CHANGELOG.org
953 lines · 51636 bytes
1#+title: gitbay changelog
2
3Versioning follows semver from v0.1.0. Database migrations run
4automatically on daemon start; upgrade notes appear per release when
5anything beyond "replace the binary and restart" is needed.
6
7* v1.13.3 — 2026-09-05
8
9Only a writer's review decides a merge gate, and a scan of one branch
10stops overwriting another's results.
11
12- =mr review= resolves with =CanRead= and applied no further check, and
13 the merge gates counted every fresh verdict. On a public repository
14 that let anyone with an account satisfy =require_approvals= — defeating
15 four-eyes review by holding two accounts, which on an instance with
16 open registration means defeating it outright — and equally let a
17 passer-by block a merge the owner wanted, with no override and only a
18 force-push to clear it. Both were confirmed against a running instance.
19 Reviewing stays open to every reader, because an outside opinion on a
20 public change is worth having; it no longer decides the gate. What
21 does is write access, the same question the gates already answer. An
22 uncounted review is marked advisory by =mr show= and by the merge
23 request page, both reading the same rule, so the page cannot show an
24 approval the gate ignores. #147
25- The two =git upload-pack= spawns behind the smart HTTP transport now
26 resolve git at start-up like everything else. The v1.13.2 rewrite
27 matched a plain identifier for the context and these pass
28 =r.Context()=, so it skipped them. #153
29- CI analyses each branch as itself. Every scan was recorded against the
30 project's main branch whatever branch produced it, so a feature branch
31 replaced main's results — a branch that removes findings made main look
32 clean before the fix merged, and one that added them made main look
33 broken when it was not. #154
34
35Replace the binary and reinstall the CLI. No migration.
36
37A repository relying on approvals from accounts without write access
38will find those merges now refused. That was the defect: such an approval
39never meant the repository accepted the change. Grant write, or name the
40reviewer in CODEOWNERS and grant write, if their approval is meant to
41count.
42
43* v1.13.2 — 2026-09-04
44
45The first SonarCloud scan's findings: eight fixed, the rest triaged and
46dismissed with reasons.
47
48- A pages directory redirect could leave the site. Both redirects passed
49 the raw request path to =http.Redirect= while the cleaned path sat a
50 line above; =net/url= keeps a leading =//=, and Go emits
51 =Location: //evil.example/= unchanged, which a browser reads as
52 protocol-relative. Reaching it needed a public repository named like a
53 host under the subdomain's own owner — repository names permit dots —
54 so it was narrow rather than impossible. The destination is built from
55 the cleaned path through =url.URL= now, which also settles the two
56 spellings the first fix missed: a =..= that escapes to the root, and a
57 backslash, which browsers following the WHATWG rules treat as a
58 separator. #153
59- The runner's default workspace was =<tmp>/gitbay-runner=: a fixed name
60 in a world-writable directory, created with =MkdirAll=, which succeeds
61 against a directory whoever already owns it. bay1 was never exposed —
62 its unit names a workspace — but the default is what anyone running the
63 binary by hand gets, and this is the process that clones repositories
64 and exports build secrets. The default moves under the user's cache
65 directory, the workspace is created 0700, and a symlink or a directory
66 owned by someone else is refused. One we own that is merely too
67 permissive is tightened rather than refused, since every runner before
68 this one made it 0755 and refusing would take the runner down on
69 upgrade. #153
70- Logout and flash consumption expire their cookies with the attributes
71 the setting calls used. Deletion worked either way; the difference was
72 a reviewer's puzzle, and four findings. #153
73- The topics-remove field has a label. A placeholder is not an accessible
74 name. TestEveryInputHasAnAccessibleName is the guard that was missing,
75 and it knows both associations — six inputs use
76 =<label>Name <input></label>=, which is as good as for/id. #153
77- git and ssh are resolved once at start-up rather than searched on every
78 spawn, and gitbayd refuses to start when one is absent instead of
79 failing on whichever request first needed it. This was 74 of the 118
80 findings; a dashboard that is mostly permanent noise is one nobody
81 reads. #153
82
83Also: SQLite migrations are excluded from analysis. They were read as
84PL/SQL, where ='' is NULL=, so =WHERE col = ''= on a =NOT NULL DEFAULT ''=
85column — correct SQLite, and the shape used throughout — read as a
86null-comparison bug.
87
88Replace the binary and reinstall the CLI. No migration. A runner whose
89workspace is group- or world-readable will have it tightened to 0700 on
90next start, and will refuse to start if that workspace is a symlink or
91belongs to another user.
92
93* v1.13.1 — 2026-09-04
94
95A command that reads its payload from stdin says so, and SonarCloud runs
96alongside the vulnerability scan.
97
98- =repo secret set= blocked with nothing printed, which is
99 indistinguishable from a hung connection, and pressing Enter did not
100 end it because the server reads to EOF — so it looked the same before
101 and after the value had been typed, and the secret echoed into the
102 scrollback on the way. A terminal is now told what is wanted and that
103 Ctrl-D ends it; a secret is read without echo and takes one line, so
104 Enter is enough. Piped input is unchanged, byte for byte: =printf %s
105 "$TOKEN" | gitbay repo secret set ...= still sends exactly the token.
106 Applies to =keys add=, =auth pgp add=, =repo deploy-key add= and
107 =release asset add= as well; public keys keep echoing, since they are
108 public. #150
109- A =sonar= CI job reports to SonarCloud, alongside =vuln=. Report-only:
110 it does not gate a build, unlike the vulnerability scan. A merge
111 request from a fork builds without secrets by design, so the job says
112 why it is skipping there rather than failing on a missing credential.
113 Only =SONAR_TOKEN= is secret and it is a build secret; the
114 organization, project key and host are checked in. Ref #149
115
116Replace the binary and reinstall the CLI. No migration.
117
118* v1.13.0 — 2026-09-04
119
120Collaboration. A review is composed and submitted as one thing, a merge
121request can say it is not asking yet and can show what changed since you
122last looked, issues are searched by their text, and the events half the
123mutations never recorded now exist.
