v1.38.0

Changed

• Breaking: a release now stops when any push run of the verify
  workflow on the tagged commit failed, on any branch, even if another run
  succeeded. A failed run that was re-run to a pass counts as passed.
• Breaking: a commit that renames a file out of a code path is no
  longer read as documentation only, so its parent's run no longer stands
  in for its own.
• Breaking: image-build.yml accepts an image only when the version it
  prints is the tag exactly, followed by whitespace or nothing, so
  v1.2.30 or v1.2.3-dirty no longer passes for v1.2.3.
• Breaking: the release tag is applied only to a reference written
  <registry>/<path>@sha256:<64 hex digits>, with no tag.
• Breaking: a files or evidence line of publish-release is one
  path or pattern, so a path may hold a space; a line that held several
  patterns separated by spaces now names one that matches nothing. A file
  name with # is refused, since gh reads it as a label.
• Breaking: tools/repo-settings.sh fails when the repository listing
  fails partway, when the policy file or a repository answer is not JSON,
  and when a write is refused with anything but the validation error
  (HTTP 422) GitHub gives for open classic projects, which alone is
  retried without has_projects. A repository left with projects enabled
  is still PARTIAL, counted apart in the summary, and leaves the exit
  status 0.
• A re-run of a publish over an existing release restates its title and
  prerelease flag along with the notes.
• Each attempt of an image deploy's smoke is stopped when smoke_timeout
  is up, and a failed smoke's last OUTPUT_MD is appended to the step
  summary.
• An image namespace with -- or __, which a reference allows, is
  accepted; one holding a newline is refused.
• The starter callers name ci.yml as the workflow an image release
  verifies, take the workflow_dispatch the pin move sends, pass smoke
  evidence only when the deploy ran, and name an example service.
• The runner policy in the README now reads hosted runners for every
  repository: private repositories run only scheduled and hand-started jobs
  there, and their push, release and deploy run from a workstation.
• Breaking: image-build.yml takes an empty verify_workflow by
  default, which reads as the one workflow in .github/workflows that
  calls lateregate.yml, as the other pipelines do. It defaulted to
  verify.yml, so a caller that passed nothing and has no verify.yml was
  refused; a repository with several callers must now name the workflow.
• Breaking: service-release.yml and image-deploy.yml run the
  rollback guard a second time right before the kubeconfig is written. An
  older release that finishes late, after a newer vX.Y.Z was tagged, now
  stops there instead of rolling production back; the build it paid for is
  lost.
• Pushing a v1.MINOR.PATCH tag moves v1 only after the tagged commit
  passed this repository's own test.yml on its push, so a tag cut on a
  red or unverified commit no longer reaches the callers that pin @v1.
• Breaking: in cli-release.yml the verified job holds contents: read and actions: read, the test job contents: read, and only the
  goreleaser job contents: write. The consumer's tests no longer run
  with a token that can write to the repository. A caller's
  .goreleaser.yaml hook that read workflow runs from the release job
  needs its own grant.
• Breaking: cli-release.yml publishes only when every leg of the
  test_os matrix succeeded. A canceled leg used to let the release
  through; it now stops it.
• Breaking: service-release.yml refuses build_cli: true with no
  cli_build_cmd in its first step. It used to fail only at the publish,
  after the build and the deploy had gone out.
• A release on a commit whose verify workflow has no push run now counts a
  successful workflow_dispatch run of that workflow on the default branch
  for the exact commit, as verified. This is the run ci-gate-bump.yml
  dispatches for its pin commit, which a push with the job's token does not
  start, so a release on a pin commit is no longer blocked. A failed push
  run of the commit, on any branch, still blocks the release, and so does a
  dispatched run on another branch or one that did not succeed.
• Breaking: the test job of lateregate.yml is named test (<os>),
  not test on <os>, so it shows no raw ${{ matrix.os }} when it is
  skipped. A branch protection rule that requires a check by the old name
  needs the new one.

