sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests 11 Projects Releases 279 Packages Wiki Activity
279 releases 279 tags
  • v0.1.8 1f7951c11c

    v0.1.8 Stable

    gitea_admin released this 2026-07-02 18:32:38 +00:00 | 1292 commits to main since this release

    Changed

    • zerotea staging sensor now fires ONLY on release commits (headmsg matches
      release-cadence/ or release: ): the release is ONE pipeline from staging
      that ff's main at the end. Ordinary lands fire nothing on staging — their
      gate is the feature branch's own CI. Fixes the land-batch stampede where 10
      merges stacked 10 concurrent pipeline-staging runs (2026-07-02).
    Downloads
  • v0.1.7 b8524ded35

    v0.1.7 Stable

    gitea_admin released this 2026-07-02 18:15:06 +00:00 | 1297 commits to main since this release

    Fixed

    • shipd security posture documented honestly: the per-pod CiliumNetworkPolicy is inert on this
      cluster (the cluster-wide allow-cluster-mesh CCNP allows all in-cluster ingress; Cilium allows
      are additive). Effective guards = identity requirement + shipd-guard VAP + rate limit +
      cadence idempotence; oathkeeper id_token verification is the tracked follow-up.
    Downloads
  • v0.1.6 d2ae480fe6

    v0.1.6 Stable

    gitea_admin released this 2026-07-02 17:24:08 +00:00 | 1304 commits to main since this release

    Added

    • The ship API: bin/pipectl (ship / land / status) and a dashboard Ship
      button backed by a new least-priv shipd service — the release act is now an
      explicit, audited API call (seanfarm.io/shipped-by), not a VERSION-flip
      commit convention. Ship submits the trusted pipeline-release-cadence
      template, serialized by the land mutex.

    Fixed

    • release-cadence no longer cuts EMPTY releases: after any release the devbump
      commit alone moved staging past the tag, so an idle cadence tick (the zerotea
      6h cron, live) or ship call released pure bookkeeping forever. A
      substantive-delta guard now skips unless staging differs from the last tag
      outside the version + changelog files.
    • Ship/cadence runs render quietly on the dashboard unless they FAIL (a running
      one already shows in NOW RUNNING; a failed ship is a loud RELEASE-pane row).
    Downloads
  • v0.1.5 5032a5a0e0

    v0.1.5 Stable

    gitea_admin released this 2026-07-02 16:53:10 +00:00 | 1309 commits to main since this release

    Fixed

    • zerotea coverage gate: compile the kcov wrapper with -fllvm. zig 0.16's
      default self-hosted x86_64 backend emits DWARF the in-cluster debian kcov
      can't read — user code was invisible, so the first hard-gated release run
      measured 0.00% and correctly failed. With the LLVM backend kcov reads
      99.58%, deterministic across runs (the original research validated on a
      Homebrew/macOS kcov, which masked the backend difference).
    Downloads
  • v0.1.4 9505f41375

    v0.1.4 Stable

    gitea_admin released this 2026-07-02 16:18:08 +00:00 | 1314 commits to main since this release

    Changed

    • Re-pinned every zelnet-builder consumer from v2@sha256:b59fbb… to
      v3@sha256:a8fdd39b… (zerotea + zelnet config/sensors, seanfarm autoland).
      v3 bakes kcov/jq/bc, so zerotea's per-commit coverage gate now enforces
      the 85% floor instead of graceful-skipping (the egress-locked compile can't
      apt kcov at runtime). Additive for zelnet/zdns (same toolchain, extra tools).
      (The bullet originally landed under 0.1.3's heading, but v0.1.3 was tagged
      minutes before the re-pin landed — it ships here.)
    Downloads
  • v0.1.3 2382b707c3

    v0.1.3 Stable

    gitea_admin released this 2026-07-02 16:07:18 +00:00 | 1321 commits to main since this release

    Fixed

    • pipelines CI no longer fires on the release machinery's ephemeral branches.
      Every release's devbump pushed _devbump/vX.Y.Z-dev and deleted it seconds
      later (after its ff-merge) — CI cloned the already-deleted branch, failed
      with git exit 128, and left a label-less red "—" row in the BUILD pane, one
      per release. The pipelines sensor filter now excludes _devbump/ (as
      zelnet's always has) and rollback- (as seanfarm's always has) — both
      exclusions predate pipelines having a VERSION file, which is why it lacked
      them.
    Downloads
  • v0.1.2 a9b45e277c

    v0.1.2 Stable

    gitea_admin released this 2026-07-02 15:49:25 +00:00 | 1324 commits to main since this release

    Splits per-commit CI from the expensive release work, and adds a deterministic
    "when to cut a release" signal — so a grind can fan out fast feature branches
    while fuzz + ReleaseSafe still run often, just not per-PR.

