Moco 0.0.3

Moco 0.0.3 adds declarative Kubernetes management through MocoTenant, MocoVault and MocoAuthorization, with a separate controller image and Helm chart.

Component	Public image	Public Helm chart
Server	ghcr.io/araihu/moco:0.0.3	oci://ghcr.io/araihu/charts/moco
Controller	ghcr.io/araihu/moco-controller:0.0.3	oci://ghcr.io/araihu/charts/moco-controller

Both images contain Linux amd64 and arm64 manifests, SBOMs and build provenance. Both charts use version/appVersion 0.0.3 and pin their matching image digest. The controller chart includes all three CRDs and supports existing image pull Secrets.

helm pull oci://ghcr.io/araihu/charts/moco --version 0.0.3
helm pull oci://ghcr.io/araihu/charts/moco-controller --version 0.0.3

Installation requires the external credentials, storage and API endpoint settings in the server chart runbook and controller runbook.

Attached assets: moco-0.0.3.tgz, moco-controller-0.0.3.tgz, release.json and SHA256SUMS. The manifest records both components' image/chart digests and archive checksums. OCI chart downloads match the attached archives byte for byte; checksums and GitHub immutable-release asset verification passed.

Release CI passed the full Dagger checks, Helm 3/4 tests, production image tests and publication. Source commit: d3230a01676007350f3452f0ad6b2c79c6697cd5.

Full Changelog: v0.0.2...v0.0.3

Moco 0.0.2

Moco 0.0.2 adds chart regression tests and fixes publication for immutable GitHub Releases.

• Five helm-unittest 1.2.1 suites with 40 cases covering production security, credentials, retained/existing storage, verified backup configuration, HTTPS/Ingress, protected monitoring and rejection of unsafe values.
• Helm 3.22.1 and 4.3.1 validation, real Helm integration tests, Kubernetes schema validation and downloadable JUnit reports in CI.
• Draft-first release publication: image and chart are validated, all three assets are uploaded, then the release becomes immutable.

Public artifacts:

docker pull ghcr.io/araihu/moco:0.0.2
helm pull oci://ghcr.io/araihu/charts/moco --version 0.0.2

The chart defaults pin the exact multi-platform image digest. Supply the external credentials, mirror storage and other installation settings from the chart runbook.

Attached files: moco-0.0.2.tgz, release.json (source commit and OCI digests), and SHA256SUMS.

gh release download v0.0.2 --repo araihu/moco --dir moco-0.0.2
(cd moco-0.0.2 && sha256sum -c SHA256SUMS)

Release validation and publication · Full changelog

Moco 0.0.1

First Moco release: a self-hosted secret-management API with a single-instance SQLite production profile.

• Tenant and vault isolation, envelope-encrypted secrets, conditional requests and transactional audit.
• Independent Cobra CLI module with table, JSON and CSV output.
• Production Helm chart with JSON Schema, native TLS, retained storage, verified mirrored backups and optional Prometheus Operator integration.
• Public Linux amd64/arm64 OCI image with provenance and SBOM attestations, plus an OCI Helm chart whose defaults pin the exact image digest.

All release validation jobs passed: application/Dagger checks, production profile, and Helm 3/4. Both OCI packages were published successfully and verified by pulling their registry descriptors and chart archive.

docker pull ghcr.io/araihu/moco:0.0.1
helm pull oci://ghcr.io/araihu/charts/moco --version 0.0.1

Verified release manifest:

{
  "tag": "v0.0.1",
  "version": "0.0.1",
  "ociTag": "0.0.1",
  "commit": "45f08c889c70fea3b962394f1d52bb86ceefce37",
  "repository": "araihu/moco",
  "imageRepository": "ghcr.io/araihu/moco",
  "chartRegistry": "oci://ghcr.io/araihu/charts",
  "imageDigest": "sha256:21c070f36c2e60cb760fb1f763be8da9c55d14c126727615f95ee97c97a6921e",
  "chartDigest": "sha256:bc1e08645b2307f02269577098eadcab13a5608dad000478da75c48188c814de",
  "chartSHA256": "1a126fafab9f69754b8d7e9c08c4bf2e7a49d65e3fce0402f6cd4493b8b0061b"
}

Chart archive checksum (after helm pull):

1a126fafab9f69754b8d7e9c08c4bf2e7a49d65e3fce0402f6cd4493b8b0061b  moco-0.0.1.tgz

The initial publication workflow reports a failure only at GitHub asset upload: this release became immutable before the workflow attached moco-0.0.1.tgz, release.json and SHA256SUMS. These attachments are unavailable for v0.0.1; download the chart from OCI and use the verified manifest/checksum above. The tag, source commit and published OCI artifacts remain unchanged. Subsequent versions use a draft-first workflow that uploads assets before publication, as required by GitHub immutable releases.

See the installation and operations guide and updated release runbook.