Commit e91fdfe0cc
Verified · cmc ci/build: success ci/test: success
CHANGELOG.org +61
| @@ -4,6 +4,67 @@ Versioning follows semver from v0.1.0. Database migrations run | ||
| 4 | 4 | automatically on daemon start; upgrade notes appear per release when |
| 5 | 5 | anything beyond "replace the binary and restart" is needed. |
| 6 | 6 | |
| 7 | * v1.18.0 — 2026-09-10 | |
| 8 | ||
| 9 | What the first real job on a user's runner needed. A twice-daily | |
| 10 | archive pull that had run on the server's host moved into a container | |
| 11 | and then onto a laptop, and each hop found a gap. | |
| 12 | ||
| 13 | ** CI runner | |
| 14 | ||
| 15 | - A secret with newlines — a private key — reaches the build. An env | |
| 16 | file has no escape for one, so such values are named on podman's | |
| 17 | command line with =--env NAME= and valued in the podman process's own | |
| 18 | environment; the value touches neither argv nor the file. | |
| 19 | - =GITBAY_SSH= in every build's environment: the instance's ssh | |
| 20 | destination as the build reaches it. Under podman the host's own | |
| 21 | addresses belong to the container (pasta), so a loopback remote is | |
| 22 | rewritten to the address pasta exposes the host at. A job that | |
| 23 | publishes back to the instance uses the variable rather than | |
| 24 | guessing. Inside a container =ssh= expands =~= from the passwd entry, | |
| 25 | not =$HOME=; keep a build's ssh config in the workspace and pass =-F=. | |
| 26 | - =-identity= drops the user's =~/.ssh/config= (=-F /dev/null=): | |
| 27 | =IdentitiesOnly= kept identities the config named, so a laptop runner | |
| 28 | authenticated as the user's own full-scope key and, on an admin's | |
| 29 | machine, could claim every repository's builds. A first-seen host key | |
| 30 | is accepted, since a service cannot answer a prompt. | |
| 31 | - A schedule tick queues nothing while the job's last build is pending | |
| 32 | or running, matching the push path. A repository no runner served | |
| 33 | gained one row per tick forever. A finished build does not suppress | |
| 34 | the tick; a schedule re-runs an unchanged commit on purpose. #206 | |
| 35 | - =admin runners forget <fingerprint>= drops a key's heartbeat row; the | |
| 36 | key stays. =admin runners= rows are the repositories a key may claim. | |
| 37 | - The bay1 unit names no =-repos=: the runner key's attachments are the | |
| 38 | boundary. =gitbay-ci:2= carries =python3-venv= and =sqlite3=, since | |
| 39 | it is also the default image for every repository the runner is | |
| 40 | attached to. | |
| 41 | ||
| 42 | ** Decisions | |
| 43 | ||
| 44 | - Claim order stays oldest-first across everything a key may claim; a | |
| 45 | repository that must never wait on another gets a runner of its own. | |
| 46 | #207 | |
| 47 | - No per-account cap on queued builds and no schedule floor: with the | |
| 48 | tick dedupe a repository with no runner holds one row per scheduled | |
| 49 | job, and a busy schedule spends its owner's compute. #206 | |
| 50 | - Attaching a runner is =n/a= on iOS: the key lives on the machine that | |
| 51 | runs builds. | |
| 52 | ||
| 53 | ** Documentation | |
| 54 | ||
| 55 | - Users: =GITBAY_SSH=, ssh's home inside a container, the =ci.yml= caps | |
| 56 | (ten jobs, fifty steps, 4096 bytes a step, 64 KiB a file) and where a | |
| 57 | broken config shows up. Admin, CI and Threat-Model follow the changes | |
| 58 | above. | |
| 59 | ||
| 60 | ** Upgrading | |
| 61 | ||
| 62 | Replace the binaries and reinstall the CLI. No migration. A runner | |
| 63 | started with =-identity= (every runner =gitbay-runner init= set up) now | |
| 64 | ignores =~/.ssh/config=; a runner that relied on it for a =ProxyJump= | |
| 65 | or an alias passes the equivalent in =-ssh-opts=. Homebrew: | |
| 66 | =brew upgrade krz/tap/gitbay-runner=. | |
| 67 | ||
| 7 | 68 | * v1.17.0 — 2026-09-09 |
| 8 | 69 | |
| 9 | 70 | CI without the operator's compute: a runner anyone installs and |