Skip to content

0.6.0

Choose a tag to compare

View all tags
@cursor cursor released this 23 Sep 14:21
· 186 commits to development since this release
v0.6.0
f03918b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.6.0 — First-run fixes after 0.5.0

23 September 2026. Minor on 0.5.0.

Upgrade if a command checked the wrong directory, hid what --json already showed, or crashed on a repository that was not finished yet. A few JSON fields and exit results change, so read Changed before upgrading a pipeline.

Install

pip install opentide==0.6.0
export OPENTIDE_REPO_ROOT=/path/to/detection-repo
opentide validate --strict

If you generated CI with opentide setup ci, regenerate it so --default-branch matches the branch you deploy from: opentide setup ci <github|gitlab|azure> --yes.

Changed

  • validate --json names the directory it read under workspace. A full run that finds no objects still exits 0, and its message names that directory (#294).
  • setup mcp --generic returns its copy-the-file instruction as advice instead of note (#292).
  • SDK: the registry index has a file_paths map. ValidationScope.path_basenames is removed; a path target matches only the object's own file (#297).
  • An unset Splunk frequency_scheduling keeps the mode it deployed with before: current for a legacy [setup] table, random for a [[tenants]] entry (#295).

Fixed

  • Commands find a detection workspace from .opentide/ or objects/, including one nested in a larger git checkout. validate --strict no longer passes having checked nothing (#294).
  • validate --file matches that path only. Issues name the object's own file, and rule.file points at it (#297).
  • Human output keeps bracketed text ([deploy, validate], [error], opentide[sentinel]), prints advice and detail, lists lint findings, and info rules / threats / objectives / coverage print the section you asked for (#292, #293).
  • rule.metadata.schema returns "rule::1.0", not Pydantic's BaseModel.schema (#298).
  • generate docs writes an actor's stage as att&ck, not ('att&ck',) (#296).
  • info no longer logs a Splunk frequency warning for a repository that does not use Splunk (#295).
  • deploy in a repository without objects/rules/ reports skipped (exit 0) instead of Errno 2. Rule files in subfolders are still not deployed; the plan names them in a warning (#300, #312).
  • An enabled platform with no [[tenants]] entry fails deploy and validate query --live with the file to edit, before any engine loads. --dry-run previews payloads and warns (#314).
  • setup --ci accepts --default-branch and prints the same warnings as setup ci (#288, #308).
  • --no-promotion and --promotion-target write [promotion] in .opentide/configurations/deployment.toml. Omitting them keeps the repository's setting; an explicit flag that disagrees with an existing table exits 2 (#307).
  • Documented CLI samples for deploy, troubleshooting, and the tutorial match what the commands print (#299).
  • vocab-upstream.yml parses again, so the vocabulary drift gate runs (#287). publish-pypi.yml can be retried after a PyPI 5xx without uploading a file twice (#289).

Tests

Each fix has a regression for the reported case and a guard for the class: human output against --json, workspace discovery from subdirectories, --file against same-basename twins, documented output samples run as the CLI, and a tenantless scaffold for every platform.

Verify

python -c "import opentide; print(opentide.__version__)"
opentide setup --yes --name "Tutorial Detections" --org "Example Corp" --platform sentinel --path /tmp/tutorial-detections
opentide --repo /tmp/tutorial-detections validate --strict

Expect 0.6.0.

Links

License: EUPL-1.2. Issues: OpenTideHQ/opentide.

Assets 2
Loading