CHANGELOG.org

   1#+title: gitbay changelog
   2
   3Versioning follows semver from v0.1.0. Database migrations run
   4automatically on daemon start; upgrade notes appear per release when
   5anything beyond "replace the binary and restart" is needed.
   6
   7* v1.20.1 — 2026-09-11
   8
   9One config check.
  10
  11- A negative =limits.max_snippets_per_user= is refused at config load,
  12  as =max_repos_per_user= and =max_bytes_per_user= already were; it
  13  used to pass validation and read as unlimited (#214).
  14
  15* v1.20.0 — 2026-09-11
  16
  17Snippets (#195): named text files a user owns outside any repository,
  18shared by URL and edited in place.
  19
  20- Migration 0054: =snippets= and =snippet_files=.
  21- =snippet create|show|list|edit|delete= and =snippet file
  22  set|get|remove=. Files are UTF-8 under =limits.max_snippet_bytes=
  23  (1MB), at most 64 per snippet; a snippet keeps at least one.
  24  =limits.max_snippets_per_user= (0, unlimited) caps how many an
  25  account may own, admins included. Visibility =public=, =unlisted=
  26  (default) or =private=; a private snippet is not found to everyone
  27  but its owner and admins.
  28- Web: =/<owner>/-/snippets= lists, each snippet page renders its
  29  files with a raw route per file, and the owner creates, edits and
  30  deletes from the page through the same commands. The owner page
  31  links to the list.
  32
  33* v1.19.0 — 2026-09-11
  34
  35Labels and milestones an org defines once for every repository under
  36it, and =Closes owner/name#N= acting across repositories (#203).
  37
  38** Org labels and milestones
  39
  40- Migration 0052: =labels= and =milestones= rows belong to a
  41  repository or to an org, exactly one, with a partial unique index
  42  per scope. Existing rows and their memberships keep their ids.
  43- A repository owned by an org sees the org's labels and milestones
  44  beside its own; =issue label --add=, =issue milestone= and =mr
  45  milestone= resolve the org's row first. A repository cannot create,
  46  recolour, remove, close or reopen a name its org holds; the refusal
  47  names the org command.
  48- =org label set|list|remove= and =org milestone
  49  create|list|close|reopen=, for org admins. Creating a name that
  50  repositories under the org already use folds them in: their issues
  51  and merge requests move to the org's row and the repository rows
  52  go. =repo transfer= into an org folds the same way. Counts on org
  53  rows span the repositories the caller can read.
  54- Web: read-only =/<org>/-/labels= and =/<org>/-/milestones=, linked
  55  from the org page; an "org" mark on repository label and milestone
  56  pages, whose forms act on repository rows only.
  57- =label list= and =milestone list= JSON carry =org: true= on an org
  58  row.
  59
  60** Cross-repository closes
  61
  62- =Closes owner/name#N= in a commit on the default branch, or in a
  63  merged merge request's title or body, closes that issue when the
  64  actor holds write on the target and the pushing key's scope allows
  65  it: a deploy key never acts outside its binding. An unknown or
  66  refused target does nothing and logs nothing; the text stays a
  67  plain autolink. An archived target is refused. Bare =owner/name#N=
  68  without a keyword stays display-only.
  69
  70** Store
  71
  72- A migration whose first line is =-- foreign_keys: off= runs on one
  73  pinned connection with foreign keys off, re-enabled afterwards and
  74  =foreign_key_check= required empty. Rebuilding a table other tables
  75  reference loses the children's rows otherwise, even under
  76  =legacy_alter_table=.
  77
  78** Behaviour changes
  79
  80- =milestone create= exits 1 on a duplicate title, as =org milestone
  81  create= does; it exited 2 before.
  82
  83Upgrade: replace the binary and restart; migration 0052 runs on
  84start and copies every label and milestone row once.
  85
  86* v1.18.1 — 2026-09-11
  87
  88A runner that cannot hang on a dead connection, SSH keys with names,
  89and dependency updates.
  90
  91** CI runner
  92
  93- Every ssh invocation carries =ConnectTimeout=10=,
  94  =ServerAliveInterval=15= and =ServerAliveCountMax=3=, placed after
  95  the identity and the operator's =-ssh-opts= so an operator's value
  96  wins. A claim whose TCP session had died under it blocked a laptop
  97  runner's poll loop for thirteen hours; it now fails within a minute
  98  and the loop resumes.
  99- The build comment in =deploy/Containerfile.ci= stages the file in
 100  the runner user's home before =podman build=: a login shell under
 101  =su= cannot read root's stdin and does not share root's =/tmp=.
 102
 103** Keys
 104
 105- SSH keys carry a label (migration 0051). =keys add --label= defaults
 106  to the authorized_keys comment; =keys label <fingerprint> [<text>]=
 107  renames or clears it. =keys list=, =admin user show=, =repo
 108  deploy-key list= and the settings page show it. Deploy, runner and
 109  admin-created keys take the comment as their label. Closes #208.
 110
 111** Web
 112
 113- Org autolinks stop before trailing punctuation: a bare URL closing a
 114  sentence or a parenthesis no longer takes the =.=, =,= or =)= into
 115  the href. Closes #209.
 116
 117** Dependencies
 118
 119- golang.org/x/crypto 0.57, x/image 0.46, x/net 0.59, x/term 0.46.
 120  Closes #205.
 121
 122* v1.18.0 — 2026-09-10
 123
 124What the first real job on a user's runner needed. A twice-daily
 125archive pull that had run on the server's host moved into a container
 126and then onto a laptop, and each hop found a gap.
 127
 128** CI runner
 129
 130- A secret with newlines — a private key — reaches the build. An env
 131  file has no escape for one, so such values are named on podman's
 132  command line with =--env NAME= and valued in the podman process's own
 133  environment; the value touches neither argv nor the file.
 134- =GITBAY_SSH= in every build's environment: the instance's ssh
 135  destination as the build reaches it. Under podman the host's own
 136  addresses belong to the container (pasta), so a loopback remote is
 137  rewritten to the address pasta exposes the host at. A job that
 138  publishes back to the instance uses the variable rather than
 139  guessing. Inside a container =ssh= expands =~= from the passwd entry,
 140  not =$HOME=; keep a build's ssh config in the workspace and pass =-F=.
 141- =-identity= drops the user's =~/.ssh/config= (=-F /dev/null=):
 142  =IdentitiesOnly= kept identities the config named, so a laptop runner
 143  authenticated as the user's own full-scope key and, on an admin's
 144  machine, could claim every repository's builds. A first-seen host key
 145  is accepted, since a service cannot answer a prompt.
 146- A schedule tick queues nothing while the job's last build is pending
 147  or running, matching the push path. A repository no runner served
 148  gained one row per tick forever. A finished build does not suppress
 149  the tick; a schedule re-runs an unchanged commit on purpose. #206
 150- =admin runners forget <fingerprint>= drops a key's heartbeat row; the
 151  key stays. =admin runners= rows are the repositories a key may claim.
 152- The bay1 unit names no =-repos=: the runner key's attachments are the
 153  boundary. =gitbay-ci:2= carries =python3-venv= and =sqlite3=, since
 154  it is also the default image for every repository the runner is
 155  attached to.
 156
 157** Decisions
 158
 159- Claim order stays oldest-first across everything a key may claim; a
 160  repository that must never wait on another gets a runner of its own.
 161  #207
 162- No per-account cap on queued builds and no schedule floor: with the
 163  tick dedupe a repository with no runner holds one row per scheduled
 164  job, and a busy schedule spends its owner's compute. #206
 165- Attaching a runner is =n/a= on iOS: the key lives on the machine that
 166  runs builds.
 167
 168** Documentation
 169
 170- Users: =GITBAY_SSH=, ssh's home inside a container, the =ci.yml= caps
 171  (ten jobs, fifty steps, 4096 bytes a step, 64 KiB a file) and where a
 172  broken config shows up. Admin, CI and Threat-Model follow the changes
 173  above.
 174
 175** Upgrading
 176
 177Replace the binaries and reinstall the CLI. No migration. A runner
 178started with =-identity= (every runner =gitbay-runner init= set up) now
 179ignores =~/.ssh/config=; a runner that relied on it for a =ProxyJump=
 180or an alias passes the equivalent in =-ssh-opts=. Homebrew:
 181=brew upgrade krz/tap/gitbay-runner=.
 182
 183* v1.17.0 — 2026-09-09
 184
 185CI without the operator's compute: a runner anyone installs and
 186attaches to their own repositories, and the server rule that makes
 187that safe. The rest of the #184 list besides.
 188
 189** CI
 190
 191- A runner key claims builds only for the repositories it is attached
 192  to. =repo runner add <owner/name> < key.pub= attaches one; a key the
 193  server has not seen lands on the caller's account with scope
 194  =runner=. =repo runner list= shows each attached key with its last
 195  poll and the build it holds; =repo runner remove <fingerprint>=
 196  detaches it. All three on the settings page. A runner-scoped key
 197  with nothing attached claims nothing, whoever owns it; a full-scope
 198  admin key still claims any repository. =runner log= and =runner
 199  done= refuse a build outside the key's attachments. #184
 200- Closed: any account could add a runner-scoped key, and =runner next=
 201  with no arguments handed it the oldest pending build on the
 202  instance, secrets included.
 203- =runner next --untrusted=: without it a merge request head from a
 204  fork is never claimed. The runner passes it when started with
 205  =-untrusted=; the bay1 unit does, because it isolates in podman.
