CHANGELOG.org

   1#+title: gitbay changelog
   2
   3Versioning follows semver from v0.1.0. Database migrations run
   4automatically on daemon start; upgrade notes appear per release when
   5anything beyond "replace the binary and restart" is needed.
   6
   7* v1.24.0 — 2026-09-18
   8
   9The web follow-ups to the design foundation (#219, #220, #221, #222,
  10#224, #225), and a repository maintenance command.
  11
  12- =build list= takes =--ref=, =--status= and =--job=, pushed down to the
  13  store query; the builds page reads the same three as GET parameters
  14  with shareable links, and groups a commit's jobs into one run showing
  15  the combined state (#224).
  16- The merge request page's "Files changed" view is wide; the
  17  conversation and commits views stay at reading width (#219).
  18- The profile page lists repositories above the biography; the
  19  contribution grid carries month labels and a legend (#225).
  20- The dashboard shows populated queues first, collapses empty ones to a
  21  heading, and says what the two Open lists cover (#222, in part).
  22- Under 52rem the rail strip keeps one scrolling row and shows pinned
  23  repositories as a second row instead of hiding them (#220).
  24- Polish from the v1.23.0 review: caption spans instead of dangling
  25  labels, runner attach keeps a rejected key and reports success, the
  26  tree root of the default branch is the repository home so the header
  27  is identical within the code tab, the file editor is wide (#221).
  28- =admin mr prune <owner/name> <n>... --yes= drops the named merged or
  29  closed MRs' =refs/merge-requests/N/head= and runs =git gc --prune=now=
  30  on the repository, for commits a history rewrite left reachable only
  31  through them. Open and source-gone MRs are refused. Nothing drops a
  32  head ref on its own. =mr diff= and the MR page say when a head is gone
  33  (#227).
  34
  35* v1.23.0 — 2026-09-17
  36
  37The web design foundation (#218). Tokens measured in both schemes, one
  38control family, content widths per page, and the landing, repository
  39overview, merge request and settings pages recomposed. Set =[web]
  40title= to =gitbay= in lower case; the templates already are.
  41
  42- =style.css= rewritten on tokens defined on =:root= and again for dark;
  43  =TestTokenContrast= enforces the floors and
  44  =TestEveryTemplateClassHasARule= that every template class has a rule.
  45- Buttons are primary, secondary, quiet or destructive; one focus ring on
  46  everything; success and error flashes share one shape.
  47- Every page picks a width: wide for code, reading for lists and threads,
  48  bounded for forms.
  49- The repository header shows description and topics on the code tab
  50  only; the overview leads with the file table and puts clone commands
  51  and facts after the README; "Find file" is "Search code".
  52- A merge request states who merged or closed it under its title and
  53  explains an empty diff.
  54- Repository settings are bounded rows with a consequence beside each
  55  control, a saved flash, a rejected value kept, and topics as one field.
  56- Landing copy says what the product is and where to go; the register
  57  form says to paste the contents of the key file and links the SSH keys
  58  wiki page.
  59- The landing page shows the merge request page, light and dark,
  60  captured from gitbay.org (two embedded PNGs under =/static/img/=).
  61
  62* v1.22.1 — 2026-09-13
  63
  64One merge gate fix.
  65
  66- =require-checks= no longer refuses a merge request head that carries
  67  no statuses when nothing was going to report one: a repository with
  68  no =.gitbay/ci.yml=, or one whose jobs all wait on a schedule or a
  69  tag, had no mergeable merge request and no remedy but turning the
  70  setting off. A head whose config carries a job a push runs, and a
  71  head in a repository that has recorded a status before — which is
  72  what reporting from outside through =status set= looks like — is
  73  still refused (#216).
  74
  75* v1.22.0 — 2026-09-12
  76
  77The CLI output sweep (#183). The rules are on the wiki's Users page,
  78under "Output rules".
  79
  80- A bad invocation prints the command's registered usage, the one
  81  source of it; the hand-written copies are gone.
  82- The =gitbay= CLI pads list rows into aligned columns at a terminal
  83  and leaves the tabs alone when piped.
  84- An empty list prints nothing on stdout and =nothing to list= on
  85  stderr.
  86- Every refusal (exit 4) says what to do instead.
  87- =status list= and =repo topics= print rows.
  88- =admin runners remove=; =forget= stays as an alias until the next
  89  release.
  90- A missing positional argument prints the hint and the usage line
  91  (#215).
  92
  93* v1.21.0 — 2026-09-12
  94
  95The web UI/UX sweep (#182).
  96
  97- Destructive controls ask for the object's name typed beside the
  98  button: release delete, snippet delete and file remove, team delete,
  99  label remove, and SSH key, email and PGP key removal. Reversible
 100  controls keep a plain button.
 101- Login returns to the page that asked for it, and says so.
 102- One timestamp format everywhere, =2006-01-02 15:04 UTC=.
 103- Tags on the refs page and in the release form are in version order,
 104  newest first.
 105- The file editor explains up front when signed commits or
 106  merge-requests-only protection would refuse the commit, answers 404
 107  for a branch that does not exist, and says when a path is new.
 108- Merge refusals name the strategy rather than the flag; an issue
 109  closed by a commit reads "closed by <who> in commit <sha>".
 110- Repository settings: every Save names its field. Labels: the colour
 111  column appears only when it means something. Sidebars use one shape
 112  for empty. List rows show the state only under "all" and say "in
 113  <milestone>". Global search counts its results. A merged MR shows
 114  its merged head and a deleted source branch. The repository home
 115  shows the SSH clone URL beside HTTPS. The settings page names
 116  =auth token create=.
 117
 118* v1.20.1 — 2026-09-11
 119
 120One config check.
 121
 122- A negative =limits.max_snippets_per_user= is refused at config load,
 123  as =max_repos_per_user= and =max_bytes_per_user= already were; it
 124  used to pass validation and read as unlimited (#214).
 125
 126* v1.20.0 — 2026-09-11
 127
 128Snippets (#195): named text files a user owns outside any repository,
 129shared by URL and edited in place.
 130
 131- Migration 0054: =snippets= and =snippet_files=.
 132- =snippet create|show|list|edit|delete= and =snippet file
 133  set|get|remove=. Files are UTF-8 under =limits.max_snippet_bytes=
 134  (1MB), at most 64 per snippet; a snippet keeps at least one.
 135  =limits.max_snippets_per_user= (0, unlimited) caps how many an
 136  account may own, admins included. Visibility =public=, =unlisted=
 137  (default) or =private=; a private snippet is not found to everyone
 138  but its owner and admins.
 139- Web: =/<owner>/-/snippets= lists, each snippet page renders its
 140  files with a raw route per file, and the owner creates, edits and
 141  deletes from the page through the same commands. The owner page
 142  links to the list.
 143
 144* v1.19.0 — 2026-09-11
 145
 146Labels and milestones an org defines once for every repository under
 147it, and =Closes owner/name#N= acting across repositories (#203).
 148
 149** Org labels and milestones
 150
 151- Migration 0052: =labels= and =milestones= rows belong to a
 152  repository or to an org, exactly one, with a partial unique index
 153  per scope. Existing rows and their memberships keep their ids.
 154- A repository owned by an org sees the org's labels and milestones
 155  beside its own; =issue label --add=, =issue milestone= and =mr
 156  milestone= resolve the org's row first. A repository cannot create,
 157  recolour, remove, close or reopen a name its org holds; the refusal
 158  names the org command.
 159- =org label set|list|remove= and =org milestone
 160  create|list|close|reopen=, for org admins. Creating a name that
 161  repositories under the org already use folds them in: their issues
 162  and merge requests move to the org's row and the repository rows
 163  go. =repo transfer= into an org folds the same way. Counts on org
 164  rows span the repositories the caller can read.
 165- Web: read-only =/<org>/-/labels= and =/<org>/-/milestones=, linked
 166  from the org page; an "org" mark on repository label and milestone
 167  pages, whose forms act on repository rows only.
 168- =label list= and =milestone list= JSON carry =org: true= on an org
 169  row.
 170
 171** Cross-repository closes
 172
 173- =Closes owner/name#N= in a commit on the default branch, or in a
 174  merged merge request's title or body, closes that issue when the
 175  actor holds write on the target and the pushing key's scope allows
 176  it: a deploy key never acts outside its binding. An unknown or
 177  refused target does nothing and logs nothing; the text stays a
 178  plain autolink. An archived target is refused. Bare =owner/name#N=
 179  without a keyword stays display-only.
 180
 181** Store
 182
 183- A migration whose first line is =-- foreign_keys: off= runs on one
 184  pinned connection with foreign keys off, re-enabled afterwards and
 185  =foreign_key_check= required empty. Rebuilding a table other tables
 186  reference loses the children's rows otherwise, even under
 187  =legacy_alter_table=.
 188
 189** Behaviour changes
 190
 191- =milestone create= exits 1 on a duplicate title, as =org milestone
 192  create= does; it exited 2 before.
 193
 194Upgrade: replace the binary and restart; migration 0052 runs on
 195start and copies every label and milestone row once.
 196
 197* v1.18.1 — 2026-09-11
 198
 199A runner that cannot hang on a dead connection, SSH keys with names,
 200and dependency updates.
 201
 202** CI runner
 203
 204- Every ssh invocation carries =ConnectTimeout=10=,
 205  =ServerAliveInterval=15= and =ServerAliveCountMax=3=, placed after
 206  the identity and the operator's =-ssh-opts= so an operator's value
 207  wins. A claim whose TCP session had died under it blocked a laptop
 208  runner's poll loop for thirteen hours; it now fails within a minute
 209  and the loop resumes.
 210- The build comment in =deploy/Containerfile.ci= stages the file in
 211  the runner user's home before =podman build=: a login shell under
 212  =su= cannot read root's stdin and does not share root's =/tmp=.
 213
 214** Keys
 215
 216- SSH keys carry a label (migration 0051). =keys add --label= defaults
 217  to the authorized_keys comment; =keys label <fingerprint> [<text>]=
 218  renames or clears it. =keys list=, =admin user show=, =repo
 219  deploy-key list= and the settings page show it. Deploy, runner and
 220  admin-created keys take the comment as their label. Closes #208.