124
125- A review is composed as a unit. =mr diff-comment --pending= holds a
126 comment back; =mr review= publishes the batch with the verdict and says
127 how many went with it; =mr review --discard= throws away what was never
128 submitted. A pending comment notifies nobody when written — the review
129 is the announcement, and it names its own size — and does not gate a
130 merge, since a thread only its author can see is one nobody else could
131 resolve. #111
132- =mr create --draft=, =mr draft=, =mr ready=. A draft does not merge and
133 does not appear in anyone's review queue; marking it ready is the
134 request for review. Draft is a flag rather than a fifth state, so every
135 =state = 'open'= rule still means what it did, and the merge refusal is
136 unconditional: every other gate is a setting an admin turns on, and
137 this one is the author's own statement about their own work. #111
138- =mr range-diff= shows what changed between two revisions of a merge
139 request, and =mr revisions= lists them. A push stales every review and
140 nothing said what had moved; a diff of the two heads cannot answer it,
141 and the previous head was overwritten in place. Each side of the
142 comparison carries the merge base it had at the time, since measuring
143 both against today's would attribute every commit that landed on the
144 target in between to this merge request's author. #111
145- Issues and merge requests are searched by their title and body, over
146 FTS5. =issue list --search= and =mr list --search= narrow one
147 repository; the instance-wide =search= reaches bodies now, and both
148 list pages carry a search box. What someone types is quoted term by
149 term, so an FTS5 operator — =c++=, =AND=, a lone quote — is a word to
150 match rather than a syntax error. #114
151- Ten mutations that changed a repository silently now record an event:
152 =mr.closed=, =mr.reviewed=, =mr.edited=, =mr.retargeted=, =mr.draft=,
153 =issue.edited=, =issue.labeled=, =issue.assigned=, =issue.milestoned=,
154 =mr.milestoned=, =release.deleted=. =mr close= and =issue edit= also
155 notify participants, which they did not. The full list is on the API
156 wiki page and =webhook add --events= refuses a name that is not on it,
157 since a subscription to a typo would never fire and nothing would say
158 so. #112
159- =gitbay-runner -jobs N= runs N builds at once. Claiming was always a
160 single transaction that selects and updates, and each build already
161 worked in its own directory, so several workers were safe the whole
162 time; the runner never used more than one. #115
163- A merge request replayed from a migration bundle has a diff. The bundle
164 carried no head at all, and =mr diff= resolves through the head ref, so
165 a merged merge request — which has no source branch left — could only
166 fail. Re-running an import after the git push sets the head it could
167 not set the first time. The GitHub import fetches =refs/pull/*/head=,
168 which a mirror made with the default refspecs does not carry. #128
169- The review loop is driven end to end by three accounts in the test
170 suite: draft, ready, thread, approval, resolve, merge, with approvals,
171 CODEOWNERS and require-resolved all on at once. Every one of those had
172 its own test and none of them met. #139
173- A bare =go test ./...= says the timeout is too short instead of
174 panicking eleven minutes in and blaming whichever test was running.
175 =make test= is what CONTRIBUTING asks for now. #143
176
177Migrations 0036 through 0039 add the search index, the draft flag,
178pending review comments and merge request head history; 0036 and 0039
179backfill from what is already there. They run on daemon start.
180
181Two things this does not do. There is still no way to ask a particular
182person for a review — the queue is computed from involvement, so a
183collaborator with write access who has not touched a thread hears nothing
184(krz/gitbay#145). And a CI build still runs as the runner's own user with
185no container; the runner on this instance is scoped to one repository,
186which is what keeps that narrow (krz/gitbay#144). Both are v1.14.0.
187
188* v1.12.0 — 2026-09-04
189
190The store and the push path. Dashboard queries walk an index instead of
191sorting the table, concurrent writers wait instead of failing, expired
192rows are swept, and a large first push no longer forks a process per
193commit.
194
195- Every dashboard list scanned its table and sorted the result to take
196 fifty rows. Reachability is correlated subqueries and cannot be
197 indexed; the index supplies the =ORDER BY= instead, so the walk stops
198 at =LIMIT=. On 20k issues and 20k merge requests: open issues 11.8ms
199 to 0.8ms, open merge requests 12.1ms to 0.8ms, the review queue 15.5ms
200 to 0.3ms, assigned issues 10.6ms to 0.04ms. The last of those also
201 drives from =issue_assignees= rather than testing =EXISTS= against
202 every issue. #137
203- Concurrent writers serialise rather than failing. Every transaction in
204 the store writes, and a deferred one takes the write lock at its first
205 write, by which point another may hold it; SQLite answers
206 =SQLITE_BUSY= and does not run the busy handler for that case, so
207 =busy_timeout= could not help. Measured with eight concurrent
208 read-then-write transactions, 44% of them failed. Beginning immediate
209 takes the lock up front, where the timeout applies. #121
210- =repo settings= updates no longer overwrite each other.
211 =settings_json= is one blob, and every caller read it off a repository
212 loaded earlier, changed a field and wrote it all back; two admins at
213 once and the later write put back what it had read for the other's
214 field. The read and the write happen together now, under one
215 immediate transaction. #123
216- Expired sessions and tokens are swept, and =[retention]= caps how long
217 the audit log, the activity feed, webhook deliveries and the mail
218 queue keep a row. Unset means forever, which is what every existing
219 instance gets. #122
220- The audit entry records flag names without their values. Secrets never
221 reached argv — they travel on stdin — but prose did: =--body <the
222 whole issue>= was stored verbatim, in a table nothing pruned, for a
223 repository that may be private. Identifiers are positional and
224 survive. #122
225- pre-receive on a require-signed repository forked a =cat-file= per
226 incoming commit and built one JSON message holding the whole push. A
227 50k-commit first push forked 50k processes and held the history in
228 memory twice. One =cat-file --batch= serves the push now, and the
229 daemon verifies each commit as it arrives. #100
230- The payloads other surfaces decode are named types in =control=. httpd
231 had its own copies of what the build, profile and dashboard commands
232 emit, so a field added to a command was silently absent on the page.
233 #126
234
235Migration 0035 adds three indexes; it runs on daemon start.