 206- =gitbay-runner init= generates a key under =~/.config/gitbay-runner/=,
 207  writes =config.toml= beside it, and prints the public key with the
 208  command that attaches it. The runner reads that file when present
 209  and flags override it. =-identity=, defaulting to the generated key,
 210  makes ssh and git use the runner's own key and no other. Homebrew:
 211  =brew install krz/tap/gitbay-runner=, then =brew services start
 212  krz/tap/gitbay-runner=. Releases ship =gitbay-runner= binaries.
 213- =admin runners= heads its output with the queue: builds pending now,
 214  and over the last day the builds claimed, the wait to claim (average
 215  and worst) and the builds the reaper ended instead of a runner
 216  reporting them. Rows are per key, with the fingerprint and the
 217  repositories the key may claim. Migration 0049. #184
 218- Stop tests for the runner's drain: a signal mid-step, the drop-in's
 219  =KillMode= and =TimeoutStopSec=, and a transient systemd user unit
 220  where one exists. #179
 221- The CI wiki page carries every push shape against every job kind and
 222  what dedupe, path filters, schedules and the reaper make of it, with
 223  a test per row. #176, #177
 224
 225** Importing
 226
 227- =import-issues --api-base= reads Forgejo instances: paging by =limit=,
 228  oldest first, comments read once, attribution and pull heads taken
 229  from the API base rather than github.com. #191
 230
 231** Documentation
 232
 233- Users: "Your own runner". Admin, Threat-Model, CI, FAQ and Parity
 234  follow the attachment rule.
 235
 236** Upgrading
 237
 238Replace the binaries and reinstall the CLI. Migration 0050 (runner
 239attachments; the runner heartbeat table is rekeyed by key and
 240emptied), applied on start. One behaviour change: a runner polling
 241with a key of scope =runner= claims nothing until a repository admin
 242attaches it with =repo runner add=. Do that right after the restart.
 243A full-scope admin key is unaffected. Merge request heads from forks
 244are built only by a runner started with =-untrusted=.
 245
 246* v1.16.0 — 2026-09-08
 247
 248What stops a stranger from moving here: the repository plumbing and
 249the team gates the #185 walk found missing, twelve merge requests
 250merged as one stack.
 251
 252** Repositories
 253
 254- =repo settings default-branch <owner/name> <branch>= moves HEAD and
 255  the record; a branch that does not exist is refused. A first push of
 256  =master= or =trunk= into a fresh repository moves the unborn HEAD to
 257  the branch that arrived, so the clone checks something out. Settings
 258  page select. #189
 259- =repo rename <owner/name> <new-name>=: the row and the directory move
 260  together, with transfer's revert on a failed move. Clone URLs change.
 261  #190
 262- =repo settings require-mr on=: an existing protected branch refuses
 263  every direct push in pre-receive, =repo commit-file= and the web
 264  editor included; =mr merge= is its only writer. Creating the branch
 265  is still a push. #197
 266- =repo settings protect-tag <glob>= (and =unprotect-tag=): matching
 267  tags are created once and refuse moves and deletion. Separately, a
 268  tag a release is anchored to refuses both while the release exists,
 269  protected or not; delete the release first. #201
 270- =repo access list= reports effective access: one row per account
 271  with the highest role and where it comes from (owner, direct, org
 272  admin, org member, team). It used to list direct grants only, so a
 273  repository reached through teams answered with nothing. #200
 274- Removing an org member drops their team memberships in the same
 275  transaction. They kept every grant their teams carried, and re-adding
 276  them to the org restored nothing because nothing had gone. #196
 277- An outsider gets one answer about an org: its existence and members
 278  are public, its teams are for members, and =org team list= and =show=
 279  refuse a non-member rather than say the org does not exist. Ref #200
 280- A repository name may not end in =.atom=, as it may not end in
 281  =.git=. Ref #192
 282
 283** Merge requests
 284
 285- A push that leaves the merge request's diff unchanged keeps its fresh
 286  reviews: the patch-id of each revision against its own merge base is
 287  compared, and a rebase onto a target that moved on no longer stales
 288  every approval. A push that changes the diff stales them as before.
 289  #198
 290- The merge gates are one computation shared by =mr show= (a =gates=
 291  block: approvals counted and required, owners outstanding per file,
 292  open threads, checks, whether a fast-forward is possible), the merge
 293  request page, and =mr merge=, which names every unmet gate in one
 294  refusal rather than the first. =mr review= reports =counts= and says
 295  when a verdict is advisory because the reviewer cannot write. #199
 296
 297** Notifications
 298
 299- =@name= in an issue, merge request, comment or diff comment files
 300  "mentioned you" in that account's inbox and makes them a participant
 301  of the thread, provided they can read the repository and have not
 302  muted it. Watchers are not told about a mention addressed to someone
 303  else. Migration 0047. #202
 304- =notifications settings mail on|off= (and =show=): inbox rows are
 305  filed either way, this is the mail half. Login links are not activity
 306  and still arrive. The account page carries the same switch.
 307  Migration 0048. Ref #194
 308
 309** Web
 310
 311- Atom feeds: =/{owner}/{repo}/releases.atom=,
 312  =/{owner}/{repo}/log.atom[/{ref}]= and =/{owner}/activity.atom=,
 313  rendered over the rows the pages already serve. The owner feed covers
 314  public repositories only, since a reader carries no session; a
 315  private repository answers 404. The releases, log and owner pages
 316  carry the discovery link. #192
 317
 318** Documentation
 319
 320- The Users page says what differs over stock ssh: a multi-word value
 321  needs a second layer of quotes, and =help <noun>= replaces =--help=.
 322  The companion-wiki paragraph #170 made stale now points at
 323  =.gitbay/wiki/=. #204
 324
 325** Upgrading
 326
 327Replace the binary and reinstall the CLI. Two migrations (0047, the
 328mentions table; 0048, the per-account mail switch), applied on start.
 329Nothing changes behaviour until a setting is turned on: =require-mr=,
 330=protect-tag= and =mail off= are all opt-in.
 331
 332* v1.15.0 — 2026-09-07
 333
 334Builds run in containers, a rebase is not rebuilt, and a runner restart
 335no longer strands the build it was running.
 336
 337** CI
 338
 339- A build's steps run in a rootless podman container, one per job. The
 340  runner clones outside the container with its key and bind-mounts the
 341  workspace in, so a step cannot reach the key, the runner's environment,
 342  or another build's workspace. =image:= is required per job and is
 343  validated as a reference, never pulled: an operator provisions images
 344  on the host. A runner configured for podman that has none refuses to
 345  start rather than fall back to the host. =-isolation none= is the
 346  explicit host-execution mode. =-cpus= and =-memory= cap a build's
 347  container. #144
 348- Builds have a home directory that outlives the build, so the Go module
 349  cache and the sonar scanner survive between runs. It is mounted into
 350  the container at the same path, and only that directory. Ref #144
 351- The host preparation script, the unit drop-in and the weekly image
 352  prune ship with =make deploy-runner=; each hardening flag the drop-in
 353  relaxes carries the reason in place. Ref #144
 354- A nightly canary on the runner host proves the boundary holds:
 355  =cmc/ci-smoke= runs a job that tries to read the key and list sibling
 356  workspaces, and fails if either succeeds. Ref #144
 357- Dedupe keys on the commit's tree, not its sha. A rebase that changes
 358  nothing is not rebuilt: the new commit gets the earlier success as its
 359  status, naming the build. Scheduled and tag builds carry no tree and
 360  are never reused. #177
 361- =vuln= and =sonar= run nightly on =main= rather than on every push;
 362  neither could inform a merge. Branches run =build= and =test=. #177
 363- A rewritten branch is filtered against the merge base rather than the
 364  old tip, so a rebased branch whose own commits change code no longer
 365  reads as a docs-only push and skips its jobs. #176
 366- A build whose runner's log stream ended with no outcome is failed two
 367  minutes later, instead of sitting =running= until a fixed deadline.
 368  Migration 0046. Ref #179
 369- The runner retries reporting a finished build's outcome, four times
 370  over about thirty seconds, when the server is unreachable. A gitbayd
 371  restart at that moment used to lose the result. Ref #179
 372- The runner drains on SIGTERM: it claims nothing more, finishes and
 373  reports the build in flight, then exits. A second signal exits at once.
 374  The unit allows fifty minutes. #179
 375
 376** Repositories
 377
 378- =repo show= reports the caller's watch and bookmark state, and the
 379  parent of a fork when the caller can read it. #178
 380- =repo unwatch= clears the row from either state; =repo mute= is the
 381  explicit silence. Watch then unwatch used to leave an account below
 382  the default with no way back. The web header toggle follows. #180
 383
 384** Upgrading
 385
 386Replace the binary and reinstall the CLI. One migration (0046, the
 387build log's close time), applied on start.
 388
 389The runner now defaults to =-isolation podman= and refuses to start
 390without a working podman and a named image. Prepare the host with
 391=deploy/runner-podman-setup.sh= and build =localhost/gitbay-ci:1= from
 392=deploy/Containerfile.ci= before deploying it, or pass =-isolation
 393none= to keep running steps on the host. Validate on a scratch
 394repository with =-repos= scoped to it first; the wiki's Admin page has
 395the procedure.
 396
 397The runner's unit gains =TimeoutStopSec=50min= and =KillMode=mixed= so
 398a stop reaches the runner alone and it can drain; under the default
 399kill mode systemd ends the build's container with the runner.
