Skip to content

Release v1.0.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Jun 18:21
v1.0.6
0680fcb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.6 — workspace sync bug-fix release

A focused patch release fixing a bifrost sync / watch / push regression introduced by the file-policies feature. 2 commits since v1.0.5 (the third is the routine plugin-manifest bump).

Bug Fixes

  • bifrost sync/watch/push reported every local file as "new" and offered to mass-push the workspace. The file-policies feature began evaluating file policies for the shared workspace location, which default-denies when no policy row exists — so a superuser got a 403 listing the workspace, the CLI silently swallowed it, and every file looked new. workspace is now treated as what it is: the superuser-only shared platform codebase, never policy-governed. (#410)
  • The CLI no longer mass-pushes on an auth/permission failure. A non-200 (especially 401/403) or network error from the server file listing is now fatal — bifrost sync/push prints an error with an auth hint and exits non-zero, pushing nothing, instead of treating an empty server view as "everything is new." bifrost watch aborts before starting its observer rather than half-initializing. (#410)
  • The Test Access policy diagnostic now reports workspace as superuser-only, matching real enforcement. (#410)

Reliability

  • An empty workspace (HTTP 200 + empty listing) is still correctly distinguished from "couldn't read the server," so a genuinely-empty first push works while a failed listing aborts.

Breaking Changes

None in this release.

Fixed CVEs

None in this release.

Contributors

None in this release — solo-maintained cycle.

Docker Images

API:

docker pull ghcr.io/gobifrost/bifrost-api:v1.0.6

Client:

docker pull ghcr.io/gobifrost/bifrost-client:v1.0.6

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Signed artifacts (Sigstore / cosign — keyless)

Each release asset has a matching .sigstore bundle (Sigstore's
self-contained signature + certificate + Rekor inclusion proof,
produced via keyless OIDC — no maintainer-held keys involved).

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v1.0.6-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/gobifrost/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v1.0.6-source.tar.gz

A SLSA build-provenance attestation is also published and verifiable via:

gh attestation verify bifrost-v1.0.6-source.tar.gz \
  --owner gobifrost
Assets 5
Loading