sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 12 Projects Releases 282 Packages Wiki Activity
282 releases 282 tags
  • v0.1.22 7cd5a41424

    v0.1.22 Stable

    gitea_admin released this 2026-07-03 14:24:29 +00:00 | 1226 commits to main since this release

    Changed

    • Dashboard: every row in a pane now has ONE uniform shape/type. Build and
      Deploy rows lead with a 12-char commit sha and nothing else; Release rows
      lead with a vX.Y.Z version and nothing else. A build no longer shows a trailing
      · vX.Y.Z (that appeared only when the built commit happened to sit on a clean
      VERSION — release commits — so the pane mixed sha and sha · version rows), and
      a release never falls back to a bare sha. The version a build might be released AS
      is a Release-pane property, not a build's identity. Dropped the green releasable
      tag (the status.releasable flag stays on the CR; it just isn't rendered).
    Downloads
  • v0.1.21 b844d611d5

    v0.1.21 Stable

    gitea_admin released this 2026-07-03 13:49:14 +00:00 | 1231 commits to main since this release

    • feat(zerotea): the release path now RUN-VERIFIES the cross-compiled binaries per
      arch (Guard 5), not just links them. build.sh's RELEASE section runs the
      ReleaseSafe+musl test suite for amd64 (natively on the all-amd64 cluster) and for
      arm64 under the cluster's host qemu-aarch64 binfmt with -Dcpu=baseline+aes, which
      selects src/crypto/aes.zig's ARMv8 Crypto-Extension HwCore (aese/aesmc) — the
      only hardware SIMD crypto path, and one never previously run in CI (all nodes are
      amd64; the baseline musl legs resolve to SoftCore). No image or infra change: the
      existing infrastructure/binfmt DaemonSet's F-flag registration makes the aarch64
      test binary exec transparently in the unprivileged, egress-locked build pod. Proven
      KAT-clean in-cluster (1233/1233 tests incl. the HwCore-vs-SoftCore parity KAT).
    Downloads
  • v0.1.20 e52bc0cd35

    v0.1.20 Stable

    gitea_admin released this 2026-07-03 13:16:28 +00:00 | 1238 commits to main since this release

    • fix(zerotea): mutation-smoke cron no longer aborts right after the baseline
      test. The rotating-sample pipeline used head -n N, which closes the pipe
      early; under set -o pipefail the upstream SIGPIPE (exit 141) killed the run
      before any mutant was applied. Replaced with awk 'NR<=n' (reads to EOF, no
      early close). The clone + baseline zig build test already worked in-cluster;
      this makes the mutate loop actually run.
    Downloads
  • v0.1.19 601ea16fcd

    v0.1.19 Stable

    gitea_admin released this 2026-07-03 13:05:27 +00:00 | 1245 commits to main since this release

    • feat(zerotea): mutation-smoke cron (Guard 4) — a self-contained 6h
      CronWorkflow that anon-clones staging and flips a rotating sample of
      behaviour-changing operators in src/** (==↔!=, <=→>,
      return true/false, and/or), re-running zig build test. A SURVIVING
      mutant (suite still green) is a candidate vacuous test / missing assertion and
      fails the run — the alert. Survivors are framed as REVIEW CANDIDATES
      (equivalent mutants survive legitimately). Zerotea-scoped only; does not touch
      the shared pipeline-staging.yaml.
    • fix(zerotea): coverage gate fails CLOSED in CI. The three kcov-unavailable
      fallbacks (kcov absent / wrapper won't build / kcov emits no percent) used to
      WARN-and-continue, so the 85% floor could silently stop being enforced. They
      now exit 1 when COV_REQUIRE=1 (defaulted from the CI-only REPO export;
      a local ./build.sh with REPO unset still skips-with-WARN). The >=floor
      comparison already failed closed and is unchanged.
    Downloads
  • v0.1.18 36cb703115

    v0.1.18 Stable

    gitea_admin released this 2026-07-03 12:53:43 +00:00 | 1251 commits to main since this release

    Changed

    • Dashboard: the Build / Release / Deploy panes now render from the
      pipelines-operator's projected Change CRs (PipelineBuild / PipelineRelease /
      PipelineDeploy) instead of the client-side parseWfRows run-classifier. A run's
      kind is decided ONCE, server-side, in the operator — so the misfiles are gone: a
      clean-VERSION build shows in Build (with releasable=true), never masquerading as
      a release; a dev delivery never appears in Release; plumbing runs project no CR
      at all (one central filter, not 13 per-sensor exclusion lists). The wf-poller
      publishes the CRs per project (/api/<proj>/{pbuild,prel,pdep}); the SPA parses them
      into the same row shape the panes/folds/latest-cards already use, and falls back to
      the classifier when a project has no CRs yet (cold rebuild before the operator syncs).
      Log/DAG folds keep working off each Change's status.workflow. Guarded by
      tests/dashboard-change-crs.test.js. See docs/CHANGE-MODEL.md.
    Downloads
  • v0.1.17 e67c148224

    v0.1.17 Stable

    gitea_admin released this 2026-07-03 12:23:41 +00:00 | 1260 commits to main since this release