 400=make deploy-runner= therefore waits for a build in flight.
 401
 402* v1.14.0 — 2026-09-06
 403
 404Logging into the web without an SSH key, wikis inside the repository,
 405CI that skips what a change does not touch, and the browser catching up
 406with the command line on nine capabilities.
 407
 408** Accounts and the web
 409
 410- A browser session can be requested by mail: the login page takes a
 411  username or a verified address and sends a link that works once and
 412  expires in fifteen minutes. An account with no SSH key had no way into
 413  the web at all. The response never says whether the account exists, and
 414  the form appears only when the instance has SMTP. #155
 415- A login link resolves to any verified address on the account, not only
 416  the primary. #158
 417- Login mail is queued rather than sent from a goroutine, so a link in
 418  flight survives a restart. #159
 419- A suspended account cannot mail itself a session, and a link minted
 420  before suspension opens nothing. #156
 421- The session cookie is =SameSite=Lax=, and a test now walks every
 422  mutating route to assert it carries the origin check. #157
 423- =POST /register= is reachable on an open instance again.
 424
 425** Wikis
 426
 427- A wiki lives at =.gitbay/wiki/= on the default branch, so editing one
 428  is editing a file in the repository — a push, or the web editor — and
 429  it is cloned, diffed and reviewed like anything else. The companion
 430  =<repo>.wiki= is gone. #170
 431
 432** CI
 433
 434- Path filters: =paths= and =paths-ignore= per job, so a docs commit
 435  does not run the whole suite. #169
 436- A branch's first push derives its diff base from the merge base
 437  rather than treating every file as changed. #171
 438- A job filtered out records a skipped status instead of nothing, so
 439  =require_checks= cannot wait forever for a check that will never
 440  arrive. #172
 441- A force-push no longer leaves queued builds pointing at an object
 442  that is gone; the orphan is cancelled when a runner claims it. #152
 443- A build step's environment is constructed rather than inherited. It
 444  was =os.Environ()= plus the build's variables, which handed repository
 445  content everything set on the runner service. A step now gets =PATH=,
 446  =HOME=, =LANG=, =CI=, its =GITBAY_*= variables and its secrets. =HOME=
 447  is the workspace, so a build cannot read the runner's =.netrc=,
 448  =.npmrc= or =.gitconfig=, where tools keep credentials. Ref #144
 449- A runner host can be prepared for rootless podman:
 450  =deploy/runner-podman-setup.sh=, the systemd changes it needs, and
 451  weekly image pruning. Nothing reads them yet; the preparation ships
 452  before the runner that requires it, on purpose. Ref #144
 453
 454** Collaboration
 455
 456- =mr review request --add <user>= asks a particular person for a
 457  review, who then carries it in their queue and is notified;
 458  =--remove= withdraws the ask. The queue was computed from involvement
 459  alone, so a collaborator who had not touched a thread heard nothing.
 460  #145
 461- Bookmarks save someone else's repository to come back to, and the
 462  count is the instance's only popularity signal. Separate from pins
 463  rather than a flag on them: a pin is private quick access to your own
 464  work and drives the rail, a bookmark is public and counted. =repo
 465  bookmark=, =repo unbookmark=, =repo bookmarks=, a control on the
 466  repository header, the count in the facts bar, and =/bookmarks=. Read
 467  access is all a bookmark needs, and one made while a repository was
 468  public drops out of the listing if it goes private. #146
 469
 470** The browser catches up
 471
 472Nine capabilities that were CLI-only and had no reason to be:
 473
 474- label management — list, create, colour, remove #163
 475- dependency status under the toggle that turns checks on #164
 476- release delete #165
 477- the account export bundle, as a download #166
 478- organization create and rename; delete stays CLI-only, wanting a
 479  typed confirmation, and the page says so #167
 480- opening a merge request from a fork, with a source picker offering
 481  the branches of every fork you can push to #168
 482- forking a repository #174
 483- cancelling a queued or running build #162
 484- the profile form #161, and a markup picker on issue and merge
 485  request create #160
 486- admin table headers align with their columns #151
 487
 488** CLI
 489
 490- =gitbay mr rebase <n>= replays a merge request's branch onto its
 491  target and re-pushes it. A repository requiring signed commits accepts
 492  only fast-forward merges, so a merge request whose target moved had to
 493  be rebased by hand; the refusal already named the procedure and this
 494  runs it. The git work is local, so the replayed commits carry your
 495  signature — the server still holds no key. A branch in a fork is
 496  refused, naming the repository to run it in. #175
 497
 498** Security
 499
 500- Mutating commands are bounded per account in the dispatcher, so SSH,
 501  the JSON API and the web spend one budget and a caller cannot refresh
 502  it by changing surface. Authentication failures were throttled;
 503  commands were not. #148
 504- A dead-lettered mail is logged by its queue row id, not the recipient
 505  address, and the relay's error is redacted before logging because a
 506  rejection quotes the address it rejected. The address stays on the
 507  row, where =/admin= shows it. One rule for every mail type. #173
 508- The 2026-09 sweep's coverage — and what it did not reach — is recorded
 509  in the wiki's Threat-Model rather than in a closed issue. #149
 510
 511** Dependencies
 512
 513- goldmark 1.8.6, sqlite 1.58.0. #140
 514
 515** Upgrading
 516
 517Replace the binary and reinstall the CLI. One migration (0043,
 518bookmarks), applied on start.
 519
 520=limits.write_rate= defaults to 60 mutating commands a minute per
 521account. A script that writes faster will be refused with exit 4 and a
 522retry time; raise it in =[limits]=, or slow the script. Read-only
 523commands, the runner protocol and the host CLI are not counted.
 524
 525A companion =<repo>.wiki= repository is no longer read. Move its pages
 526to =.gitbay/wiki/= on the default branch.
 527
 528Runner isolation is half done. Builds still run as the runner's user
 529with no container: the step environment no longer leaks the service's,
 530and a host can be prepared for podman, but nothing yet executes a build
 531in one. Do not enable CI for repositories you do not trust. #144 stays
 532open for the execution half.
 533
 534* v1.13.3 — 2026-09-05
 535
 536Only a writer's review decides a merge gate, and a scan of one branch
 537stops overwriting another's results.
 538
 539- =mr review= resolves with =CanRead= and applied no further check, and
 540  the merge gates counted every fresh verdict. On a public repository
 541  that let anyone with an account satisfy =require_approvals= — defeating
 542  four-eyes review by holding two accounts, which on an instance with
 543  open registration means defeating it outright — and equally let a
 544  passer-by block a merge the owner wanted, with no override and only a
 545  force-push to clear it. Both were confirmed against a running instance.
 546  Reviewing stays open to every reader, because an outside opinion on a
 547  public change is worth having; it no longer decides the gate. What
 548  does is write access, the same question the gates already answer. An
 549  uncounted review is marked advisory by =mr show= and by the merge
 550  request page, both reading the same rule, so the page cannot show an
 551  approval the gate ignores. #147
 552- The two =git upload-pack= spawns behind the smart HTTP transport now
 553  resolve git at start-up like everything else. The v1.13.2 rewrite
 554  matched a plain identifier for the context and these pass
 555  =r.Context()=, so it skipped them. #153
 556- CI analyses each branch as itself. Every scan was recorded against the
 557  project's main branch whatever branch produced it, so a feature branch
 558  replaced main's results — a branch that removes findings made main look
 559  clean before the fix merged, and one that added them made main look
 560  broken when it was not. #154
 561
 562Replace the binary and reinstall the CLI. No migration.
 563
 564A repository relying on approvals from accounts without write access
 565will find those merges now refused. That was the defect: such an approval
 566never meant the repository accepted the change. Grant write, or name the
 567reviewer in CODEOWNERS and grant write, if their approval is meant to
 568count.
 569
 570* v1.13.2 — 2026-09-04
 571
 572The first SonarCloud scan's findings: eight fixed, the rest triaged and
 573dismissed with reasons.
 574
 575- A pages directory redirect could leave the site. Both redirects passed
 576  the raw request path to =http.Redirect= while the cleaned path sat a
 577  line above; =net/url= keeps a leading =//=, and Go emits
 578  =Location: //evil.example/= unchanged, which a browser reads as
 579  protocol-relative. Reaching it needed a public repository named like a
 580  host under the subdomain's own owner — repository names permit dots —
 581  so it was narrow rather than impossible. The destination is built from
 582  the cleaned path through =url.URL= now, which also settles the two
 583  spellings the first fix missed: a =..= that escapes to the root, and a
 584  backslash, which browsers following the WHATWG rules treat as a
 585  separator. #153
 586- The runner's default workspace was =<tmp>/gitbay-runner=: a fixed name
 587  in a world-writable directory, created with =MkdirAll=, which succeeds
 588  against a directory whoever already owns it. bay1 was never exposed —
 589  its unit names a workspace — but the default is what anyone running the
 590  binary by hand gets, and this is the process that clones repositories
 591  and exports build secrets. The default moves under the user's cache
 592  directory, the workspace is created 0700, and a symlink or a directory
 593  owned by someone else is refused. One we own that is merely too
 594  permissive is tightened rather than refused, since every runner before
 595  this one made it 0755 and refusing would take the runner down on
 596  upgrade. #153
 597- Logout and flash consumption expire their cookies with the attributes
 598  the setting calls used. Deletion worked either way; the difference was
 599  a reviewer's puzzle, and four findings. #153
 600- The topics-remove field has a label. A placeholder is not an accessible
 601  name. TestEveryInputHasAnAccessibleName is the guard that was missing,
 602  and it knows both associations — six inputs use
 603  =<label>Name <input></label>=, which is as good as for/id. #153
 604- git and ssh are resolved once at start-up rather than searched on every
 605  spawn, and gitbayd refuses to start when one is absent instead of
 606  failing on whichever request first needed it. This was 74 of the 118
 607  findings; a dashboard that is mostly permanent noise is one nobody
 608  reads. #153
 609
 610Also: SQLite migrations are excluded from analysis. They were read as
 611PL/SQL, where ='' is NULL=, so =WHERE col = ''= on a =NOT NULL DEFAULT ''=
 612column — correct SQLite, and the shape used throughout — read as a
 613null-comparison bug.