 221
 222** Web
 223
 224- Org autolinks stop before trailing punctuation: a bare URL closing a
 225  sentence or a parenthesis no longer takes the =.=, =,= or =)= into
 226  the href. Closes #209.
 227
 228** Dependencies
 229
 230- golang.org/x/crypto 0.57, x/image 0.46, x/net 0.59, x/term 0.46.
 231  Closes #205.
 232
 233* v1.18.0 — 2026-09-10
 234
 235What the first real job on a user's runner needed. A twice-daily
 236archive pull that had run on the server's host moved into a container
 237and then onto a laptop, and each hop found a gap.
 238
 239** CI runner
 240
 241- A secret with newlines — a private key — reaches the build. An env
 242  file has no escape for one, so such values are named on podman's
 243  command line with =--env NAME= and valued in the podman process's own
 244  environment; the value touches neither argv nor the file.
 245- =GITBAY_SSH= in every build's environment: the instance's ssh
 246  destination as the build reaches it. Under podman the host's own
 247  addresses belong to the container (pasta), so a loopback remote is
 248  rewritten to the address pasta exposes the host at. A job that
 249  publishes back to the instance uses the variable rather than
 250  guessing. Inside a container =ssh= expands =~= from the passwd entry,
 251  not =$HOME=; keep a build's ssh config in the workspace and pass =-F=.
 252- =-identity= drops the user's =~/.ssh/config= (=-F /dev/null=):
 253  =IdentitiesOnly= kept identities the config named, so a laptop runner
 254  authenticated as the user's own full-scope key and, on an admin's
 255  machine, could claim every repository's builds. A first-seen host key
 256  is accepted, since a service cannot answer a prompt.
 257- A schedule tick queues nothing while the job's last build is pending
 258  or running, matching the push path. A repository no runner served
 259  gained one row per tick forever. A finished build does not suppress
 260  the tick; a schedule re-runs an unchanged commit on purpose. #206
 261- =admin runners forget <fingerprint>= drops a key's heartbeat row; the
 262  key stays. =admin runners= rows are the repositories a key may claim.
 263- The bay1 unit names no =-repos=: the runner key's attachments are the
 264  boundary. =gitbay-ci:2= carries =python3-venv= and =sqlite3=, since
 265  it is also the default image for every repository the runner is
 266  attached to.
 267
 268** Decisions
 269
 270- Claim order stays oldest-first across everything a key may claim; a
 271  repository that must never wait on another gets a runner of its own.
 272  #207
 273- No per-account cap on queued builds and no schedule floor: with the
 274  tick dedupe a repository with no runner holds one row per scheduled
 275  job, and a busy schedule spends its owner's compute. #206
 276- Attaching a runner is =n/a= on iOS: the key lives on the machine that
 277  runs builds.
 278
 279** Documentation
 280
 281- Users: =GITBAY_SSH=, ssh's home inside a container, the =ci.yml= caps
 282  (ten jobs, fifty steps, 4096 bytes a step, 64 KiB a file) and where a
 283  broken config shows up. Admin, CI and Threat-Model follow the changes
 284  above.
 285
 286** Upgrading
 287
 288Replace the binaries and reinstall the CLI. No migration. A runner
 289started with =-identity= (every runner =gitbay-runner init= set up) now
 290ignores =~/.ssh/config=; a runner that relied on it for a =ProxyJump=
 291or an alias passes the equivalent in =-ssh-opts=. Homebrew:
 292=brew upgrade krz/tap/gitbay-runner=.
 293
 294* v1.17.0 — 2026-09-09
 295
 296CI without the operator's compute: a runner anyone installs and
 297attaches to their own repositories, and the server rule that makes
 298that safe. The rest of the #184 list besides.
 299
 300** CI
 301
 302- A runner key claims builds only for the repositories it is attached
 303  to. =repo runner add <owner/name> < key.pub= attaches one; a key the
 304  server has not seen lands on the caller's account with scope
 305  =runner=. =repo runner list= shows each attached key with its last
 306  poll and the build it holds; =repo runner remove <fingerprint>=
 307  detaches it. All three on the settings page. A runner-scoped key
 308  with nothing attached claims nothing, whoever owns it; a full-scope
 309  admin key still claims any repository. =runner log= and =runner
 310  done= refuse a build outside the key's attachments. #184
 311- Closed: any account could add a runner-scoped key, and =runner next=
 312  with no arguments handed it the oldest pending build on the
 313  instance, secrets included.
 314- =runner next --untrusted=: without it a merge request head from a
 315  fork is never claimed. The runner passes it when started with
 316  =-untrusted=; the bay1 unit does, because it isolates in podman.
 317- =gitbay-runner init= generates a key under =~/.config/gitbay-runner/=,
 318  writes =config.toml= beside it, and prints the public key with the
 319  command that attaches it. The runner reads that file when present
 320  and flags override it. =-identity=, defaulting to the generated key,
 321  makes ssh and git use the runner's own key and no other. Homebrew:
 322  =brew install krz/tap/gitbay-runner=, then =brew services start
 323  krz/tap/gitbay-runner=. Releases ship =gitbay-runner= binaries.
 324- =admin runners= heads its output with the queue: builds pending now,
 325  and over the last day the builds claimed, the wait to claim (average
 326  and worst) and the builds the reaper ended instead of a runner
 327  reporting them. Rows are per key, with the fingerprint and the
 328  repositories the key may claim. Migration 0049. #184
 329- Stop tests for the runner's drain: a signal mid-step, the drop-in's
 330  =KillMode= and =TimeoutStopSec=, and a transient systemd user unit
 331  where one exists. #179
 332- The CI wiki page carries every push shape against every job kind and
 333  what dedupe, path filters, schedules and the reaper make of it, with
 334  a test per row. #176, #177
 335
 336** Importing
 337
 338- =import-issues --api-base= reads Forgejo instances: paging by =limit=,
 339  oldest first, comments read once, attribution and pull heads taken
 340  from the API base rather than github.com. #191
 341
 342** Documentation
 343
 344- Users: "Your own runner". Admin, Threat-Model, CI, FAQ and Parity
 345  follow the attachment rule.
 346
 347** Upgrading
 348
 349Replace the binaries and reinstall the CLI. Migration 0050 (runner
 350attachments; the runner heartbeat table is rekeyed by key and
 351emptied), applied on start. One behaviour change: a runner polling
 352with a key of scope =runner= claims nothing until a repository admin
 353attaches it with =repo runner add=. Do that right after the restart.
 354A full-scope admin key is unaffected. Merge request heads from forks
 355are built only by a runner started with =-untrusted=.
 356
 357* v1.16.0 — 2026-09-08
 358
 359What stops a stranger from moving here: the repository plumbing and
 360the team gates the #185 walk found missing, twelve merge requests
 361merged as one stack.
 362
 363** Repositories
 364
 365- =repo settings default-branch <owner/name> <branch>= moves HEAD and
 366  the record; a branch that does not exist is refused. A first push of
 367  =master= or =trunk= into a fresh repository moves the unborn HEAD to
 368  the branch that arrived, so the clone checks something out. Settings
 369  page select. #189
 370- =repo rename <owner/name> <new-name>=: the row and the directory move
 371  together, with transfer's revert on a failed move. Clone URLs change.
 372  #190
 373- =repo settings require-mr on=: an existing protected branch refuses
 374  every direct push in pre-receive, =repo commit-file= and the web
 375  editor included; =mr merge= is its only writer. Creating the branch
 376  is still a push. #197
 377- =repo settings protect-tag <glob>= (and =unprotect-tag=): matching
 378  tags are created once and refuse moves and deletion. Separately, a
 379  tag a release is anchored to refuses both while the release exists,
 380  protected or not; delete the release first. #201
 381- =repo access list= reports effective access: one row per account
 382  with the highest role and where it comes from (owner, direct, org
 383  admin, org member, team). It used to list direct grants only, so a
 384  repository reached through teams answered with nothing. #200
 385- Removing an org member drops their team memberships in the same
 386  transaction. They kept every grant their teams carried, and re-adding
 387  them to the org restored nothing because nothing had gone. #196
 388- An outsider gets one answer about an org: its existence and members
 389  are public, its teams are for members, and =org team list= and =show=
 390  refuse a non-member rather than say the org does not exist. Ref #200
 391- A repository name may not end in =.atom=, as it may not end in
 392  =.git=. Ref #192
 393
 394** Merge requests
 395
 396- A push that leaves the merge request's diff unchanged keeps its fresh
 397  reviews: the patch-id of each revision against its own merge base is
 398  compared, and a rebase onto a target that moved on no longer stales
 399  every approval. A push that changes the diff stales them as before.
 400  #198
 401- The merge gates are one computation shared by =mr show= (a =gates=
 402  block: approvals counted and required, owners outstanding per file,
 403  open threads, checks, whether a fast-forward is possible), the merge
 404  request page, and =mr merge=, which names every unmet gate in one
 405  refusal rather than the first. =mr review= reports =counts= and says
 406  when a verdict is advisory because the reviewer cannot write. #199
 407
 408** Notifications
 409
 410- =@name= in an issue, merge request, comment or diff comment files
 411  "mentioned you" in that account's inbox and makes them a participant
 412  of the thread, provided they can read the repository and have not
 413  muted it. Watchers are not told about a mention addressed to someone
 414  else. Migration 0047. #202
 415- =notifications settings mail on|off= (and =show=): inbox rows are
 416  filed either way, this is the mail half. Login links are not activity
 417  and still arrive. The account page carries the same switch.
 418  Migration 0048. Ref #194
 419
 420** Web
 421
 422- Atom feeds: =/{owner}/{repo}/releases.atom=,
 423  =/{owner}/{repo}/log.atom[/{ref}]= and =/{owner}/activity.atom=,
 424  rendered over the rows the pages already serve. The owner feed covers
 425  public repositories only, since a reader carries no session; a
 426  private repository answers 404. The releases, log and owner pages
 427  carry the discovery link. #192
 428
 429** Documentation
 430
 431- The Users page says what differs over stock ssh: a multi-word value
 432  needs a second layer of quotes, and =help <noun>= replaces =--help=.
