Releases: alethialabs-io/alethialabs
Releases · alethialabs-io/alethialabs
Release list
runner: v0.4.0
0.4.0 (2026-08-12)
Features
- ci: arm the Go coverage ratchet, and revive both badges that have been dead since July (#2001) (fa093c2)
Bug Fixes
- agent: bound the ACR token exchange with its own http client (#2203) (989e3da), closes #2037
- agent: derive the build Job name from the renderer instead of re-deriving it (#2194) (f1f836a), closes #2032
- agent: send the db-authproxy mysql error packet with sequence id 2 (#2208) (fd299a8), closes #2043
- agent: write the tofu plan artifact with utils.WriteSecretFile instead of a world-readable 0644 file (#2209) (84e5ecb), closes #2015
- caches: carry the allowed-CIDR list from the canvas to the deploy (#2155) (f62cfe2)
- console: pick the component lists explicitly, and give the subtree a CI detector before enforcing (#1980) (a8b29de)
- nosql: carry a global table's replica regions from the canvas to the deploy (#2175) (0b548f1), closes #1982
- obs: gate each OTLP signal on its own endpoint instead of OR-ing all three (#2226) (1338b28)
- provisioner: route a namespace-placement teardown away from the full-cluster tofu destroy (#2162) (66a556d)
- runner: AKS token minting worked only for workload identity (#1728) (117680b)
- runner: delete two vacuous deploy-validation tests and give the safety poll a test seam (#2227) (62c4dee)
- runner: derive the runner's own image ref instead of asking an operator for it (#1795) (1cddd19), closes #1787
- runner: fail closed on a config_snapshot key the contract does not model, and stop the DB-row spread that feeds it (#1973) (44bbcf6)
- sandbox: make Passthrough refuse a NoEgress spec instead of silently running it (#2163) (f11a96a), closes #2042
cli: v0.5.0
0.5.0 (2026-08-11)
Features
- ci: arm the Go coverage ratchet, and revive both badges that have been dead since July (#2001) (fa093c2)
- cli:
alethia verify receipt— the signed evidence receipt, from the terminal (#2341) (8f4cb1b) - cli: addon enable / disable — the marketplace becomes scriptable (#2319) (ed13b9a)
- cli: alethia connector hetzner — the one cloud you had to leave the terminal for (#2316) (6f52901)
- cli: alethia runner register — and harden the last route on the raw CLI seam (#2317) (1fbb6ad)
- cli: attach, scan and detach your own charts and IaC from the terminal (#2321) (f81fdb6)
- cli: author components per ENVIRONMENT — and stop a remove destroying the sibling tier (#2309) (7f96ec3)
- cli: placement from the terminal — a two-tier project stops costing two clusters (#2313) (b09c6ac)
Bug Fixes
- alibaba: withdraw the WAF offer — the WAF 3.0 instance is account-scoped and a project cannot own it (#1841) (#1970) (675745e)
- auth: require explicit approval for the CLI device flow, and bound, expire and secure the credential path (#2233) (d05a1c9)
- cli: honour --no-input in confirm() and add an explicit --yes to the destructive commands (#2239) (f5ca7ed)
- cli: measure the coverage gate off the profile, not
go tool cover -func(#2275) (7a7fd4d), closes #1990 - runners: the deploy form offered clouds whose runner templates do not exist (#1817) (b4dae57), closes #1794
- ui: align table headers, neutralise newlines in cells, and stop swallowing write errors (#2224) (4a77a9d)
runner: v0.3.0
0.3.0 (2026-07-30)
Features
- compat: apply-time COMPAT-001 fail-closed gate + compat_result metadata (#1358) (81043d9), closes #1215
- compat: formalize the 7 version couplings against matrix.json (#1214) (#1252) (fd4b5e0)
- connectors: helm_registry keyless OCI ECR — in-cluster token refresh (#1185) (#1303) (409e2b8)
- fabric: activate azure namespace placement — federated-identity per-namespace provisioner (#1408) (7c56870)
- fabric: activate gcp namespace placement — Workload-Identity per-namespace provisioner (#1405) (e43bd0b)
- fabric: activate vcluster placement path + delivery renderer (#1307) (a7de7e5), closes #1231
- fabric: namespace-placement keyless-mint dispatch seam (#1013) (#1138) (5b870e8)
- fabric: per-namespace cloud identity (AWS IRSA) for namespace placement (Closes #957) (#1029) (3cc73a7)