236
237Two changes in behaviour rather than configuration. A heavily contended
238write now blocks for up to =busy_timeout= (five seconds) instead of
239returning an error immediately — waiting is the point, but a caller that
240treated the error as normal will see a pause instead. And anything
241parsing =audit --json= for command arguments will find flag values gone;
242the flag names and the positional arguments are still there.
243
244* v1.11.0 — 2026-09-04
245
246The web catches up with the rest of the forge: search across the
247instance, a notification inbox, a compare view, linkable diff lines,
248and a pass over contrast, heading structure and the stylesheet.
249
250- Notifications are no longer mail or nothing. An =inbox= table holds a
251 row per recipient whether or not the instance has SMTP;
252 =notifications list= reads it, unread by default, and =notifications
253 read <id>... | --all= clears it. =repo watch= adds you to a
254 repository's notifications and =repo unwatch= mutes it, with a mute
255 beating every other reason to be told, including owning the
256 repository or having written the thread. The unread count rides on
257 =dashboard= and in the web rail. #113
258- =search= matches repository paths, descriptions and topics, and issue
259 and merge request titles, across everything the caller can read;
260 =/search= renders it with a field in the rail on every page, and an
261 anonymous visitor gets the public rows from the same query. Titles
262 only — body search is #114. #118
263- =/{owner}/{repo}/compare/{a}...{b}= shows what one ref adds on top of
264 another. Diff rows, files and review threads carry ids, so a line can
265 be linked to. The issue and merge request lists page at fifty with
266 the cursors the commands already emit. #118
267- CODEOWNERS gating is a setting rather than a file that happens to
268 exist: =repo settings require-codeowners <owner/name> on|off=, off by
269 default, still independent of =require-approvals=. A repository can
270 carry the file as documentation of who to ask without it gating
271 merges. #142
272- A failed form action's reason rides a one-shot cookie instead of
273 =?e=<message>=, so it no longer survives a reload or lands in
274 history. #119
275- A diff cut at 4 MiB cuts on a line boundary and says so, the
276 diffstat says its counts are partial, and a merge request's commit
277 list says "first 100 of N". #117
278- Page templates parse once with the layout at start-up, so a template
279 that does not parse fails the process rather than the first visit to
280 its page. #116
281- Markdown headings carry ids, matching org pages, and the stylesheet
282 serves a hash ETag with a day's lifetime and answers a matching
283 =If-None-Match= with 304. #132
284- Dark-mode buttons carry a visible edge (a 1 px border was 1.3:1
285 against the 3:1 non-text contrast floor), and a stored label colour
286 is held between 0.12 and 0.28 relative luminance so it clears 3:1 on
287 both grounds while keeping its hue. #120
288- Accessibility: the pin star is decoration and the word carries the
289 meaning, the refs and release asset tables have scoped column
290 headers, state filters carry =aria-current= rather than marking the
291 active one by colour alone, and a rendered README or wiki page's
292 headings move down one level so they sit under the page's own. #133
293- The stylesheet drops rules no template reaches, folds two off-scale
294 values onto the type scale, and resolves the classes templates asked
295 for and it never defined. #131
296- On a phone the tab bar wraps to a second row instead of scrolling
297 sideways with its scrollbar hidden, and the landing page says in
298 three sections what a reader, a writer and a reviewer can do. #134
299
300Migration 0034 adds =inbox= and =repo_watchers=; it runs on daemon
301start. Reinstall the CLI for =search=, =notifications= and =repo
302watch/unwatch=.
303
304Two upgrade notes beyond replacing the binary. A repository that
305relied on a CODEOWNERS file gating merges by its presence alone loses
306that gate until =require-codeowners= is set: nothing back-fills it,
307since the database cannot say which branches carry the file. And
308=search= and =notifications= are now reserved top-level routes, so a
309user or organization already holding either name keeps it but its
310profile page is shadowed by the route.
311
312* v1.10.0 — 2026-09-04
313
314Every command parses its arguments the same way, the web answers by
315exit code, and a restart no longer waits on idle connections.
316
317- One flag parser for every command: an unknown flag, a missing value or
318 too many arguments is exit 2 with the command's usage, everywhere.
319 =mr review --approve --bogus= used to report repository =--bogus= as
320 not found. #96
321- =--json= is honoured by the dispatcher's own refusals, so a script told
322 no gets the envelope. #109
323- A store failure is exit 1 and not-found is exit 3; both used to be
324 usage errors. #107
325- Web form actions answer by exit code: the 404 page for a thing that
326 does not exist, the page with the message for anything else. #106
327- Inside a clone, =gitbay mr create= takes the checked-out branch as
328 =--source=; =gitbay <noun> --help= is the server's reference for the
329 noun, flags included. #101 #130
330- Shutdown closes idle SSH connections at once and drains only sessions
331 mid-command; a store failure during key lookup no longer counts as a
332 bad key against the auth limiter; the CLI says on ssh's exit 255 that
333 a burst may have tripped it. #141
334- A merge request head the target already contains is recorded as
335 merged instead of refused; a fork is created with its parent in one
336 insert; a failed transfer revert is reported; the repository quota is
337 checked under a lock. #108
338- Issues and merge requests share their comment, reference and
339 author-or-write code. #110
340- The payloads the web and clients decode are named types: =Created=,
341 =MRCreated=, =IssueShow=, =MRShow=. JSON unchanged. #126
342- Tests: parse failures per command, non-ASCII paths (which found
343 =ls-tree= returning octal escapes, fixed with =core.quotepath=off= for
344 every git the server runs), concurrent pushes. #129
345
346Replace the binary and restart, and reinstall the CLI. No migration.
347
348* v1.9.0 — 2026-09-03
349
350The runner is no longer an admin, the web no longer reaches around the
351registry, and the CLI stops paying a handshake per command.