 433  The companion-wiki paragraph #170 made stale now points at
 434  =.gitbay/wiki/=. #204
 435
 436** Upgrading
 437
 438Replace the binary and reinstall the CLI. Two migrations (0047, the
 439mentions table; 0048, the per-account mail switch), applied on start.
 440Nothing changes behaviour until a setting is turned on: =require-mr=,
 441=protect-tag= and =mail off= are all opt-in.
 442
 443* v1.15.0 — 2026-09-07
 444
 445Builds run in containers, a rebase is not rebuilt, and a runner restart
 446no longer strands the build it was running.
 447
 448** CI
 449
 450- A build's steps run in a rootless podman container, one per job. The
 451  runner clones outside the container with its key and bind-mounts the
 452  workspace in, so a step cannot reach the key, the runner's environment,
 453  or another build's workspace. =image:= is required per job and is
 454  validated as a reference, never pulled: an operator provisions images
 455  on the host. A runner configured for podman that has none refuses to
 456  start rather than fall back to the host. =-isolation none= is the
 457  explicit host-execution mode. =-cpus= and =-memory= cap a build's
 458  container. #144
 459- Builds have a home directory that outlives the build, so the Go module
 460  cache and the sonar scanner survive between runs. It is mounted into
 461  the container at the same path, and only that directory. Ref #144
 462- The host preparation script, the unit drop-in and the weekly image
 463  prune ship with =make deploy-runner=; each hardening flag the drop-in
 464  relaxes carries the reason in place. Ref #144
 465- A nightly canary on the runner host proves the boundary holds:
 466  =cmc/ci-smoke= runs a job that tries to read the key and list sibling
 467  workspaces, and fails if either succeeds. Ref #144
 468- Dedupe keys on the commit's tree, not its sha. A rebase that changes
 469  nothing is not rebuilt: the new commit gets the earlier success as its
 470  status, naming the build. Scheduled and tag builds carry no tree and
 471  are never reused. #177
 472- =vuln= and =sonar= run nightly on =main= rather than on every push;
 473  neither could inform a merge. Branches run =build= and =test=. #177
 474- A rewritten branch is filtered against the merge base rather than the
 475  old tip, so a rebased branch whose own commits change code no longer
 476  reads as a docs-only push and skips its jobs. #176
 477- A build whose runner's log stream ended with no outcome is failed two
 478  minutes later, instead of sitting =running= until a fixed deadline.
 479  Migration 0046. Ref #179
 480- The runner retries reporting a finished build's outcome, four times
 481  over about thirty seconds, when the server is unreachable. A gitbayd
 482  restart at that moment used to lose the result. Ref #179
 483- The runner drains on SIGTERM: it claims nothing more, finishes and
 484  reports the build in flight, then exits. A second signal exits at once.
 485  The unit allows fifty minutes. #179
 486
 487** Repositories
 488
 489- =repo show= reports the caller's watch and bookmark state, and the
 490  parent of a fork when the caller can read it. #178
 491- =repo unwatch= clears the row from either state; =repo mute= is the
 492  explicit silence. Watch then unwatch used to leave an account below
 493  the default with no way back. The web header toggle follows. #180
 494
 495** Upgrading
 496
 497Replace the binary and reinstall the CLI. One migration (0046, the
 498build log's close time), applied on start.
 499
 500The runner now defaults to =-isolation podman= and refuses to start
 501without a working podman and a named image. Prepare the host with
 502=deploy/runner-podman-setup.sh= and build =localhost/gitbay-ci:1= from
 503=deploy/Containerfile.ci= before deploying it, or pass =-isolation
 504none= to keep running steps on the host. Validate on a scratch
 505repository with =-repos= scoped to it first; the wiki's Admin page has
 506the procedure.
 507
 508The runner's unit gains =TimeoutStopSec=50min= and =KillMode=mixed= so
 509a stop reaches the runner alone and it can drain; under the default
 510kill mode systemd ends the build's container with the runner.
 511=make deploy-runner= therefore waits for a build in flight.
 512
 513* v1.14.0 — 2026-09-06
 514
 515Logging into the web without an SSH key, wikis inside the repository,
 516CI that skips what a change does not touch, and the browser catching up
 517with the command line on nine capabilities.
 518
 519** Accounts and the web
 520
 521- A browser session can be requested by mail: the login page takes a
 522  username or a verified address and sends a link that works once and
 523  expires in fifteen minutes. An account with no SSH key had no way into
 524  the web at all. The response never says whether the account exists, and
 525  the form appears only when the instance has SMTP. #155
 526- A login link resolves to any verified address on the account, not only
 527  the primary. #158
 528- Login mail is queued rather than sent from a goroutine, so a link in
 529  flight survives a restart. #159
 530- A suspended account cannot mail itself a session, and a link minted
 531  before suspension opens nothing. #156
 532- The session cookie is =SameSite=Lax=, and a test now walks every
 533  mutating route to assert it carries the origin check. #157
 534- =POST /register= is reachable on an open instance again.
 535
 536** Wikis
 537
 538- A wiki lives at =.gitbay/wiki/= on the default branch, so editing one
 539  is editing a file in the repository — a push, or the web editor — and
 540  it is cloned, diffed and reviewed like anything else. The companion
 541  =<repo>.wiki= is gone. #170
 542
 543** CI
 544
 545- Path filters: =paths= and =paths-ignore= per job, so a docs commit
 546  does not run the whole suite. #169
 547- A branch's first push derives its diff base from the merge base
 548  rather than treating every file as changed. #171
 549- A job filtered out records a skipped status instead of nothing, so
 550  =require_checks= cannot wait forever for a check that will never
 551  arrive. #172
 552- A force-push no longer leaves queued builds pointing at an object
 553  that is gone; the orphan is cancelled when a runner claims it. #152
 554- A build step's environment is constructed rather than inherited. It
 555  was =os.Environ()= plus the build's variables, which handed repository
 556  content everything set on the runner service. A step now gets =PATH=,
 557  =HOME=, =LANG=, =CI=, its =GITBAY_*= variables and its secrets. =HOME=
 558  is the workspace, so a build cannot read the runner's =.netrc=,
 559  =.npmrc= or =.gitconfig=, where tools keep credentials. Ref #144
 560- A runner host can be prepared for rootless podman:
 561  =deploy/runner-podman-setup.sh=, the systemd changes it needs, and
 562  weekly image pruning. Nothing reads them yet; the preparation ships
 563  before the runner that requires it, on purpose. Ref #144
 564
 565** Collaboration
 566
 567- =mr review request --add <user>= asks a particular person for a
 568  review, who then carries it in their queue and is notified;
 569  =--remove= withdraws the ask. The queue was computed from involvement
 570  alone, so a collaborator who had not touched a thread heard nothing.
 571  #145
 572- Bookmarks save someone else's repository to come back to, and the
 573  count is the instance's only popularity signal. Separate from pins
 574  rather than a flag on them: a pin is private quick access to your own
 575  work and drives the rail, a bookmark is public and counted. =repo
 576  bookmark=, =repo unbookmark=, =repo bookmarks=, a control on the
 577  repository header, the count in the facts bar, and =/bookmarks=. Read
 578  access is all a bookmark needs, and one made while a repository was
 579  public drops out of the listing if it goes private. #146
 580
 581** The browser catches up
 582
 583Nine capabilities that were CLI-only and had no reason to be:
 584
 585- label management — list, create, colour, remove #163
 586- dependency status under the toggle that turns checks on #164
 587- release delete #165
 588- the account export bundle, as a download #166
 589- organization create and rename; delete stays CLI-only, wanting a
 590  typed confirmation, and the page says so #167
 591- opening a merge request from a fork, with a source picker offering
 592  the branches of every fork you can push to #168
 593- forking a repository #174
 594- cancelling a queued or running build #162
 595- the profile form #161, and a markup picker on issue and merge
 596  request create #160
 597- admin table headers align with their columns #151
 598
 599** CLI
 600
 601- =gitbay mr rebase <n>= replays a merge request's branch onto its
 602  target and re-pushes it. A repository requiring signed commits accepts
 603  only fast-forward merges, so a merge request whose target moved had to
 604  be rebased by hand; the refusal already named the procedure and this
 605  runs it. The git work is local, so the replayed commits carry your
 606  signature — the server still holds no key. A branch in a fork is
 607  refused, naming the repository to run it in. #175
 608
 609** Security
 610
 611- Mutating commands are bounded per account in the dispatcher, so SSH,
 612  the JSON API and the web spend one budget and a caller cannot refresh
 613  it by changing surface. Authentication failures were throttled;
 614  commands were not. #148
 615- A dead-lettered mail is logged by its queue row id, not the recipient
 616  address, and the relay's error is redacted before logging because a
 617  rejection quotes the address it rejected. The address stays on the
 618  row, where =/admin= shows it. One rule for every mail type. #173
 619- The 2026-09 sweep's coverage — and what it did not reach — is recorded
 620  in the wiki's Threat-Model rather than in a closed issue. #149
 621
 622** Dependencies
 623
 624- goldmark 1.8.6, sqlite 1.58.0. #140
 625
 626** Upgrading
 627
 628Replace the binary and reinstall the CLI. One migration (0043,
 629bookmarks), applied on start.
 630
 631=limits.write_rate= defaults to 60 mutating commands a minute per
 632account. A script that writes faster will be refused with exit 4 and a
 633retry time; raise it in =[limits]=, or slow the script. Read-only
 634commands, the runner protocol and the host CLI are not counted.
 635
 636A companion =<repo>.wiki= repository is no longer read. Move its pages
 637to =.gitbay/wiki/= on the default branch.
 638
 639Runner isolation is half done. Builds still run as the runner's user
 640with no container: the step environment no longer leaks the service's,
 641and a host can be prepared for podman, but nothing yet executes a build
 642in one. Do not enable CI for repositories you do not trust. #144 stays
 643open for the execution half.
