Skip to content

v0.11.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 18:08
· 3 commits to main since this release
v0.11.0
This tag was signed with the committer’s verified signature.
balcsida Dávid Balatoni
SSH Key Fingerprint: WjfLjYSGqwAvhKk36hJZdaFyPAyKJcSxfoien1VavOU
Verified
Learn about vigilant mode.
7d4f662
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GraphNest v0.11.0

Compatibility: pre-1.0 pilot; Kubernetes 1.25 or newer. No migrations and no
configuration changes. Adds graphnest login and logout: an OAuth sign-in with
PKCE over an RFC 8252 loopback redirect, which needs GRAPHNEST_MCP_OAUTH on the
server. OAuth access tokens now also authenticate GET /v1/repositories,
GET /v1/repositories/{id}, GET /v1/graph/repositories/{id}/status and
POST /v1/graph/uploads; existing API tokens and MCP clients keep working.
Security: images include SBOMs, provenance, and GitHub attestations. The
graphnest binaries ship with SHA-256 checksums, a dependency inventory and
build provenance attestations. Publishing with an OAuth token needs the new
graph:write scope plus the repository publication grant; OAuth tokens still
cannot mint or manage credentials. The CLI keeps its login in a 0600 file per
server.

Immutable artifacts

  • ghcr.io/balcsida/graphnest/application@sha256:7f01310f854630ea12eda915b19d3738f7327ac6f27b1594f054ad3406a0701d
  • ghcr.io/balcsida/graphnest/node@sha256:4ad93596a84515965ea177e8ccc199f51c6b86b196c4bd9fcf869de5d3b5c78b
  • oci://ghcr.io/balcsida/graphnest/charts/graphnest:0.11.0@sha256:d87e82e455b5600d22068811f2a71b3473b9ba5286763987f32759401ca8faaf

Verification

gh attestation verify "oci://ghcr.io/balcsida/graphnest/application@sha256:7f01310f854630ea12eda915b19d3738f7327ac6f27b1594f054ad3406a0701d" --repo "balcsida/graphnest"
gh attestation verify "oci://ghcr.io/balcsida/graphnest/node@sha256:4ad93596a84515965ea177e8ccc199f51c6b86b196c4bd9fcf869de5d3b5c78b" --repo "balcsida/graphnest"
gh attestation verify "graphnest-0.11.0.tgz" --repo "balcsida/graphnest"

Command-line tool

The graphnest command imports a local CodeGraph index without installing CodeGraph. Download the binary for your platform and graphnest_0.11.0_checksums.txt from the release assets, then verify and run it:

sha256sum -c --ignore-missing graphnest_0.11.0_checksums.txt
gh attestation verify graphnest_0.11.0_<os>_<arch> --repo "balcsida/graphnest"
chmod +x graphnest_0.11.0_<os>_<arch>
./graphnest_0.11.0_<os>_<arch> doctor

What's Changed

  • feat(cli): sign in with graphnest login (OAuth PKCE, RFC 8252) by @balcsida in #149
  • chore(release): prepare v0.11.0 by @balcsida in #150

Full Changelog: v0.10.0...v0.11.0

Contributors

balcsida
Assets 9
Loading