Skip to content

Release v1.4.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Sep 22:43
· 192 commits to main since this release
v1.4.1
ade714a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.4.1 — Solution access gates + UI polish

13 commits since v1.4.0. This release introduces per-call solution targeting with an inbound access gate, closes the CLI gap on the new gates, and ships a batch of UI fixes.

Features

  • Per-call solution targeting with allow_inbound_access gate: SDK operations (workflows.execute, tables.query/get/insert, files.read, events.emit) accept a solution= parameter resolving inside the org scope, with sealed installs unreachable from outside (#778)
  • solution global_repo_access renamed to allow_outbound_access (compat alias, no migration) (#777)
  • New solution update CLI command (PATCH install-local fields) + --allow-inbound-access/--no-allow-inbound-access on solution create / solution init (#779)
  • Solution edit dialog gains the inbound-access toggle (#778)

Bug Fixes

  • Engine token for no-timeout workflows lives 24h, not 5 minutes (#771 by @sdc53)
  • Integrations mappings toolbar pinned, row actions consolidated, phantom page scroll killed (#775)
  • Workspace tabs stay inline on mobile (#774); wrap beside chat on mobile (#772)
  • Middle-click navigation restored, consistent catalog actions (#770)
  • Searchable dropdown filtering and long selections fixed (#768)
  • Workspace dashboard header stabilized (#767)

Developer Experience

  • Focused local verification restored as the PR prerequisite, merge queue as the broad gate (#776)

Docs

  • Build skill documents per-call inbound solution targeting; Codex mirrors synced (#780)

Contributors

  • @sdc53 — fixed the no-timeout engine token lifetime from 5 minutes to 24h (#771)

Fixed CVEs

None in this release. No dependency bumps with CVE/GHSA IDs in this range; the single security-tagged commit (#771) is a token-lifetime reliability fix.

Breaking Changes

None in this release.

Docker Images

API:

docker pull ghcr.io/gobifrost/bifrost-api:v1.4.1

Client:

docker pull ghcr.io/gobifrost/bifrost-client:v1.4.1

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Signed Artifacts (Sigstore / cosign — keyless)

Each release asset has a matching .sigstore bundle (Sigstore's
self-contained signature + certificate + Rekor inclusion proof,
produced via keyless OIDC — no maintainer-held keys involved).

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v1.4.1-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/gobifrost/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v1.4.1-source.tar.gz

A SLSA build-provenance attestation is also published and verifiable via:

gh attestation verify bifrost-v1.4.1-source.tar.gz \
  --owner gobifrost

Contributors

sdc53
Assets 5
Loading