v1.5.4

A patch release for the 1.5 line: private-git-module credentials that were silently doing nothing, and a base-image OpenSSL update.

Bug Fixes

• Private git module credentials now work. A workspace with git_http_auth or git_ssh_auth credentials got none of them. $HOME in the runner Job sat on the read-only root filesystem, so the git configuration could not be written at all; the failure was logged at warning and the run continued without credentials. init then failed against a private module source with an authentication error that named neither the credential nor the cause — while the log line above it said auth had been configured. (#1442)

  Three changes: $HOME is now a writable volume in the runner Job; credentials that cannot be applied fail the run, naming the count and the path, instead of being skipped; and Terrapod asks git whether it actually reads the configuration, rather than inferring success from having written a file.

  The $HOME fix is not git-specific — anything consulting it was equally affected, including helm's repository cache, kubectl's, and the AWS CLI's configuration. The runner's root filesystem stays read-only.

  If you worked around this with HOME or GIT_CONFIG_GLOBAL in runner_extra_env, both can be removed after upgrading. Leaving them set is harmless.

Security

• Rebuilt against a refreshed base image, clearing an OpenSSL advisory affecting v1.5.3 (GHSA-cxxc-cvx5-r9cr): openssl / libssl3t64 / openssl-provider-legacy move from 3.5.6-1~deb13u2 to 3.5.7-1~deb13u2. No configuration change required.

Status

Stable — a drop-in upgrade from v1.5.3. No schema, API, configuration or Helm-values changes.

Full Changelog: v1.5.3...v1.5.4