CHANGELOG.org

Until now the instance had one operator surface: root on the host. Every question about the instance itself — who is on it, what is stuck, what a spam repository is doing — needed a shell on port 2222. This release gives an instance admin the same answers over SSH, and one page on the web.

• admin user list pages accounts by username with --state active|pending|disabled|admin, each row carrying its state and last_seen, the newest use of any of its SSH keys or API tokens. admin user show <name> adds the keys with their last use, each address with how it was verified, PGP keys, org roles, owned repository count, API token names and live browser sessions. Both are SSH-only and refused to non-admins, like audit. #69
• admin user promote|demote. The only way to admin was admin user create --admin; an existing account could not be raised and an admin could not step down. Demoting the last admin is refused inside the transaction that counts them. The host-local twin is the recovery path when no admin key is reachable. #70
• Repository overrides for moderation: admin repo list with size and last push, and admin repo archive|unarchive|visibility|delete. Policy still knows nothing about instance admin — a private repository answers not-found to an admin as before — so each override skips the access check explicitly and writes its own admin repo.<action> audit row. #71
• gitbayd admin dispatches into the registry. User create, disable, enable and delete, email verify, invite and stats were reimplemented on the host; they now live in the registry, SSH-only and admin-gated, and the host binary runs them as the host — an admin context with no account behind it, so its audit rows say source: host where a session says the key fingerprint. Invite and stats gain an SSH twin by the same move. backup, gc and the backfills stay host-local. #72
• audit filters: --actor <user> or --actor - for actorless rows, --action <prefix>, and --since as a duration (30m, 24h, 7d) or a date. gitbayd admin audit takes the same flags and --json. #73
• dashboard carries a queues block for admins: per worker — webhooks, mail, mirrors, builds, dependency checks — the pending, retrying and dead-lettered counts, the oldest pending age, and the retrying or failed rows themselves, capped at twenty each. The mail queue was readable nowhere before. /admin renders the block by dispatching dashboard; non-admins get a 404 and no rail link. #74
• gitbayd admin config show prints the configuration in effect as TOML, defaults filled in and smtp_pass redacted, so a support question starts from what runs rather than what was written. #81
• Build badges are served as PNG at badge/build.png as well as SVG, for places that will not render SVG.
• Host monitoring writes its reading to journald on every run and exits non-zero on an alert, so an unset webhook no longer looks like a healthy host; it reads the ACME cache where it actually lives and reports the soonest expiry. govulncheck runs as its own CI job. The database is snapshotted hourly by gitbay-db-backup.timer, keeping 48, alongside the nightly full archive; archives inherit the database's mode rather than the umask default. #28
• A runner whose log stream drops no longer fails the build it was recording. #67
• go.yaml.in/yaml/v3 and golang.org/x/net bumped. #60

Replace the binary and restart. No migration. The gitbay-db-backup timer and the monitor changes ship in deploy/cloud-init.yaml for new hosts; an existing host takes them from there by hand.

A runner took every repository's work, which decided where you could run one.

• runner next takes optional owner/name arguments and gitbay-runner takes -repos, so a runner claims builds only for the repositories it names. Naming none is the old behaviour, so an existing runner is unaffected. This is what makes a runner outside the server practical: one on a machine that should build a single project no longer picks up a build belonging to someone else, which with open registration need not be anyone the operator knows. The scoping is what the runner asks for rather than an ACL the server holds over it — a runner account is admin by necessity, so the boundary is the operator choosing how to start it. #66

Replace the binary and restart. Runners want the new binary too, though an old one keeps working unscoped.

Merging landed commits without running anything.

• A merge moves the target ref with a direct ref update, so it never reached post-receive and none of the ref-update work fired: no push event for webhooks to subscribe to, and no builds. Pushing a commit to a branch ran the whole .gitbay/ci.yml; merging the identical commit ran nothing. Both now happen in the merge path, with the build queueing shared between it and post-receive rather than living in one of them. #65

Replace the binary and restart.

A merge request said what its state was and almost nothing about when it got there. It now keeps time.