    Changed

    • Incremental release.
    Downloads
  • v0.1.16 ee5560e313

    v0.1.16 Stable

    gitea_admin released this 2026-07-03 08:21:36 +00:00 | 1265 commits to main since this release

    Added

    • Dashboard: RELEASE rows now surface per-step logs for the credential-safe
      steps of a release run (compile/publish/test/validate/…). A succeeded release
      folds to its artifacts and step-log chips; a FAILED release folds to its
      step logs (the point of opening it). The promote/sign/devbump/cadence pods —
      which hold Forgejo push tokens + GPG/cosign signing keys — are never
      web-published: the wf-poller's logidx awk gates release nodes by a DEFAULT-DENY
      allowlist of safe step-template names (exact $7 in S match + NF==7
      field-integrity), the same templates already published for build runs. Because
      emit_logs only mirrors indexed S3 keys, a dropped step's log is never fetched.
      Guarded by tests/dashboard-release-logs.test.js (extracts the awk as the
      single source of truth; locks the render/render-installer boundary) +
      tests/dashboard-release-render.test.js. (Live release-log streaming remains a
      follow-up; this ships the archived path.)
    Downloads
  • v0.1.15 b58314ed8d

    v0.1.15 Stable

    gitea_admin released this 2026-07-02 22:13:38 +00:00 | 1270 commits to main since this release

    Added

    • Dashboard LIVE step logs: a running build/deploy row folds open to pulsing
      live chips; the log viewer auto-refreshes every 3s and sticks to the bottom —
      no Argo-UI detour to watch a run in flight. (wf-poller tails running pods into
      the shared volume; nginx serves /livelog/ + /api//live.)
    • Dashboard: "Latest · deploy" card in the DEPLOY PIPELINES pane (deployed
      commit, status, when), completing the latest-card trio.

    Changed

    • Dashboard: NOW RUNNING and RECENT RELEASES sections removed — running rows
      (pulsing dot + live chips) replace the stage pills, and release history lives
      one click away in Forgejo.

    Fixed

    • cancel-stale (the superseded-build reaper — plumbing, not signal) no longer
      appears anywhere on the dashboard: filtered from the archived log index, the
      live-log tails, and defensively at parse time.
    • Live logs (adversarial-review hardening): live-tail is now scoped to build +
      deploy runs only — release/promote/cadence/ship pod stdout (which can hold
      Forgejo tokens / signing material) is never web-published, matching the
      archived-log surface.
    • Live viewer no longer false-"step finished"s on a single transient 404: the
      poller swaps /shared/livelog by rename (µs gap, not a full rm -rf window), the
      per-project TSV publishes tmp+mv, and the client tolerates 3 consecutive
      misses before declaring a live stream ended.
    • Live viewer: generation-guarded fetches (a stale in-flight poll can no longer
      paint the wrong log or kill a newly-opened chip's timer); wfPoll drops results
      that resolve after a project switch; a running row's fold no longer flaps shut
      between steps (sticky last-good live index until the row goes terminal); a
      release fold survives the Running→Succeeded flip (stable state key).
    Downloads
  • v0.1.14 413af10acc

    v0.1.14 Stable

    gitea_admin released this 2026-07-02 22:06:42 +00:00 | 1276 commits to main since this release

    Fixed

    • Release machinery no longer leaves a FAILED CI row per release: every CI
      sensor now excludes release-cadence/<v> (mirrors _devbump//_promote/).
      The cadence CWT pushes that branch, PR-merges it, then deletes it seconds
      later; CI was firing on the push and racing the delete, so the build cloned
      an already-gone branch (fatal: Remote branch … not found). Applied to all
      13 versioned projects (gitops-flux seanfarm/platform are versionless → no
      cadence → exempt).
    • pipeline-land now deletes the feature branch after a successful merge
      (delete_branch_after_merge) — a landed branch is done, so it's reaped
      instead of accumulating on Forgejo. The branch-delete push (after==000…0)
      is already dropped by every CI filter, so no spurious build fires.
    Downloads
  • v0.1.13 e5462e7c93

    v0.1.13 Stable

    gitea_admin released this 2026-07-02 21:24:03 +00:00 | 1281 commits to main since this release

    Fixed

    • Fix-forward off v0.1.12: the Forgejo ff-race poisoned that version number
      (DB recorded the _promote PR merged, main never advanced, every retry
      no-op-merged), freezing the shared trunk at v0.1.11 for all agents. Skip to
      0.1.13; this release carries all staging work that was stuck behind it.
    Downloads