Cloud-Visi v0.1.0-beta.4 — usability and onboarding improvements

Cloud-Visi v0.1.0-beta.4

This beta makes Terraform investigations and setup easier to follow.

What changed

• Shorter page guidance and clearer plan, apply and state evidence labels.
• Filters follow the selected history and repository permissions; investigation
  links preserve supported scope and explain omitted selections.
• More readable dependency diagrams with focused selections and clearer labels.
• Setup summaries match tracked repositories, and state setup waits for the
  first sync. GitHub discovery errors include practical recovery steps.
• Historical orphan-check coverage stays visible. State observed before a code
  change is excluded from measurable delivery duration.
• Fresh installations use Cloud-Visi branding; existing custom names are kept.

Azure Blob Storage and AWS S3 state, GitHub and Azure DevOps repositories, and
GitHub Actions and Azure Pipelines continue to be supported within their
documented evidence limits.
A green workflow alone does not prove Terraform was applied. GitHub Actions
coverage remains partial; DORA uses supported Azure Pipeline evidence.

Upgrade

Use ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.4 for AMD64 or ARM64.
Preserve the database, encryption key and trial files. No new schema migration
or runtime service is introduced. The trial owner verification key is unchanged.

Verification and limits

Fresh checks pass: 2,137 Go pass events with real-migration API tests
(16 skip events, zero failures, 28 packages), 549 UI tests, deployment checks,
Helm lint and the exact-archive ARM64 startup/sign-in/trial-verifier/scanner test.
Pass events include subtests and packages. Native publication results and the
approved image digest are recorded in the
release record.
The customer walkthrough and separate live first-sync onboarding passed. Full
live Actions/state onboarding still needs refreshed GitHub access and Azure
state credentials. Prior AWS campaign acceptance and scale qualifications remain
unchanged. GCS, notifications and OCI chart publication are outside this release.

Product source remains private. The OCI asset contains compiled runtime images,
SBOMs and build provenance. GitHub's source archives contain deployment files.

Full changelog

Published image checks

Native GitHub AMD64 and ARM64 readiness, non-root user, administrator login, build identity, configured trial verifier and bundled scanner checks pass.

Both architectures are publicly available. Anonymous OCI registry downloads of both manifests and all runtime config/layer bytes passed SHA-256 checks (12 unique blobs, 136,209,626 bytes). The version and beta alias match the approved digest. Beta.1, beta.2 and beta.3 are unchanged; latest is absent and no OCI chart was published.

Native checks | Deployment checks

Cloud-Visi v0.1.0-beta.3 — AWS evidence improvements

Source: 22344f62c0ea5bcddd89c15b933eb32575d3c162 (merged AWS fixes).

AWS and GitHub Actions

• Validate the existing AWS S3 state-reader and GitHub Actions path with a
  50-case campaign, six private fixture repositories and scoped replay tests.
• Recognize full-SHA artifact action pins and output-only plans behind canonical
  local composite wrappers, including reusable workflow forms.
• Report typed S3 region-routing failures and STS credential failures nested
  inside S3 reads with the correct explanation. Failed reads retain state history.
• Explain current GitHub delivery evidence and log coverage accurately; workflow
  success never implies Terraform apply or current cloud state.
• Reject parent-directory action paths and native shell steps that resemble local
  composites. Legitimate indented action inputs named shell remain supported.
• Add AWS/GitHub setup and evidence limits.

Upgrade and verification

• Parser version 13 applies to new successful reads; historical repair stays
  explicit and bounded. Preserve the database and matching encryption-key storage.
• Administrator sign-in and installation-bound trials continue from beta.2 with
  the same owner verification key. No schema migration or new runtime service.
• Final tested source: 2,117 Go pass events, 16 skips, zero failures across 28
  packages, with real-migration API coverage. Events include subtests/packages.
  Nine fixture tests, nine actionlint checks, Terraform formatting and server
  build pass. The merged main tree matches that reviewed/tested source exactly.
• The campaign's 50 cases are in Review, none Closed; overall independent
  acceptance is pending. Public gate/fork variants do not certify private
  features or first-time outsider behavior. Invalid-account refusal does not
  certify a successful cross-account read. Some controls are controlled replays.
• GitHub Actions coverage remains partial; DORA retains its Azure Pipeline limit.
  State is an observation, not continuous cloud health or apply causality.
• GCS, notifications, automatic remediation and OCI chart publication remain
  excluded. No new scale or vulnerability-free dependency claim is made.
• Published AMD64/ARM64 native runtime and bundled scanner checks pass; both
  architectures download anonymously. Beta.1/beta.2 are unchanged and beta
  matches the approved digest. No latest tag or OCI chart was published.
• See release verification and
  the completed release record.

