Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 19:41
· 1167 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.6.0
931ae11
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fugaro v0.6.0

Install:

  • Homebrew: brew install dimipaun/tap/fugaro
  • Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.6.0
  • Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

  • fugaro image refresh --yes confirms every step unattended, including each billable build, so the cloud step can run from CI or a script instead of needing a real terminal.
  • fugaro upgrade [PATH...] and the /fugaro:upgrade skill move a checkout to this release in one command: it pins the plugin, updates it through the claude CLI, and refreshes the job images. --local runs only the parts a coding agent's own session can do, --check reports drift without changing anything, --yes confirms the cloud step unattended, and --allow-fork moves a hosted fork's marketplace pin instead of dimipaun/fugaro's.
  • A project can now publish a project layer (fugaro config show, layer, init and publish) holding project-wide defaults and named workflow profiles, so a repository's fugaro.yaml can shrink to a few lines naming the project and, when needed, a profile; fugaro ls, diagnose and doctor all show the layer a run used, and fugaro run only embeds a layer on a job image built from this release's base, refusing older ones by name. Until the 0.7.0 bucket IAM hardening ships, config publish's --executable-changes gate is a CLI check, not a permission: any launcher can still write the project layer object directly. The daily image check and the rebuilds it starts now resolve each repository's fugaro.yaml over the same layer, so a layered project's job image is built and checked against the layer it runs with.
  • A run whose container was killed or crashed no longer blocks fugaro run --pr N for the rest of its branch lock's lifetime: the CLI now clears a lock once the backend reports its execution over, instead of waiting out the full expiry, and fugaro cancel says when a lock is still held on an already-finished run.
  • fugaro watch shows finished runs with a cursor and a run detail view, filters them with a (toggle showing every finished run) and x (acknowledge) in the interactive screen or --all and --keep/--keep-count on the command line, and lists the ones ready for review separately; fugaro logs --url prints a run's Cloud console link instead of its logs.
  • SECURITY.md now states Fugaro's trust model and its known limits in one place, including that every launcher still holds broad write access to the runs bucket until the 0.7.0 IAM hardening ships.

For operators

  1. Upgrade the CLI (brew upgrade dimipaun/tap/fugaro).
  2. Run fugaro upgrade in each checkout (it pins the plugin and refreshes the job images). This is required before any run can carry a project layer: a layered fugaro run is refused on a job image older than 0.6.0.
  3. For projects adopting layered configuration, run fugaro config publish from an operator's own terminal; add --executable-changes when a profile carries commands, image.apt, image.setup or image.skip_build_scripts.
  4. Then merge each repository's minimal fugaro.yaml. Do this only after every CLI and CI pin that touches the repository is on 0.6.0 or later: the strict parser refuses a file with new keys like profile: on an older release.

