Skip to content

Release v1.0.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Jul 18:03
v1.0.8
eebd684
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bifrost v1.0.8

v1.0.8 rolls up the recent Solutions, CLI, scheduling, SDK, and packaging fixes since v1.0.7. This release contains 25 commits, with the biggest focus on making Solution install/deploy paths safer, more observable, and less surprising under real org-scoped usage.

Reliability & Solution Deploys

  • Hardened Solution installs by moving install and from-repo install onto async deploy jobs, preserving terminal failure state for pollers, and fixing the from-repo lock race (#441).
  • Fixed cold Solution workflow module loading so Solution-managed workflow modules resolve on the non-warm path (#447).
  • Fixed Solution CLI token refresh when running inside an existing event loop (#446).
  • Fixed Solution local targeting gaps and local runtime regressions across bound workspaces, path refs, and install scopes (#428, #427).
  • Consolidated Solution runtime scoping into one derivation chain with stronger enforcement and browser contract coverage (#430).
  • Fixed org-bound install path::fn resolution and bound-workspace app reference preference (#431).

Security & Supply-Chain Hardening

  • Added live-path file-policy deny auditing, including read/list denials, and removed dead policy-check code paths (#441).
  • Correctly carries and enforces is_provider_org in auth principals, file/table scope gates, app-context resolution, and policy predicate UI (#441).
  • Sweeps declared-location S3 objects on Solution hard delete so runtime files do not outlive the install (#441).
  • Removed the server-side policy-rule rename cascade that could rewrite live, possibly Solution-managed rows outside guard layers (#441).
  • Refreshed runtime and CI dependencies, including Node, nginx, Python, Playwright, GitHub Actions, and grouped client npm packages (#420, #421, #422, #423, #424, #425).

CLI, SDK & Developer Experience

  • Fixed deterministic CLI wheel subpackage inclusion so bifrost.commands and related modules are packaged reliably (#443).
  • Fixed CLI expired-token connection errors (#435).
  • Added global CLI default connection selection (#429).
  • Fixed virtual import resolution edge cases and pinned workflow ref-shape parity across UUID, path::fn, and name references (#419, #432).
  • Corrected the bifrost-build skill docs so workflow names resolve like path refs, and clarified Bifrost plugin skills/file CLI help (#433, #416).
  • Added Bifrost plugin icon assets and bumped plugin manifests to 1.0.8 for Claude/Codex marketplace freshness (#415, #451).

Bug Fixes

  • Fixed schedule event timezone handling (#434).
  • Repointed the docs screenshot pipeline and release skills at the gobifrost site repo (#426).
  • Documented CI lessons in the Bifrost issues skill (#417).

Contributors

None in this release — solo-maintained cycle. Verified with the release contributor scan across 25 landed PRs; non-human Dependabot dependency PRs are listed under security/supply-chain hardening instead.

Fixed CVEs

No specific CVE, GHSA, or PYSEC identifiers were listed in the landed dependency PR bodies. This release does include dependency refreshes for Node, nginx, Python, Playwright, GitHub Actions, and client npm packages (#420, #421, #422, #423, #424, #425).

Breaking Changes

  • Solution install endpoints now return 202 Accepted with a deploy_job_id and must be polled for completion instead of assuming a synchronous install response. The CLI and UI were updated in this release, and CONTRACT_VERSION moved from 6 to 7 (#441).

Docker Images

API:

docker pull ghcr.io/gobifrost/bifrost-api:v1.0.8

Client:

docker pull ghcr.io/gobifrost/bifrost-client:v1.0.8

Signed artifacts (Sigstore / cosign — keyless)

The source tarball has a matching .sigstore bundle (Sigstore's self-contained signature + certificate + Rekor inclusion proof, produced via keyless OIDC — no maintainer-held keys involved).

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v1.0.8-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/gobifrost/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v1.0.8-source.tar.gz

A SLSA build-provenance attestation is also published and verifiable via:

gh attestation verify bifrost-v1.0.8-source.tar.gz \
  --owner gobifrost
Assets 5
Loading