Pull the released image

docker pull ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.3

Linux AMD64 and ARM64 are available. Approved multi-architecture digest:
sha256:d41299fe9b15845491e579c808c9e16f8b8c95961574f33ca63cae6e86b80959.

Archive SHA256: 72380a0b11614e4766694b21f476ed1c8feb5c116b1093b153bc7c39ab1b24fa.

The beta alias matches this digest. Both architectures download anonymously.
Beta.1 and beta.2 are unchanged; latest remains absent and the OCI chart is
unpublished. Native publication and runtime verification:
https://github.com/cloud-visi/cloud-visi-deploy/actions/runs/39044313680.

The attached release record contains completed checks. Product source remains
private; automatic ZIP/tar.gz source links contain public deployment files only.

Cloud-Visi v0.1.0-beta.2

Source: 8a7a663eb3dbc57bfd2df45675fc8237b94797e6.

Added

• Local administrator sign-in, revocable sessions, repository-scoped viewer
  grants, account administration, CSRF protection and authenticated snapshots.
• Installation-bound trials, with signed offline keys valid for up to 30 days.
  Expiry pauses access and sync while preserving data and renewal access.
• Durable repository identity across providers, server scopes and reconnection;
  independent commit membership for mirrored repositories.
• Separate Terraform plan, apply and state observations, retained run attempts,
  explicit cross-repository attribution and independent source/cloud filters.
• Backend identity and configuration resolution with one selected workspace per
  root and protection against unsafe target changes.
• Dependencies through locals, variables and scoped modules; retained graph
  generations, explicit historical reparse and scoped Azure/S3 cross-state paths.

Changed

• Integrates the Graphite & Butter interface colours with all approved features.
• Bounds scoped queries and evidence enrichment, and limits browser request
  concurrency so authentication and trial checks remain responsive.
• Missing evidence remains unconfirmed. A successful workflow or a resource in a
  later state snapshot does not prove that a particular Terraform apply succeeded.

Upgrade requirements

• Back up the database and matching repository/encryption-key storage. Keep both
  through the upgrade; do not remove volumes or replace the encryption key.
• Configure AUTH_PUBLIC_URL to the exact HTTPS origin behind your existing
  trusted TLS proxy. New and upgraded installations require operator bootstrap
  of the first administrator. See access setup.
• Sign in before activating the installation-bound trial. Existing beta.1 installs
  have no saved trial and need an owner-issued key for this release.
• Application migrations are additive. Historical reparse/repair commands remain
  explicit operator actions; no historical campaign is run by this release.

Verification and limits

• AMD64 and ARM64 native readiness, sign-in, version and bundled scanner checks
  passed against the published digest. Both architectures download anonymously.
  The beta.1 image is unchanged; no latest tag or OCI chart was published.
  See image verification and the
  release record.

• Fresh release verification: 2,012 Go test/subtest pass events across 28 packages,
  46 explicit auth/upgrade/scoping harness pass events and 528 UI tests. UI lint,
  TypeScript/Vite build, Go vet, 21 deployment checks and Helm lint passed.
  Harness counts overlap the full suite; diagnostic/performance tests are opt-in.

• The verified synthetic partner profile is 20 repositories, 5,000 resources,
  50,000 changes and five readers, including a passing uninterrupted two-hour soak.

• The 25,000-resource comparison still misses latency targets and is outside that
  verified envelope. Synthetic results are not a customer workload guarantee.

• GitHub Actions coverage remains partial; DORA retains its Azure Pipeline limit.

