Releases

A CLI-first git forge. SSH is the API: your key is your identity, every capability exists over stock OpenSSH with no client installed, and the web dispatches the same control commands rather than reimplementing them.

What v1 means here: repo hosting, issues, and merge requests, plus signature verification with six distinct states, protected branches, orgs and teams, forks, mirroring, imports, CI/CD, static pages, LFS, releases, wikis, webhooks, a JSON API, and backups — all end-to-end tested against real git, ssh, sshd and gpg, and running in production at gitbay.org.

This release completes the web: a proper diff view shared by commit and MR pages, repository facts, account settings, organization management, check status on the log. The Parity page in the wiki is the maintained capability matrix and states which rows stay CLI-only by design — anything whose input is a credential.

No migrations, no new config. Upgrading from v0.5.0 is replace-the-binary-and-restart. Binaries are reproducible; verify with SHA256SUMS.

A design pass and a parity pass.

New design: a black shell with a persistent left rail carrying cross-repo state, the repo header rendered identically on every tab, sharp lines, self-hosted IBM Plex, and code blocks readable in both color schemes.

Web parity with the CLI, dispatched through the same command registry the CLI and JSON API use: MR review/merge/close and MR creation, issue triage, repository settings and visibility, release create/edit, build trigger. SSH-only commands still refuse over the web — secrets, mirror tokens, domain claims, token minting, deletion and transfer.

Plus a dashboard that answers "what needs me", build status badges for public repos, and [web] title separating the display name from the hostname.

No migrations. New config: [web] title. Binaries are reproducible; verify with SHA256SUMS.

Git LFS over both transports (SSH-minted tokens, anonymous public downloads, sha256-verified uploads, content-addressed storage with an S3-ready interface), build-failure mail with log tails, release edit, and scheme-aware syntax highlighting including markdown and org code blocks. No migrations; new config [lfs] root and [lfs] max_object_bytes. Binaries are reproducible; verify with SHA256SUMS.

CI (.gitbay/ci.yml jobs, gitbay-runner over SSH, secrets, cron, tag triggers), static pages (owner subdomains plus DNS-verified custom domains), wikis, teams, activity graphs, MR commit lists, per-file history, mirror status surfacing, GFM tables and image previews, and admin user delete. Migrations 0020-0025 apply on start; the runner is a new binary — see the Admin guide. Stress-tested against an 82k-commit import of git.git; numbers on the wiki Performance page. Binaries are reproducible (CGO off, trimpath, stripped); verify with SHA256SUMS.

Phases 1-3 complete. Collaboration: deploy keys, commit statuses with require-checks, email notifications, inline review threads, required approvals with CODEOWNERS. Product: design system with top nav and blue accent, repo/code search, blame, dashboard with pinned repos, milestones and issue templates, releases with hosted assets, editable issues/MRs, commit-message issue actions as linked system messages. Adoption: go-install vanity imports, reproducible release builds, admin gc/stats with a weekly timer, GitHub issue/PR history import, push/pull mirroring, web signup, audit logging with auth throttling and user disable, and account migration between instances. Migrations 0006-0019 apply on start; [go_import], [mirrors], web.privacy_notice, and accounts mode are opt-in. Binaries are reproducible (CGO off, trimpath, stripped); verify with SHA256SUMS.

First tagged release: the complete CLI-first forge. SSH control plane usable from bare OpenSSH, git over SSH/HTTPS/git-daemon, repos, issues, merge requests with signature policy, OpenPGP and SSHSIG verification, orgs, repo import, web UI, invites and SMTP, JSON API, webhooks, backups, ACME TLS. Binaries are reproducible: CGO off, trimpath, stripped (see SHA256SUMS).