Skip to content

v0.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Oct 03:29
· 1151 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.7.0
89e4281
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fugaro v0.7.0

Install:

  • Homebrew: brew install dimipaun/tap/fugaro
  • Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.7.0
  • Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

  • One base image for every project: the go, web-node and java-services images are gone, replaced by a single language-agnostic fugaro-base (Debian, mise, Claude Code and the other agent harnesses, a broad tooling kit, graphify, built for amd64 and arm64). A project declares its runtimes in a mise.toml (or image.tools in fugaro.yaml) instead of choosing a language image; base:, image.node and image.jdk are now refused with a message that points at docs/base-image-migration.md, and a 0.6 CLI refuses the new fugaro.yaml, so this is a breaking release.
  • Recipes grow up: a starter catalog with a "use when" line each (fugaro recipes ls --verbose), a coder that can be the reviewer, a review mode for existing pull requests (trusted authors only: review.allow_forks is removed), a bounce between coder and reviewer, check steps that gate a run, and commands.lint / commands.fix with autofix commits before the review. The routing skill picks a recipe from the catalog, and fugaro run --attempts N runs a best-of-N batch under one budget.
  • fugaro runs ls lists runs (the old fugaro ls prints a pointer to it), and the run registry now carries the last action and token count. A workflow can say how its repository is provisioned with workflows.<name>.checkout: baked | clone; clone is accepted by the schema but refused at launch until 0.7.1, because the runner side is not released yet, and fugaro init --repo and fugaro image refresh refuse to deploy a clone workflow.
  • The runs bucket is hardened: launchers read it and write only under runs/; operators keep full control. It takes effect only when an operator applies the Terraform (fugaro init), and fugaro doctor gains a runs-bucket-iam check that fails closed.
  • Provider models (a non-Anthropic model through OpenRouter) report real cost, so the budget caps count what a run actually spent (0.6.7), and a DeepSeek coder and reviewer has run end to end. The README's "Why Fugaro" is rewritten around four reasons.

For operators

  1. Upgrade the CLI: brew upgrade dimipaun/tap/fugaro.
  2. Migrate each repository before merging anything else: remove base:, image.node and image.jdk from fugaro.yaml, declare the runtimes in mise.toml (the /fugaro:setup skill does it), merge, then run fugaro image refresh in the checkout. It copies fugaro-base (published by this release's tag) into your registry, moves the daily image check onto it and rebuilds each workflow's image; it asks before every billable build. Until the 0.7.0 tag has published fugaro-base, fugaro image refresh refuses with a clear error. A shared config published by an older Fugaro that still lists go, web-node or java-services is accepted with a warning and cleaned the next time someone publishes.
  3. The old per-language images (fugaro-go, fugaro-web-node, fugaro-java-services) stay on ghcr.io forever as history, but no release after 0.6.x refreshes them.
  4. To get the bucket hardening, run fugaro init for the installation in your own terminal and read its plan: it deletes only the launchers' old objectAdmin grants, behind its own banner and confirmation. Until then nothing changes, and a one-person installation plans no change at all.
  5. Not yet verified live: the cold-start time of a run on the new base image (the 0.6 image measured about 12 seconds on the sandbox; the owner repeats it after migrating) and the bucket hardening's live Check 32 (run on the fugaro installation, never on belong).