• Reviews and checks carry the moment they last said something, on the merge request page and in mr show. A ci/<job> check also reports how long its build ran, so the timing of a run is readable without opening it. Checks posted through status set have no build and report only the time. !137
• A merged or closed merge request names who resolved it and when. The header stated "X wants to merge" whatever the state; it now says "X merged A into main on <date>", or "closed this without merging", and drops the claim entirely for a row that carries no stamp rather than inventing a time.
• mr show gains merged_at=/=merged_by and closed_at=/=closed_by, a created_at per review, and updated_at plus duration per check, in both JSON and text. Additive: nothing existing changed shape.
• The iOS client renders all of it as of krz/gitbay-ios!37.

Replace the binary and restart. Migration 0029 adds four columns to merge_requests and backfills the merge stamp for merge requests already merged, reading the mr.merged events. A merge with no such event to read — an import, or a row older than its events — keeps no stamp, and every surface says nothing about when it happened rather than guessing.

Every release until now answered questions. This one notices something on its own: that a repository's dependencies have moved, and says so without being asked.

• Dependency update checks, opt-in per repository. A daemon worker reads the manifests on the default branch, asks the ecosystem's registry what the current release is, and maintains one issue per repository — opened when something falls behind, rewritten when the set changes, closed once nothing is behind. No package manager runs, so it needs no CI runner and no configuration beyond turning it on. #58

  • go.mod against proxy.golang.org, package.json with package-lock.json against npm, Cargo.toml with Cargo.lock against crates.io, requirements.txt and pyproject.toml against PyPI. A lockfile wins where both exist. A requirement naming a set rather than a release — a range, a wildcard, a git or path source — is skipped, since a range that already admits the newest release is not news.
  • repo deps enable|disable|status, a toggle on the repository settings page, and the same three over the JSON API.
  • Off by default, because checking a private repository tells a public registry what it depends on. That is the owner's disclosure to make. [deps] check_interval_hours sets the cadence, default 24.
  • The issue is authored by a gitbay-bot account, so the existing notification mail reaches the repository's owner rather than excluding them as the actor. Its table is padded to its columns, which a renderer ignores and a mail client needs. #61
• help takes a prefix — help mr narrows the registry to one noun — and every command now documents its arguments, so the server answers "what are the flags" instead of being guessed at. #57
• Web: settings rows end in one column of controls, checkboxes drawn at the height of the inputs and buttons they sit beside #59; an added line keeps its leading dash in the diff; a contributor's several verified addresses collapse to one row #56.

Replace the binary and restart. Migration 0028 adds two tables and, when the name is free, the gitbay-bot account. An instance already using that name for a user or an org keeps what it has: the account is not created, and dependency checks report that as the reason they cannot open an issue rather than the migration failing and the daemon not starting. #64

Two CI fixes found by running orgo's release pipeline on this instance.

• A runner killed between claiming a build and reporting it left the build running forever, and the commit's ci/<job> status pending with it. runner next now fails builds past a 90-minute deadline — longer than the runner's own -timeout — and resolves their commit status. #53
• gitbay keys add and gitbay repo deploy-key add take stdin as a bare < key.pub, but only forwarded it when --file - appeared in the arguments, so both sent an empty body and rejected input the SSH API accepts. #55

Replace the binary and restart.

The web finishes the job #35 set it: reading, reviewing and responding, with the CLI still the complete interface. Every capability exists over SSH, every web write dispatches the same control command, and anything whose input is a credential stays on the command line. The Parity page in the wiki is the maintained matrix and says which rows are deliberately CLI-only.

• Diff view: one foldable section per file with line-number gutters, per-file stats, rename and binary handling, and syntax highlighting run per hunk per side so multi-line constructs lex as real code. Commit and merge request pages share it; review threads anchor inline.
• Repository facts on the code page: commit, branch and tag counts, detected license, latest release, build status, a language census by tracked bytes, and contributors resolved to accounts by verified email. All derived from git at render time.
• Account settings on the web: SSH keys with scope, OpenPGP keys, and email addresses. Public keys are the only credential-shaped input the web accepts — they are not secret, and a new user needs one registered before the CLI is reachable to them. Token minting and account export stay SSH-only.
• Organizations are run from their page: membership and roles, teams, team members, and team repository grants, for org admins.
• Commit log shows each commit's combined check status and gains a path filter, so per-file history is reachable without editing the URL.
• Issue references from commit messages read "referenced in commit <sha> by <author>", linking the author when their email is verified here.
• The rail's focus ring uses the shell's own mark: the light scheme's accent was a dark blue ring on a black rail.