Changelog

  • layered config task 15: the daily check resolves over its copy; one sum for every consumer (#258)
  • layered config task 14: Cloud Build submissions carry the project layer, pinned by its sum (#254)
  • layered config task 19: the setup skill writes the minimal fugaro.yaml when the project has a layer (#257)
  • layered config task 18: docs/project-layer.md, cross-references, the scope table pinned by a test (#256)
  • layered config: gate skip_build_scripts, fix the copy-write race, and the empty-profile banner (#255)
  • layered config task 12: fugaro config show, layer and init (#243)
  • layered config task 16: doctor shows the project layer and flags drift, stale copies and stale images (#253)
  • Implement Task 6 of docs/plans/2026-10-08-generic-tool.md (the design i… (#252)
  • layered config task 11: fugaro run embeds the project layer behind a 0.6.0 image gate (#230)
  • layered config task 13: fugaro config publish, guarded, conditional, with per-repository copies (#244)
  • layered config task 10: validate, doctor, init, secrets and image resolve over the project layer (#231)
  • base image: strip ssh-agent's setgid bit; add Task 7's Docker hardening tests (#251)
  • bucket iam task 6: one operator-role refusal for publishes a launcher can no longer make (#245)
  • generic tool task 5: watch selects runs, keeps blocks in place and expands a run's detail (#249)
  • base image task 4: the base's smoke checks every pin and tool; a size budget (#247)
  • base image: put the harness Node's $prefix/bin on PATH inside install-node.sh (#250)
  • layered config task 17: ls and diagnose show the project layer a run used (#242)
  • base image: add gpgv, the package install-node's gpgv call actually needs (#248)
  • lock: take over a stale branch lock instead of waiting out its expiry (#222)
  • base image task 2: the Debian 13 base with the kit, mise and the harnesses (#235)
  • generic tool task 4: watch reads finished runs from the runs bucket (#229)
  • generic tool task 2: the registry carries the verify summary and the PR link (#228)
  • generic tool task 21: SECURITY.md states the trust model and its known limits (#226)
  • config: three small hardening fixes in internal/config (merged node path) (#217)
  • bucket iam task 3: the install guard checks every bucket grant's condition (#232)
  • bucket iam task 5: a refused write is blobx.ErrForbidden; launchers' writes all land under runs/ (#225)
  • base image task 1: the presence table and the selftest's presence checks (#224)
  • generic tool task 1: fugaro logs --url and the link in the empty hint (#227)
  • bucket iam task 1: the launchers' runs/ condition, one definition (#223)
  • layered config task 9: findLayer and resolveFugaroYAML, the CLI's one resolution seam (#221)
  • layered config task 7: the runner resolves over the task's project layer and records both sums (#220)
  • layered config task 5: the project layer schema and the layered corpora (#219)
  • layered config task 4: Resolve merges the project layer, a profile and the repository (#213)
  • upgrade task 9: the /fugaro:upgrade skill (#209)
  • upgrade task 10: the docs give one upgrade command (#208)
  • design: runs-bucket IAM hardening (only operators write fugaro/) and its 0.7.0 plan (#215)
  • design: generic-tool hardening (0.7.0) and its plan; Docker backend measured first for 0.8.0 (#214)
  • layered config task 6: task.json carries the project layer's exact text (#212)
  • layered config task 8: the project layer's offline-only cache (#211)
  • recipes: escape untrusted key text in Problem.Path (#210)
  • layered config task 2: the project layer and its strict, scope-checked parser (#207)
  • base image task 3: fugaro-services moves to common and finds what the project installed (#206)
  • layered config tests: golden scope table and executable-keys pins, workflow profile schema case (#205)
  • base image task 5: scan.sh --secrets, Trivy over every layer and the image config (#204)
  • upgrade task 6: the plugin step through the claude CLI (#203)
  • upgrade task 7: the cloud step, never attempted in an agent's session (#200)
  • layered config task 3: profile and workflows..profile in fugaro.yaml (#202)
  • layered config task 1: the scope table of every fugaro.yaml key (#201)
  • upgrade task 8: plugin hints name fugaro upgrade --local where the pin step backs it (#198)
  • upgrade task 2: which claude plugin calls a checkout needs (#197)
  • design: layered project configuration (project layer, profiles, scopes) and its 0.6.0 plan (#199)
  • upgrade task 3: image refresh takes a checkout, a rerun line and a plan hook (#193)
  • upgrade task 1: the claude plugin runner, its allowlist and a fake claude (#192)
  • upgrade task 5: fugaro upgrade with the pin step, the summary and the exit code (#195)
  • upgrade task 4: the cloud step's state from local files only (#194)
  • base image: the design and the implementation plan (#196)
  • image refresh --yes: confirm every step unattended, reversing D2 (#190)

Base images

Published by the images workflow for this tag:

  • ghcr.io/dimipaun/fugaro-web-node:0.6.0
  • ghcr.io/dimipaun/fugaro-web-node:0 (moves to the highest release of the major)
  • ghcr.io/dimipaun/fugaro-go:0.6.0 and ghcr.io/dimipaun/fugaro-go:0
  • ghcr.io/dimipaun/fugaro-java-services:0.6.0 and ghcr.io/dimipaun/fugaro-java-services:0
  • ghcr.io/dimipaun/fugaro-history:0.6.0 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64; each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.

Assets 13
Loading