sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity
758 releases 759 tags
  • v0.1.28 d03e0e40da

    v0.1.28 Stable

    gitea_admin released this 2026-07-04 10:39:41 +00:00 | 2733 commits to trunk since this release

    Security

    • buildkit + ibmi publish no longer xtrace-leak the MinIO build key. pipeline-build-buildkit
      and pipeline-build-ibmi ran set -eux before mc alias set … "$AK" "$SK", so bash printed the
      work-bucket access/secret key into the archived pod log (archiveLogs: true) on every buildkit- and
      ibmi-taxonomy build — a supply-chain vector (anyone reading logs could poison builds/<sha>/). Now
      set -eu → alias → set -x, matching the pipeline-build/-desktop twins that already did this.
    • shipd hardens the X-User-Email identity. POST /api/ship now rejects a blank/malformed header
      (must match a basic email shape) before stamping the audited actor; nginx.conf documents why the
      header cannot be safely cleared at that hop. Still trusted transitively — the proper close (verify a
      signed oathkeeper id_token) remains accepted debt, bounded by the shipd-guard VAP + cadence idempotency.

    Fixed

    • deploy-flux no longer green-skips a REGRESSED trunk. The superseded check treated any trunk-tip != sha as "superseded → exit 0"; a Forgejo ff-race regressing the ref backward then stranded a release
      undeployed while the row showed Succeeded. Ported the compare-API discrimination from pipeline-deploy
      (sha AHEAD of tip ⇒ regression ⇒ exit 1 loud) and added an empty-tip guard (transient API failure now
      fails loud, not green). Protects the gitops-flux spine (seanfarm / platform-seanfarm).
    • promote PR-fallbacks match by base AND head. The ff-main and dev-cycle-bump fallbacks in promote,
      promote-tag, and promote-image selected the first open PR by base only, so an unrelated concurrent PR
      could be ff-merged onto a protected main/trunk. Now use the by-base/head lookup the codebase already
      uses in pipeline-land.
    • image + tag promote enforce version monotonicity. promote-tag and promote-image overwrote
      releases/latest unconditionally; a lower clean version reaching trunk could roll the latest pointer
      backward. Ported the sort -V no-downgrade guard from pipeline-promote.
    • desktop release fails closed on a missing macOS SDK. fetch-sdk logged a warning and exited 0, so a
      release build could ship a signed zelnet package silently missing its .app/.pkg. Now exit 1 when a
      required SDK object is absent on a release build (dev/feature-branch CI still skips gracefully).
    • land binds the merge to the verified sha. pipeline-land merged by branch name; a machine branch
      (image-bumps) could advance between the green-check and the merge and land an unvalidated tip. Now
      re-asserts the tip and passes head_commit_id (Forgejo 409s on any move).
    • releases-only main is push-protected on the rpg + zelnet repos. branch-protection rendered
      enablePush: true for main on rpg-hello/demo/lemonade/munchers + zelnet, contradicting their
      main: releases-only. Set to false (the ff-only merge-API promote works fine under protection).
    • ibmi deploy integrity gate no longer masks a failed query. Added set -o pipefail + a non-empty
      assertion so a failing zelnet sql in the piped integrity check can't be swallowed into a false "differs".
    • trunk-name resolver is failure-safe fleet-wide (11 sites). Replaced ls-remote --exit-code … || TRUNK=staging — which misread any transient ls-remote failure as "repo uses the dead staging name" —
      with a single dual-head query that picks the present ref and defaults to the live trunk on error, across
      build/build-buildkit/build-ibmi/build-desktop, validate/validate-flux, promote-image, deploy-ibmi,
      test-ibmi-behavioral, and the two zerotea crons.
    • rollback-* CI reservation narrowed to the machine pattern. The gitops CI filters excluded any
      rollback-… branch (so a human rollback-cnpg-migration got no CI); tightened to rollback-[0-9a-f]{7,}$
      so only the ephemeral rollback-<sha> branches the deploy creates are skipped.
    • devbump reads only the .version field for zig-zon. The "already -dev" idempotency guard grepped the
      whole build.zig.zon and false-matched a nightly minimum_zig_version = "…-dev.N", which would wedge
      auto-releases; now extracts .version the way the cadence template does.
    • validate dropped the dead staging remap left by the staging→trunk rename, and shipd's config
      parser strips YAML quotes       so a quoted kind: "none" is honored by the no-release guard (matching pipectl).
    Downloads
  • v0.1.27 a0a91d9f44

    v0.1.27 Stable

    gitea_admin released this 2026-07-03 22:54:58 +00:00 | 2738 commits to trunk since this release