 644
 645* v1.13.3 — 2026-09-05
 646
 647Only a writer's review decides a merge gate, and a scan of one branch
 648stops overwriting another's results.
 649
 650- =mr review= resolves with =CanRead= and applied no further check, and
 651  the merge gates counted every fresh verdict. On a public repository
 652  that let anyone with an account satisfy =require_approvals= — defeating
 653  four-eyes review by holding two accounts, which on an instance with
 654  open registration means defeating it outright — and equally let a
 655  passer-by block a merge the owner wanted, with no override and only a
 656  force-push to clear it. Both were confirmed against a running instance.
 657  Reviewing stays open to every reader, because an outside opinion on a
 658  public change is worth having; it no longer decides the gate. What
 659  does is write access, the same question the gates already answer. An
 660  uncounted review is marked advisory by =mr show= and by the merge
 661  request page, both reading the same rule, so the page cannot show an
 662  approval the gate ignores. #147
 663- The two =git upload-pack= spawns behind the smart HTTP transport now
 664  resolve git at start-up like everything else. The v1.13.2 rewrite
 665  matched a plain identifier for the context and these pass
 666  =r.Context()=, so it skipped them. #153
 667- CI analyses each branch as itself. Every scan was recorded against the
 668  project's main branch whatever branch produced it, so a feature branch
 669  replaced main's results — a branch that removes findings made main look
 670  clean before the fix merged, and one that added them made main look
 671  broken when it was not. #154
 672
 673Replace the binary and reinstall the CLI. No migration.
 674
 675A repository relying on approvals from accounts without write access
 676will find those merges now refused. That was the defect: such an approval
 677never meant the repository accepted the change. Grant write, or name the
 678reviewer in CODEOWNERS and grant write, if their approval is meant to
 679count.
 680
 681* v1.13.2 — 2026-09-04
 682
 683The first SonarCloud scan's findings: eight fixed, the rest triaged and
 684dismissed with reasons.
 685
 686- A pages directory redirect could leave the site. Both redirects passed
 687  the raw request path to =http.Redirect= while the cleaned path sat a
 688  line above; =net/url= keeps a leading =//=, and Go emits
 689  =Location: //evil.example/= unchanged, which a browser reads as
 690  protocol-relative. Reaching it needed a public repository named like a
 691  host under the subdomain's own owner — repository names permit dots —
 692  so it was narrow rather than impossible. The destination is built from
 693  the cleaned path through =url.URL= now, which also settles the two
 694  spellings the first fix missed: a =..= that escapes to the root, and a
 695  backslash, which browsers following the WHATWG rules treat as a
 696  separator. #153
 697- The runner's default workspace was =<tmp>/gitbay-runner=: a fixed name
 698  in a world-writable directory, created with =MkdirAll=, which succeeds
 699  against a directory whoever already owns it. bay1 was never exposed —
 700  its unit names a workspace — but the default is what anyone running the
 701  binary by hand gets, and this is the process that clones repositories
 702  and exports build secrets. The default moves under the user's cache
 703  directory, the workspace is created 0700, and a symlink or a directory
 704  owned by someone else is refused. One we own that is merely too
 705  permissive is tightened rather than refused, since every runner before
 706  this one made it 0755 and refusing would take the runner down on
 707  upgrade. #153
 708- Logout and flash consumption expire their cookies with the attributes
 709  the setting calls used. Deletion worked either way; the difference was
 710  a reviewer's puzzle, and four findings. #153
 711- The topics-remove field has a label. A placeholder is not an accessible
 712  name. TestEveryInputHasAnAccessibleName is the guard that was missing,
 713  and it knows both associations — six inputs use
 714  =<label>Name <input></label>=, which is as good as for/id. #153
 715- git and ssh are resolved once at start-up rather than searched on every
 716  spawn, and gitbayd refuses to start when one is absent instead of
 717  failing on whichever request first needed it. This was 74 of the 118
 718  findings; a dashboard that is mostly permanent noise is one nobody
 719  reads. #153
 720
 721Also: SQLite migrations are excluded from analysis. They were read as
 722PL/SQL, where ='' is NULL=, so =WHERE col = ''= on a =NOT NULL DEFAULT ''=
 723column — correct SQLite, and the shape used throughout — read as a
 724null-comparison bug.
 725
 726Replace the binary and reinstall the CLI. No migration. A runner whose
 727workspace is group- or world-readable will have it tightened to 0700 on
 728next start, and will refuse to start if that workspace is a symlink or
 729belongs to another user.
 730
 731* v1.13.1 — 2026-09-04
 732
 733A command that reads its payload from stdin says so, and SonarCloud runs
 734alongside the vulnerability scan.
 735
 736- =repo secret set= blocked with nothing printed, which is
 737  indistinguishable from a hung connection, and pressing Enter did not
 738  end it because the server reads to EOF — so it looked the same before
 739  and after the value had been typed, and the secret echoed into the
 740  scrollback on the way. A terminal is now told what is wanted and that
 741  Ctrl-D ends it; a secret is read without echo and takes one line, so
 742  Enter is enough. Piped input is unchanged, byte for byte: =printf %s
 743  "$TOKEN" | gitbay repo secret set ...= still sends exactly the token.
 744  Applies to =keys add=, =auth pgp add=, =repo deploy-key add= and
 745  =release asset add= as well; public keys keep echoing, since they are
 746  public. #150
 747- A =sonar= CI job reports to SonarCloud, alongside =vuln=. Report-only:
 748  it does not gate a build, unlike the vulnerability scan. A merge
 749  request from a fork builds without secrets by design, so the job says
 750  why it is skipping there rather than failing on a missing credential.
 751  Only =SONAR_TOKEN= is secret and it is a build secret; the
 752  organization, project key and host are checked in. Ref #149
 753
 754Replace the binary and reinstall the CLI. No migration.
 755
 756* v1.13.0 — 2026-09-04
 757
 758Collaboration. A review is composed and submitted as one thing, a merge
 759request can say it is not asking yet and can show what changed since you
 760last looked, issues are searched by their text, and the events half the
 761mutations never recorded now exist.
 762
 763- A review is composed as a unit. =mr diff-comment --pending= holds a
 764  comment back; =mr review= publishes the batch with the verdict and says
 765  how many went with it; =mr review --discard= throws away what was never
 766  submitted. A pending comment notifies nobody when written — the review
 767  is the announcement, and it names its own size — and does not gate a
 768  merge, since a thread only its author can see is one nobody else could
 769  resolve. #111
 770- =mr create --draft=, =mr draft=, =mr ready=. A draft does not merge and
 771  does not appear in anyone's review queue; marking it ready is the
 772  request for review. Draft is a flag rather than a fifth state, so every
 773  =state = 'open'= rule still means what it did, and the merge refusal is
 774  unconditional: every other gate is a setting an admin turns on, and
 775  this one is the author's own statement about their own work. #111
 776- =mr range-diff= shows what changed between two revisions of a merge
 777  request, and =mr revisions= lists them. A push stales every review and
 778  nothing said what had moved; a diff of the two heads cannot answer it,
 779  and the previous head was overwritten in place. Each side of the
 780  comparison carries the merge base it had at the time, since measuring
 781  both against today's would attribute every commit that landed on the
 782  target in between to this merge request's author. #111
 783- Issues and merge requests are searched by their title and body, over
 784  FTS5. =issue list --search= and =mr list --search= narrow one
 785  repository; the instance-wide =search= reaches bodies now, and both
 786  list pages carry a search box. What someone types is quoted term by
 787  term, so an FTS5 operator — =c++=, =AND=, a lone quote — is a word to
 788  match rather than a syntax error. #114
 789- Ten mutations that changed a repository silently now record an event:
 790  =mr.closed=, =mr.reviewed=, =mr.edited=, =mr.retargeted=, =mr.draft=,
 791  =issue.edited=, =issue.labeled=, =issue.assigned=, =issue.milestoned=,
 792  =mr.milestoned=, =release.deleted=. =mr close= and =issue edit= also
 793  notify participants, which they did not. The full list is on the API
 794  wiki page and =webhook add --events= refuses a name that is not on it,
 795  since a subscription to a typo would never fire and nothing would say
 796  so. #112
 797- =gitbay-runner -jobs N= runs N builds at once. Claiming was always a
 798  single transaction that selects and updates, and each build already
 799  worked in its own directory, so several workers were safe the whole
 800  time; the runner never used more than one. #115
 801- A merge request replayed from a migration bundle has a diff. The bundle
 802  carried no head at all, and =mr diff= resolves through the head ref, so
 803  a merged merge request — which has no source branch left — could only
 804  fail. Re-running an import after the git push sets the head it could
 805  not set the first time. The GitHub import fetches =refs/pull/*/head=,
 806  which a mirror made with the default refspecs does not carry. #128
 807- The review loop is driven end to end by three accounts in the test
 808  suite: draft, ready, thread, approval, resolve, merge, with approvals,
 809  CODEOWNERS and require-resolved all on at once. Every one of those had
 810  its own test and none of them met. #139
 811- A bare =go test ./...= says the timeout is too short instead of
 812  panicking eleven minutes in and blaming whichever test was running.
 813  =make test= is what CONTRIBUTING asks for now. #143
 814
 815Migrations 0036 through 0039 add the search index, the draft flag,
 816pending review comments and merge request head history; 0036 and 0039
 817backfill from what is already there. They run on daemon start.
 818
 819Two things this does not do. There is still no way to ask a particular
 820person for a review — the queue is computed from involvement, so a
 821collaborator with write access who has not touched a thread hears nothing
 822(krz/gitbay#145). And a CI build still runs as the runner's own user with
 823no container; the runner on this instance is scoped to one repository,
 824which is what keeps that narrow (krz/gitbay#144). Both are v1.14.0.
 825
 826* v1.12.0 — 2026-09-04
 827
 828The store and the push path. Dashboard queries walk an index instead of
 829sorting the table, concurrent writers wait instead of failing, expired
 830rows are swept, and a large first push no longer forks a process per
 831commit.