• Available state is an observation, not continuous cloud health or apply causality.

• GCS, notifications, automatic remediation and OCI chart publication are excluded.

• The locked UI build dependency source-map-js 1.2.1 has a
  known source-map denial-of-service advisory.
  It processes the trusted release source during build; the runtime image ships
  the compiled static UI and Go server, without Node.js or that build package.
  This release is not a claim of a vulnerability-free dependency inventory.

Pull the released image

docker pull ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.2

Approved multi-architecture digest: sha256:6b85bf671016716bbb56746e436bd8f0d82c06a56d4f26924dbe17f604d5bc40.

Archive SHA256: 1f6a0359ad7b8f681b102884d0dba80a23716fe479e5cb7872cf8e9a3f598339.

The beta alias matches this digest. latest remains absent. Native publication
and runtime verification: https://github.com/cloud-visi/cloud-visi-deploy/actions/runs/39019872885.

The attached record contains completed checks. Deployment and access setup
describes HTTPS, first-admin bootstrap, trial activation and data-preserving upgrades.

Cloud-Visi beta 0.1.0-beta.1

Cloud-Visi beta 0.1.0-beta.1

Terraform change intelligence for DevOps, platform and SRE teams. Connect a repository you know and explore its existing code history, pull requests, pipeline activity and optional Terraform state context. There is no required evaluation task or prescribed outcome.

Image

• Version: ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.1
• Moving beta alias: ghcr.io/cloud-visi/cloud-visi:beta
• Platforms: Linux AMD64 and ARM64
• Image digest: sha256:3466183702f584975c02e600f51e2e364d7be51129e46c535de7e13a58d9b5d5
• Includes SBOMs and minimal build provenance. Product source remains private.
• Public downloads verified without stored credentials on AMD64 and ARM64. Both tags resolve to the digest above.

docker pull ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.1

Kubernetes with Helm

Kubernetes remains the supported deployment path. The OCI chart is still on hold; use the chart files from this deployment repository and select the beta image explicitly:

git clone https://github.com/cloud-visi/cloud-visi-deploy.git
cd cloud-visi-deploy
CONTEXT=your-context-name
kubectl --context "$CONTEXT" create namespace cloud-visi
python3 scripts/create-kubernetes-secret.py --context "$CONTEXT"
helm upgrade --install cloud-visi ./charts/cloud-visi \
  --kube-context "$CONTEXT" --namespace cloud-visi \
  --set image.tag=0.1.0-beta.1 --wait --timeout 10m
kubectl --context "$CONTEXT" -n cloud-visi port-forward service/cloud-visi 8080:8080

Open http://127.0.0.1:8080. If the namespace already exists, keep it. For an existing installation, preserve its Secret and data and make a backup before upgrading. See the repository's Kubernetes and operations guides for storage, external database and recovery options.

Optional Docker Compose

python3 scripts/create-compose-env.py
CLOUD_VISI_IMAGE=ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.1 docker compose pull
CLOUD_VISI_IMAGE=ghcr.io/cloud-visi/cloud-visi:0.1.0-beta.1 docker compose up -d --wait --wait-timeout 600

Use the same image selection for later restarts or save CLOUD_VISI_IMAGE in your local .env. Keep the generated database password and encryption key.

Repository connection

Choose a GitHub organization or Azure DevOps repository containing Terraform .tf files that you have permission to read. Use a read-only code-host token. Terraform state credentials are optional and can be added later in Settings. You do not need to create infrastructure or run Terraform to start using the application.

Validation and limits

The database-backed Go suite and deployment checks pass. Local Helm backup/restore, upgrade and retained-storage reinstall were verified. Published image startup, database readiness, release metadata, non-root execution and the bundled scanner pass on native AMD64 and ARM64 GitHub runners. Earlier local AMD64 checks also passed through Docker emulation on an ARM Mac.

The beta has no built-in login. Use a trusted namespace and network boundary. The Helm instructions use port forwarding and Compose exposes localhost only. Shared access requires your existing authentication gateway.

The licence remains undecided. This image publication was explicitly authorized for partner validation. The OCI chart has not been published.