- fabric: runner-injected kube-conn seam + activate gcp & azure vcluster placement (#1392) (03ca029)
- fabric: vcluster provisioner seam — helm-create + exportKubeConfig (#960) (#1239) (c16dc75)
- keyless: couple the three alethia_app literals so they cannot drift silently (#1552) (#1554) (5d85383)
- placement: activate alibaba placement (both tiers — keyless RRSA-signed ACK + per-namespace RAM identity) (#1431) (e3ebe7e)
- placement: activate hetzner-talos placement tier (Talos-API kubeconfig from persisted talosconfig) (#1433) (701eba9)
- runner:
registry-tokencross-account keyless registry refresher (B2/PR B) (Part of #925) (#1036) (fb77a43) - runner: alethia db-authproxy — in-process token mint + TLS upstream + wire splice (pg & mysql) (#1521) (36bbad2)
- runner: azure-mysql keyless bootstrap SQL dialect + AAD token scope (#1456) (1f25368)
- runner: keyless MySQL bootstrap SQL — aws AWSAuthenticationPlugin + gcp IAM grants (#1506) (#1541) (f1f302d)
- runner: scan BYO charts pulled from an OCI registry (#1300) (#1313) (e18d171)
Bug Fixes
- core,runner: make git clone/pull cancellable via context (#987) (#1025) (efc55fe)
- e2e: pin the project templates' providers so the nightly stops resolving live (#1573) (6586eb5)
- infracost: checksum-verify, timeout, and config-driven version (#983) (3eca757), closes #946 #950
- runner,console: stop persisting live runner_token at rest; re-mint on update (#945) (#1014) (8d9fcb0)
- runner: ActivateTokenCloud restores a pre-existing token on cleanup (#988) (#1020) (f7cb0a7)
- runner: cross-compile the runner image for its target arch (multi-arch build bug) (#1052) (17ab6d9), closes #1050
- runner: derive CloudAccountID from ambient env in the self-operator path (#1190) (d5791ef)
- runner: fail the audit job when the verify verdict can't persist (#991) (cd2950c), closes #986
- runner: nil-guard resolveAccountID (#989) (#1018) (d052776)
- runner: set X-Amz-Expires on the EKS presigned token (#1040) (#1209) (85ccd39)
- runner: single config-driven tofu version + panic-safe id truncation (#964) (977396c), closes #947 #949
- runner: StreamWake reuses the configured transport + gets an idle deadline (#953) (#1024) (d29cee5)
- security: write secret-bearing files owner-only (0600) (#961) (e684a6a)
cli: v0.4.0
runner: v0.2.0
0.2.0 (2026-07-19)
Features
- addons: W4.5 — secret knobs render to a runner-seeded k8s Secret, never the manifest (Closes #640) (#656) (ea3a718)
- breakglass: audited, gated, blast-radius-bounded privileged recovery backend + CLI (#364) (d001598)
- byo-iac: deploy-time binding resolution + bind-sheet UI for BYO-IaC targets (#687, #823) (#824) (6c67392)
- canvas: a BYO-IaC environment reads as an architecture (W8) (#527) (b913323)
- connectors: four-cloud OIDC-only + cloud-shell parity (AWS/Azure/Aliyun ↔ GCP) (7e8caac)
- connectors: four-cloud OIDC-only + cloud-shell parity (AWS/Azure/Aliyun ↔ GCP) (a50d9ab)
- db: add PROBE_CLUSTER job kind + environment_probes history table (BYOC B2.1) (#449) (c7e6732)
- e2e/aws: pre-apply cost ceiling + stale-cluster preflight + single-NAT (BYOC A1.4) (3565daf)
- e2e/aws: pre-apply cost ceiling + stale-cluster preflight + single-NAT (BYOC A1.4) (605483c)
- hetzner: surface in-cluster data-service endpoints + credential refs (FT-2) (#511) (4e18b67)
- keyless: per-cloud keyless DB credential auth — GCP Cloud SQL IAM / Azure Entra (#722) (#766) (394ab3c)
- observability: OpenTelemetry traces + metrics on the traceparent substrate (#346) (cf8caf8)
- observability: self-hosted error tracking (Sentry SDK → GlitchTip, env-gated) (#362) (594a4ce)
- runner: detect and repair apply-orphaned resources — a failed apply could permanently wedge an environment (#526) (#543) (8c04139)
- runner: executeBuild — schedule in-cluster kaniko builds, capture digests (Closes #588) (#606) (0939afc)
- scanner: W5 Path A seam #0 — describe BYO chart workloads (#648) (#663) (a5ebaa7)
- services: W2 #0 seam — resolved_image output field + BUILD job kind + result contract (#597) (73650f4)
- surface GitOps/ArgoCD status — Deploy tab, canvas badges, cluster card (Closes #574) (#642) (190fd29)
