Release v0.0.68

BBT Workflow v0.0.68

🐳 Published Docker Images

Immutable digests (preferred for trust)

Tags can move; these digests cannot. Signatures and provenance refer to these references.

• ghcr.io/burgan-tech/vnext/execution@sha256:1d5b26bb0e4b3ea4ab39cdaff37675a84e62e3d97997fbea1829b09dc51d0793
• ghcr.io/burgan-tech/vnext/orchestrator@sha256:59376286d43b5265596cf817078373664dea36166f21e91e1d19c0f876720d17
• ghcr.io/burgan-tech/vnext/init@sha256:eabe68af86841648fa867d76223442ffb7768aa227b4522bfc6a826d940747ec
• ghcr.io/burgan-tech/vnext/inbox@sha256:acb315337d4af684ed927363b49298d5ea2f255be87f2862d66689d3af6e994d
• ghcr.io/burgan-tech/vnext/outbox@sha256:19be8404ecd439b81b9640483c66e4c7231ff17634305f7bab07f6d43b8ec6e9
• ghcr.io/burgan-tech/vnext/db-migrator@sha256:0f4e645b60a157ce9e94d811e92ee215a9426115d7a6d2024f90f6b21ab2fb95

Tags (mutable, convenience)

docker pull ghcr.io/burgan-tech/vnext/execution:0.0.68
docker pull ghcr.io/burgan-tech/vnext/orchestrator:0.0.68
docker pull ghcr.io/burgan-tech/vnext/init:0.0.68
docker pull ghcr.io/burgan-tech/vnext/inbox:0.0.68
docker pull ghcr.io/burgan-tech/vnext/outbox:0.0.68
docker pull ghcr.io/burgan-tech/vnext/db-migrator:0.0.68

🔐 Supply Chain

• OCI provenance & SBOM: pushed with the image (BuildKit provenance: mode=max, sbom: true).
• GitHub build provenance: artifact attestation for this workflow run (identity, repo, workflow ref).
• Cosign signature: each image signed by digest with keyless OIDC.

Verify Cosign signature (digest)

# Execution
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/execution@sha256:1d5b26bb0e4b3ea4ab39cdaff37675a84e62e3d97997fbea1829b09dc51d0793

# Orchestrator
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/orchestrator@sha256:59376286d43b5265596cf817078373664dea36166f21e91e1d19c0f876720d17

# Init
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/init@sha256:eabe68af86841648fa867d76223442ffb7768aa227b4522bfc6a826d940747ec

# Inbox
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/inbox@sha256:acb315337d4af684ed927363b49298d5ea2f255be87f2862d66689d3af6e994d

# Outbox
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/outbox@sha256:19be8404ecd439b81b9640483c66e4c7231ff17634305f7bab07f6d43b8ec6e9

# DbMigrator
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/burgan-tech/vnext/.github/workflows/build-and-publish-images.yml@.*" \
  ghcr.io/burgan-tech/vnext/db-migrator@sha256:0f4e645b60a157ce9e94d811e92ee215a9426115d7a6d2024f90f6b21ab2fb95

Verify GitHub build provenance attestation

gh attestation verify oci://ghcr.io/burgan-tech/vnext/execution@sha256:1d5b26bb0e4b3ea4ab39cdaff37675a84e62e3d97997fbea1829b09dc51d0793    --repo burgan-tech/vnext
gh attestation verify oci://ghcr.io/burgan-tech/vnext/orchestrator@sha256:59376286d43b5265596cf817078373664dea36166f21e91e1d19c0f876720d17  --repo burgan-tech/vnext
gh attestation verify oci://ghcr.io/burgan-tech/vnext/init@sha256:eabe68af86841648fa867d76223442ffb7768aa227b4522bfc6a826d940747ec          --repo burgan-tech/vnext
gh attestation verify oci://ghcr.io/burgan-tech/vnext/inbox@sha256:acb315337d4af684ed927363b49298d5ea2f255be87f2862d66689d3af6e994d        --repo burgan-tech/vnext
gh attestation verify oci://ghcr.io/burgan-tech/vnext/outbox@sha256:19be8404ecd439b81b9640483c66e4c7231ff17634305f7bab07f6d43b8ec6e9      --repo burgan-tech/vnext
gh attestation verify oci://ghcr.io/burgan-tech/vnext/db-migrator@sha256:0f4e645b60a157ce9e94d811e92ee215a9426115d7a6d2024f90f6b21ab2fb95  --repo burgan-tech/vnext

🚀 Quick Start

Using Docker Compose:

version: '3.8'
services:
  execution:
    image: ghcr.io/burgan-tech/vnext/execution:0.0.68
    ports:
      - "5001:5000"
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
  orchestrator:
    image: ghcr.io/burgan-tech/vnext/orchestrator:0.0.68
    ports:
      - "5002:5000"
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
    depends_on:
      - execution
  init:
    image: ghcr.io/burgan-tech/vnext/init:0.0.68
    ports:
      - "3005:3000"
    environment:
      - VNEXT_APP_URL=http://vnext-app:4201
      - PACKAGE_API_PORT=3005
      - DEFAULT_REGISTRY=https://registry.npmjs.org/
    depends_on:
      - orchestrator
  inbox:
    image: ghcr.io/burgan-tech/vnext/inbox:0.0.68
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
    depends_on:
      - orchestrator
  outbox:
    image: ghcr.io/burgan-tech/vnext/outbox:0.0.68
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
    depends_on:
      - orchestrator

🏷️ Available Tags

• v0.0.68 - This release
• latest - Latest stable release
• release-v0.0 - Branch-specific build

---

🤖 Built from branch: release-v0.0
📝 Commit: 4d00351
⏰ Build run: 78

What's Changed

• fix(subflow): pass workflow scripts to input mapping compilation by @yilmaztayfun in #784
• feat(workflow,api): add output model for sync response and free-form payload support by @yilmaztayfun in #785
• fix(subflow): prevent deep-subflow stuck via job-name collision fix + fault-on-load-failure by @yilmaztayfun in #787
• fix(api): bind camelCase payload keys in start/transition endpoints by @yilmaztayfun in #788
• F/monitoring api by @EreenKara in #786
• fix(jobname): keep readable dotted names Dapr-safe (drop ~ marker and… by @yilmaztayfun in #789
• feat(workflow,api): return workflow output mapping directly as sync response by @yilmaztayfun in #790
• fix(subflow): propagate sync caller mode through completion/fault resume by @yilmaztayfun in #791
• Add StateStore task type for Dapr state store caching by @yilmaztayfun in #792
• feat(instances): capture effective state snapshot in transition history by @yilmaztayfun in #793
• fix(subflow): prevent sync=true parents getting stuck Busy — per-sub resume lock key + correlation revert fix by @yilmaztayfun in #794
• v0.0.68 by @yilmaztayfun in #795

New Contributors

• @EreenKara made their first contribution in #786

Full Changelog: v0.0.67...v0.0.68