    Added

    • templates/base/pipeline-release-cadence.yaml — a trusted CWT (holds the
      Forgejo token, runs no project code) that a per-project CronWorkflow submits
      on a schedule. If staging advanced past the last release tag, it drops the
      -dev suffix in the version file, promotes the CHANGELOG [Unreleased]
      section to a dated one, and lands it — driving pipeline-staging release mode
      (deep fuzz + ReleaseSafe + packaging + promote). Idempotent no-op when staging
      == last tag, the version is already clean, or the tag exists.
    • projects/zerotea/release-cron.yaml — the zerotea release-cadence signal
      (0 */6 * * *, concurrency Forbid). Fuzz + ReleaseSafe now run every 6h when
      there are changes, not on every PR.

    Changed

    • projects/zerotea/build.sh — per-commit CI is now a FAST correctness gate:
      zig fmt --check + zig build test + a Debug zig build (compiles exe +
      fuzz harness) + a deterministic kcov coverage gate (src-scoped, floor 85%,
      today ~99.6%; degrades to a warning until the builder ships kcov). The deep
      fuzz pass + amd64/arm64 ReleaseSafe cross-compile + nfpm packaging are gated
      to release mode (clean x.y.z). config.yaml records the coverage floor +
      the 6h cadence.
    Downloads
  • v0.1.1 c9816fc8b2

    v0.1.1 Stable

    gitea_admin released this 2026-07-02 15:00:39 +00:00 | 1329 commits to main since this release

    Hardens the release path against the Forgejo ff-race that stranded v0.1.0
    (tagged + released but never deployed: the ff-merge 200'd, the DB recorded the
    PR merged, and an internal Forgejo op pushed main back seconds later — after
    which every re-PR of the same sha insta-closed as "already included"). This
    release is itself the fix-forward that advances main past the stranded sha.

    Fixed

    • promote-tag: main advancement now runs in up to 3 rounds and only counts a
      main that still holds the release sha after an 8s settle; all rounds failing
      aborts the release BEFORE the tag is cut (nothing half-released).
    • deploy: when the triggering trunk tip is BEHIND the deploy sha (regression),
      fail loudly instead of "Succeeded (skipped as superseded)" — a stranded
      release is now a red row, not silence.
    • promote-tag / devbump / deploy ffpr: PR-number fallbacks now match their own
      head+base with jq — the old first-open-PR grep could pick an unrelated PR
      and merge the wrong thing into the wrong branch.
    Downloads
  • v0.1.0 8d6e9344b4

    v0.1.0 Stable

    gitea_admin released this 2026-07-02 14:40:18 +00:00 | 1332 commits to main since this release

    The first shaped release: the pipelines repo now follows its own contract.

    Added

    • Consolidated CI/CD dashboard (pipelines.sean.farm): left-nav SPA over every
      project, BUILD / RELEASE / DEPLOY panes, per-step archived build & deploy
      logs (click a row), greenscreen reel galleries, dev-build downloads.
    • Shared pipeline templates across 5 taxonomies and 13 projects: validate /
      build (buildkit, desktop, ibmi) / test (pkg-install, ibmi-behavioral, noop) /
      promote (gpg-pkg, image-cosign, tag) / land / staging / deploy (+ flux
      variant) / devbump / cancel-stale / provisioner.
    • gitops-deploy taxonomy v2 — tag-shaped releases: VERSION + CHANGELOG.md,
      releases cut by pipeline-promote-tag, deploys triggered by the release
      advancing main (a main-push sensor), not by every staging land.
    • deploy-v2: server-side dry-run gate before main advances, ff-only merge
      machinery, ArgoCD convergence gate (Synced@sha + Healthy), data-plane smoke
      (the dashboard must serve rows, not just 200), auto-rollback on failed
      convergence for staging-triggered deploys.
    • In-cluster CI guards mirrored from pre-push: dashboard row classifier,
      archived-log index parser, and the poller-scripts structural guard (all four
      broken-\-continuation variants).

    Fixed

    • The dashboard silent-empty family: poller kubectl promotion gated on
      success, per-project truncate (no ghost rows), download-index and prune
      protected from transient-blip clobbers.
    Downloads