352
353- =keys add --scope runner= confines a key to =runner next/log/done= and
354 read-only git; the runner commands accept that scope or an admin. The
355 systemd drop-in sandboxes the runner process. gitbay.org's runner now
356 polls as a non-admin =ci= account scoped to one repository. #92
357- The web's repo create, issue create and edit, MR edit and both comment
358 forms dispatch the command the CLI runs, so the repository quota, the
359 archived-repository refusal, notifications, the body format and the
360 audit entry hold from a browser. #93
361- The CLI shares one SSH connection per instance (=ControlMaster=, five
362 minutes idle): a command costs a round trip instead of a handshake,
363 0.4 s instead of 4 s from a distant laptop. =no_multiplex = true= on
364 an instance opts out. #94
365- A disabled account is refused on every surface, and disabling revokes
366 its API tokens along with its sessions. #95
367- CODEOWNERS gates whenever the file exists on the target branch, not
368 only under =require-approvals=. #99
369- The HTTP listeners have header and idle timeouts, and SIGTERM drains
370 in-flight requests and SSH sessions before exit. #104 #105
371- =git archive= runs under a two-minute deadline and a 512 MiB cap. #124
372- Every git invocation ends option parsing before the ref, so a ref
373 shaped like an option is a bad revision and never a flag. #135
374- The admin noun is gated in the dispatcher as well as in each handler;
375 registry tests cover that and =ReadsStdin=. #127
376- An e2e test runs every =ReadOnly= command against a populated instance
377 and fails on any row it changes. #97
378- =http.trusted_proxies= attributes proxied API requests to the last
379 untrusted =X-Forwarded-For= hop for rate limiting; =email add= is
380 capped at five codes an hour per account. #136
381- A merge request head is built in the target repository, at
382 =refs/merge-requests/<n>/head=, so a fork's merge request has
383 =ci/<job>= statuses for =require-checks= to gate on. A head from
384 another repository is built without the target's secrets. #98
385- Triggers refuse deleting a user or organization that still owns
386 repositories, whatever path the delete takes. #136
387- The stylesheet's fonts are served again, and directory crumbs on blob
388 and blame pages link to the tree. #102 #103
389- The Threat-Model wiki page covers the runner. #138
390
391Replace the binary and restart, reinstall the CLI, and =make
392deploy-runner=: the runner fetches merge request refs before checkout.
393Migrations 0032 and 0033 run on start. The daemon host needs git 2.24
394or newer for =--end-of-options=.
395Operators running =gitbay-runner=: give it a non-admin account with a
396key added by =keys add --scope runner=, remove the admin key it held,
397and =make deploy-runner= to install the sandboxed unit drop-in; an
398admin key keeps working meanwhile.
399
400* v1.8.1 — 2026-09-03
401
402Markdown and org files render when opened.
403
404- A =.md=, =.markdown= or =.org= file renders on its page the way a
405 README does on the directory page, through the same renderer with
406 relative links resolved against the file's directory. =source= in the
407 action bar, or =?view=source=, shows the text as before. Every other
408 file is unchanged. #88
409- The e2e harness waits for the HTTP and git listeners as well as SSH
410 before a test starts; a test whose first act was an HTTP request could
411 be refused, which failed two otherwise green runs. #91
412
413Replace the binary and restart. No migration.
414
415* v1.8.0 — 2026-09-03
416
417The tracker's lists narrow, labels have colours you set, and the CLI's
418help is the server's.
419
420- =issue list= takes =--label=, =--assignee=, =--author= and
421 =--milestone= (a title, or =none= for issues with no milestone);
422 =mr list= takes =--author= and =--milestone=. The store narrows in
423 SQL, and the web lists take the same names as query parameters and
424 show each active filter with a link that drops it and keeps the rest.
425 Both lists had taken =--state= and nothing else, so the web's
426 filtering could never match the CLI's. #84
427- =label list= shows a repository's labels with their colour and how
428 many issues carry each; =label set <label> [--color rrggbb|'']=
429 creates a label or sets its colour; =label remove= takes it off every
430 issue. The colour column had existed since labels did and nothing
431 wrote it. The hash is optional because over bare ssh a bare =#= starts
432 a comment for the tokenizer. =issue label --add= still creates a
433 colourless label on the fly. #85
434- =gitbay help= with a prefix or =--json= runs the server's help, the
435 only place flags are written down and whose JSON is the contract;
436 bare =gitbay help= is still the local tree. Cobra's built-in help had
437 owned the word, so =gitbay help --json= failed on an unknown flag. #86
438
439Replace the binary and restart, and reinstall the CLI for the help
440change. No migration.
441
442* v1.7.0 — 2026-09-02
443
444What an open instance needs before it is open: a cap on what one
445account can take, a way out of a browser session you no longer hold,
446and accounts that never verified do not stay forever.
447
448- =limits.max_repos_per_user= caps the repositories an account owns
449 directly; =repo create=, =fork= and =import= refuse past it with the
450 numbers. =limits.max_bytes_per_user= caps their disk: a push may be no
451 larger than what the owner has left, riding the same
452 =receive.maxInputSize= as the pack cap, and is refused outright when
453 nothing is left. Organizations are not capped. Migration 0031 adds
454 per-account overrides, set with =admin user limits <name> [--repos
455 n|default] [--bytes n|default]= and shown by =admin user show=. Both
456 default to 0, unlimited, so nothing changes until set. #82
457- =registration.pending_expiry=, a duration, removes self-registered
458 accounts still unverified after that long, hourly and once at start,
459 audited as =pending.expired=. Empty keeps them, as before. #82
460- =web sessions list= shows each unexpired browser session by a short id
461 with its creation and expiry; =web sessions revoke <id>= ends one and
462 =--all= ends every one. SSH-only, matching the token commands, and
463 scoped to the caller. #83
464- A step runs in its own process group and a cancel or timeout kills the
465 group. On a host whose =/bin/sh= is dash, killing the shell alone left
466 its child holding the log pipe, so a cancelled build held the runner
467 until the child finished on its own, minutes for a test suite. The
468 wait after a kill is capped at ten seconds besides.
469- A commit with a build still queued or running is not queued again
470 when a fast-forward lands it; the v1.6.0 skip counted only a finished
471 success. #90
472
473- =golang.org/x/crypto= v0.56.0: GO-2026-6354 and GO-2026-6355 in its
474 =ssh= package, both reached through =ssh.NewServerConn= in the
475 embedded SSH server; one is a denial of service on a deadlocked
476 undecided channel.
