sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity
758 releases 759 tags
  • v0.1.138 b5f4acc1a9

    v0.1.138 Stable

    pipeline-bot released this 2026-07-12 07:32:42 +00:00 | 2150 commits to trunk since this release

    Changed

    • envtest gate stops fetching its control plane at run time (Phase 2b). The
      pipeline-test-envtest step ran go install setup-envtest + setup-envtest use 1.35.0
      (downloading a tool + the kube-apiserver/etcd/kubectl binaries) on every run. It now
      runs on the new envtest-tester:v1 AlmaLinux image, which bakes Go 1.26.5
      (GOTOOLCHAIN=local), setup-envtest, and the envtest 1.35.0 assets at a fixed
      KUBEBUILDER_ASSETS path — zero runtime tool fetch. Go modules still come from
      GOPROXY (source data, not a tool); egress-lock + Athens remain a follow-up.

    Included changes (v0.1.137 -> v0.1.138)

    • 380feb174c5d feat(envtest): test gate runs on baked envtest-tester:v1 (no runtime setup-envtest fetch)
    Downloads
  • v0.1.137 869e3474ae

    v0.1.137 Stable

    pipeline-bot released this 2026-07-12 06:57:20 +00:00 | 2154 commits to trunk since this release

    Changed

    • Kernel-path steps stop fetching tools at run time (Phase 2a). The kernel-build
      verify step (crane from GitHub) and the deploy verify-sig step (cosign from
      GitHub) now run on pipeline-tools:v4 (which bakes crane + cosign + kubectl) with
      the runtime curl … releases/download lines deleted. These fired on every kernel
      roll — the same runtime-fetch SPOF class as the dl.min.io outage, now removed from
      the security spine. Also dropped a redundant apt-get install jq in
      pipeline-promote-image (jq is already baked). Seanfarm-side kernel-stager +
      cosign-key-extractor get the same treatment in a companion seanfarm change.

    Included changes (v0.1.136 -> v0.1.137)

    • 6ba13b855fac feat(kernel): verify/deploy steps use baked pipeline-tools:v4 (no runtime crane/cosign fetch)
    Downloads
  • v0.1.136 5232e41f17

    v0.1.136 Stable

    pipeline-bot released this 2026-07-12 06:21:42 +00:00 | 2158 commits to trunk since this release

    Added

    • build-images hard deadline — the pipeline-build-images ClusterWorkflowTemplate
      now sets activeDeadlineSeconds: 3600, so the controller force-terminates any build
      that runs past 1h regardless of what it's stuck on. Defense-in-depth after the no-op
      hang (v0.1.135): a wedged workflow in an unresolvable-reference requeue loop can't be
      killed by a UI "Terminate" (the controller never re-evaluates it), but the deadline
      check fires on every reconcile and kills it. ttlStrategy only GCs completed
      workflows; this caps running ones. A no-op build is ~40s, so 1h is deep headroom.

    Included changes (v0.1.135 -> v0.1.136)

    • 9e79e6be041a feat(build-images): hard activeDeadlineSeconds cap so a wedged build self-terminates
    Downloads
  • v0.1.135 57e10c34ad

    v0.1.135 Stable

    pipeline-bot released this 2026-07-11 23:11:21 +00:00 | 2162 commits to trunk since this release

    Fixed

    • build-images no-op hang: a seanfarm/builder-images commit touching no
      onboarded (VERSION-carrying) image wedged CI forever — the empty build fan-out
      had no aggregated built output, so gather hung on unresolvable-reference
      requeue and never wrote the smoke=pass MANIFEST, blocking the merge (12h-stuck
      builds observed). prepare now emits a __none__ sentinel leg so the fan-out is
      never empty, build-one early-exits on it, and a single always-run gather
      filters the empty entry. Unblocks base-image-only changes (kernel-builder,
      orphan-image deletion). The count>0 path is unchanged.

    Included changes (v0.1.134 -> v0.1.135)

    • 2195ee350991 fix(build-images): no-op commit no longer hangs CI (sentinel fan-out leg)
    • 0ff1a881571f revert(maxsec): remove requireSignedCommits fleet-wide (incident)
    • 9cf3a59f95b6 fix(maxsec): reactive Do:squash fallback for the de-admined bot
    • c0f6a133b3f3 feat(maxsec): statusCheck for zdns + zerotea (server-package uses buildkit CI)
    Downloads
  • v0.1.134 adc2f48d6b

    v0.1.134 Stable

    pipeline-bot released this 2026-07-11 10:52:11 +00:00 | 2169 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.1.133 -> v0.1.134)

    • 6eade07bbaab feat(maxsec): fleet-roll branch-protection dials to the remaining 15 projects
    Downloads
  • v0.1.133 d9637aafa3

    v0.1.133 Stable

    pipeline-bot released this 2026-07-11 10:20:46 +00:00 | 2173 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.1.132 -> v0.1.133)

    • ae1e2397494c feat(maxsec): expand branch-protection canary to libseanfarm-operator
    Downloads
  • v0.1.132 30fceeded7

    v0.1.132 Stable

    pipeline-bot released this 2026-07-11 06:03:48 +00:00 | 2177 commits to trunk since this release

    • Move the two OCI retag-by-digest steps (pipeline-promote-images,
      pipeline-promote-kernel) off the multi-GB sysadmin:v8 image onto minimal
      pipeline-tools:v3, which now bakes crane (go-containerregistry v0.21.7) at
      build time alongside mc/kubectl/skopeo. sysadmin is fully out of the promote
      path. Unify every templates/base pipeline-tools ref on :v3 (v3 = v2 + crane;
      no version skew).

    Included changes (v0.1.131 -> v0.1.132)

    • 50f46beaaa60 feat(pipeline): move OCI retag steps off sysadmin onto pipeline-tools:v3 (crane baked)
    Downloads
  • v0.1.131 7f16945f00

    v0.1.131 Stable

    pipeline-bot released this 2026-07-11 05:26:01 +00:00 | 2181 commits to trunk since this release

    • Pin the pipeline's baked toolchain to the released pipeline-tools:v2 tag
      instead of a raw @sha256: digest across all templates/base steps (promote,
      deploy-kernel, build-images, build-backfill, pkg-install, provisioner). The
      :v2 tag resolves to the same content, now cut through builder-images'
      release pipeline (cosign-signed provenance) rather than a hand-pinned digest;
      also upgrades pipeline-promote-tag off its stale Phase-1 build.

    Included changes (v0.1.130 -> v0.1.131)

    • 53c76493c641 fix(pipeline): pin baked toolchain to released pipeline-tools:v2 tag
    Downloads
  • v0.1.130 e291a86b40

    v0.1.130 Stable

    pipeline-bot released this 2026-07-10 17:34:58 +00:00 | 2186 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.1.129 -> v0.1.130)

    • 6329d741a803 fix(pipeline-merge): 409 head_commit_id can be transient, not just a tip-move
    • a695296dac52 feat(maxsec-3c): hello-lib opts into requireSignedCommits (canary)
    Downloads
  • v0.1.129 8473bedb9f

    v0.1.129 Stable

    pipeline-bot released this 2026-07-10 16:44:31 +00:00 | 2192 commits to trunk since this release

    • Deploy pipelines-operator v0.1.28. Auto-bump the operator app pin (targetRevision + controller image) v0.1.27 -> v0.1.28 in apps/applications.yaml; rides the next pipelines release to main, where the pipelines-deploy sensor syncs the operator.

    Included changes (v0.1.128 -> v0.1.129)

    • 3c6f4ef503da deploy(operator): pin pipelines-operator v0.1.27 -> v0.1.28
    Downloads