Bug Fixes
- ci: make Go modules tidy standalone + fix the CLI mirror sync (#851) (65c7406)
- runner: flag orphan_risk on non-cancel mid-apply interruption (audit #8) (#396) (8a706df)
- runner: resolve BYO chart git tokens per-repo, not once per job (#468) (1a9549d)
- runner: un-break dev — executeBuild now uses the canonical imagebuild renderer (#611) (7b84b52)
- runner: wire the PROBE_CLUSTER executor — every probe job was failing (#528) (#533) (6998054)
- secrets: stop AWS generated secret values leaking into execution_metadata (audit P1) (#393) (07a1c72)
- security: stop persisting argocd admin password in execution_metadata (#427) (7d086ab)
cli: v0.3.0
0.3.0 (2026-07-19)
Features
- breakglass: audited, gated, blast-radius-bounded privileged recovery backend + CLI (#364) (d001598)
- cli: addon/chart/iac project-source commands (#828) (62ea144)
- cli: broaden install channels (Scoop, deb/rpm/apk) + wire get.alethialabs.io (#359) (7c18ce9)
- cli: cloud-inventory + org-settings + agent commands (#830) (d4901bb)
- cli: drift + cost project posture commands (#825) (462de90)
- cli: fix Homebrew release pipeline + surface richer data in CLI UI (#351) (9bcfc17)
- cli: make ArgoCD legible on the CLI — cluster get/list + GitOps sync/health (#785) (d22e6d9)
- cli: promotion + staged delivery-pipeline commands (#829) (df4879f)
- cli: protection + probes environment-state commands (#826) (b2fc041)
- cli: repo/provider/config-export commands + verify wire fix (#822) (dbcc7e8)
- connectors: Alibaba cloud-shell setup script + UI tab + CLI flow (#448) (9e12fee)
- connectors: AWS cloud-shell setup script + UI tab + CLI flow (#451) (76ee574)
- db: add PROBE_CLUSTER job kind + environment_probes history table (BYOC B2.1) (#449) (c7e6732)
- fabric: W-g1 CLI --env — target a specific environment on plan/apply/destroy (#843) (#863) (6b745ab)
- observability: OpenTelemetry traces + metrics on the traceparent substrate (#346) (cf8caf8)
- services: W2 #0 seam — resolved_image output field + BUILD job kind + result contract (#597) (73650f4)
Bug Fixes
v0.2.1
Changelog
- 72fd642 Brew formula update for grape version v0.2.0
- 8fefa7f Brew formula update for grape version v0.2.1
- e9c8acd Merge pull request #33 from bobikenobi12/staging
- c6c7de0 Merge pull request #34 from bobikenobi12/staging
- 34111f8 Merge pull request #35 from bobikenobi12/staging
- da63824 Merge pull request #37 from bobikenobi12/staging
- f48f128 ci(tendril): use native ARM runner instead of QEMU emulation
- dc08c87 feat(thesis): redesign presentation for ТУЕС defense
- e3c289a feat(trellis): show provisioning state for tendrils with active deploy jobs
- 19fca0c feat(trellis): show updating state for tendrils with active update jobs
- 1f51f7c feat(vintner): add favicon using existing logo
- 25b2f42 fix(grape): change default URL to beta.adp.itgix.com
- cf4a1fc fix(grape): use unstyled status symbols in table cells
- 684b449 fix(tendril): bump Terraform to 1.10.3 + fix platform for_each providers
- d9d5407 fix(tendril): copy grape module stubs in Dockerfile for go.work
- 5be65c0 fix(tendril): fix infracost binary path in Dockerfile
- 34da49c fix(trellis): exclude /docs from auth middleware matcher
- 1208888 fix(trellis): fix job cancel RLS and prevent duplicate destroy jobs
- e664f52 fix(trellis): memoize filtered tendrils to prevent selection reset
- 614bfa1 fix(turbo): declare DOCS_URL in build env for Vercel rewrites
- 04ed288 refactor(grape): centralize WebOrigin into a single function
- d011a93 refactor(trellis): store audit fixes + vineyard rename/delete UI
v0.2.0
v0.1.7
Changelog
- 20714b5 cleanup gitignores and add rules to GEMINI.md
- dafe26f feat(grape): enhance auth commands UI and add interactive login prompt
- 3560db7 fix height issues
- d01bdcf fix(grape): update default web origin to adp.prod.itgix.eu
- f5bfd24 new frontend
- 790cabe refactor(trellis): rename web app to trellis and complete UI overhaul
- 1d7070d refactor(vintner): rename docs to vintner and switch to ingress-level routing
- efd7e4a remove useless div