477
478Replace both binaries and restart: =make deploy= for the daemon
479(migration 0031 adds two columns to =users= on start), then
480=make deploy-runner= for the process-group kill.
481
482* v1.6.1 — 2026-09-02
483
484A cancel reaches a build in its clone.
485
486- The runner honoured a cancel only in its step loop; a build cancelled
487 during its clone or checkout ran git to completion first, which on a
488 loaded host was long enough for the v1.6.0 test to fail on the CI
489 host while passing locally. One =runStep= now drives the clone, the
490 checkout and each step with the cancel signal and the deadline, and
491 checks the signal before starting at all. The runner logs how its log
492 session ended when that was not a cancel.
493
494Replace the runner: =make deploy-runner=. The daemon is unchanged from
495v1.6.0.
496
497* v1.6.0 — 2026-09-02
498
499The v1.4.0 admin surface answered questions about accounts. This one
500answers questions about the machinery: which runner is alive, what is
501stuck, whether last night's backup exists, and it lets an operator stop
502a build instead of waiting it out.
503
504- A build a runner claimed and never reported is failed by the
505 scheduler's minute tick, with no runner involved. It used to happen
506 only when some runner polled again, so a dead sole runner left its
507 builds running forever. =GITBAY_STALE_BUILD_DEADLINE= shortens the
508 deadline for tests. #75
509- Runners are visible. Migration 0030 adds =runner_seen=: one row per
510 runner account with its last poll, the =-repos= scope it asked for,
511 and the build it holds. =admin runners= lists them, over SSH and on
512 the host. #76
513- =GET /healthz=: whether the database answers and which commit serves,
514 no auth, no repository data, 503 when the database does not answer.
515 =healthz= joins the reserved names. #77
516- The host monitor's hourly reading carries the age of the newest full
517 backup and database snapshot, alerting at 25 and 2 hours, and the
518 daemon's own =/healthz= answer read through =site_url=. Both ride the
519 journald line and the webhook body. #78
520- =admin stats= reports =lfs_bytes=. =admin gc --lfs= scans every
521 repository's objects for LFS pointers and removes stored objects none
522 names, keeping anything younger than a day since git lfs uploads
523 before it pushes. #79
524- =admin backup --verify <archive>= reads an archive back: SQLite's
525 integrity check on the snapshot, and the repositories it names against
526 the archive's. A database-only archive says so. Damage or a missing
527 repository exits non-zero. #80
528- A commit that already passed a job on another branch is not built
529 again when a fast-forward lands it. Merging the six-layer v1.6.0 stack
530 had queued eighteen jobs for commits that had each just gone green.
531 Failed or abandoned builds still re-queue. #90
532- =build cancel <owner/name> <n>= withdraws a queued build or ends a
533 running one. For a running build the server closes the runner's log
534 session, the runner kills the step within seconds, and its late report
535 changes nothing. The commit status goes back to the passed result from
536 another build of the same commit when one exists, else reads
537 =cancelled=. Needs write access.
538- Deploys copy with =rsync --partial=, so a transfer the host's load
539 stalled resumes, and =make deploy-runner= installs a systemd drop-in
540 (=Nice=10=, =CPUWeight=30=, =IOWeight=30=) so a build never starves the
541 host's sshd again.
542
543Replace both binaries and restart: =make deploy= for the daemon, then
544=make deploy-runner= for the runner, which carries its half of running-
545build cancellation and installs the drop-in. Migration 0030 adds the
546=runner_seen= table on start. The monitor change ships in
547=deploy/cloud-init.yaml=; an existing host takes it by hand.
548
549* v1.5.0 — 2026-09-02
550
551Merge requests stack.
552
553- A merge request whose target is the source branch of another open
554 merge request in the same repository is stacked on it. Nothing is
555 stored and no flag exists; the forge reads the stack from the
556 branches. =mr create= says =stacked on !A= when it applies, =mr show=
557 carries =stacked_on= and =stacked=, =mr list= rows carry =stacked_on=,
558 and the page says both directions in the header. #87
559- When the lower merge request merges, everything stacked on it is
560 retargeted onto what it merged into, with a system comment naming the
561 merge and its reviews kept: after a fast-forward or merge commit the
562 diff against the new target is the diff they were of. A squash or
563 rebase merge under a stack is refused, naming the stack, since it
564 would rewrite the commits the stack builds on.
565- The first stack merged on gitbay.org was the six merge requests of
566 v1.6.0, bottom-up, with no =mr retarget= typed. The wiki's
567 Stacked-MRs page walks through it.
568
569Replace the binary and restart. No migration.
570
571* v1.4.0 — 2026-09-01
572
573Until now the instance had one operator surface: root on the host. Every
574question about the instance itself — who is on it, what is stuck, what a
575spam repository is doing — needed a shell on port 2222. This release
576gives an instance admin the same answers over SSH, and one page on the
577web.
578
579- =admin user list= pages accounts by username with
580 =--state active|pending|disabled|admin=, each row carrying its state
581 and =last_seen=, the newest use of any of its SSH keys or API tokens.
