sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity
758 releases 759 tags
  • v0.1.98 01b579e9a7

    v0.1.98 Stable

    pipeline-bot released this 2026-07-08 12:16:53 +00:00 | 2346 commits to trunk since this release

    Changed

    • Dashboard folds now support a per-project artifact keep-list (FLAGS[proj].artifacts): when set,
      only matching download chips render in BOTH the build fold and the release fold; reels (.mp4)
      always show. zelnet declares [/\.exe$/i, /macos/i] so its folds surface only the testable
      Windows + macOS builds, hiding the Linux tarballs, rpm/deb, checksums, and screenshot posters.
      Other projects are unaffected (unset ⇒ keep all). New artifactKeep(name) + test.
    • Build-download mirror window aligned 24 → 40 (the log/trace windows) so every build the BUILDS
      pane folds open via its logs also has its Windows/Mac binaries downloadable — no more "logs but
      no downloads" rows for builds older than the 24-deep window.

    Included changes (v0.1.97 -> v0.1.98)

    • bd74654c67f8 feat(dashboard): per-project artifact keep-list (zelnet = Win+Mac+reels)
    Downloads
  • v0.1.97 82ffd89453

    v0.1.97 Stable

    pipeline-bot released this 2026-07-08 11:46:40 +00:00 | 2351 commits to trunk since this release

    Changed

    • Dashboard BUILDS pane is now operational, not a ledger: a build row renders only when it can
      fold open to something (live logs, flame trace, dev binaries, or archived step logs) or is still
      in flight. Terminal builds whose fold sources aged out — and backfilled Change records with no
      workflow — no longer appear as dropdown-less dead rows; they survive as data behind the release
      change-list. New one-line buildPaneVisible(w,fd) policy + tests/dashboard-build-pane.test.js.

    Included changes (v0.1.96 -> v0.1.97)

    • 0d3addaa3127 fix(dashboard): hide foldless builds — BUILDS pane is operational, not a ledger
    Downloads
  • v0.1.96 c7f2ee4da1

    v0.1.96 Stable

    pipeline-bot released this 2026-07-08 10:51:33 +00:00 | 2357 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.1.95 -> v0.1.96)

    • 900492027902 fix(backfill): renders.tar.gz probe uses mc stat — mc ls prefix semantics pruned real history
    Downloads
  • v0.1.95 b76e5cff7b

    v0.1.95 Stable

    pipeline-bot released this 2026-07-08 10:36:26 +00:00 | 2363 commits to trunk since this release

    Fixed

    • RELEASES pane shows only releases — the declared ship path (pipectl / shipd / the
      cadence CronJob) creates a PipelineRelease CR per "ship?" decision, and the pane rendered them
      all: phase=Skipped "—" rows piled up 4/day per declared-cadence project, versionless Succeeded
      intent shells lingered from ship-mashing, and a version shipped through both paths (projected
      -release- CR + declared -ship- CR) rendered twice. Two one-line SPA helpers fix it:
      isShipIntent drops Skipped and versionless+tagless terminal non-failures (Running/Pending ships
      and Failed/Error releases stay loud), and dedupReleaseRows renders each version once, keeping
      the richest row (workflow > tag > Succeeded). Filtering runs BEFORE the Forgejo-synth merge so a
      dropped junk row lets the durable tag-derived row re-appear. Covered by
      tests/dashboard-release-rows.test.js (also run by the in-cluster CI guard).
    • BUILDS pane shows only commits a build pipeline actually built — the gitops validate
      (pipeline-validate / pipeline-validate-flux) writes a builds/<short>/MANIFEST for every
      render, including the trunk re-validation that runs as deploy prep. pipeline-build-backfill
      turned those into BUILD rows, so un-openable plumbing commits (devbump / release-merge /
      land-merge) littered the pane with no logs or artifacts behind them. The validate now stamps an
      explicit kind= in the MANIFEST (build on a feature branch — the change's CI test; staging
      on the trunk — deploy prep), and the backfill's new classify_build_record keeps only real
      builds. Legacy records with no kind fall back to the render's signature artifact
      (renders.tar.gz on the trunk), so a build's genuine compile output is never misread. Phantom
      build CRs created before this fix are pruned on the backfill's next hourly run (delete guarded to
      backfilled=true — a projector-owned live build is never touched). This replaces the last
      reliance on the overloaded mode= field for the build/render distinction. Covered by
      tests/backfill-classify.test.js.

    Included changes (v0.1.94 -> v0.1.95)

    • 1ef614bacdd3 fix(dashboard): RELEASES pane shows only releases — drop ship-intents, dedup versions
    • fc3117b156ff test(backfill): run classify guard in-cluster CI; POSIX-sh portable
    • 8ae6d4d1fda6 fix(backfill): BUILDS pane shows only commits a build pipeline built
    Downloads
  • v0.1.94 0786e9721b

    v0.1.94 Stable

    pipeline-bot released this 2026-07-07 10:57:54 +00:00 | 2371 commits to trunk since this release

    Added

    • builder-images builds pull packages through pkg-cache — pipeline-build-images's
      shared build-one leg now passes --opt build-arg:PKG_CACHE=http://pkg-cache.pkg-cache.svc.cluster.local:8080,
      so every dockerfile-set image whose Containerfile declares ARG PKG_CACHE fetches
      apt/dnf/apk + nix + stable raw binaries from the in-cluster pull-through cache instead
      of the internet. buildkit ignores the build-arg for images that don't declare it (warning
      only), so this is safe for all images.