 832
 833- Every dashboard list scanned its table and sorted the result to take
 834  fifty rows. Reachability is correlated subqueries and cannot be
 835  indexed; the index supplies the =ORDER BY= instead, so the walk stops
 836  at =LIMIT=. On 20k issues and 20k merge requests: open issues 11.8ms
 837  to 0.8ms, open merge requests 12.1ms to 0.8ms, the review queue 15.5ms
 838  to 0.3ms, assigned issues 10.6ms to 0.04ms. The last of those also
 839  drives from =issue_assignees= rather than testing =EXISTS= against
 840  every issue. #137
 841- Concurrent writers serialise rather than failing. Every transaction in
 842  the store writes, and a deferred one takes the write lock at its first
 843  write, by which point another may hold it; SQLite answers
 844  =SQLITE_BUSY= and does not run the busy handler for that case, so
 845  =busy_timeout= could not help. Measured with eight concurrent
 846  read-then-write transactions, 44% of them failed. Beginning immediate
 847  takes the lock up front, where the timeout applies. #121
 848- =repo settings= updates no longer overwrite each other.
 849  =settings_json= is one blob, and every caller read it off a repository
 850  loaded earlier, changed a field and wrote it all back; two admins at
 851  once and the later write put back what it had read for the other's
 852  field. The read and the write happen together now, under one
 853  immediate transaction. #123
 854- Expired sessions and tokens are swept, and =[retention]= caps how long
 855  the audit log, the activity feed, webhook deliveries and the mail
 856  queue keep a row. Unset means forever, which is what every existing
 857  instance gets. #122
 858- The audit entry records flag names without their values. Secrets never
 859  reached argv — they travel on stdin — but prose did: =--body <the
 860  whole issue>= was stored verbatim, in a table nothing pruned, for a
 861  repository that may be private. Identifiers are positional and
 862  survive. #122
 863- pre-receive on a require-signed repository forked a =cat-file= per
 864  incoming commit and built one JSON message holding the whole push. A
 865  50k-commit first push forked 50k processes and held the history in
 866  memory twice. One =cat-file --batch= serves the push now, and the
 867  daemon verifies each commit as it arrives. #100
 868- The payloads other surfaces decode are named types in =control=. httpd
 869  had its own copies of what the build, profile and dashboard commands
 870  emit, so a field added to a command was silently absent on the page.
 871  #126
 872
 873Migration 0035 adds three indexes; it runs on daemon start.
 874
 875Two changes in behaviour rather than configuration. A heavily contended
 876write now blocks for up to =busy_timeout= (five seconds) instead of
 877returning an error immediately — waiting is the point, but a caller that
 878treated the error as normal will see a pause instead. And anything
 879parsing =audit --json= for command arguments will find flag values gone;
 880the flag names and the positional arguments are still there.
 881
 882* v1.11.0 — 2026-09-04
 883
 884The web catches up with the rest of the forge: search across the
 885instance, a notification inbox, a compare view, linkable diff lines,
 886and a pass over contrast, heading structure and the stylesheet.
 887
 888- Notifications are no longer mail or nothing. An =inbox= table holds a
 889  row per recipient whether or not the instance has SMTP;
 890  =notifications list= reads it, unread by default, and =notifications
 891  read <id>... | --all= clears it. =repo watch= adds you to a
 892  repository's notifications and =repo unwatch= mutes it, with a mute
 893  beating every other reason to be told, including owning the
 894  repository or having written the thread. The unread count rides on
 895  =dashboard= and in the web rail. #113
 896- =search= matches repository paths, descriptions and topics, and issue
 897  and merge request titles, across everything the caller can read;
 898  =/search= renders it with a field in the rail on every page, and an
 899  anonymous visitor gets the public rows from the same query. Titles
 900  only — body search is #114. #118
 901- =/{owner}/{repo}/compare/{a}...{b}= shows what one ref adds on top of
 902  another. Diff rows, files and review threads carry ids, so a line can
 903  be linked to. The issue and merge request lists page at fifty with
 904  the cursors the commands already emit. #118
 905- CODEOWNERS gating is a setting rather than a file that happens to
 906  exist: =repo settings require-codeowners <owner/name> on|off=, off by
 907  default, still independent of =require-approvals=. A repository can
 908  carry the file as documentation of who to ask without it gating
 909  merges. #142
 910- A failed form action's reason rides a one-shot cookie instead of
 911  =?e=<message>=, so it no longer survives a reload or lands in
 912  history. #119
 913- A diff cut at 4 MiB cuts on a line boundary and says so, the
 914  diffstat says its counts are partial, and a merge request's commit
 915  list says "first 100 of N". #117
 916- Page templates parse once with the layout at start-up, so a template
 917  that does not parse fails the process rather than the first visit to
 918  its page. #116
 919- Markdown headings carry ids, matching org pages, and the stylesheet
 920  serves a hash ETag with a day's lifetime and answers a matching
 921  =If-None-Match= with 304. #132
 922- Dark-mode buttons carry a visible edge (a 1 px border was 1.3:1
 923  against the 3:1 non-text contrast floor), and a stored label colour
 924  is held between 0.12 and 0.28 relative luminance so it clears 3:1 on
 925  both grounds while keeping its hue. #120
 926- Accessibility: the pin star is decoration and the word carries the
 927  meaning, the refs and release asset tables have scoped column
 928  headers, state filters carry =aria-current= rather than marking the
 929  active one by colour alone, and a rendered README or wiki page's
 930  headings move down one level so they sit under the page's own. #133
 931- The stylesheet drops rules no template reaches, folds two off-scale
 932  values onto the type scale, and resolves the classes templates asked
 933  for and it never defined. #131
 934- On a phone the tab bar wraps to a second row instead of scrolling
 935  sideways with its scrollbar hidden, and the landing page says in
 936  three sections what a reader, a writer and a reviewer can do. #134
 937
 938Migration 0034 adds =inbox= and =repo_watchers=; it runs on daemon
 939start. Reinstall the CLI for =search=, =notifications= and =repo
 940watch/unwatch=.
 941
 942Two upgrade notes beyond replacing the binary. A repository that
 943relied on a CODEOWNERS file gating merges by its presence alone loses
 944that gate until =require-codeowners= is set: nothing back-fills it,
 945since the database cannot say which branches carry the file. And
 946=search= and =notifications= are now reserved top-level routes, so a
 947user or organization already holding either name keeps it but its
 948profile page is shadowed by the route.
 949
 950* v1.10.0 — 2026-09-04
 951
 952Every command parses its arguments the same way, the web answers by
 953exit code, and a restart no longer waits on idle connections.
 954
 955- One flag parser for every command: an unknown flag, a missing value or
 956  too many arguments is exit 2 with the command's usage, everywhere.
 957  =mr review --approve --bogus= used to report repository =--bogus= as
 958  not found. #96
 959- =--json= is honoured by the dispatcher's own refusals, so a script told
 960  no gets the envelope. #109
 961- A store failure is exit 1 and not-found is exit 3; both used to be
 962  usage errors. #107
 963- Web form actions answer by exit code: the 404 page for a thing that
 964  does not exist, the page with the message for anything else. #106
 965- Inside a clone, =gitbay mr create= takes the checked-out branch as
 966  =--source=; =gitbay <noun> --help= is the server's reference for the
 967  noun, flags included. #101 #130
 968- Shutdown closes idle SSH connections at once and drains only sessions
 969  mid-command; a store failure during key lookup no longer counts as a
 970  bad key against the auth limiter; the CLI says on ssh's exit 255 that
 971  a burst may have tripped it. #141
 972- A merge request head the target already contains is recorded as
 973  merged instead of refused; a fork is created with its parent in one
 974  insert; a failed transfer revert is reported; the repository quota is
 975  checked under a lock. #108
 976- Issues and merge requests share their comment, reference and
 977  author-or-write code. #110
 978- The payloads the web and clients decode are named types: =Created=,
 979  =MRCreated=, =IssueShow=, =MRShow=. JSON unchanged. #126
 980- Tests: parse failures per command, non-ASCII paths (which found
 981  =ls-tree= returning octal escapes, fixed with =core.quotepath=off= for
 982  every git the server runs), concurrent pushes. #129
 983
 984Replace the binary and restart, and reinstall the CLI. No migration.
 985
 986* v1.9.0 — 2026-09-03
 987
 988The runner is no longer an admin, the web no longer reaches around the
 989registry, and the CLI stops paying a handshake per command.
 990
 991- =keys add --scope runner= confines a key to =runner next/log/done= and
 992  read-only git; the runner commands accept that scope or an admin. The
 993  systemd drop-in sandboxes the runner process. gitbay.org's runner now
 994  polls as a non-admin =ci= account scoped to one repository. #92
 995- The web's repo create, issue create and edit, MR edit and both comment
 996  forms dispatch the command the CLI runs, so the repository quota, the
 997  archived-repository refusal, notifications, the body format and the
 998  audit entry hold from a browser. #93
 999- The CLI shares one SSH connection per instance (=ControlMaster=, five
1000  minutes idle): a command costs a round trip instead of a handshake,
1001  0.4 s instead of 4 s from a distant laptop. =no_multiplex = true= on
1002  an instance opts out. #94
1003- A disabled account is refused on every surface, and disabling revokes
1004  its API tokens along with its sessions. #95
1005- CODEOWNERS gates whenever the file exists on the target branch, not
1006  only under =require-approvals=. #99
1007- The HTTP listeners have header and idle timeouts, and SIGTERM drains
1008  in-flight requests and SSH sessions before exit. #104 #105
1009- =git archive= runs under a two-minute deadline and a 512 MiB cap. #124
1010- Every git invocation ends option parsing before the ref, so a ref
1011  shaped like an option is a bad revision and never a flag. #135
1012- The admin noun is gated in the dispatcher as well as in each handler;
1013  registry tests cover that and =ReadsStdin=. #127
1014- An e2e test runs every =ReadOnly= command against a populated instance
1015  and fails on any row it changes. #97
1016- =http.trusted_proxies= attributes proxied API requests to the last
1017  untrusted =X-Forwarded-For= hop for rate limiting; =email add= is
1018  capped at five codes an hour per account. #136
1019- A merge request head is built in the target repository, at
1020  =refs/merge-requests/<n>/head=, so a fork's merge request has
1021  =ci/<job>= statuses for =require-checks= to gate on. A head from
1022  another repository is built without the target's secrets. #98
1023- Triggers refuse deleting a user or organization that still owns
1024  repositories, whatever path the delete takes. #136
1025- The stylesheet's fonts are served again, and directory crumbs on blob
1026  and blame pages link to the tree. #102 #103
1027- The Threat-Model wiki page covers the runner. #138
1028
1029Replace the binary and restart, reinstall the CLI, and =make
1030deploy-runner=: the runner fetches merge request refs before checkout.