582 =admin user show <name>= adds the keys with their last use, each
583 address with how it was verified, PGP keys, org roles, owned
584 repository count, API token names and live browser sessions. Both are
585 SSH-only and refused to non-admins, like =audit=. #69
586- =admin user promote|demote=. The only way to admin was
587 =admin user create --admin=; an existing account could not be raised
588 and an admin could not step down. Demoting the last admin is refused
589 inside the transaction that counts them. The host-local twin is the
590 recovery path when no admin key is reachable. #70
591- Repository overrides for moderation: =admin repo list= with size and
592 last push, and =admin repo archive|unarchive|visibility|delete=. Policy
593 still knows nothing about instance admin — a private repository
594 answers not-found to an admin as before — so each override skips the
595 access check explicitly and writes its own =admin repo.<action>= audit
596 row. #71
597- =gitbayd admin= dispatches into the registry. User create, disable,
598 enable and delete, email verify, invite and stats were reimplemented on
599 the host; they now live in the registry, SSH-only and admin-gated, and
600 the host binary runs them as the host — an admin context with no
601 account behind it, so its audit rows say =source: host= where a
602 session says the key fingerprint. Invite and stats gain an SSH twin by
603 the same move. =backup=, =gc= and the backfills stay host-local. #72
604- =audit= filters: =--actor <user>= or =--actor -= for actorless rows,
605 =--action <prefix>=, and =--since= as a duration (=30m=, =24h=, =7d=)
606 or a date. =gitbayd admin audit= takes the same flags and =--json=. #73
607- =dashboard= carries a =queues= block for admins: per worker —
608 webhooks, mail, mirrors, builds, dependency checks — the pending,
609 retrying and dead-lettered counts, the oldest pending age, and the
610 retrying or failed rows themselves, capped at twenty each. The mail
611 queue was readable nowhere before. =/admin= renders the block by
612 dispatching =dashboard=; non-admins get a 404 and no rail link. #74
613- =gitbayd admin config show= prints the configuration in effect as
614 TOML, defaults filled in and =smtp_pass= redacted, so a support
615 question starts from what runs rather than what was written. #81
616- Build badges are served as PNG at =badge/build.png= as well as SVG,
617 for places that will not render SVG.
618- Host monitoring writes its reading to journald on every run and exits
619 non-zero on an alert, so an unset webhook no longer looks like a
620 healthy host; it reads the ACME cache where it actually lives and
621 reports the soonest expiry. govulncheck runs as its own CI job. The
622 database is snapshotted hourly by =gitbay-db-backup.timer=, keeping 48,
623 alongside the nightly full archive; archives inherit the database's
624 mode rather than the umask default. #28
625- A runner whose log stream drops no longer fails the build it was
626 recording. #67
627- =go.yaml.in/yaml/v3= and =golang.org/x/net= bumped. #60
628
629Replace the binary and restart. No migration. The =gitbay-db-backup=
630timer and the monitor changes ship in =deploy/cloud-init.yaml= for new
631hosts; an existing host takes them from there by hand.
632
633* v1.3.0 — 2026-08-31
634
635A runner took every repository's work, which decided where you could run
636one.
637
638- =runner next= takes optional =owner/name= arguments and =gitbay-runner=
639 takes =-repos=, so a runner claims builds only for the repositories it
640 names. Naming none is the old behaviour, so an existing runner is
641 unaffected. This is what makes a runner outside the server practical: one
642 on a machine that should build a single project no longer picks up a
643 build belonging to someone else, which with open registration need not be
644 anyone the operator knows. The scoping is what the runner asks for rather
645 than an ACL the server holds over it — a runner account is admin by
646 necessity, so the boundary is the operator choosing how to start it. #66
647
648Replace the binary and restart. Runners want the new binary too, though an
649old one keeps working unscoped.
650
651* v1.2.1 — 2026-08-31
652
653Merging landed commits without running anything.
654
655- A merge moves the target ref with a direct ref update, so it never
656 reached post-receive and none of the ref-update work fired: no =push=
657 event for webhooks to subscribe to, and no builds. Pushing a commit to a
658 branch ran the whole =.gitbay/ci.yml=; merging the identical commit ran
659 nothing. Both now happen in the merge path, with the build queueing
660 shared between it and post-receive rather than living in one of them.
661 #65
662
663Replace the binary and restart.
664
665* v1.2.0 — 2026-08-31
666
667A merge request said what its state was and almost nothing about when it
668got there. It now keeps time.
669
670- Reviews and checks carry the moment they last said something, on the
671 merge request page and in =mr show=. A =ci/<job>= check also reports how
672 long its build ran, so the timing of a run is readable without opening
673 it. Checks posted through =status set= have no build and report only the
674 time. !137
675- A merged or closed merge request names who resolved it and when. The
676 header stated "X wants to merge" whatever the state; it now says "X
677 merged A into main on <date>", or "closed this without merging", and
678 drops the claim entirely for a row that carries no stamp rather than
679 inventing a time.
680- =mr show= gains =merged_at=/=merged_by= and =closed_at=/=closed_by=, a
681 =created_at= per review, and =updated_at= plus =duration= per check, in
682 both JSON and text. Additive: nothing existing changed shape.
683- The iOS client renders all of it as of krz/gitbay-ios!37.
684
685Replace the binary and restart. Migration 0029 adds four columns to
686=merge_requests= and backfills the merge stamp for merge requests already
687merged, reading the =mr.merged= events. A merge with no such event to read
688— an import, or a row older than its events — keeps no stamp, and every
689surface says nothing about when it happened rather than guessing.
690
691* v1.1.0 — 2026-08-31
692
693Every release until now answered questions. This one notices something
694on its own: that a repository's dependencies have moved, and says so
695without being asked.
696
697- Dependency update checks, opt-in per repository. A daemon worker reads
698 the manifests on the default branch, asks the ecosystem's registry what
699 the current release is, and maintains one issue per repository — opened
700 when something falls behind, rewritten when the set changes, closed once
701 nothing is behind. No package manager runs, so it needs no CI runner and
702 no configuration beyond turning it on. #58
703 - =go.mod= against proxy.golang.org, =package.json= with
704 =package-lock.json= against npm, =Cargo.toml= with =Cargo.lock=
705 against crates.io, =requirements.txt= and =pyproject.toml= against
706 PyPI. A lockfile wins where both exist. A requirement naming a set
707 rather than a release — a range, a wildcard, a git or path source — is
708 skipped, since a range that already admits the newest release is not
709 news.
710 - =repo deps enable|disable|status=, a toggle on the repository settings
711 page, and the same three over the JSON API.
712 - Off by default, because checking a private repository tells a public
713 registry what it depends on. That is the owner's disclosure to make.
714 =[deps] check_interval_hours= sets the cadence, default 24.
715 - The issue is authored by a =gitbay-bot= account, so the existing
716 notification mail reaches the repository's owner rather than excluding
717 them as the actor. Its table is padded to its columns, which a
718 renderer ignores and a mail client needs. #61
719- =help= takes a prefix — =help mr= narrows the registry to one noun — and
720 every command now documents its arguments, so the server answers "what
721 are the flags" instead of being guessed at. #57
722- Web: settings rows end in one column of controls, checkboxes drawn at
723 the height of the inputs and buttons they sit beside #59; an added line
724 keeps its leading dash in the diff; a contributor's several verified
725 addresses collapse to one row #56.