No migrations. No new config.

Upgrading from v0.5.0 is replace-the-binary-and-restart.

A design pass and a parity pass. The web stops being a read-only mirror of the CLI without becoming the place you are expected to work.

• New design: a black shell with a persistent left rail carrying cross-repo state (pinned repos, review queue), the repo header rendered identically on every tab so navigation never moves, sharp lines, self-hosted IBM Plex, and code blocks that read against both color schemes. Tree listings sort directories first and carry each file's last commit; diffs, inputs and controls were reworked to match.

• Web parity with the CLI, dispatched through the same command registry the CLI and JSON API use — every web write is the equivalent gitbay command with --source web:

  • merge requests: review, resolve threads, merge, close, and open a new MR from the browser
  • issues: state, labels, assignees, milestones
  • repositories: settings, branch protection, visibility
  • releases: create and edit; builds: trigger a job

  Commands marked SSH-only still refuse over the web: build secrets, mirror tokens, domain claims, token minting, deletion and transfer.

• A dashboard that answers "what needs me": review queue, assigned issues, pinned repos, and an activity feed. Author names resolve to accounts and link to profiles wherever commits appear.
• Build status badges at /{owner}/{repo}/badge/build.svg for public repos.
• [web] title sets the instance's display name, separate from the hostname commands are pasted with.
• make build/test/deploy targets.
• Fixes: the mobile tab strip scrolls sideways only, long commit subjects no longer overflow on narrow screens, the shell fills the viewport with the line-length cap moved onto prose, and the account cell lines up with the page footer.

No migrations. New config: [web] title.

• Git LFS: standard clients work over both transports. git-lfs-authenticate joins the SSH dispatcher (deploy keys included; download needs read, upload write), minting stateless repo- and operation-scoped tokens for the batch API and basic transfers. Anonymous HTTPS downloads for public repos; uploads verified against size and sha256 before landing. Storage is content-addressed under [lfs] root behind a small interface an S3-compatible backend can drop into; [lfs] max_object_bytes caps objects (512MB default).
• Build failures mail the repo's notify targets with the log tail and build link — failed scheduled jobs reach an inbox.
• release edit updates a release's title and notes (absent flags keep their field); omaha-style CI note rebuilds work again.
• Syntax highlighting follows the color scheme: class-based chroma with light and dark palettes, the light-pinned code background is gone, and markdown fences and org src blocks highlight too. The UGC sanitizer admits only chroma's token-code classes.

No migrations. New config: [lfs] root, [lfs] max_object_bytes.

• CI: .gitbay/ci.yml jobs run as builds claimed by gitbay-runner over SSH (admin-only runner protocol; statuses feed require-checks). Per-repo secrets set over stdin and injected into build environments; cron schedules (server-local time) and tag-glob triggers, mutually exclusive per job; build list/show/log/trigger and a builds tab.
• Pages: public repos' pages branches served on <owner>.<domain> ([pages] domain), custom domains with DNS TXT ownership challenges and 7-day expiry for pending claims, per-subdomain on-demand ACME.
• Wikis (.wiki companion repos, access mirrors the parent) and teams within orgs (members-role scoping, per-repo team grants).
• Activity graphs on user and org pages, backfillable (admin backfill-activity); commits attributed by verified author email, deduped by sha.
• MR pages list the commits the MR carries; mr show gains a commits section.
• Per-file history: ?path= on the web log, --path on repo log, history link on blob pages.
• Mirror status surfaced in repo show and the repo header (admin-only), with sync errors visible; tag-only pushes now schedule mirror syncs.
• Rendering: GFM tables/strikethrough/autolinks/task lists, blob image previews, raw serves images with real content types (README images render under nosniff), 0BSD license recognition, repo website links, compact dashboard pins.
• admin user delete for accounts that anchor nothing, with named blockers otherwise.
• Fixes: wiki pages no longer overflow on mobile (iOS font-inflation trigger), GHSA-free deps, secret values pipe correctly through the CLI.

