tag at the deploy sha.
      • Deployable-main hard guard: a MAIN-anchored (release) deploy now fails loud if the deploy sha
        carries no release tag — catching any release path that advanced main without tagging. Rollback
        reverts are exempt (untagged by design; they restore last-good).

    Added

    • pipeline-build-backfill CronWorkflow — reconstructs PipelineBuild CRs (terminal, no workflow)
      from the durable MinIO builds/<short>/MANIFEST archive so the BUILDS pane keeps history after a
      build's Argo workflow GC's, and the RELEASES "changes since" commit-highlight links resolve. Matches
      the projector's naming/labels (idempotent, skips existing); terminal phase → the zombie-reaper leaves
      it. Scoped RBAC (pipelinebuilds+/status in workflows-alice) + the dashboardread-s3 read key.

    Included changes (v0.1.87 -> v0.1.88)

    • 27e267f3547b feat(deploy): gitops deploys reflect tagged releases + backfill build history
    Downloads
  • v0.1.87 4e5b1fa0b0

    v0.1.87 Stable

    gitea_admin released this 2026-07-06 19:18:03 +00:00 | 909 commits to main since this release

    Removed

    • Retire projects/builder-images/ — builder-images is now a PipelineProject CR in seanfarm
      (dockerfile-set taxonomy, pipelines-operator v0.1.18). The operator SSA-adopted the ci/staging
      sensors + branch-protections + ci-artifacts + provision the overlay created; the ApplicationSet's
      preserveResourcesOnDeletion keeps them through the cutover. projects/ now holds only linux
      (the intentionally special-cased kernel pipeline) — the CRD migration is complete.

    Included changes (v0.1.86 -> v0.1.87)

    • e4959c3fb631 chore: retire projects/builder-images/ overlay (now a PipelineProject CR)
    Downloads
  • v0.1.86 f01e58d68a

    v0.1.86 Stable

    gitea_admin released this 2026-07-06 17:31:02 +00:00 | 915 commits to main since this release

    Added

    • builder-images (dockerfile-set) now emits per-image RELEASE rows. pipeline-promote-images, in
      its retag loop, creates one display-only PipelineRelease per retagged image (version <name>-<vN>,
      status.phase=Succeeded, image digest + release workflow linked) so the dashboard RELEASES pane shows
      sysadmin-6, cast-render-3, … instead of "(no releases yet)". The CRs carry no spec.declaredBy,
      so the operator's ReleaseSubmitter ignores them — pure projection, they trigger no workflow/deploy.
      Scoped RBAC added to the pipeline-build-images SA (create/patch pipelinereleases + /status in
      workflows-alice, nothing cluster-scoped). Best-effort: a kubectl blip never fails the actual release
      (the retag + ff-main are the release; the row re-creates on the next promote).

    Included changes (v0.1.85 -> v0.1.86)

    • 3376431414b8 feat(promote): per-image PipelineRelease rows for dockerfile-set
    Downloads
  • v0.1.85 9ec6a9b5d6

    v0.1.85 Stable

    gitea_admin released this 2026-07-06 16:40:18 +00:00 | 920 commits to main since this release

    Fixed

    • Durable log folds no longer collapse multi-leg steps — when a build's live workflow has GC'd and
      emit_logs reconstructs the fold by listing the archive under <wf>/, each node's main.log is now
      keyed by the full <step>-<id> (unique) rather than the bare step name, so two legs that share a base
      name (e.g. compile amd64 + arm64) render as two distinct chips pointing at their own logs instead of
      two identical chips onto one file.