726
727Replace the binary and restart. Migration 0028 adds two tables and, when
728the name is free, the =gitbay-bot= account. An instance already using that
729name for a user or an org keeps what it has: the account is not created,
730and dependency checks report that as the reason they cannot open an issue
731rather than the migration failing and the daemon not starting. #64
732
733* v1.0.1 — 2026-08-30
734
735Two CI fixes found by running orgo's release pipeline on this instance.
736
737- A runner killed between claiming a build and reporting it left the build
738 =running= forever, and the commit's =ci/<job>= status pending with it.
739 =runner next= now fails builds past a 90-minute deadline — longer than the
740 runner's own =-timeout= — and resolves their commit status. #53
741- =gitbay keys add= and =gitbay repo deploy-key add= take stdin as a bare
742 =< key.pub=, but only forwarded it when =--file -= appeared in the
743 arguments, so both sent an empty body and rejected input the SSH API
744 accepts. #55
745
746Replace the binary and restart.
747
748* v1.0.0 — 2026-08-26
749
750The web finishes the job #35 set it: reading, reviewing and responding,
751with the CLI still the complete interface. Every capability exists over
752SSH, every web write dispatches the same control command, and anything
753whose input is a credential stays on the command line. The [[https://gitbay.org/krz/gitbay/wiki/Parity][Parity]] page in
754the wiki is the maintained matrix and says which rows are deliberately
755CLI-only.
756
757- Diff view: one foldable section per file with line-number gutters,
758 per-file stats, rename and binary handling, and syntax highlighting
759 run per hunk per side so multi-line constructs lex as real code.
760 Commit and merge request pages share it; review threads anchor
761 inline.
762- Repository facts on the code page: commit, branch and tag counts,
763 detected license, latest release, build status, a language census by
764 tracked bytes, and contributors resolved to accounts by verified
765 email. All derived from git at render time.
766- Account settings on the web: SSH keys with scope, OpenPGP keys, and
767 email addresses. Public keys are the only credential-shaped input the
768 web accepts — they are not secret, and a new user needs one
769 registered before the CLI is reachable to them. Token minting and
770 account export stay SSH-only.
771- Organizations are run from their page: membership and roles, teams,
772 team members, and team repository grants, for org admins.
773- Commit log shows each commit's combined check status and gains a path
774 filter, so per-file history is reachable without editing the URL.
775- Issue references from commit messages read "referenced in commit
776 <sha> by <author>", linking the author when their email is verified
777 here.
778- The rail's focus ring uses the shell's own mark: the light scheme's
779 accent was a dark blue ring on a black rail.
780
781No migrations. No new config.
782
783Upgrading from v0.5.0 is replace-the-binary-and-restart.
784
785* v0.5.0 — 2026-08-26
786
787A design pass and a parity pass. The web stops being a read-only
788mirror of the CLI without becoming the place you are expected to work.
789
790- New design: a black shell with a persistent left rail carrying
791 cross-repo state (pinned repos, review queue), the repo header
792 rendered identically on every tab so navigation never moves, sharp
793 lines, self-hosted IBM Plex, and code blocks that read against both
794 color schemes. Tree listings sort directories first and carry each
795 file's last commit; diffs, inputs and controls were reworked to
796 match.
797- Web parity with the CLI, dispatched through the same command
798 registry the CLI and JSON API use — every web write is the
799 equivalent =gitbay= command with =--source web=:
800 - merge requests: review, resolve threads, merge, close, and open a
801 new MR from the browser
802 - issues: state, labels, assignees, milestones
803 - repositories: settings, branch protection, visibility
804 - releases: create and edit; builds: trigger a job
805 Commands marked SSH-only still refuse over the web: build secrets,
806 mirror tokens, domain claims, token minting, deletion and transfer.
807- A dashboard that answers "what needs me": review queue, assigned
808 issues, pinned repos, and an activity feed. Author names resolve to
809 accounts and link to profiles wherever commits appear.
810- Build status badges at =/{owner}/{repo}/badge/build.svg= for public
811 repos.
812- =[web] title= sets the instance's display name, separate from the
813 hostname commands are pasted with.
814- =make build/test/deploy= targets.
815- Fixes: the mobile tab strip scrolls sideways only, long commit
816 subjects no longer overflow on narrow screens, the shell fills the
817 viewport with the line-length cap moved onto prose, and the account
818 cell lines up with the page footer.
819
820No migrations. New config: =[web] title=.
821
822* v0.4.0 — 2026-08-25
823
824- Git LFS: standard clients work over both transports.
825 =git-lfs-authenticate= joins the SSH dispatcher (deploy keys
826 included; download needs read, upload write), minting stateless
827 repo- and operation-scoped tokens for the batch API and basic
828 transfers. Anonymous HTTPS downloads for public repos; uploads
829 verified against size and sha256 before landing. Storage is
830 content-addressed under =[lfs] root= behind a small interface an
831 S3-compatible backend can drop into; =[lfs] max_object_bytes= caps
832 objects (512MB default).
833- Build failures mail the repo's notify targets with the log tail and
834 build link — failed scheduled jobs reach an inbox.
835- =release edit= updates a release's title and notes (absent flags
836 keep their field); omaha-style CI note rebuilds work again.
837- Syntax highlighting follows the color scheme: class-based chroma
838 with light and dark palettes, the light-pinned code background is
839 gone, and markdown fences and org src blocks highlight too. The UGC
840 sanitizer admits only chroma's token-code classes.
841
842No migrations. New config: =[lfs] root=, =[lfs] max_object_bytes=.
843
844* v0.3.0 — 2026-08-25
845
846- CI: =.gitbay/ci.yml= jobs run as builds claimed by =gitbay-runner=
847 over SSH (admin-only runner protocol; statuses feed =require-checks=).