 614
 615Replace the binary and reinstall the CLI. No migration. A runner whose
 616workspace is group- or world-readable will have it tightened to 0700 on
 617next start, and will refuse to start if that workspace is a symlink or
 618belongs to another user.
 619
 620* v1.13.1 — 2026-09-04
 621
 622A command that reads its payload from stdin says so, and SonarCloud runs
 623alongside the vulnerability scan.
 624
 625- =repo secret set= blocked with nothing printed, which is
 626  indistinguishable from a hung connection, and pressing Enter did not
 627  end it because the server reads to EOF — so it looked the same before
 628  and after the value had been typed, and the secret echoed into the
 629  scrollback on the way. A terminal is now told what is wanted and that
 630  Ctrl-D ends it; a secret is read without echo and takes one line, so
 631  Enter is enough. Piped input is unchanged, byte for byte: =printf %s
 632  "$TOKEN" | gitbay repo secret set ...= still sends exactly the token.
 633  Applies to =keys add=, =auth pgp add=, =repo deploy-key add= and
 634  =release asset add= as well; public keys keep echoing, since they are
 635  public. #150
 636- A =sonar= CI job reports to SonarCloud, alongside =vuln=. Report-only:
 637  it does not gate a build, unlike the vulnerability scan. A merge
 638  request from a fork builds without secrets by design, so the job says
 639  why it is skipping there rather than failing on a missing credential.
 640  Only =SONAR_TOKEN= is secret and it is a build secret; the
 641  organization, project key and host are checked in. Ref #149
 642
 643Replace the binary and reinstall the CLI. No migration.
 644
 645* v1.13.0 — 2026-09-04
 646
 647Collaboration. A review is composed and submitted as one thing, a merge
 648request can say it is not asking yet and can show what changed since you
 649last looked, issues are searched by their text, and the events half the
 650mutations never recorded now exist.
 651
 652- A review is composed as a unit. =mr diff-comment --pending= holds a
 653  comment back; =mr review= publishes the batch with the verdict and says
 654  how many went with it; =mr review --discard= throws away what was never
 655  submitted. A pending comment notifies nobody when written — the review
 656  is the announcement, and it names its own size — and does not gate a
 657  merge, since a thread only its author can see is one nobody else could
 658  resolve. #111
 659- =mr create --draft=, =mr draft=, =mr ready=. A draft does not merge and
 660  does not appear in anyone's review queue; marking it ready is the
 661  request for review. Draft is a flag rather than a fifth state, so every
 662  =state = 'open'= rule still means what it did, and the merge refusal is
 663  unconditional: every other gate is a setting an admin turns on, and
 664  this one is the author's own statement about their own work. #111
 665- =mr range-diff= shows what changed between two revisions of a merge
 666  request, and =mr revisions= lists them. A push stales every review and
 667  nothing said what had moved; a diff of the two heads cannot answer it,
 668  and the previous head was overwritten in place. Each side of the
 669  comparison carries the merge base it had at the time, since measuring
 670  both against today's would attribute every commit that landed on the
 671  target in between to this merge request's author. #111
 672- Issues and merge requests are searched by their title and body, over
 673  FTS5. =issue list --search= and =mr list --search= narrow one
 674  repository; the instance-wide =search= reaches bodies now, and both
 675  list pages carry a search box. What someone types is quoted term by
 676  term, so an FTS5 operator — =c++=, =AND=, a lone quote — is a word to
 677  match rather than a syntax error. #114
 678- Ten mutations that changed a repository silently now record an event:
 679  =mr.closed=, =mr.reviewed=, =mr.edited=, =mr.retargeted=, =mr.draft=,
 680  =issue.edited=, =issue.labeled=, =issue.assigned=, =issue.milestoned=,
 681  =mr.milestoned=, =release.deleted=. =mr close= and =issue edit= also
 682  notify participants, which they did not. The full list is on the API
 683  wiki page and =webhook add --events= refuses a name that is not on it,
 684  since a subscription to a typo would never fire and nothing would say
 685  so. #112
 686- =gitbay-runner -jobs N= runs N builds at once. Claiming was always a
 687  single transaction that selects and updates, and each build already
 688  worked in its own directory, so several workers were safe the whole
 689  time; the runner never used more than one. #115
 690- A merge request replayed from a migration bundle has a diff. The bundle
 691  carried no head at all, and =mr diff= resolves through the head ref, so
 692  a merged merge request — which has no source branch left — could only
 693  fail. Re-running an import after the git push sets the head it could
 694  not set the first time. The GitHub import fetches =refs/pull/*/head=,
 695  which a mirror made with the default refspecs does not carry. #128
 696- The review loop is driven end to end by three accounts in the test
 697  suite: draft, ready, thread, approval, resolve, merge, with approvals,
 698  CODEOWNERS and require-resolved all on at once. Every one of those had
 699  its own test and none of them met. #139
 700- A bare =go test ./...= says the timeout is too short instead of
 701  panicking eleven minutes in and blaming whichever test was running.
 702  =make test= is what CONTRIBUTING asks for now. #143
 703
 704Migrations 0036 through 0039 add the search index, the draft flag,
 705pending review comments and merge request head history; 0036 and 0039
 706backfill from what is already there. They run on daemon start.
 707
 708Two things this does not do. There is still no way to ask a particular
 709person for a review — the queue is computed from involvement, so a
 710collaborator with write access who has not touched a thread hears nothing
 711(krz/gitbay#145). And a CI build still runs as the runner's own user with
 712no container; the runner on this instance is scoped to one repository,
 713which is what keeps that narrow (krz/gitbay#144). Both are v1.14.0.
 714
 715* v1.12.0 — 2026-09-04
 716
 717The store and the push path. Dashboard queries walk an index instead of
 718sorting the table, concurrent writers wait instead of failing, expired
 719rows are swept, and a large first push no longer forks a process per
 720commit.
 721
 722- Every dashboard list scanned its table and sorted the result to take
 723  fifty rows. Reachability is correlated subqueries and cannot be
 724  indexed; the index supplies the =ORDER BY= instead, so the walk stops
 725  at =LIMIT=. On 20k issues and 20k merge requests: open issues 11.8ms
 726  to 0.8ms, open merge requests 12.1ms to 0.8ms, the review queue 15.5ms
 727  to 0.3ms, assigned issues 10.6ms to 0.04ms. The last of those also
 728  drives from =issue_assignees= rather than testing =EXISTS= against
 729  every issue. #137
 730- Concurrent writers serialise rather than failing. Every transaction in
 731  the store writes, and a deferred one takes the write lock at its first
 732  write, by which point another may hold it; SQLite answers
 733  =SQLITE_BUSY= and does not run the busy handler for that case, so
 734  =busy_timeout= could not help. Measured with eight concurrent
 735  read-then-write transactions, 44% of them failed. Beginning immediate
 736  takes the lock up front, where the timeout applies. #121
 737- =repo settings= updates no longer overwrite each other.
 738  =settings_json= is one blob, and every caller read it off a repository
 739  loaded earlier, changed a field and wrote it all back; two admins at
 740  once and the later write put back what it had read for the other's
 741  field. The read and the write happen together now, under one
 742  immediate transaction. #123
 743- Expired sessions and tokens are swept, and =[retention]= caps how long
 744  the audit log, the activity feed, webhook deliveries and the mail
 745  queue keep a row. Unset means forever, which is what every existing
 746  instance gets. #122
 747- The audit entry records flag names without their values. Secrets never
 748  reached argv — they travel on stdin — but prose did: =--body <the
 749  whole issue>= was stored verbatim, in a table nothing pruned, for a
 750  repository that may be private. Identifiers are positional and
 751  survive. #122
 752- pre-receive on a require-signed repository forked a =cat-file= per
 753  incoming commit and built one JSON message holding the whole push. A
 754  50k-commit first push forked 50k processes and held the history in
 755  memory twice. One =cat-file --batch= serves the push now, and the
 756  daemon verifies each commit as it arrives. #100
 757- The payloads other surfaces decode are named types in =control=. httpd
 758  had its own copies of what the build, profile and dashboard commands
 759  emit, so a field added to a command was silently absent on the page.
 760  #126
 761
 762Migration 0035 adds three indexes; it runs on daemon start.
 763
 764Two changes in behaviour rather than configuration. A heavily contended
 765write now blocks for up to =busy_timeout= (five seconds) instead of
 766returning an error immediately — waiting is the point, but a caller that
 767treated the error as normal will see a pause instead. And anything
 768parsing =audit --json= for command arguments will find flag values gone;
 769the flag names and the positional arguments are still there.