    Included changes (v0.1.84 -> v0.1.85)

    • 420d5f0d607e fix(dashboard): unique log file per node in durable fold fallback
    Downloads
  • v0.1.84 0af33268bb

    v0.1.84 Stable

    gitea_admin released this 2026-07-06 16:26:39 +00:00 | 925 commits to main since this release

    Fixed

    • Build-artifact folds are now durable (survive the live Argo workflow's TTL GC). The dashboard's
      build download + per-step log folds were keyed off the ephemeral wf-<proj>.tsv (live workflows only),
      so once a project's build workflows GC'd, every build row lost its expand affordance even though the
      binaries (MinIO builds/<short>/) and step logs (workflow archive) persist. The wf-poller now emits a
      durable bmeta-<proj>.tsv (<short>\t<wf>) from the PipelineBuild CRs (both the short label and
      the attempt workflow name outlive the wf); emit_build unions those durable shorts, and emit_logs
      unions the durable build wfs and falls back to listing the immutable archive under <wf>/ when the live
      logidx is gone. Build folds now match the panes ROWS, which already survive via the query service.

    Included changes (v0.1.83 -> v0.1.84)

    • 1d8e3c7133ff fix(dashboard): durable build-artifact folds from PipelineBuild CRs
    Downloads
  • v0.1.83 6082be0abc

    v0.1.83 Stable

    gitea_admin released this 2026-07-06 15:16:53 +00:00 | 930 commits to main since this release

    Fixed

    • pipeline-staging forwards renderRoot + gitRepositoryName (defaulted, unused by non-flux
      build templates) so the gitops-flux RELEASE build (buildTemplate=pipeline-validate-flux, which reads
      them at workflow level) resolves them — a shipped gitops-flux release failed to submit with
      "failed to resolve {{workflow.parameters.renderRoot}}" (caught on platform-seanfarm, the canary).

    Included changes (v0.1.82 -> v0.1.83)

    • d55c8b815a51 fix(pipeline-staging): forward renderRoot + gitRepositoryName for gitops-flux release
    Downloads
  • v0.1.82 21b407db98

    v0.1.82 Stable

    gitea_admin released this 2026-07-06 14:45:36 +00:00 | 935 commits to main since this release

    Changed

    • gitops-flux gains a release beat (build→release→deploy), step 1 of 2 — template support.
      Prep so seanfarm + platform-seanfarm stop being special (deploy-on-trunk-push with no tag) and
      follow "builds releasable, releases deployable" like every other project:
      • pipeline-validate-flux now reads the VERSION file (mirrors pipeline-validate): a clean
        x.y.z → mode=release (so a shipped trunk push runs pipeline-staging's promote-tag),
        -dev/absent → mode=deploy (a plain land only validates). Backward-compatible: still
        versionless while a repo has no VERSION file.
      • pipeline-deploy-flux gains an anchor param so it can deploy off a RELEASED main push
        (anchor=main: the superseded/regressed check anchors on main, since the release devbumps trunk
        ahead) as well as the legacy fused trunk flow (anchor=""). The drift gate no longer requires
        codeberg==Forgejo-main (codeberg is legitimately behind after a release); the ff-only codeberg
        push in step 3/5 remains the divergence guard. fromSha now records the live codeberg tip.
        Behavior is unchanged until the gitops-flux sensors switch (operator step 2).

    Removed

    • Retire projects/{seanfarm,platform-seanfarm,pipelines}/ — the CRD migration is COMPLETE. The
      3 self-referential gitops repos are now PipelineProject CRs in seanfarm, rendered by
      pipelines-operator v0.1.15's gitops-flux + gitops-deploy renderers (seanfarm carries the image-bumps
      autoland; pipelines self-host carries the ArgoCD deploy sensor). Parity-gated; operator SSA-adopts the
      preserved sensors, preserveResourcesOnDeletion keeps them through the cutover. projects/ now
      holds only builder-images + linux       (the intentionally special-cased dockerfile-set + kernel
      pipelines). All 16 pipeline projects across all 7 taxonomies are now CR-registered — "ingest a
      project" = "write a ~20-line PipelineProject CR."

    Included changes (v0.1.81 -> v0.1.82)

    • bd6459067f88 feat(gitops-flux): template support for a release beat (build->release->deploy)
    Downloads