Changelog

  • release: highlights for v0.7.0 (#334)
  • merge next into main: 0.7.0
  • clone: refuse checkout: clone until the runner side exists (cloneSince 0.7.1) (#332)
  • design: project-level secrets, set once per project (0.7.1) (#329)
  • generic tool task 16: clone workflows run the base image with no build and no check job (#275)
  • README: Why Fugaro in four reasons (safe by construction, scale out and walk away, team control, the newest tools and models); drop the duplicated project-layer paragraph (#331)
  • images workflow: apply the staged change for 0.7.0 (delete the legacy base job; publish and verify-public cover history) (#330)
  • base image: add graphify, a knowledge-graph CLI, in an isolated venv (code-only) (#326)
  • merge base-cut into next: the 0.7.0 base-image hard cut
  • base image task 16: the setup skill writes mise.toml and one Dockerfile shape (#320)
  • design: verify the base image's signature when it is copied (digest-pinned, signed, -pinned tag) (#318)
  • base image task 20: delete the go, web-node and java-services images, their CI and release lines (#319)
  • base image task 19: the CLI, local and shared config, and the check job refuse/drop legacy base kinds (#310)
  • bucket iam task 9: Check 32, the live check for the runs bucket's launcher grants (run on fugaro, never belong) (#317)
  • bucket iam task 8: docs say launchers write only runs/, that the hardening needs an operator's apply, and what stays open (#316)
  • design: a safe agent.env (allow-listed) and a provider-scoped agent_env; nothing built (#306)
  • generic tool task 13: fugaro run --attempts N (best-of-N batch with one budget, parallel and recipe check) (#312)
  • forward-merge main 0.6.6 into next: the provider-model env fix, the highlights and the release bump (cherry-picked) (#315)
  • generic tool task 19: the routing skill chooses the recipe from the catalog (with its safety rules) (#311)
  • generic tool task 12: review mode and pick, trusted authors only (allow_forks removed) (#280)
  • fugaro.yaml: raise the per-stage agent cap to 50 (notional under oauth; the default 25 kept ending long fix rounds) (#309)
  • fugaro.yaml: raise the per-stage agent cap to 50 (notional under oauth; the default 25 kept ending long fix rounds) (#308)
  • base image task 18: render, selftest and the hash know only the Fugaro base (#304)
  • design: Headroom context compression in the agent loop (opt-in, api-key with the gateway on; nothing built) (#303)
  • base image task 17: the config refuses every legacy setting (targets base-cut; the suite is red there until Tasks 16, 18, 19) (#282)
  • base image: DeepSeek harness is no longer excluded; guard that its table row, loop entry and lockfile pin move together (#302)
  • forward-merge main into next: named Claude accounts, update warning, release 0.6.5 (#301)
  • images workflow: publish the base image
  • base image task 15: the user docs, the migration doc and design v1 section 7 (honest about what is not published or enforced yet) (#284)
  • base-cut: runs and their PRs target the base-cut branch
  • images workflow (pending): verify-public needs publish-base to have succeeded when base is built; pins are tested (#285)
  • base image task 6: build per architecture, publish an index, verify arm64 (#281)
  • generic tool task 11: check steps gate the run; lint autofix commits before the review (#276)
  • generic tool task 14: the starter recipe catalog, recipes ls --verbose and the 0.7.0 recipe gate (#272)
  • base image task 13: BaseKind everywhere; the base kind flows through init, build and refresh (#274)
  • generic tool task 7: fugaro runs ls, the ls tombstone and singular aliases (#273)
  • generic tool task 3: the registry carries the last action and the token count, with the old-rules fallback (#240)
  • base image task 12: selftest and local build on the base kind, mise-tools and harness credential files (#261)
  • generic tool task 15: workflows..checkout: baked or clone (#236)
  • bucket iam task 7: doctor's runs-bucket-iam check, failing closed (#263)
  • generic tool task 10: the bounce and coder: reviewer in the recipe runner, with validate and docs (#265)
  • base image task 10: the mise step in the derived Dockerfile, image.tools, and the base kind's cache default (#264)
  • base image task 14: the repository's own mise.toml and a test pinning it to the Dockerfile, go.mod and CI (#260)
  • base image task 11: the image config hash covers image.tools and the mise files (#262)
  • bucket iam task 4: HardeningAllowDelete, the guard that allows deleting only the old launcher objectAdmin grants (#266)
  • Task: forward-merge main into next as ONE standalone change (main just … (#268)
  • generic tool task 20: direct providers, check 33 and the control plane seam (#233)
  • base kind task 9: the base kind, image.tools and mise detection (#237)
  • generic tool task 9: commands.lint, commands.fix and review.allow_forks (#238)
  • generic tool task 8: recipes gain use_when, coder: reviewer, mode: review, check steps and bounce (#239)
  • bucket iam task 2: launchers read the runs bucket and write only runs/; operators keep objectAdmin (#234)
  • next: runs and their PRs target the next branch (restore base_branch: main when next merges into main)

Base images

Published by the images workflow for this tag:

  • ghcr.io/dimipaun/fugaro-history:0.7.0 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
  • ghcr.io/dimipaun/fugaro-base:0.7.0 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.7.0-amd64 and 0.7.0-arm64)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.

Assets 13
Loading