 770
 771* v1.11.0 — 2026-09-04
 772
 773The web catches up with the rest of the forge: search across the
 774instance, a notification inbox, a compare view, linkable diff lines,
 775and a pass over contrast, heading structure and the stylesheet.
 776
 777- Notifications are no longer mail or nothing. An =inbox= table holds a
 778  row per recipient whether or not the instance has SMTP;
 779  =notifications list= reads it, unread by default, and =notifications
 780  read <id>... | --all= clears it. =repo watch= adds you to a
 781  repository's notifications and =repo unwatch= mutes it, with a mute
 782  beating every other reason to be told, including owning the
 783  repository or having written the thread. The unread count rides on
 784  =dashboard= and in the web rail. #113
 785- =search= matches repository paths, descriptions and topics, and issue
 786  and merge request titles, across everything the caller can read;
 787  =/search= renders it with a field in the rail on every page, and an
 788  anonymous visitor gets the public rows from the same query. Titles
 789  only — body search is #114. #118
 790- =/{owner}/{repo}/compare/{a}...{b}= shows what one ref adds on top of
 791  another. Diff rows, files and review threads carry ids, so a line can
 792  be linked to. The issue and merge request lists page at fifty with
 793  the cursors the commands already emit. #118
 794- CODEOWNERS gating is a setting rather than a file that happens to
 795  exist: =repo settings require-codeowners <owner/name> on|off=, off by
 796  default, still independent of =require-approvals=. A repository can
 797  carry the file as documentation of who to ask without it gating
 798  merges. #142
 799- A failed form action's reason rides a one-shot cookie instead of
 800  =?e=<message>=, so it no longer survives a reload or lands in
 801  history. #119
 802- A diff cut at 4 MiB cuts on a line boundary and says so, the
 803  diffstat says its counts are partial, and a merge request's commit
 804  list says "first 100 of N". #117
 805- Page templates parse once with the layout at start-up, so a template
 806  that does not parse fails the process rather than the first visit to
 807  its page. #116
 808- Markdown headings carry ids, matching org pages, and the stylesheet
 809  serves a hash ETag with a day's lifetime and answers a matching
 810  =If-None-Match= with 304. #132
 811- Dark-mode buttons carry a visible edge (a 1 px border was 1.3:1
 812  against the 3:1 non-text contrast floor), and a stored label colour
 813  is held between 0.12 and 0.28 relative luminance so it clears 3:1 on
 814  both grounds while keeping its hue. #120
 815- Accessibility: the pin star is decoration and the word carries the
 816  meaning, the refs and release asset tables have scoped column
 817  headers, state filters carry =aria-current= rather than marking the
 818  active one by colour alone, and a rendered README or wiki page's
 819  headings move down one level so they sit under the page's own. #133
 820- The stylesheet drops rules no template reaches, folds two off-scale
 821  values onto the type scale, and resolves the classes templates asked
 822  for and it never defined. #131
 823- On a phone the tab bar wraps to a second row instead of scrolling
 824  sideways with its scrollbar hidden, and the landing page says in
 825  three sections what a reader, a writer and a reviewer can do. #134
 826
 827Migration 0034 adds =inbox= and =repo_watchers=; it runs on daemon
 828start. Reinstall the CLI for =search=, =notifications= and =repo
 829watch/unwatch=.
 830
 831Two upgrade notes beyond replacing the binary. A repository that
 832relied on a CODEOWNERS file gating merges by its presence alone loses
 833that gate until =require-codeowners= is set: nothing back-fills it,
 834since the database cannot say which branches carry the file. And
 835=search= and =notifications= are now reserved top-level routes, so a
 836user or organization already holding either name keeps it but its
 837profile page is shadowed by the route.
 838
 839* v1.10.0 — 2026-09-04
 840
 841Every command parses its arguments the same way, the web answers by
 842exit code, and a restart no longer waits on idle connections.
 843
 844- One flag parser for every command: an unknown flag, a missing value or
 845  too many arguments is exit 2 with the command's usage, everywhere.
 846  =mr review --approve --bogus= used to report repository =--bogus= as
 847  not found. #96
 848- =--json= is honoured by the dispatcher's own refusals, so a script told
 849  no gets the envelope. #109
 850- A store failure is exit 1 and not-found is exit 3; both used to be
 851  usage errors. #107
 852- Web form actions answer by exit code: the 404 page for a thing that
 853  does not exist, the page with the message for anything else. #106
 854- Inside a clone, =gitbay mr create= takes the checked-out branch as
 855  =--source=; =gitbay <noun> --help= is the server's reference for the
 856  noun, flags included. #101 #130
 857- Shutdown closes idle SSH connections at once and drains only sessions
 858  mid-command; a store failure during key lookup no longer counts as a
 859  bad key against the auth limiter; the CLI says on ssh's exit 255 that
 860  a burst may have tripped it. #141
 861- A merge request head the target already contains is recorded as
 862  merged instead of refused; a fork is created with its parent in one
 863  insert; a failed transfer revert is reported; the repository quota is
 864  checked under a lock. #108
 865- Issues and merge requests share their comment, reference and
 866  author-or-write code. #110
 867- The payloads the web and clients decode are named types: =Created=,
 868  =MRCreated=, =IssueShow=, =MRShow=. JSON unchanged. #126
 869- Tests: parse failures per command, non-ASCII paths (which found
 870  =ls-tree= returning octal escapes, fixed with =core.quotepath=off= for
 871  every git the server runs), concurrent pushes. #129
 872
 873Replace the binary and restart, and reinstall the CLI. No migration.
 874
 875* v1.9.0 — 2026-09-03
 876
 877The runner is no longer an admin, the web no longer reaches around the
 878registry, and the CLI stops paying a handshake per command.
 879
 880- =keys add --scope runner= confines a key to =runner next/log/done= and
 881  read-only git; the runner commands accept that scope or an admin. The
 882  systemd drop-in sandboxes the runner process. gitbay.org's runner now
 883  polls as a non-admin =ci= account scoped to one repository. #92
 884- The web's repo create, issue create and edit, MR edit and both comment
 885  forms dispatch the command the CLI runs, so the repository quota, the
 886  archived-repository refusal, notifications, the body format and the
 887  audit entry hold from a browser. #93
 888- The CLI shares one SSH connection per instance (=ControlMaster=, five
 889  minutes idle): a command costs a round trip instead of a handshake,
 890  0.4 s instead of 4 s from a distant laptop. =no_multiplex = true= on
 891  an instance opts out. #94
 892- A disabled account is refused on every surface, and disabling revokes
 893  its API tokens along with its sessions. #95
 894- CODEOWNERS gates whenever the file exists on the target branch, not
 895  only under =require-approvals=. #99
 896- The HTTP listeners have header and idle timeouts, and SIGTERM drains
 897  in-flight requests and SSH sessions before exit. #104 #105
 898- =git archive= runs under a two-minute deadline and a 512 MiB cap. #124
 899- Every git invocation ends option parsing before the ref, so a ref
 900  shaped like an option is a bad revision and never a flag. #135
 901- The admin noun is gated in the dispatcher as well as in each handler;
 902  registry tests cover that and =ReadsStdin=. #127
 903- An e2e test runs every =ReadOnly= command against a populated instance
 904  and fails on any row it changes. #97
 905- =http.trusted_proxies= attributes proxied API requests to the last
 906  untrusted =X-Forwarded-For= hop for rate limiting; =email add= is
 907  capped at five codes an hour per account. #136
 908- A merge request head is built in the target repository, at
 909  =refs/merge-requests/<n>/head=, so a fork's merge request has
 910  =ci/<job>= statuses for =require-checks= to gate on. A head from
 911  another repository is built without the target's secrets. #98
 912- Triggers refuse deleting a user or organization that still owns
 913  repositories, whatever path the delete takes. #136
 914- The stylesheet's fonts are served again, and directory crumbs on blob
 915  and blame pages link to the tree. #102 #103
 916- The Threat-Model wiki page covers the runner. #138
 917
 918Replace the binary and restart, reinstall the CLI, and =make
 919deploy-runner=: the runner fetches merge request refs before checkout.
 920Migrations 0032 and 0033 run on start. The daemon host needs git 2.24
 921or newer for =--end-of-options=.
 922Operators running =gitbay-runner=: give it a non-admin account with a
 923key added by =keys add --scope runner=, remove the admin key it held,
 924and =make deploy-runner= to install the sandboxed unit drop-in; an
 925admin key keeps working meanwhile.
 926
 927* v1.8.1 — 2026-09-03
 928
 929Markdown and org files render when opened.
 930
 931- A =.md=, =.markdown= or =.org= file renders on its page the way a
 932  README does on the directory page, through the same renderer with
 933  relative links resolved against the file's directory. =source= in the
 934  action bar, or =?view=source=, shows the text as before. Every other
 935  file is unchanged. #88
 936- The e2e harness waits for the HTTP and git listeners as well as SSH
 937  before a test starts; a test whose first act was an HTTP request could
 938  be refused, which failed two otherwise green runs. #91
 939
 940Replace the binary and restart. No migration.
 941
 942* v1.8.0 — 2026-09-03
 943
 944The tracker's lists narrow, labels have colours you set, and the CLI's
 945help is the server's.
 946
 947- =issue list= takes =--label=, =--assignee=, =--author= and
 948  =--milestone= (a title, or =none= for issues with no milestone);
 949  =mr list= takes =--author= and =--milestone=. The store narrows in
 950  SQL, and the web lists take the same names as query parameters and
 951  show each active filter with a link that drops it and keeps the rest.