    Changed

    • Integration trunk renamed staging → trunk, fleet-wide. All 15 pipeline repos now
      carry a push-protected trunk created at their staging tip (the old staging branches are
      frozen relics, deleted after this release removes their protections). Sensors now trigger on
      refs/heads/trunk only, CI excludes it, provision hooks ENSURE trunk, and
      pipeline-staging passes branch: trunk to builds (the runtime resolver still maps either
      name, so older seeds self-heal). Proven end-to-end on rpg-lemonade before rollout:
      land → trunk build → ship → release v0.1.5 (savf) → prod deploy → chore(trunk) devbump.
      The word "staging" now belongs exclusively to the ENVIRONMENT ladder (dev/staging/prod —
      e.g. ibmi's SOMEARA1/SOMEARA2/SOMEARAB). hello-lib (operator-rendered sensors) migrates when
      pipelines-operator learns the trunk name — the last staging holdout.
    Downloads
  • v0.1.26 38122d4637

    v0.1.26 Stable

    gitea_admin released this 2026-07-03 22:13:27 +00:00 | 2743 commits to trunk since this release

    Added

    • Trunk-name resolver — the staging→trunk branch-rename foundation. Every shared template
      that touches the integration trunk now resolves the trunk NAME per-repo at runtime (Forgejo
      branches/trunk 200 → trunk, 404 → the legacy staging, anything else → fail loud, never
      guess): pipeline-land (PR base), release-cadence + devbump + the three promotes (provenance
      clones, ancestry checks, devbump PRs), deploy + deploy-flux (superseded check, ff-main,
      rollback), the build/validate family (clone branch + builds/latest gates; git-less publish
      pods accept both names), test-ibmi/deploy-ibmi clones, fuzz, and the zerotea crons.
      pipectl/shipd resolve project config from raw/branch/trunk with a staging fallback.
      Every trunk sensor now watches BOTH refs/heads/staging and refs/heads/trunk (a sensor
      deploy and a branch rename can never be atomic — single-ref flips guarantee a dead window),
      every CI sensor excludes both, and every project gains a trunk ForgejoBranchProtection
      (enablePush:false) that PRE-EXISTS the branch, so a rogue push cannot mint an unprotected
      trunk and hijack the resolvers. With no repo renamed yet this release is behavior-neutral;
      each repo's rename is now pure branch surgery (create trunk at the staging tip, delete
      staging) with zero further sensor/template changes. rpg-hello also gains the trunk
      protection its staging never had.
    Downloads
  • v0.1.25 dbd95a4b6c

    v0.1.25 Stable

    gitea_admin released this 2026-07-03 20:38:24 +00:00 | 2748 commits to trunk since this release

    Fixed

    • pipeline-deploy-ibmi: first-deploy file seeding no longer passes CRTDUPOBJ an explicit
      object list — OBJ() takes ONE (possibly generic) name (CPD0047 on a list; hit by rpg-demo
      v0.1.6's PARTPF+PARTLF seed). Missing PFs now duplicate one-per-command (DATA(*YES)), then
      LFs — a duplicated LF attaches to the same-named PF already in the TO-library (verified via
      DSPDBR: prod PARTLF pins prod PARTPF, not staging's).
    Downloads
  • v0.1.24 ce579aaac9

    v0.1.24 Stable

    gitea_admin released this 2026-07-03 20:07:55 +00:00 | 2753 commits to trunk since this release

    Fixed

    • pipeline-deploy-ibmi: staging-read race + devbump false-refusal (found by the very first
      live deploy, rpg-lemonade v0.1.4). (1) The promote step now holds the pub400-ibmi-compile
      mutex instead of a deploy-private one — CRTDUPOBJ reads the staging library that every build
      rewrites, and the post-release devbump build's clean-slate DLTPGM deleted LEMONADE mid-promote
      (CPF2105). (2) The integrity gate now tolerates release-equivalent rebuilds: on OBJCREATED
      drift it promotes iff git diff <release-sha>..staging excluding VERSION/CHANGELOG.md is
      empty (the devbump rebuild recompiles identical source); real source drift still refuses with
      "re-ship".
    Downloads
  • v0.1.23 c817ac0c00

    v0.1.23 Stable

    gitea_admin released this 2026-07-03 19:48:47 +00:00 | 2758 commits to trunk since this release