Fixed

• A smoke script that passes without writing OUTPUT_MD no longer fails
  the deploy.
• The digest check of an image deploy no longer reports that the overlay
  names no image when the rendered overlay is large.
• A wait_minutes such as 08 is read as eight minutes instead of failing.
• A commented-out call to lateregate.yml no longer counts as a second
  per-push workflow.
• ensure-kustomize no longer takes an installed v5.8.30 for the pinned
  5.8.3.
• signed-checksums sums a file whose name starts with -.
• tools/repo-settings.sh --help exits 0, and a repository it cannot read
  is reported with gh's error instead of a list of drifted fields.
• An image release passes evidence to publish-release only when a .md
  file was downloaded, so an evidence pattern that matched no Markdown no
  longer fails the publish.
• A backport tag such as v1.5.1, pushed after v1.6.0, no longer moves
  v1 backwards: v1 moves only to the highest v1.MINOR.PATCH release
  tag.

v1.37.0

Changed

• ci-gate-bump.yml dispatches no per-push run in a repository that
  ships from a workstation (ship: in .lateregate.yaml, ci-gate
  v0.68.0) and has no workflow calling lateregate.yml: the bump has
  already run the whole bar on the new pin. Every other repository still
  needs exactly one caller.

v1.36.0

Added

• service-release.yml takes a platforms input, default linux/amd64:
  the platform the image is built for. A release now ships an x64 image
  from an arm64 runner as well as from an x64 one. Pass another value
  to build for a different cluster; in split mode it must be exactly one
  linux/<arch> entry (for example linux/arm64), which is also what the
  binary is compiled for, and anything else fails the build step.

Changed

• The tools the shared steps fetch when the runner has none (gh,
  kubectl, kustomize) are the build for the runner's architecture, x64
  or arm64, instead of always x64. Every checksum is still verified. A
  runner of any other architecture fails with a message naming it.
  Nothing to change in a caller. The "Ensure kubectl" step of
  service-release.yml is now the shared ensure-kubectl action.

Removed

• runner-health.yml, which moved CI_RUNNER_PRIVATE to ubuntu-latest
  while linux-vm was offline or a job had waited for it over 20 minutes.
  Those hosted minutes billed against the organization's Actions budget,
  and a spent budget fails every private repository's hosted jobs at zero
  steps until the month ends. A private repository's job now waits for the
  self-hosted runner. RUNNER_HEALTH_TOKEN is no longer read, and
  CI_RUNNER_SWITCHES is no longer written.

v1.35.0

Changed

• The shared workflows and actions pin the same commit of each third-party
  action as every latere-ai repository: docker/login-action v4.8.0,
  actions/download-artifact v8.0.2, docker/setup-qemu-action v4.4.0 and
  sigstore/cosign-installer v4.1.3. The cosign that signs and verifies is
  unchanged: it is still the version actions/lib/versions.sh names.

v1.34.0

Changed

• ci-gate-bump.yml finds the module that pins latere.ai/x/ci-gate the way
  lateregate.yml does, so a repository that keeps the pin in a nested
  module (internal/gate) can call it. The daily check, the pin move, the
  gates, the commit and the issue's reproduce commands all use that module;
  the commit holds its go.mod and go.sum. The new input gate_module
  names the directory and wins over detection. A repository with the pin in
  its root go.mod sees no difference.

v1.33.0

Changed

• The release check (verified-commit, run by image-build.yml,
  service-release.yml, cli-release.yml and notes-release.yml) also
  reads every other workflow the tagged commit's branch push ran. A check a
  repository keeps in a workflow of its own, such as a device session under
  a real sandbox, now blocks a release when it failed or was cancelled, and
  is waited for while it runs, as the per-push gate is. A workflow whose run
  skipped every job, or that did not run on the commit, has no say.

