CHANGELOG: v1.18.0 !368
1 file changed, +61 −0
Layout: unified · split
CHANGELOG.org +61
| @@ -4,6 +4,67 @@ Versioning follows semver from v0.1.0. Database migrations run | |||
| 4 | automatically on daemon start; upgrade notes appear per release when | 4 | automatically on daemon start; upgrade notes appear per release when |
| 5 | anything beyond "replace the binary and restart" is needed. | 5 | anything beyond "replace the binary and restart" is needed. |
| 6 | 6 | ||
| 7 | * v1.18.0 — 2026-09-10 | ||
| 8 | |||
| 9 | What the first real job on a user's runner needed. A twice-daily | ||
| 10 | archive pull that had run on the server's host moved into a container | ||
| 11 | and then onto a laptop, and each hop found a gap. | ||
| 12 | |||
| 13 | ** CI runner | ||
| 14 | |||
| 15 | - A secret with newlines — a private key — reaches the build. An env | ||
| 16 | file has no escape for one, so such values are named on podman's | ||
| 17 | command line with =--env NAME= and valued in the podman process's own | ||
| 18 | environment; the value touches neither argv nor the file. | ||
| 19 | - =GITBAY_SSH= in every build's environment: the instance's ssh | ||
| 20 | destination as the build reaches it. Under podman the host's own | ||
| 21 | addresses belong to the container (pasta), so a loopback remote is | ||
| 22 | rewritten to the address pasta exposes the host at. A job that | ||
| 23 | publishes back to the instance uses the variable rather than | ||
| 24 | guessing. Inside a container =ssh= expands =~= from the passwd entry, | ||
| 25 | not =$HOME=; keep a build's ssh config in the workspace and pass =-F=. | ||
| 26 | - =-identity= drops the user's =~/.ssh/config= (=-F /dev/null=): | ||
| 27 | =IdentitiesOnly= kept identities the config named, so a laptop runner | ||
| 28 | authenticated as the user's own full-scope key and, on an admin's | ||
| 29 | machine, could claim every repository's builds. A first-seen host key | ||
| 30 | is accepted, since a service cannot answer a prompt. | ||
| 31 | - A schedule tick queues nothing while the job's last build is pending | ||
| 32 | or running, matching the push path. A repository no runner served | ||
| 33 | gained one row per tick forever. A finished build does not suppress | ||
| 34 | the tick; a schedule re-runs an unchanged commit on purpose. #206 | ||
| 35 | - =admin runners forget <fingerprint>= drops a key's heartbeat row; the | ||
| 36 | key stays. =admin runners= rows are the repositories a key may claim. | ||
| 37 | - The bay1 unit names no =-repos=: the runner key's attachments are the | ||
| 38 | boundary. =gitbay-ci:2= carries =python3-venv= and =sqlite3=, since | ||
| 39 | it is also the default image for every repository the runner is | ||
| 40 | attached to. | ||
| 41 | |||
| 42 | ** Decisions | ||
| 43 | |||
| 44 | - Claim order stays oldest-first across everything a key may claim; a | ||
| 45 | repository that must never wait on another gets a runner of its own. | ||
| 46 | #207 | ||
| 47 | - No per-account cap on queued builds and no schedule floor: with the | ||
| 48 | tick dedupe a repository with no runner holds one row per scheduled | ||
| 49 | job, and a busy schedule spends its owner's compute. #206 | ||
| 50 | - Attaching a runner is =n/a= on iOS: the key lives on the machine that | ||
| 51 | runs builds. | ||
| 52 | |||
| 53 | ** Documentation | ||
| 54 | |||
| 55 | - Users: =GITBAY_SSH=, ssh's home inside a container, the =ci.yml= caps | ||
| 56 | (ten jobs, fifty steps, 4096 bytes a step, 64 KiB a file) and where a | ||
| 57 | broken config shows up. Admin, CI and Threat-Model follow the changes | ||
| 58 | above. | ||
| 59 | |||
| 60 | ** Upgrading | ||
| 61 | |||
| 62 | Replace the binaries and reinstall the CLI. No migration. A runner | ||
| 63 | started with =-identity= (every runner =gitbay-runner init= set up) now | ||
| 64 | ignores =~/.ssh/config=; a runner that relied on it for a =ProxyJump= | ||
| 65 | or an alias passes the equivalent in =-ssh-opts=. Homebrew: | ||
| 66 | =brew upgrade krz/tap/gitbay-runner=. | ||
| 67 | |||
| 7 | * v1.17.0 — 2026-09-09 | 68 | * v1.17.0 — 2026-09-09 |
| 8 | 69 | ||
| 9 | CI without the operator's compute: a runner anyone installs and | 70 | CI without the operator's compute: a runner anyone installs and |