    Added

    • ibmi-rpg environments + Deploy pipeline (IBMI-IMPORT.md §11): an environment is an IBM i
      LIBRARY — SOMEARA1 (CI scratch) / SOMEARA2 (staging) / SOMEARAB (prod), pre-provisioned on
      pub400 (CRTLIB denied). pipeline-build-ibmi selects the lib by branch and compiles behind
      CHGCURLIB in-job (ibmi-builder :v8, zelnet 0.10.1 multi-command cmd); the behavioral test
      gains a package step (SAVOBJ the tested objects.env manifest → release *SAVF + an
      OBJCREATED deploy-manifest, published to releases/v<V>/ before main ff's); promote-tag
      attaches the .savf to the Forgejo release; and the new pipeline-deploy-ibmi (per-project
      main-push sensors on all four rpg-* projects) promotes staging→prod with integrity-gated
      CRTDUPOBJ — *PGM/DSPF replaced with the tested binaries, PF/LF only-if-missing so prod data is
      never clobbered. pub400 denies RSTOBJ/RST, so the SAVF is the durable real-IBM-i artifact and
      drift between ship and deploy refuses with "re-ship".
    Downloads
  • v0.1.22 7cd5a41424

    v0.1.22 Stable

    gitea_admin released this 2026-07-03 14:24:29 +00:00 | 2763 commits to trunk since this release

    Changed

    • Dashboard: every row in a pane now has ONE uniform shape/type. Build and
      Deploy rows lead with a 12-char commit sha and nothing else; Release rows
      lead with a vX.Y.Z version and nothing else. A build no longer shows a trailing
      · vX.Y.Z (that appeared only when the built commit happened to sit on a clean
      VERSION — release commits — so the pane mixed sha and sha · version rows), and
      a release never falls back to a bare sha. The version a build might be released AS
      is a Release-pane property, not a build's identity. Dropped the green releasable
      tag (the status.releasable flag stays on the CR; it just isn't rendered).
    Downloads
  • v0.1.21 b844d611d5

    v0.1.21 Stable

    gitea_admin released this 2026-07-03 13:49:14 +00:00 | 2768 commits to trunk since this release

    • feat(zerotea): the release path now RUN-VERIFIES the cross-compiled binaries per
      arch (Guard 5), not just links them. build.sh's RELEASE section runs the
      ReleaseSafe+musl test suite for amd64 (natively on the all-amd64 cluster) and for
      arm64 under the cluster's host qemu-aarch64 binfmt with -Dcpu=baseline+aes, which
      selects src/crypto/aes.zig's ARMv8 Crypto-Extension HwCore (aese/aesmc) — the
      only hardware SIMD crypto path, and one never previously run in CI (all nodes are
      amd64; the baseline musl legs resolve to SoftCore). No image or infra change: the
      existing infrastructure/binfmt DaemonSet's F-flag registration makes the aarch64
      test binary exec transparently in the unprivileged, egress-locked build pod. Proven
      KAT-clean in-cluster (1233/1233 tests incl. the HwCore-vs-SoftCore parity KAT).
    Downloads
  • v0.1.20 e52bc0cd35

    v0.1.20 Stable

    gitea_admin released this 2026-07-03 13:16:28 +00:00 | 2775 commits to trunk since this release

    • fix(zerotea): mutation-smoke cron no longer aborts right after the baseline
      test. The rotating-sample pipeline used head -n N, which closes the pipe
      early; under set -o pipefail the upstream SIGPIPE (exit 141) killed the run
      before any mutant was applied. Replaced with awk 'NR<=n' (reads to EOF, no
      early close). The clone + baseline zig build test already worked in-cluster;
      this makes the mutate loop actually run.
    Downloads
  • v0.1.19 601ea16fcd

    v0.1.19 Stable

    gitea_admin released this 2026-07-03 13:05:27 +00:00 | 2782 commits to trunk since this release

    • feat(zerotea): mutation-smoke cron (Guard 4) — a self-contained 6h
      CronWorkflow that anon-clones staging and flips a rotating sample of
      behaviour-changing operators in src/** (==↔!=, <=→>,
      return true/false, and/or), re-running zig build test. A SURVIVING
      mutant (suite still green) is a candidate vacuous test / missing assertion and
      fails the run — the alert. Survivors are framed as REVIEW CANDIDATES
      (equivalent mutants survive legitimately). Zerotea-scoped only; does not touch
      the shared pipeline-staging.yaml.
    • fix(zerotea): coverage gate fails CLOSED in CI. The three kcov-unavailable
      fallbacks (kcov absent / wrapper won't build / kcov emits no percent) used to
      WARN-and-continue, so the 85% floor could silently stop being enforced. They
      now exit 1 when COV_REQUIRE=1 (defaulted from the CI-only REPO export;
      a local ./build.sh with REPO unset still skips-with-WARN). The >=floor
      comparison already failed closed and is unchanged.
    Downloads