1031Migrations 0032 and 0033 run on start. The daemon host needs git 2.24
1032or newer for =--end-of-options=.
1033Operators running =gitbay-runner=: give it a non-admin account with a
1034key added by =keys add --scope runner=, remove the admin key it held,
1035and =make deploy-runner= to install the sandboxed unit drop-in; an
1036admin key keeps working meanwhile.
1037
1038* v1.8.1 — 2026-09-03
1039
1040Markdown and org files render when opened.
1041
1042- A =.md=, =.markdown= or =.org= file renders on its page the way a
1043  README does on the directory page, through the same renderer with
1044  relative links resolved against the file's directory. =source= in the
1045  action bar, or =?view=source=, shows the text as before. Every other
1046  file is unchanged. #88
1047- The e2e harness waits for the HTTP and git listeners as well as SSH
1048  before a test starts; a test whose first act was an HTTP request could
1049  be refused, which failed two otherwise green runs. #91
1050
1051Replace the binary and restart. No migration.
1052
1053* v1.8.0 — 2026-09-03
1054
1055The tracker's lists narrow, labels have colours you set, and the CLI's
1056help is the server's.
1057
1058- =issue list= takes =--label=, =--assignee=, =--author= and
1059  =--milestone= (a title, or =none= for issues with no milestone);
1060  =mr list= takes =--author= and =--milestone=. The store narrows in
1061  SQL, and the web lists take the same names as query parameters and
1062  show each active filter with a link that drops it and keeps the rest.
1063  Both lists had taken =--state= and nothing else, so the web's
1064  filtering could never match the CLI's. #84
1065- =label list= shows a repository's labels with their colour and how
1066  many issues carry each; =label set <label> [--color rrggbb|'']=
1067  creates a label or sets its colour; =label remove= takes it off every
1068  issue. The colour column had existed since labels did and nothing
1069  wrote it. The hash is optional because over bare ssh a bare =#= starts
1070  a comment for the tokenizer. =issue label --add= still creates a
1071  colourless label on the fly. #85
1072- =gitbay help= with a prefix or =--json= runs the server's help, the
1073  only place flags are written down and whose JSON is the contract;
1074  bare =gitbay help= is still the local tree. Cobra's built-in help had
1075  owned the word, so =gitbay help --json= failed on an unknown flag. #86
1076
1077Replace the binary and restart, and reinstall the CLI for the help
1078change. No migration.
1079
1080* v1.7.0 — 2026-09-02
1081
1082What an open instance needs before it is open: a cap on what one
1083account can take, a way out of a browser session you no longer hold,
1084and accounts that never verified do not stay forever.
1085
1086- =limits.max_repos_per_user= caps the repositories an account owns
1087  directly; =repo create=, =fork= and =import= refuse past it with the
1088  numbers. =limits.max_bytes_per_user= caps their disk: a push may be no
1089  larger than what the owner has left, riding the same
1090  =receive.maxInputSize= as the pack cap, and is refused outright when
1091  nothing is left. Organizations are not capped. Migration 0031 adds
1092  per-account overrides, set with =admin user limits <name> [--repos
1093  n|default] [--bytes n|default]= and shown by =admin user show=. Both
1094  default to 0, unlimited, so nothing changes until set. #82
1095- =registration.pending_expiry=, a duration, removes self-registered
1096  accounts still unverified after that long, hourly and once at start,
1097  audited as =pending.expired=. Empty keeps them, as before. #82
1098- =web sessions list= shows each unexpired browser session by a short id
1099  with its creation and expiry; =web sessions revoke <id>= ends one and
1100  =--all= ends every one. SSH-only, matching the token commands, and
1101  scoped to the caller. #83
1102- A step runs in its own process group and a cancel or timeout kills the
1103  group. On a host whose =/bin/sh= is dash, killing the shell alone left
1104  its child holding the log pipe, so a cancelled build held the runner
1105  until the child finished on its own, minutes for a test suite. The
1106  wait after a kill is capped at ten seconds besides.
1107- A commit with a build still queued or running is not queued again
1108  when a fast-forward lands it; the v1.6.0 skip counted only a finished
1109  success. #90
1110
1111- =golang.org/x/crypto= v0.56.0: GO-2026-6354 and GO-2026-6355 in its
1112  =ssh= package, both reached through =ssh.NewServerConn= in the
1113  embedded SSH server; one is a denial of service on a deadlocked
1114  undecided channel.
1115
1116Replace both binaries and restart: =make deploy= for the daemon
1117(migration 0031 adds two columns to =users= on start), then
1118=make deploy-runner= for the process-group kill.
1119
1120* v1.6.1 — 2026-09-02
1121
1122A cancel reaches a build in its clone.
1123
1124- The runner honoured a cancel only in its step loop; a build cancelled
1125  during its clone or checkout ran git to completion first, which on a
1126  loaded host was long enough for the v1.6.0 test to fail on the CI
1127  host while passing locally. One =runStep= now drives the clone, the
1128  checkout and each step with the cancel signal and the deadline, and
1129  checks the signal before starting at all. The runner logs how its log
1130  session ended when that was not a cancel.
1131
1132Replace the runner: =make deploy-runner=. The daemon is unchanged from
1133v1.6.0.
1134
1135* v1.6.0 — 2026-09-02
1136
1137The v1.4.0 admin surface answered questions about accounts. This one
1138answers questions about the machinery: which runner is alive, what is
1139stuck, whether last night's backup exists, and it lets an operator stop
1140a build instead of waiting it out.
1141
1142- A build a runner claimed and never reported is failed by the
1143  scheduler's minute tick, with no runner involved. It used to happen
1144  only when some runner polled again, so a dead sole runner left its
1145  builds running forever. =GITBAY_STALE_BUILD_DEADLINE= shortens the
1146  deadline for tests. #75
1147- Runners are visible. Migration 0030 adds =runner_seen=: one row per
1148  runner account with its last poll, the =-repos= scope it asked for,
1149  and the build it holds. =admin runners= lists them, over SSH and on
1150  the host. #76
1151- =GET /healthz=: whether the database answers and which commit serves,
1152  no auth, no repository data, 503 when the database does not answer.
1153  =healthz= joins the reserved names. #77
1154- The host monitor's hourly reading carries the age of the newest full
1155  backup and database snapshot, alerting at 25 and 2 hours, and the
1156  daemon's own =/healthz= answer read through =site_url=. Both ride the
1157  journald line and the webhook body. #78
1158- =admin stats= reports =lfs_bytes=. =admin gc --lfs= scans every
1159  repository's objects for LFS pointers and removes stored objects none
1160  names, keeping anything younger than a day since git lfs uploads
1161  before it pushes. #79
1162- =admin backup --verify <archive>= reads an archive back: SQLite's
1163  integrity check on the snapshot, and the repositories it names against
1164  the archive's. A database-only archive says so. Damage or a missing
1165  repository exits non-zero. #80
1166- A commit that already passed a job on another branch is not built
1167  again when a fast-forward lands it. Merging the six-layer v1.6.0 stack
1168  had queued eighteen jobs for commits that had each just gone green.
1169  Failed or abandoned builds still re-queue. #90
1170- =build cancel <owner/name> <n>= withdraws a queued build or ends a
1171  running one. For a running build the server closes the runner's log
1172  session, the runner kills the step within seconds, and its late report
1173  changes nothing. The commit status goes back to the passed result from
1174  another build of the same commit when one exists, else reads
1175  =cancelled=. Needs write access.
1176- Deploys copy with =rsync --partial=, so a transfer the host's load
1177  stalled resumes, and =make deploy-runner= installs a systemd drop-in
1178  (=Nice=10=, =CPUWeight=30=, =IOWeight=30=) so a build never starves the
1179  host's sshd again.
1180
1181Replace both binaries and restart: =make deploy= for the daemon, then
1182=make deploy-runner= for the runner, which carries its half of running-
1183build cancellation and installs the drop-in. Migration 0030 adds the
1184=runner_seen= table on start. The monitor change ships in
1185=deploy/cloud-init.yaml=; an existing host takes it by hand.
1186
1187* v1.5.0 — 2026-09-02
1188
1189Merge requests stack.
1190
1191- A merge request whose target is the source branch of another open
1192  merge request in the same repository is stacked on it. Nothing is
1193  stored and no flag exists; the forge reads the stack from the
1194  branches. =mr create= says =stacked on !A= when it applies, =mr show=
1195  carries =stacked_on= and =stacked=, =mr list= rows carry =stacked_on=,
1196  and the page says both directions in the header. #87
1197- When the lower merge request merges, everything stacked on it is
1198  retargeted onto what it merged into, with a system comment naming the
1199  merge and its reviews kept: after a fast-forward or merge commit the
1200  diff against the new target is the diff they were of. A squash or
1201  rebase merge under a stack is refused, naming the stack, since it
1202  would rewrite the commits the stack builds on.
1203- The first stack merged on gitbay.org was the six merge requests of
1204  v1.6.0, bottom-up, with no =mr retarget= typed. The wiki's
1205  Stacked-MRs page walks through it.
1206
1207Replace the binary and restart. No migration.
1208
1209* v1.4.0 — 2026-09-01
1210
1211Until now the instance had one operator surface: root on the host. Every
1212question about the instance itself — who is on it, what is stuck, what a
1213spam repository is doing — needed a shell on port 2222. This release
1214gives an instance admin the same answers over SSH, and one page on the
1215web.