848 Per-repo secrets set over stdin and injected into build environments;
849 cron schedules (server-local time) and tag-glob triggers, mutually
850 exclusive per job; =build list/show/log/trigger= and a builds tab.
851- Pages: public repos' =pages= branches served on =<owner>.<domain>=
852 (=[pages] domain=), custom domains with DNS TXT ownership challenges
853 and 7-day expiry for pending claims, per-subdomain on-demand ACME.
854- Wikis (=.wiki= companion repos, access mirrors the parent) and teams
855 within orgs (members-role scoping, per-repo team grants).
856- Activity graphs on user and org pages, backfillable
857 (=admin backfill-activity=); commits attributed by verified author
858 email, deduped by sha.
859- MR pages list the commits the MR carries; =mr show= gains a commits
860 section.
861- Per-file history: =?path== on the web log, =--path= on =repo log=,
862 history link on blob pages.
863- Mirror status surfaced in =repo show= and the repo header
864 (admin-only), with sync errors visible; tag-only pushes now schedule
865 mirror syncs.
866- Rendering: GFM tables/strikethrough/autolinks/task lists, blob image
867 previews, raw serves images with real content types (README images
868 render under nosniff), 0BSD license recognition, repo website links,
869 compact dashboard pins.
870- =admin user delete= for accounts that anchor nothing, with named
871 blockers otherwise.
872- Fixes: wiki pages no longer overflow on mobile (iOS font-inflation
873 trigger), GHSA-free deps, secret values pipe correctly through the
874 CLI.
875
876Migrations 0020-0025 apply on start. New config: =[pages] domain=.
877The runner is a new binary (=gitbay-runner=); see the wiki's Admin
878guide for setup. Stress-tested against an import of git.git (82k
879commits): see the wiki's Performance page.
880
881* v0.2.0 — 2026-08-24
882
883- Deploy keys: repo-bound CI keys (=repo deploy-key=), ro/rw, rename- and
884 transfer-proof.
885- Commit statuses (=status set/list=), combined state on MR pages, and a
886 =require-checks= merge gate.
887- Email notifications for issue and MR activity (participants with
888 verified addresses; never the actor).
889- Inline review threads on MR diffs (=mr diff-comment/threads/resolve=),
890 stale on force-push, =require-resolved= merge gate.
891- Required approvals with CODEOWNERS (=require-approvals=; latest review
892 wins, author excluded) and a =require-resolved= gate; merge gate order
893 is checks → approvals → CODEOWNERS → resolved threads → signatures.
894- Web design revamp: token-based stylesheet (light+dark), wordmark and
895 favicon, aligned layout grid, card-based listings, designed 404,
896 mobile pass.
897- Cross-references and mentions: =#N=, =!N=, =owner/name#N=, =@user=
898 autolink in issue/MR text, viewer-aware for private repos.
899- Archived repositories (read-only with badge) and repo topics.
900- Blame view with signature-aware attribution and 1000-line pages.
901- Repository search (name/description/topic) and per-repo code search
902 (=repo grep=, web search tab); blob line anchors.
903- Homepage: dashboard for logged-in users (pinned repos via =repo pin=,
904 open MRs and issues involving you), landing page for visitors, full
905 public listing at =/explore=; MR diffs collapsed by default.
906- Milestones (=milestone create/list/close=, =issue/mr milestone=) with
907 web progress; issue templates from =.gitbay/issue-template*.md=
908 (CLI =$EDITOR= prefill and web form).
909- Issue actions from commit messages landing on the default branch:
910 =closes/fixes/resolves #N= closes, bare =#N= leaves a reference
911 comment; once per issue+commit.
912- Vanity Go imports: =[go_import]= config serves go-import meta tags, so
913 =go install gitbay.org/gitbay/cmd/...@latest= works.
914- Release script: =deploy/release.sh <tag>= builds reproducible
915 linux/amd64, linux/arm64, and darwin/arm64 binaries with SHA256SUMS.
916- Repository maintenance: =admin gc= (repack/prune, per-repo sizes),
917 =admin stats= (counts + disk usage), weekly =gitbay-gc.timer=.
918- Releases: tag-anchored notes and binary assets (=release= commands,
919 assets over SSH stdin/stdout, web releases tab with downloads).
920- GitHub history import: =repo import-issues= brings issues and PRs
921 (as merged/closed MRs) with comments, labels, and state, attributed
922 inline and resumable.
923- Push and pull mirroring (=repo mirror=): background sync, read-only
924 pull mirrors, per-mirror status; credentials server-side, SSRF-guarded.
925- Web signup at =/register= for open and invite instances.
926- Audit log (=audit=, =gitbayd admin audit=): every mutating command
927 with source key fingerprint, registrations, force-pushes, auth
928 failures. Hardening: per-IP auth-failure throttling
929 (=ssh_auth_rate=), =max_pack_bytes= enforced, =admin user
930 disable/enable=.
931- Account migration: =gitbay migrate --from <host>= (bundle
932 export/replay + client-side git mirror); =gitbay auth export= as a
933 user-level backup.
934- Editable issues and MRs (=issue edit=, =mr edit=, web forms).
935- Commit references appear as system messages with linked shas.
936- Design: top nav, repo listing rows (topics, license, last updated),
937 file table headers, README relative-link resolution, branch
938 dropdown, web pinning, org owner picker, label filters, linked
939 usernames and commit parents, =/privacy= page, blue accent.
940
941Upgrade notes: migrations 0006–0019 apply on start. No config changes
942required; =[go_import]=, =[mirrors]=, =web.privacy_notice=, and
943=web.mode = "accounts"= are opt-in.
944
945* v0.1.0 — 2026-08-24
946
947First tagged release: the complete CLI-first forge. SSH control plane
948(bare-OpenSSH usable), git over SSH/HTTPS/git-daemon, repos, issues,
949merge requests (ff/merge/squash/rebase with signature policy), OpenPGP
950and SSHSIG verification with retroactive re-verification, orgs, repo
951import, web UI (view-only or accounts mode), registration with invites
952and SMTP, HTTPS/JSON API with SSH-minted tokens, webhooks, backups,
953ACME TLS, systemd deployment.