 952  Both lists had taken =--state= and nothing else, so the web's
 953  filtering could never match the CLI's. #84
 954- =label list= shows a repository's labels with their colour and how
 955  many issues carry each; =label set <label> [--color rrggbb|'']=
 956  creates a label or sets its colour; =label remove= takes it off every
 957  issue. The colour column had existed since labels did and nothing
 958  wrote it. The hash is optional because over bare ssh a bare =#= starts
 959  a comment for the tokenizer. =issue label --add= still creates a
 960  colourless label on the fly. #85
 961- =gitbay help= with a prefix or =--json= runs the server's help, the
 962  only place flags are written down and whose JSON is the contract;
 963  bare =gitbay help= is still the local tree. Cobra's built-in help had
 964  owned the word, so =gitbay help --json= failed on an unknown flag. #86
 965
 966Replace the binary and restart, and reinstall the CLI for the help
 967change. No migration.
 968
 969* v1.7.0 — 2026-09-02
 970
 971What an open instance needs before it is open: a cap on what one
 972account can take, a way out of a browser session you no longer hold,
 973and accounts that never verified do not stay forever.
 974
 975- =limits.max_repos_per_user= caps the repositories an account owns
 976  directly; =repo create=, =fork= and =import= refuse past it with the
 977  numbers. =limits.max_bytes_per_user= caps their disk: a push may be no
 978  larger than what the owner has left, riding the same
 979  =receive.maxInputSize= as the pack cap, and is refused outright when
 980  nothing is left. Organizations are not capped. Migration 0031 adds
 981  per-account overrides, set with =admin user limits <name> [--repos
 982  n|default] [--bytes n|default]= and shown by =admin user show=. Both
 983  default to 0, unlimited, so nothing changes until set. #82
 984- =registration.pending_expiry=, a duration, removes self-registered
 985  accounts still unverified after that long, hourly and once at start,
 986  audited as =pending.expired=. Empty keeps them, as before. #82
 987- =web sessions list= shows each unexpired browser session by a short id
 988  with its creation and expiry; =web sessions revoke <id>= ends one and
 989  =--all= ends every one. SSH-only, matching the token commands, and
 990  scoped to the caller. #83
 991- A step runs in its own process group and a cancel or timeout kills the
 992  group. On a host whose =/bin/sh= is dash, killing the shell alone left
 993  its child holding the log pipe, so a cancelled build held the runner
 994  until the child finished on its own, minutes for a test suite. The
 995  wait after a kill is capped at ten seconds besides.
 996- A commit with a build still queued or running is not queued again
 997  when a fast-forward lands it; the v1.6.0 skip counted only a finished
 998  success. #90
 999
1000- =golang.org/x/crypto= v0.56.0: GO-2026-6354 and GO-2026-6355 in its
1001  =ssh= package, both reached through =ssh.NewServerConn= in the
1002  embedded SSH server; one is a denial of service on a deadlocked
1003  undecided channel.
1004
1005Replace both binaries and restart: =make deploy= for the daemon
1006(migration 0031 adds two columns to =users= on start), then
1007=make deploy-runner= for the process-group kill.
1008
1009* v1.6.1 — 2026-09-02
1010
1011A cancel reaches a build in its clone.
1012
1013- The runner honoured a cancel only in its step loop; a build cancelled
1014  during its clone or checkout ran git to completion first, which on a
1015  loaded host was long enough for the v1.6.0 test to fail on the CI
1016  host while passing locally. One =runStep= now drives the clone, the
1017  checkout and each step with the cancel signal and the deadline, and
1018  checks the signal before starting at all. The runner logs how its log
1019  session ended when that was not a cancel.
1020
1021Replace the runner: =make deploy-runner=. The daemon is unchanged from
1022v1.6.0.
1023
1024* v1.6.0 — 2026-09-02
1025
1026The v1.4.0 admin surface answered questions about accounts. This one
1027answers questions about the machinery: which runner is alive, what is
1028stuck, whether last night's backup exists, and it lets an operator stop
1029a build instead of waiting it out.
1030
1031- A build a runner claimed and never reported is failed by the
1032  scheduler's minute tick, with no runner involved. It used to happen
1033  only when some runner polled again, so a dead sole runner left its
1034  builds running forever. =GITBAY_STALE_BUILD_DEADLINE= shortens the
1035  deadline for tests. #75
1036- Runners are visible. Migration 0030 adds =runner_seen=: one row per
1037  runner account with its last poll, the =-repos= scope it asked for,
1038  and the build it holds. =admin runners= lists them, over SSH and on
1039  the host. #76
1040- =GET /healthz=: whether the database answers and which commit serves,
1041  no auth, no repository data, 503 when the database does not answer.
1042  =healthz= joins the reserved names. #77
1043- The host monitor's hourly reading carries the age of the newest full
1044  backup and database snapshot, alerting at 25 and 2 hours, and the
1045  daemon's own =/healthz= answer read through =site_url=. Both ride the
1046  journald line and the webhook body. #78
1047- =admin stats= reports =lfs_bytes=. =admin gc --lfs= scans every
1048  repository's objects for LFS pointers and removes stored objects none
1049  names, keeping anything younger than a day since git lfs uploads
1050  before it pushes. #79
1051- =admin backup --verify <archive>= reads an archive back: SQLite's
1052  integrity check on the snapshot, and the repositories it names against
1053  the archive's. A database-only archive says so. Damage or a missing
1054  repository exits non-zero. #80
1055- A commit that already passed a job on another branch is not built
1056  again when a fast-forward lands it. Merging the six-layer v1.6.0 stack
1057  had queued eighteen jobs for commits that had each just gone green.
1058  Failed or abandoned builds still re-queue. #90
1059- =build cancel <owner/name> <n>= withdraws a queued build or ends a
1060  running one. For a running build the server closes the runner's log
1061  session, the runner kills the step within seconds, and its late report
1062  changes nothing. The commit status goes back to the passed result from
1063  another build of the same commit when one exists, else reads
1064  =cancelled=. Needs write access.
1065- Deploys copy with =rsync --partial=, so a transfer the host's load
1066  stalled resumes, and =make deploy-runner= installs a systemd drop-in
1067  (=Nice=10=, =CPUWeight=30=, =IOWeight=30=) so a build never starves the
1068  host's sshd again.
1069
1070Replace both binaries and restart: =make deploy= for the daemon, then
1071=make deploy-runner= for the runner, which carries its half of running-
1072build cancellation and installs the drop-in. Migration 0030 adds the
1073=runner_seen= table on start. The monitor change ships in
1074=deploy/cloud-init.yaml=; an existing host takes it by hand.
1075
1076* v1.5.0 — 2026-09-02
1077
1078Merge requests stack.
1079
1080- A merge request whose target is the source branch of another open
1081  merge request in the same repository is stacked on it. Nothing is
1082  stored and no flag exists; the forge reads the stack from the
1083  branches. =mr create= says =stacked on !A= when it applies, =mr show=
1084  carries =stacked_on= and =stacked=, =mr list= rows carry =stacked_on=,
1085  and the page says both directions in the header. #87
1086- When the lower merge request merges, everything stacked on it is
1087  retargeted onto what it merged into, with a system comment naming the
1088  merge and its reviews kept: after a fast-forward or merge commit the
1089  diff against the new target is the diff they were of. A squash or
1090  rebase merge under a stack is refused, naming the stack, since it
1091  would rewrite the commits the stack builds on.
1092- The first stack merged on gitbay.org was the six merge requests of
1093  v1.6.0, bottom-up, with no =mr retarget= typed. The wiki's
1094  Stacked-MRs page walks through it.
1095
1096Replace the binary and restart. No migration.
1097
1098* v1.4.0 — 2026-09-01
1099
1100Until now the instance had one operator surface: root on the host. Every
1101question about the instance itself — who is on it, what is stuck, what a
1102spam repository is doing — needed a shell on port 2222. This release
1103gives an instance admin the same answers over SSH, and one page on the
1104web.
1105
1106- =admin user list= pages accounts by username with
1107  =--state active|pending|disabled|admin=, each row carrying its state
1108  and =last_seen=, the newest use of any of its SSH keys or API tokens.
1109  =admin user show <name>= adds the keys with their last use, each
1110  address with how it was verified, PGP keys, org roles, owned
1111  repository count, API token names and live browser sessions. Both are
1112  SSH-only and refused to non-admins, like =audit=. #69
1113- =admin user promote|demote=. The only way to admin was
1114  =admin user create --admin=; an existing account could not be raised
1115  and an admin could not step down. Demoting the last admin is refused
1116  inside the transaction that counts them. The host-local twin is the
1117  recovery path when no admin key is reachable. #70
1118- Repository overrides for moderation: =admin repo list= with size and
1119  last push, and =admin repo archive|unarchive|visibility|delete=. Policy
1120  still knows nothing about instance admin — a private repository
1121  answers not-found to an admin as before — so each override skips the
1122  access check explicitly and writes its own =admin repo.<action>= audit
1123  row. #71
1124- =gitbayd admin= dispatches into the registry. User create, disable,
1125  enable and delete, email verify, invite and stats were reimplemented on
1126  the host; they now live in the registry, SSH-only and admin-gated, and
1127  the host binary runs them as the host — an admin context with no
1128  account behind it, so its audit rows say =source: host= where a
1129  session says the key fingerprint. Invite and stats gain an SSH twin by
1130  the same move. =backup=, =gc= and the backfills stay host-local. #72
1131- =audit= filters: =--actor <user>= or =--actor -= for actorless rows,
1132  =--action <prefix>=, and =--since= as a duration (=30m=, =24h=, =7d=)
1133  or a date. =gitbayd admin audit= takes the same flags and =--json=. #73
1134- =dashboard= carries a =queues= block for admins: per worker —
1135  webhooks, mail, mirrors, builds, dependency checks — the pending,
1136  retrying and dead-lettered counts, the oldest pending age, and the
1137  retrying or failed rows themselves, capped at twenty each. The mail
1138  queue was readable nowhere before. =/admin= renders the block by
1139  dispatching =dashboard=; non-admins get a 404 and no rail link. #74
1140- =gitbayd admin config show= prints the configuration in effect as
1141  TOML, defaults filled in and =smtp_pass= redacted, so a support
1142  question starts from what runs rather than what was written. #81
1143- Build badges are served as PNG at =badge/build.png= as well as SVG,
1144  for places that will not render SVG.