    Included changes (v0.1.93 -> v0.1.94)

    • c5429c8a2320 feat(pkg-cache): builder-images builds fetch packages through pkg-cache
    • 7f349a10c461 feat(dashboard): deploy row shows '→ target', versions move to the fold
    Downloads
  • v0.1.93 d3aa57088c

    v0.1.93 Stable

    pipeline-bot released this 2026-07-07 06:55:21 +00:00 | 2378 commits to trunk since this release

    Fixed

    • pipeline-staging declares the codeberg volume so the promote step's skopeo-push
      (reached via templateRef into pipeline-promote-image) can mount codeberg-push-secret.
      A templateRef'd template does NOT inherit its own WorkflowTemplate's workflow-level volumes,
      so the codeberg-push added to pipeline-promote-image broke EVERY operator release at
      promote[0].push with volume 'codeberg' not found in workflow spec — mirrors how
      forgejo/docker are already declared here. First operator release after the codeberg-push
      landed surfaced it.

    Included changes (v0.1.92 -> v0.1.93)

    • 718bf441d8fb fix(pipeline-staging): declare codeberg volume for skopeo-push
    Downloads
  • v0.1.92 c2071fd4ef

    v0.1.92 Stable

    pipeline-bot released this 2026-07-06 23:42:24 +00:00 | 2383 commits to trunk since this release

    Changed

    • De-admin (data-plane, pass 2): the kernel + builder-images build/promote legs
      (pipeline-build-kernel, pipeline-build-images, pipeline-promote-images,
      pipeline-promote-kernel) now mount forgejo-pipeline-bot-token instead of
      forgejo-admin-token — same clone/API-read + branch/PR/merge/tag/release ops, all
      within the bot's write:repository + write-collaborator access. Only the provisioner
      webhook (needs repo-admin) and forgejo-sync (direct-push-to-main) still use the admin
      token; those need the Phase E rework (ForgejoWebhook CR + ff-merge restructure).

    Included changes (v0.1.91 -> v0.1.92)

    • 0a5fdb0f1bd6 feat(de-admin): kernel + builder-images legs run as pipeline-bot (pass 2)
    Downloads
  • v0.1.91 730584696d

    v0.1.91 Stable

    gitea_admin released this 2026-07-06 23:31:53 +00:00 | 2388 commits to trunk since this release

    Changed

    • De-admin (data-plane, pass 1): the 8 standard pipeline legs (land, staging,
      promote, promote-tag, promote-image, deploy, deploy-flux, release-cadence) now mount
      the non-admin forgejo-pipeline-bot-token instead of the site-admin
      forgejo-admin-token. Mounted at the SAME path (items: {key: token, path: admin_token}) so the read logic + git URLs are untouched — only the token identity
      changes. pipeline-bot is a write collaborator + (when enabled) merge/tag-whitelisted,
      so it can clone/push, open+merge PRs to protected branches, and cut tags/releases.
      The kernel + builder-images build/promote legs, the provisioner webhook, and
      forgejo-sync still use the admin token (follow-up passes).

    Fixed

    • pipeline-promote-image (go-operator-image taxonomy) now pushes each operator
      release image to codeberg (codeberg.org/someara/<project>:v<version>) in
      addition to registry.sean.farm. The operator Deployments pull from codeberg —
      it is rebuild-durable (survives make destroy, present at cold-rebuild before
      zot exists), whereas a registry.sean.farm-pinned operator would
      ImagePullBackOff-deadlock a cold rebuild. Previously releases only reached
      registry.sean.farm, so every operator (forgejo/openbao/kratos/pipelines) was
      stranded at whatever version was last hand-pushed to codeberg. Uses the existing
      codeberg-push-secret (same cred builder-images uses); same OCI tar → identical
      signed digest.

    Included changes (v0.1.90 -> v0.1.91)

    • 2f9164365e02 feat(de-admin): standard data-plane legs run as pipeline-bot (pass 1)
    • 8ac04f12f7cf fix(promote-image): push operator release images to codeberg too
    Downloads
  • v0.1.90 aeb51ed66c

    v0.1.90 Stable

    gitea_admin released this 2026-07-06 21:06:30 +00:00 | 2395 commits to trunk since this release

    Fixed

    • A Role that patches a CR */status subresource must also grant get. kubectl patch --subresource=status --type=merge GETs the subresource first, so a patch-only grant fails with
      "cannot get resource /status" and the status write silently no-ops. Fixes the per-image
      PipelineRelease RBAC (pipelinereleases/status was [patch] → [get,patch]), which would have
      left every builder-images release row non-terminal. Adds a regression guard
      (tests/rbac-status-subresource.sh, wired into tests/check.sh) that fails if any Role patches a
      */status resource without get.

    Included changes (v0.1.89 -> v0.1.90)

    • b99e9908560f test(rbac): guard that a Role patching */status also grants get
    Downloads
  • v0.1.89 643c13d7bb

    v0.1.89 Stable

    gitea_admin released this 2026-07-06 20:37:13 +00:00 | 2400 commits to trunk since this release

    Changed

    • Incremental release.

    Included changes (v0.1.88 -> v0.1.89)

    • 056970a6e931 fix(backfill): grant get on pipelinebuilds/status + self-heal stuck CRs
    Downloads