Fixed

• lateregate.yml runs every step of the test job in bash. On a Windows
  runner a step without a shell runs in PowerShell, so a windows-latest
  in test.os failed at its first step.

v1.32.1

Fixed

• lateregate.yml no longer asks for actions: read. A reusable workflow
  that asks for a permission its caller does not grant fails at startup with
  no job, so since v1.32.0 every run of a caller that grants only
  contents: read failed before it began. The jobs now run with the
  caller's token: a caller that grants actions: read gets the plan from
  the last green commit, and one that does not checks the whole tree.

v1.32.0

Changed

• lateregate.yml measures the plan from the last green commit. The job that
  reads the plan runs lateregate base -since green and lists from the
  commit it prints, naming it in the log and the step summary. When the pinned
  lateregate has no base command, no run was green, or the API refuses,
  the whole tree is checked and the log says why. The workflow now asks for
  actions: read; a caller that grants only contents: read keeps working and
  checks the whole tree.
• The tools a gate installs come from the plan's needs: Node and Bun, and
  Chromium in each chromium:<dir>. A hosted gate job installs only what its
  gate needs. A pinned lateregate without needs gets the previous rule.
• The test systems come from the test entry's os, else test_os.
• The module that pins the tool is found by its tool line when
  gate_module is empty: the root, else the one tracked go.mod that has it;
  several nested ones fail the job and ask for gate_module.
• test_os, frontend_browser_package and gate_module are still accepted and
  documented as superseded by .lateregate.yaml and auto-detection.

v1.31.0

Fixed

• ci-gate-bump.yml finds the per-push caller by its uses: line. A comment
  or a header example that names lateregate.yml@v1 is no longer counted as a
  second caller, so a repository that documents the pipeline in a comment no
  longer fails the dispatch of the gate on the pin commit.

Added

• image-deploy.yml, a stage a core calls between image-build.yml and
  image-publish.yml to deploy its own release. It takes the build's
  images (one to three <ref>@<digest> lines, or <name>=<ref>@<digest>
  where the overlay names the image otherwise) and the deployments to wait
  for, sets each image by digest in deploy/prod's kustomization.yaml with
  kustomize edit set image, runs kubectl apply -k, waits for each
  Deployment, runs after_roll, removes the kubeconfig, and runs the smoke
  script, which it repeats for smoke_timeout seconds so a Deployment on the
  Recreate strategy can come back. The job runs in the production
  environment with url, refuses once a newer tag exists, and uploads the
  smoke evidence as the artifact smoke-evidence for image-publish.yml's
  evidence: '*-evidence'. The caller gates the job with its own repository
  variable and maps its secret onto DEPLOY_KUBECONFIG
  (DEPLOY_KUBECONFIG: ${{ secrets.ARCA_KUBECONFIG }}), and grants
  contents: read. examples/image-release.yml shows the job and the
  publish condition that tolerates a skipped deploy.
• actions/ensure-kubectl, actions/ensure-kustomize and
  actions/deploy-by-digest, the shared steps behind it, and
  KUBECTL_VERSION and KUSTOMIZE_VERSION in actions/lib/versions.sh
  (kubectl and kustomize outputs).

v1.30.0

Added

• service-release.yml and notes-release.yml refuse a tag whose commit did
  not pass CI. Their first step is the shared verified-commit check that
  image-build.yml and cli-release.yml already run: the tagged commit's
  per-push gate run on its branch push must have succeeded, so a tag on a
  commit whose CI failed, was cancelled or never ran builds, deploys and
  publishes nothing. Both take the same verify_workflow (empty: the
  workflow that calls lateregate.yml), wait_minutes and skip_paths
  (specs/*, *.md) inputs. A notes-release.yml caller
  now grants actions: read beside contents: write; without it the
  release fails at startup.

Changed

• wait_minutes, in every release pipeline that checks CI, defaults to
  waiting 60 minutes on a GitHub-hosted runner and to refusing at once on
  the self-hosted runner, where a waiting release held one of the two
  slots the run it waited for needed. The refusal prints the command that
  re-runs the release once CI is green. A caller that passes a number keeps
  it.
• verified-commit, in a run started on a branch rather than a tag (a
  manual rebuild from main), reads that branch's own push run of the
  commit. It used to set those runs apart as the tag push's and refuse.