Migrations 0020-0025 apply on start. New config: [pages] domain. The runner is a new binary (gitbay-runner); see the wiki's Admin guide for setup. Stress-tested against an import of git.git (82k commits): see the wiki's Performance page.

• Deploy keys: repo-bound CI keys (repo deploy-key), ro/rw, rename- and transfer-proof.
• Commit statuses (status set/list), combined state on MR pages, and a require-checks merge gate.
• Email notifications for issue and MR activity (participants with verified addresses; never the actor).
• Inline review threads on MR diffs (mr diff-comment/threads/resolve), stale on force-push, require-resolved merge gate.
• Required approvals with CODEOWNERS (require-approvals; latest review wins, author excluded) and a require-resolved gate; merge gate order is checks → approvals → CODEOWNERS → resolved threads → signatures.
• Web design revamp: token-based stylesheet (light+dark), wordmark and favicon, aligned layout grid, card-based listings, designed 404, mobile pass.
• Cross-references and mentions: #N, !N, owner/name#N, @user autolink in issue/MR text, viewer-aware for private repos.
• Archived repositories (read-only with badge) and repo topics.
• Blame view with signature-aware attribution and 1000-line pages.
• Repository search (name/description/topic) and per-repo code search (repo grep, web search tab); blob line anchors.
• Homepage: dashboard for logged-in users (pinned repos via repo pin, open MRs and issues involving you), landing page for visitors, full public listing at /explore; MR diffs collapsed by default.
• Milestones (milestone create/list/close, issue/mr milestone) with web progress; issue templates from .gitbay/issue-template*.md (CLI $EDITOR prefill and web form).
• Issue actions from commit messages landing on the default branch: closes/fixes/resolves #N closes, bare #N leaves a reference comment; once per issue+commit.
• Vanity Go imports: [go_import] config serves go-import meta tags, so go install gitbay.org/gitbay/cmd/...@latest works.
• Release script: deploy/release.sh <tag> builds reproducible linux/amd64, linux/arm64, and darwin/arm64 binaries with SHA256SUMS.
• Repository maintenance: admin gc (repack/prune, per-repo sizes), admin stats (counts + disk usage), weekly gitbay-gc.timer.
• Releases: tag-anchored notes and binary assets (release commands, assets over SSH stdin/stdout, web releases tab with downloads).
• GitHub history import: repo import-issues brings issues and PRs (as merged/closed MRs) with comments, labels, and state, attributed inline and resumable.
• Push and pull mirroring (repo mirror): background sync, read-only pull mirrors, per-mirror status; credentials server-side, SSRF-guarded.
• Web signup at /register for open and invite instances.
• Audit log (audit, gitbayd admin audit): every mutating command with source key fingerprint, registrations, force-pushes, auth failures. Hardening: per-IP auth-failure throttling (ssh_auth_rate), max_pack_bytes enforced, admin user disable/enable.
• Account migration: gitbay migrate --from <host> (bundle export/replay + client-side git mirror); gitbay auth export as a user-level backup.
• Editable issues and MRs (issue edit, mr edit, web forms).
• Commit references appear as system messages with linked shas.
• Design: top nav, repo listing rows (topics, license, last updated), file table headers, README relative-link resolution, branch dropdown, web pinning, org owner picker, label filters, linked usernames and commit parents, /privacy page, blue accent.

Upgrade notes: migrations 0006–0019 apply on start. No config changes required; [go_import], [mirrors], web.privacy_notice, and web.mode = "accounts" are opt-in.

First tagged release: the complete CLI-first forge. SSH control plane (bare-OpenSSH usable), git over SSH/HTTPS/git-daemon, repos, issues, merge requests (ff/merge/squash/rebase with signature policy), OpenPGP and SSHSIG verification with retroactive re-verification, orgs, repo import, web UI (view-only or accounts mode), registration with invites and SMTP, HTTPS/JSON API with SSH-minted tokens, webhooks, backups, ACME TLS, systemd deployment.