Skip to content

v0.0.13-rc

Pre-release
Pre-release

Choose a tag to compare

View all tags
@AndrewGrachov AndrewGrachov released this 29 Oct 23:14
· 75 commits to main since this release
v0.0.13-rc
72ab661
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release candidate for v0.0.13.

Highlights

  • Managed connections. A principal/grant model with personal defaults and per-task execution bindings (BEL-59). A shared outbound OAuth lifecycle with grant lineage and recovery (BEL-138). A lease-authenticated credential broker for runners (BEL-60).
  • Jira Cloud OAuth. Personal Jira connections through Atlassian 3LO, with read and explicit write consent. A runner Jira helper with comment receipts that never post twice. A Workspace Jira panel. The API-token Jira proxy is removed (BEL-61).
  • Env secrets. Secrets are written encrypted through the secret store, and a one-shot conversion handles the plaintext rows that remain (BEL-149).
  • Commerce groundwork. Plan push and execution-usage reporting, off by default (BEL-146, BEL-163).

Fixes

  • Job store lock order:
    • BEL-157 / BEL-81: the claim try-locks the thread lock, and retry never row-locks a live row.
    • BEL-161: thread writers lock the root row first.
  • BEL-160: a leftover pod stuck Terminating hands the claim back as blocked.
  • The claude runner pins auto permission mode (#1107). The runner git guard is lifted (#1109).
  • BEL-122: the gates skill drops a stale curl requirement.

Upgrade notes

  • Migrations 094–100 are expand-only, except 100. It disconnects every legacy API-token Jira connection and scrubs its token. Queued tasks bound to such a connection wait for their user to connect Jira through OAuth and bind it.
  • Jira OAuth needs an Atlassian 3LO app. The steps are in docs/jira-app-runbook.md. Configure it with integrations.jira.clientId and secret.atlassianClientSecret (ATLASSIAN_CLIENT_ID / ATLASSIAN_CLIENT_SECRET). While those are unset, starting a Jira connection answers INTEGRATION_NOT_CONFIGURED.
  • After the rollout completes, run the env-secret conversion once, and rerun it until it exits 0: kubectl exec deploy/<release>-factory -c dashboard -- node server/dist/secrets/convert-env-cli.js. Oversized rows are listed and must be re-entered.
  • New optional chart values: dashboard.commerce.{enabled,url}, secret.commerceToken, integrations.jira.clientId and secret.atlassianClientSecret.

Validation

  • On the merged heads: npm test, test:db, typecheck, lint:changed and verify:ui (106).
  • test:jobs --changed: one known failure, BEL-166.
  • Kind test:k8s --cluster, per PR: BEL-138 632/0 and BEL-60 632/0. BEL-61 637/1: a chart-render check that passed on its own; the check is now instrumented.
  • Migration upgrade path: a v0.0.12 seed with legacy Jira connections, bindings and a secret env var applies 094–100 with every row kept.

Known limits

  • BEL-164: the authorization deadline and the lineage claim lease are not yet unified.
  • BEL-166: the opencode image check still asserts the git denies that #1109 lifted.
  • BEL-140/141: there is no blocking connect interaction yet. A waiting task is unblocked through the bind route.
  • BEL-169: the Atlassian remote MCP investigation.
Assets 2
Loading