1145- Host monitoring writes its reading to journald on every run and exits
1146  non-zero on an alert, so an unset webhook no longer looks like a
1147  healthy host; it reads the ACME cache where it actually lives and
1148  reports the soonest expiry. govulncheck runs as its own CI job. The
1149  database is snapshotted hourly by =gitbay-db-backup.timer=, keeping 48,
1150  alongside the nightly full archive; archives inherit the database's
1151  mode rather than the umask default. #28
1152- A runner whose log stream drops no longer fails the build it was
1153  recording. #67
1154- =go.yaml.in/yaml/v3= and =golang.org/x/net= bumped. #60
1155
1156Replace the binary and restart. No migration. The =gitbay-db-backup=
1157timer and the monitor changes ship in =deploy/cloud-init.yaml= for new
1158hosts; an existing host takes them from there by hand.
1159
1160* v1.3.0 — 2026-08-31
1161
1162A runner took every repository's work, which decided where you could run
1163one.
1164
1165- =runner next= takes optional =owner/name= arguments and =gitbay-runner=
1166  takes =-repos=, so a runner claims builds only for the repositories it
1167  names. Naming none is the old behaviour, so an existing runner is
1168  unaffected. This is what makes a runner outside the server practical: one
1169  on a machine that should build a single project no longer picks up a
1170  build belonging to someone else, which with open registration need not be
1171  anyone the operator knows. The scoping is what the runner asks for rather
1172  than an ACL the server holds over it — a runner account is admin by
1173  necessity, so the boundary is the operator choosing how to start it. #66
1174
1175Replace the binary and restart. Runners want the new binary too, though an
1176old one keeps working unscoped.
1177
1178* v1.2.1 — 2026-08-31
1179
1180Merging landed commits without running anything.
1181
1182- A merge moves the target ref with a direct ref update, so it never
1183  reached post-receive and none of the ref-update work fired: no =push=
1184  event for webhooks to subscribe to, and no builds. Pushing a commit to a
1185  branch ran the whole =.gitbay/ci.yml=; merging the identical commit ran
1186  nothing. Both now happen in the merge path, with the build queueing
1187  shared between it and post-receive rather than living in one of them.
1188  #65
1189
1190Replace the binary and restart.
1191
1192* v1.2.0 — 2026-08-31
1193
1194A merge request said what its state was and almost nothing about when it
1195got there. It now keeps time.
1196
1197- Reviews and checks carry the moment they last said something, on the
1198  merge request page and in =mr show=. A =ci/<job>= check also reports how
1199  long its build ran, so the timing of a run is readable without opening
1200  it. Checks posted through =status set= have no build and report only the
1201  time. !137
1202- A merged or closed merge request names who resolved it and when. The
1203  header stated "X wants to merge" whatever the state; it now says "X
1204  merged A into main on <date>", or "closed this without merging", and
1205  drops the claim entirely for a row that carries no stamp rather than
1206  inventing a time.
1207- =mr show= gains =merged_at=/=merged_by= and =closed_at=/=closed_by=, a
1208  =created_at= per review, and =updated_at= plus =duration= per check, in
1209  both JSON and text. Additive: nothing existing changed shape.
1210- The iOS client renders all of it as of krz/gitbay-ios!37.
1211
1212Replace the binary and restart. Migration 0029 adds four columns to
1213=merge_requests= and backfills the merge stamp for merge requests already
1214merged, reading the =mr.merged= events. A merge with no such event to read
1215— an import, or a row older than its events — keeps no stamp, and every
1216surface says nothing about when it happened rather than guessing.
1217
1218* v1.1.0 — 2026-08-31
1219
1220Every release until now answered questions. This one notices something
1221on its own: that a repository's dependencies have moved, and says so
1222without being asked.
1223
1224- Dependency update checks, opt-in per repository. A daemon worker reads
1225  the manifests on the default branch, asks the ecosystem's registry what
1226  the current release is, and maintains one issue per repository — opened
1227  when something falls behind, rewritten when the set changes, closed once
1228  nothing is behind. No package manager runs, so it needs no CI runner and
1229  no configuration beyond turning it on. #58
1230  - =go.mod= against proxy.golang.org, =package.json= with
1231    =package-lock.json= against npm, =Cargo.toml= with =Cargo.lock=
1232    against crates.io, =requirements.txt= and =pyproject.toml= against
1233    PyPI. A lockfile wins where both exist. A requirement naming a set
1234    rather than a release — a range, a wildcard, a git or path source — is
1235    skipped, since a range that already admits the newest release is not
1236    news.
1237  - =repo deps enable|disable|status=, a toggle on the repository settings
1238    page, and the same three over the JSON API.
1239  - Off by default, because checking a private repository tells a public
1240    registry what it depends on. That is the owner's disclosure to make.
1241    =[deps] check_interval_hours= sets the cadence, default 24.
1242  - The issue is authored by a =gitbay-bot= account, so the existing
1243    notification mail reaches the repository's owner rather than excluding
1244    them as the actor. Its table is padded to its columns, which a
1245    renderer ignores and a mail client needs. #61
1246- =help= takes a prefix — =help mr= narrows the registry to one noun — and
1247  every command now documents its arguments, so the server answers "what
1248  are the flags" instead of being guessed at. #57
1249- Web: settings rows end in one column of controls, checkboxes drawn at
1250  the height of the inputs and buttons they sit beside #59; an added line
1251  keeps its leading dash in the diff; a contributor's several verified
1252  addresses collapse to one row #56.
1253
1254Replace the binary and restart. Migration 0028 adds two tables and, when
1255the name is free, the =gitbay-bot= account. An instance already using that
1256name for a user or an org keeps what it has: the account is not created,
1257and dependency checks report that as the reason they cannot open an issue
1258rather than the migration failing and the daemon not starting. #64
1259
1260* v1.0.1 — 2026-08-30
1261
1262Two CI fixes found by running orgo's release pipeline on this instance.
1263
1264- A runner killed between claiming a build and reporting it left the build
1265  =running= forever, and the commit's =ci/<job>= status pending with it.
1266  =runner next= now fails builds past a 90-minute deadline — longer than the
1267  runner's own =-timeout= — and resolves their commit status. #53
1268- =gitbay keys add= and =gitbay repo deploy-key add= take stdin as a bare
1269  =< key.pub=, but only forwarded it when =--file -= appeared in the
1270  arguments, so both sent an empty body and rejected input the SSH API
1271  accepts. #55
1272
1273Replace the binary and restart.
1274
1275* v1.0.0 — 2026-08-26
1276
1277The web finishes the job #35 set it: reading, reviewing and responding,
1278with the CLI still the complete interface. Every capability exists over
1279SSH, every web write dispatches the same control command, and anything
1280whose input is a credential stays on the command line. The [[https://gitbay.org/krz/gitbay/wiki/Parity][Parity]] page in
1281the wiki is the maintained matrix and says which rows are deliberately
1282CLI-only.
1283
1284- Diff view: one foldable section per file with line-number gutters,
1285  per-file stats, rename and binary handling, and syntax highlighting
1286  run per hunk per side so multi-line constructs lex as real code.
1287  Commit and merge request pages share it; review threads anchor
1288  inline.
1289- Repository facts on the code page: commit, branch and tag counts,
1290  detected license, latest release, build status, a language census by
1291  tracked bytes, and contributors resolved to accounts by verified
1292  email. All derived from git at render time.
1293- Account settings on the web: SSH keys with scope, OpenPGP keys, and
1294  email addresses. Public keys are the only credential-shaped input the
1295  web accepts — they are not secret, and a new user needs one
1296  registered before the CLI is reachable to them. Token minting and
1297  account export stay SSH-only.
1298- Organizations are run from their page: membership and roles, teams,
1299  team members, and team repository grants, for org admins.
1300- Commit log shows each commit's combined check status and gains a path
1301  filter, so per-file history is reachable without editing the URL.
1302- Issue references from commit messages read "referenced in commit
1303  <sha> by <author>", linking the author when their email is verified
1304  here.
1305- The rail's focus ring uses the shell's own mark: the light scheme's
1306  accent was a dark blue ring on a black rail.
1307
1308No migrations. No new config.
1309
1310Upgrading from v0.5.0 is replace-the-binary-and-restart.
1311
1312* v0.5.0 — 2026-08-26
1313
1314A design pass and a parity pass. The web stops being a read-only
1315mirror of the CLI without becoming the place you are expected to work.