1216
1217- =admin user list= pages accounts by username with
1218  =--state active|pending|disabled|admin=, each row carrying its state
1219  and =last_seen=, the newest use of any of its SSH keys or API tokens.
1220  =admin user show <name>= adds the keys with their last use, each
1221  address with how it was verified, PGP keys, org roles, owned
1222  repository count, API token names and live browser sessions. Both are
1223  SSH-only and refused to non-admins, like =audit=. #69
1224- =admin user promote|demote=. The only way to admin was
1225  =admin user create --admin=; an existing account could not be raised
1226  and an admin could not step down. Demoting the last admin is refused
1227  inside the transaction that counts them. The host-local twin is the
1228  recovery path when no admin key is reachable. #70
1229- Repository overrides for moderation: =admin repo list= with size and
1230  last push, and =admin repo archive|unarchive|visibility|delete=. Policy
1231  still knows nothing about instance admin — a private repository
1232  answers not-found to an admin as before — so each override skips the
1233  access check explicitly and writes its own =admin repo.<action>= audit
1234  row. #71
1235- =gitbayd admin= dispatches into the registry. User create, disable,
1236  enable and delete, email verify, invite and stats were reimplemented on
1237  the host; they now live in the registry, SSH-only and admin-gated, and
1238  the host binary runs them as the host — an admin context with no
1239  account behind it, so its audit rows say =source: host= where a
1240  session says the key fingerprint. Invite and stats gain an SSH twin by
1241  the same move. =backup=, =gc= and the backfills stay host-local. #72
1242- =audit= filters: =--actor <user>= or =--actor -= for actorless rows,
1243  =--action <prefix>=, and =--since= as a duration (=30m=, =24h=, =7d=)
1244  or a date. =gitbayd admin audit= takes the same flags and =--json=. #73
1245- =dashboard= carries a =queues= block for admins: per worker —
1246  webhooks, mail, mirrors, builds, dependency checks — the pending,
1247  retrying and dead-lettered counts, the oldest pending age, and the
1248  retrying or failed rows themselves, capped at twenty each. The mail
1249  queue was readable nowhere before. =/admin= renders the block by
1250  dispatching =dashboard=; non-admins get a 404 and no rail link. #74
1251- =gitbayd admin config show= prints the configuration in effect as
1252  TOML, defaults filled in and =smtp_pass= redacted, so a support
1253  question starts from what runs rather than what was written. #81
1254- Build badges are served as PNG at =badge/build.png= as well as SVG,
1255  for places that will not render SVG.
1256- Host monitoring writes its reading to journald on every run and exits
1257  non-zero on an alert, so an unset webhook no longer looks like a
1258  healthy host; it reads the ACME cache where it actually lives and
1259  reports the soonest expiry. govulncheck runs as its own CI job. The
1260  database is snapshotted hourly by =gitbay-db-backup.timer=, keeping 48,
1261  alongside the nightly full archive; archives inherit the database's
1262  mode rather than the umask default. #28
1263- A runner whose log stream drops no longer fails the build it was
1264  recording. #67
1265- =go.yaml.in/yaml/v3= and =golang.org/x/net= bumped. #60
1266
1267Replace the binary and restart. No migration. The =gitbay-db-backup=
1268timer and the monitor changes ship in =deploy/cloud-init.yaml= for new
1269hosts; an existing host takes them from there by hand.
1270
1271* v1.3.0 — 2026-08-31
1272
1273A runner took every repository's work, which decided where you could run
1274one.
1275
1276- =runner next= takes optional =owner/name= arguments and =gitbay-runner=
1277  takes =-repos=, so a runner claims builds only for the repositories it
1278  names. Naming none is the old behaviour, so an existing runner is
1279  unaffected. This is what makes a runner outside the server practical: one
1280  on a machine that should build a single project no longer picks up a
1281  build belonging to someone else, which with open registration need not be
1282  anyone the operator knows. The scoping is what the runner asks for rather
1283  than an ACL the server holds over it — a runner account is admin by
1284  necessity, so the boundary is the operator choosing how to start it. #66
1285
1286Replace the binary and restart. Runners want the new binary too, though an
1287old one keeps working unscoped.
1288
1289* v1.2.1 — 2026-08-31
1290
1291Merging landed commits without running anything.
1292
1293- A merge moves the target ref with a direct ref update, so it never
1294  reached post-receive and none of the ref-update work fired: no =push=
1295  event for webhooks to subscribe to, and no builds. Pushing a commit to a
1296  branch ran the whole =.gitbay/ci.yml=; merging the identical commit ran
1297  nothing. Both now happen in the merge path, with the build queueing
1298  shared between it and post-receive rather than living in one of them.
1299  #65
1300
1301Replace the binary and restart.
1302
1303* v1.2.0 — 2026-08-31
1304
1305A merge request said what its state was and almost nothing about when it
1306got there. It now keeps time.
1307
1308- Reviews and checks carry the moment they last said something, on the
1309  merge request page and in =mr show=. A =ci/<job>= check also reports how
1310  long its build ran, so the timing of a run is readable without opening
1311  it. Checks posted through =status set= have no build and report only the
1312  time. !137
1313- A merged or closed merge request names who resolved it and when. The
1314  header stated "X wants to merge" whatever the state; it now says "X
1315  merged A into main on <date>", or "closed this without merging", and
1316  drops the claim entirely for a row that carries no stamp rather than
1317  inventing a time.
1318- =mr show= gains =merged_at=/=merged_by= and =closed_at=/=closed_by=, a
1319  =created_at= per review, and =updated_at= plus =duration= per check, in
1320  both JSON and text. Additive: nothing existing changed shape.
1321- The iOS client renders all of it as of krz/gitbay-ios!37.
1322
1323Replace the binary and restart. Migration 0029 adds four columns to
1324=merge_requests= and backfills the merge stamp for merge requests already
1325merged, reading the =mr.merged= events. A merge with no such event to read
1326— an import, or a row older than its events — keeps no stamp, and every
1327surface says nothing about when it happened rather than guessing.
1328
1329* v1.1.0 — 2026-08-31
1330
1331Every release until now answered questions. This one notices something
1332on its own: that a repository's dependencies have moved, and says so
1333without being asked.
1334
1335- Dependency update checks, opt-in per repository. A daemon worker reads
1336  the manifests on the default branch, asks the ecosystem's registry what
1337  the current release is, and maintains one issue per repository — opened
1338  when something falls behind, rewritten when the set changes, closed once
1339  nothing is behind. No package manager runs, so it needs no CI runner and
1340  no configuration beyond turning it on. #58
1341  - =go.mod= against proxy.golang.org, =package.json= with
1342    =package-lock.json= against npm, =Cargo.toml= with =Cargo.lock=
1343    against crates.io, =requirements.txt= and =pyproject.toml= against
1344    PyPI. A lockfile wins where both exist. A requirement naming a set
1345    rather than a release — a range, a wildcard, a git or path source — is
1346    skipped, since a range that already admits the newest release is not
1347    news.
1348  - =repo deps enable|disable|status=, a toggle on the repository settings
1349    page, and the same three over the JSON API.
1350  - Off by default, because checking a private repository tells a public
1351    registry what it depends on. That is the owner's disclosure to make.
1352    =[deps] check_interval_hours= sets the cadence, default 24.
1353  - The issue is authored by a =gitbay-bot= account, so the existing
1354    notification mail reaches the repository's owner rather than excluding
1355    them as the actor. Its table is padded to its columns, which a
1356    renderer ignores and a mail client needs. #61
1357- =help= takes a prefix — =help mr= narrows the registry to one noun — and
1358  every command now documents its arguments, so the server answers "what
1359  are the flags" instead of being guessed at. #57
1360- Web: settings rows end in one column of controls, checkboxes drawn at
1361  the height of the inputs and buttons they sit beside #59; an added line
1362  keeps its leading dash in the diff; a contributor's several verified
1363  addresses collapse to one row #56.
1364
1365Replace the binary and restart. Migration 0028 adds two tables and, when
1366the name is free, the =gitbay-bot= account. An instance already using that
1367name for a user or an org keeps what it has: the account is not created,
1368and dependency checks report that as the reason they cannot open an issue
1369rather than the migration failing and the daemon not starting. #64
1370
1371* v1.0.1 — 2026-08-30
1372
1373Two CI fixes found by running orgo's release pipeline on this instance.
1374
1375- A runner killed between claiming a build and reporting it left the build
1376  =running= forever, and the commit's =ci/<job>= status pending with it.
1377  =runner next= now fails builds past a 90-minute deadline — longer than the
1378  runner's own =-timeout= — and resolves their commit status. #53
1379- =gitbay keys add= and =gitbay repo deploy-key add= take stdin as a bare
1380  =< key.pub=, but only forwarded it when =--file -= appeared in the
1381  arguments, so both sent an empty body and rejected input the SSH API
1382  accepts. #55
1383
1384Replace the binary and restart.
1385
1386* v1.0.0 — 2026-08-26
1387
1388The web finishes the job #35 set it: reading, reviewing and responding,
1389with the CLI still the complete interface. Every capability exists over
1390SSH, every web write dispatches the same control command, and anything
1391whose input is a credential stays on the command line. The [[https://gitbay.org/krz/gitbay/wiki/Parity][Parity]] page in
1392the wiki is the maintained matrix and says which rows are deliberately
1393CLI-only.
1394
1395- Diff view: one foldable section per file with line-number gutters,
1396  per-file stats, rename and binary handling, and syntax highlighting
1397  run per hunk per side so multi-line constructs lex as real code.
1398  Commit and merge request pages share it; review threads anchor
1399  inline.
1400- Repository facts on the code page: commit, branch and tag counts,
1401  detected license, latest release, build status, a language census by
1402  tracked bytes, and contributors resolved to accounts by verified
1403  email. All derived from git at render time.
1404- Account settings on the web: SSH keys with scope, OpenPGP keys, and
1405  email addresses. Public keys are the only credential-shaped input the
1406  web accepts — they are not secret, and a new user needs one
1407  registered before the CLI is reachable to them. Token minting and
1408  account export stay SSH-only.
1409- Organizations are run from their page: membership and roles, teams,
1410  team members, and team repository grants, for org admins.
1411- Commit log shows each commit's combined check status and gains a path
1412  filter, so per-file history is reachable without editing the URL.
1413- Issue references from commit messages read "referenced in commit
1414  <sha> by <author>", linking the author when their email is verified
1415  here.
1416- The rail's focus ring uses the shell's own mark: the light scheme's
1417  accent was a dark blue ring on a black rail.
1418
1419No migrations. No new config.
1420
1421Upgrading from v0.5.0 is replace-the-binary-and-restart.
1422
1423* v0.5.0 — 2026-08-26
1424
1425A design pass and a parity pass. The web stops being a read-only
1426mirror of the CLI without becoming the place you are expected to work.
1427
1428- New design: a black shell with a persistent left rail carrying
1429  cross-repo state (pinned repos, review queue), the repo header
1430  rendered identically on every tab so navigation never moves, sharp
1431  lines, self-hosted IBM Plex, and code blocks that read against both
1432  color schemes. Tree listings sort directories first and carry each
1433  file's last commit; diffs, inputs and controls were reworked to
1434  match.
1435- Web parity with the CLI, dispatched through the same command
1436  registry the CLI and JSON API use — every web write is the
1437  equivalent =gitbay= command with =--source web=:
1438  - merge requests: review, resolve threads, merge, close, and open a
1439    new MR from the browser
1440  - issues: state, labels, assignees, milestones
1441  - repositories: settings, branch protection, visibility
1442  - releases: create and edit; builds: trigger a job
1443  Commands marked SSH-only still refuse over the web: build secrets,
1444  mirror tokens, domain claims, token minting, deletion and transfer.
1445- A dashboard that answers "what needs me": review queue, assigned
1446  issues, pinned repos, and an activity feed. Author names resolve to
1447  accounts and link to profiles wherever commits appear.
1448- Build status badges at =/{owner}/{repo}/badge/build.svg= for public
1449  repos.
1450- =[web] title= sets the instance's display name, separate from the
1451  hostname commands are pasted with.
1452- =make build/test/deploy= targets.
1453- Fixes: the mobile tab strip scrolls sideways only, long commit
1454  subjects no longer overflow on narrow screens, the shell fills the
1455  viewport with the line-length cap moved onto prose, and the account
1456  cell lines up with the page footer.
1457
1458No migrations. New config: =[web] title=.
1459
1460* v0.4.0 — 2026-08-25
1461
1462- Git LFS: standard clients work over both transports.
1463  =git-lfs-authenticate= joins the SSH dispatcher (deploy keys
1464  included; download needs read, upload write), minting stateless
1465  repo- and operation-scoped tokens for the batch API and basic
1466  transfers. Anonymous HTTPS downloads for public repos; uploads
1467  verified against size and sha256 before landing. Storage is
1468  content-addressed under =[lfs] root= behind a small interface an
1469  S3-compatible backend can drop into; =[lfs] max_object_bytes= caps
1470  objects (512MB default).
1471- Build failures mail the repo's notify targets with the log tail and
1472  build link — failed scheduled jobs reach an inbox.
1473- =release edit= updates a release's title and notes (absent flags
1474  keep their field); omaha-style CI note rebuilds work again.
1475- Syntax highlighting follows the color scheme: class-based chroma
1476  with light and dark palettes, the light-pinned code background is
1477  gone, and markdown fences and org src blocks highlight too. The UGC
1478  sanitizer admits only chroma's token-code classes.
1479
1480No migrations. New config: =[lfs] root=, =[lfs] max_object_bytes=.
1481
1482* v0.3.0 — 2026-08-25
1483
1484- CI: =.gitbay/ci.yml= jobs run as builds claimed by =gitbay-runner=
1485  over SSH (admin-only runner protocol; statuses feed =require-checks=).
1486  Per-repo secrets set over stdin and injected into build environments;
1487  cron schedules (server-local time) and tag-glob triggers, mutually
1488  exclusive per job; =build list/show/log/trigger= and a builds tab.
1489- Pages: public repos' =pages= branches served on =<owner>.<domain>=
1490  (=[pages] domain=), custom domains with DNS TXT ownership challenges
1491  and 7-day expiry for pending claims, per-subdomain on-demand ACME.
1492- Wikis (=.wiki= companion repos, access mirrors the parent) and teams
1493  within orgs (members-role scoping, per-repo team grants).
1494- Activity graphs on user and org pages, backfillable
1495  (=admin backfill-activity=); commits attributed by verified author
1496  email, deduped by sha.
1497- MR pages list the commits the MR carries; =mr show= gains a commits
1498  section.
1499- Per-file history: =?path== on the web log, =--path= on =repo log=,
1500  history link on blob pages.
1501- Mirror status surfaced in =repo show= and the repo header
1502  (admin-only), with sync errors visible; tag-only pushes now schedule
1503  mirror syncs.
1504- Rendering: GFM tables/strikethrough/autolinks/task lists, blob image
1505  previews, raw serves images with real content types (README images
1506  render under nosniff), 0BSD license recognition, repo website links,
1507  compact dashboard pins.
1508- =admin user delete= for accounts that anchor nothing, with named
1509  blockers otherwise.
1510- Fixes: wiki pages no longer overflow on mobile (iOS font-inflation
1511  trigger), GHSA-free deps, secret values pipe correctly through the
1512  CLI.
1513
1514Migrations 0020-0025 apply on start. New config: =[pages] domain=.
1515The runner is a new binary (=gitbay-runner=); see the wiki's Admin
1516guide for setup. Stress-tested against an import of git.git (82k
1517commits): see the wiki's Performance page.
1518
1519* v0.2.0 — 2026-08-24
1520
1521- Deploy keys: repo-bound CI keys (=repo deploy-key=), ro/rw, rename- and
1522  transfer-proof.
1523- Commit statuses (=status set/list=), combined state on MR pages, and a
1524  =require-checks= merge gate.
1525- Email notifications for issue and MR activity (participants with
1526  verified addresses; never the actor).
1527- Inline review threads on MR diffs (=mr diff-comment/threads/resolve=),
1528  stale on force-push, =require-resolved= merge gate.
1529- Required approvals with CODEOWNERS (=require-approvals=; latest review
1530  wins, author excluded) and a =require-resolved= gate; merge gate order
1531  is checks → approvals → CODEOWNERS → resolved threads → signatures.
1532- Web design revamp: token-based stylesheet (light+dark), wordmark and
1533  favicon, aligned layout grid, card-based listings, designed 404,
1534  mobile pass.
1535- Cross-references and mentions: =#N=, =!N=, =owner/name#N=, =@user=
1536  autolink in issue/MR text, viewer-aware for private repos.
1537- Archived repositories (read-only with badge) and repo topics.
1538- Blame view with signature-aware attribution and 1000-line pages.
1539- Repository search (name/description/topic) and per-repo code search
1540  (=repo grep=, web search tab); blob line anchors.
1541- Homepage: dashboard for logged-in users (pinned repos via =repo pin=,
1542  open MRs and issues involving you), landing page for visitors, full
1543  public listing at =/explore=; MR diffs collapsed by default.
1544- Milestones (=milestone create/list/close=, =issue/mr milestone=) with
1545  web progress; issue templates from =.gitbay/issue-template*.md=
1546  (CLI =$EDITOR= prefill and web form).
1547- Issue actions from commit messages landing on the default branch:
1548  =closes/fixes/resolves #N= closes, bare =#N= leaves a reference
1549  comment; once per issue+commit.
1550- Vanity Go imports: =[go_import]= config serves go-import meta tags, so
1551  =go install gitbay.org/gitbay/cmd/...@latest= works.
1552- Release script: =deploy/release.sh <tag>= builds reproducible
1553  linux/amd64, linux/arm64, and darwin/arm64 binaries with SHA256SUMS.
1554- Repository maintenance: =admin gc= (repack/prune, per-repo sizes),
1555  =admin stats= (counts + disk usage), weekly =gitbay-gc.timer=.
1556- Releases: tag-anchored notes and binary assets (=release= commands,
1557  assets over SSH stdin/stdout, web releases tab with downloads).
1558- GitHub history import: =repo import-issues= brings issues and PRs
1559  (as merged/closed MRs) with comments, labels, and state, attributed
1560  inline and resumable.
1561- Push and pull mirroring (=repo mirror=): background sync, read-only
1562  pull mirrors, per-mirror status; credentials server-side, SSRF-guarded.
1563- Web signup at =/register= for open and invite instances.
1564- Audit log (=audit=, =gitbayd admin audit=): every mutating command
1565  with source key fingerprint, registrations, force-pushes, auth
1566  failures. Hardening: per-IP auth-failure throttling
1567  (=ssh_auth_rate=), =max_pack_bytes= enforced, =admin user
1568  disable/enable=.
1569- Account migration: =gitbay migrate --from <host>= (bundle
1570  export/replay + client-side git mirror); =gitbay auth export= as a
1571  user-level backup.
1572- Editable issues and MRs (=issue edit=, =mr edit=, web forms).
1573- Commit references appear as system messages with linked shas.
1574- Design: top nav, repo listing rows (topics, license, last updated),
1575  file table headers, README relative-link resolution, branch
1576  dropdown, web pinning, org owner picker, label filters, linked
1577  usernames and commit parents, =/privacy= page, blue accent.
1578
1579Upgrade notes: migrations 0006–0019 apply on start. No config changes
1580required; =[go_import]=, =[mirrors]=, =web.privacy_notice=, and
1581=web.mode = "accounts"= are opt-in.
1582
1583* v0.1.0 — 2026-08-24
1584
1585First tagged release: the complete CLI-first forge. SSH control plane
1586(bare-OpenSSH usable), git over SSH/HTTPS/git-daemon, repos, issues,
1587merge requests (ff/merge/squash/rebase with signature policy), OpenPGP
1588and SSHSIG verification with retroactive re-verification, orgs, repo
1589import, web UI (view-only or accounts mode), registration with invites
1590and SMTP, HTTPS/JSON API with SSH-minted tokens, webhooks, backups,
1591ACME TLS, systemd deployment.