1316
1317- New design: a black shell with a persistent left rail carrying
1318  cross-repo state (pinned repos, review queue), the repo header
1319  rendered identically on every tab so navigation never moves, sharp
1320  lines, self-hosted IBM Plex, and code blocks that read against both
1321  color schemes. Tree listings sort directories first and carry each
1322  file's last commit; diffs, inputs and controls were reworked to
1323  match.
1324- Web parity with the CLI, dispatched through the same command
1325  registry the CLI and JSON API use — every web write is the
1326  equivalent =gitbay= command with =--source web=:
1327  - merge requests: review, resolve threads, merge, close, and open a
1328    new MR from the browser
1329  - issues: state, labels, assignees, milestones
1330  - repositories: settings, branch protection, visibility
1331  - releases: create and edit; builds: trigger a job
1332  Commands marked SSH-only still refuse over the web: build secrets,
1333  mirror tokens, domain claims, token minting, deletion and transfer.
1334- A dashboard that answers "what needs me": review queue, assigned
1335  issues, pinned repos, and an activity feed. Author names resolve to
1336  accounts and link to profiles wherever commits appear.
1337- Build status badges at =/{owner}/{repo}/badge/build.svg= for public
1338  repos.
1339- =[web] title= sets the instance's display name, separate from the
1340  hostname commands are pasted with.
1341- =make build/test/deploy= targets.
1342- Fixes: the mobile tab strip scrolls sideways only, long commit
1343  subjects no longer overflow on narrow screens, the shell fills the
1344  viewport with the line-length cap moved onto prose, and the account
1345  cell lines up with the page footer.
1346
1347No migrations. New config: =[web] title=.
1348
1349* v0.4.0 — 2026-08-25
1350
1351- Git LFS: standard clients work over both transports.
1352  =git-lfs-authenticate= joins the SSH dispatcher (deploy keys
1353  included; download needs read, upload write), minting stateless
1354  repo- and operation-scoped tokens for the batch API and basic
1355  transfers. Anonymous HTTPS downloads for public repos; uploads
1356  verified against size and sha256 before landing. Storage is
1357  content-addressed under =[lfs] root= behind a small interface an
1358  S3-compatible backend can drop into; =[lfs] max_object_bytes= caps
1359  objects (512MB default).
1360- Build failures mail the repo's notify targets with the log tail and
1361  build link — failed scheduled jobs reach an inbox.
1362- =release edit= updates a release's title and notes (absent flags
1363  keep their field); omaha-style CI note rebuilds work again.
1364- Syntax highlighting follows the color scheme: class-based chroma
1365  with light and dark palettes, the light-pinned code background is
1366  gone, and markdown fences and org src blocks highlight too. The UGC
1367  sanitizer admits only chroma's token-code classes.
1368
1369No migrations. New config: =[lfs] root=, =[lfs] max_object_bytes=.
1370
1371* v0.3.0 — 2026-08-25
1372
1373- CI: =.gitbay/ci.yml= jobs run as builds claimed by =gitbay-runner=
1374  over SSH (admin-only runner protocol; statuses feed =require-checks=).
1375  Per-repo secrets set over stdin and injected into build environments;
1376  cron schedules (server-local time) and tag-glob triggers, mutually
1377  exclusive per job; =build list/show/log/trigger= and a builds tab.
1378- Pages: public repos' =pages= branches served on =<owner>.<domain>=
1379  (=[pages] domain=), custom domains with DNS TXT ownership challenges
1380  and 7-day expiry for pending claims, per-subdomain on-demand ACME.
1381- Wikis (=.wiki= companion repos, access mirrors the parent) and teams
1382  within orgs (members-role scoping, per-repo team grants).
1383- Activity graphs on user and org pages, backfillable
1384  (=admin backfill-activity=); commits attributed by verified author
1385  email, deduped by sha.
1386- MR pages list the commits the MR carries; =mr show= gains a commits
1387  section.
1388- Per-file history: =?path== on the web log, =--path= on =repo log=,
1389  history link on blob pages.
1390- Mirror status surfaced in =repo show= and the repo header
1391  (admin-only), with sync errors visible; tag-only pushes now schedule
1392  mirror syncs.
1393- Rendering: GFM tables/strikethrough/autolinks/task lists, blob image
1394  previews, raw serves images with real content types (README images
1395  render under nosniff), 0BSD license recognition, repo website links,
1396  compact dashboard pins.
1397- =admin user delete= for accounts that anchor nothing, with named
1398  blockers otherwise.
1399- Fixes: wiki pages no longer overflow on mobile (iOS font-inflation
1400  trigger), GHSA-free deps, secret values pipe correctly through the
1401  CLI.
1402
1403Migrations 0020-0025 apply on start. New config: =[pages] domain=.
1404The runner is a new binary (=gitbay-runner=); see the wiki's Admin
1405guide for setup. Stress-tested against an import of git.git (82k
1406commits): see the wiki's Performance page.
1407
1408* v0.2.0 — 2026-08-24
1409
1410- Deploy keys: repo-bound CI keys (=repo deploy-key=), ro/rw, rename- and
1411  transfer-proof.
1412- Commit statuses (=status set/list=), combined state on MR pages, and a
1413  =require-checks= merge gate.
1414- Email notifications for issue and MR activity (participants with
1415  verified addresses; never the actor).
1416- Inline review threads on MR diffs (=mr diff-comment/threads/resolve=),
1417  stale on force-push, =require-resolved= merge gate.
1418- Required approvals with CODEOWNERS (=require-approvals=; latest review
1419  wins, author excluded) and a =require-resolved= gate; merge gate order
1420  is checks → approvals → CODEOWNERS → resolved threads → signatures.
1421- Web design revamp: token-based stylesheet (light+dark), wordmark and
1422  favicon, aligned layout grid, card-based listings, designed 404,
1423  mobile pass.
1424- Cross-references and mentions: =#N=, =!N=, =owner/name#N=, =@user=
1425  autolink in issue/MR text, viewer-aware for private repos.
1426- Archived repositories (read-only with badge) and repo topics.
1427- Blame view with signature-aware attribution and 1000-line pages.
1428- Repository search (name/description/topic) and per-repo code search
1429  (=repo grep=, web search tab); blob line anchors.
1430- Homepage: dashboard for logged-in users (pinned repos via =repo pin=,
1431  open MRs and issues involving you), landing page for visitors, full
1432  public listing at =/explore=; MR diffs collapsed by default.
1433- Milestones (=milestone create/list/close=, =issue/mr milestone=) with
1434  web progress; issue templates from =.gitbay/issue-template*.md=
1435  (CLI =$EDITOR= prefill and web form).
1436- Issue actions from commit messages landing on the default branch:
1437  =closes/fixes/resolves #N= closes, bare =#N= leaves a reference
1438  comment; once per issue+commit.
1439- Vanity Go imports: =[go_import]= config serves go-import meta tags, so
1440  =go install gitbay.org/gitbay/cmd/...@latest= works.
1441- Release script: =deploy/release.sh <tag>= builds reproducible
1442  linux/amd64, linux/arm64, and darwin/arm64 binaries with SHA256SUMS.
1443- Repository maintenance: =admin gc= (repack/prune, per-repo sizes),
1444  =admin stats= (counts + disk usage), weekly =gitbay-gc.timer=.
1445- Releases: tag-anchored notes and binary assets (=release= commands,
1446  assets over SSH stdin/stdout, web releases tab with downloads).
1447- GitHub history import: =repo import-issues= brings issues and PRs
1448  (as merged/closed MRs) with comments, labels, and state, attributed
1449  inline and resumable.
1450- Push and pull mirroring (=repo mirror=): background sync, read-only
1451  pull mirrors, per-mirror status; credentials server-side, SSRF-guarded.
1452- Web signup at =/register= for open and invite instances.
1453- Audit log (=audit=, =gitbayd admin audit=): every mutating command
1454  with source key fingerprint, registrations, force-pushes, auth
1455  failures. Hardening: per-IP auth-failure throttling
1456  (=ssh_auth_rate=), =max_pack_bytes= enforced, =admin user
1457  disable/enable=.
1458- Account migration: =gitbay migrate --from <host>= (bundle
1459  export/replay + client-side git mirror); =gitbay auth export= as a
1460  user-level backup.
1461- Editable issues and MRs (=issue edit=, =mr edit=, web forms).
1462- Commit references appear as system messages with linked shas.
1463- Design: top nav, repo listing rows (topics, license, last updated),
1464  file table headers, README relative-link resolution, branch
1465  dropdown, web pinning, org owner picker, label filters, linked
1466  usernames and commit parents, =/privacy= page, blue accent.
1467
1468Upgrade notes: migrations 0006–0019 apply on start. No config changes
1469required; =[go_import]=, =[mirrors]=, =web.privacy_notice=, and
1470=web.mode = "accounts"= are opt-in.
1471
1472* v0.1.0 — 2026-08-24
1473
1474First tagged release: the complete CLI-first forge. SSH control plane
1475(bare-OpenSSH usable), git over SSH/HTTPS/git-daemon, repos, issues,
1476merge requests (ff/merge/squash/rebase with signature policy), OpenPGP
1477and SSHSIG verification with retroactive re-verification, orgs, repo
1478import, web UI (view-only or accounts mode), registration with invites
1479and SMTP, HTTPS/JSON API with SSH-minted tokens, webhooks, backups,
1480ACME TLS, systemd deployment.