OpsWarden v1.0.14

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.14_amd64.deb
Linux (portable)	OpsWarden_1.0.14_amd64.AppImage
Windows	OpsWarden_1.0.14_x64-setup.exe
macOS	OpsWarden_1.0.14_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:345a22971c8305bca973515b31438baae69c295c3d2f6e2fa3ff5603016f2a3a

Production pins this digest, never a mutable tag.

What's Changed

• docs: close P0-P3 in production by @RomeoCavazza in #139
• fix(desktop): repair the Compose desktop build and guard its pins by @RomeoCavazza in #143
• fix(server): make the listen socket configurable by @RomeoCavazza in #144
• feat(security): bound credential guessing and close the backend audit by @RomeoCavazza in #145
• chore(deps): bump the github-actions group across 1 directory with 8 updates by @dependabot[bot] in #140
• chore(deps): bump the server-minor-and-patch group across 1 directory with 7 updates by @dependabot[bot] in #142
• chore(deps): bump the npm group and keep the vitest pair hoisted by @RomeoCavazza in #146
• Release v1.0.14 by @RomeoCavazza in #148

New Contributors

• @dependabot[bot] made their first contribution in #140

Full Changelog: v1.0.13...v1.0.14

OpsWarden v1.0.13

OpsWarden v1.0.13 closes the P0–P3 recovery and hardening roadmap.

Alertmanager acceptance

• The rule form exposes both alert_firing and alert_resolved and explains
  that resolution is an independent event, not an automatic incident close.
• Component and real-browser tests cover the lifecycle contract at a mobile
  viewport.
• The exact 1 MiB body boundary is tested.
• A pinned, bounded mutation campaign tested 48 mutations in the Alertmanager
  trust boundary: 45 caught, three compile-time unviable, none surviving.

Deployment security

• Browser WebSocket upgrades require an exact configured Origin; cross-site,
  null, malformed and repeated origins receive HTTP 403 before upgrade.
  Originless native clients remain supported and still authenticate in-band.
• Every application Docker build/runtime base is pinned to an immutable
  multi-architecture SHA-256 digest, with a CI regression gate.
• New SQL migrations are immutable and explicitly classified as expand,
  backfill or contract. Destructive SQL is rejected from compatible phases.

The companion Ops releases add backup freshness alerts, guarded Kubernetes
release-state restoration and centralized Loki/Alloy log collection.

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.13_amd64.deb
Linux (portable)	OpsWarden_1.0.13_amd64.AppImage
Windows	OpsWarden_1.0.13_x64-setup.exe
macOS	OpsWarden_1.0.13_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:1acd2b9bff23bf61bd014cfe38d1680ab0f9a9bd301a15c8f167720d7b488919

Production pins this digest, never a mutable tag.

What's Changed

• docs: reconcile roadmap after v1.0.12 by @RomeoCavazza in #130
• refactor: split websocket and reaction tests by @RomeoCavazza in #131
• refactor(server): split automation config domain by @RomeoCavazza in #132
• refactor(server): split PostgreSQL adapter tests by @RomeoCavazza in #133
• refactor: finish splitting oversized source files by @RomeoCavazza in #134
• docs: reconcile the post-backup roadmap by @RomeoCavazza in #135
• test(alertmanager): enforce lifecycle acceptance by @RomeoCavazza in #136
• feat(security): complete P3 deployment hardening by @RomeoCavazza in #137
• Release v1.0.13 by @RomeoCavazza in #138

Full Changelog: v1.0.12...v1.0.13

OpsWarden v1.0.12

OpsWarden v1.0.12 completes the Alertmanager lifecycle contract introduced
in v1.0.11.

Alert lifecycle

• Each alert in an Alertmanager notification group is handled independently.
• firing and resolved alerts produce distinct alert_firing and
  alert_resolved events, including mixed-status groups.
• Semantic idempotency ignores retries whose JSON formatting, labels,
  annotations or provisional firing endsAt changed, while preserving genuine
  lifecycle transitions.
• Receiving alert_resolved does not implicitly close an Incident. Teams
  choose the reaction attached to that event.

Operations and verification

• /metrics exposes bounded Alertmanager delivery counters for accepted,
  rejected, duplicate, ignored and failed outcomes.
• HTTP and persistence tests cover the 1 MiB limit, authentication, provider
  mismatch, disabled rules, Team isolation and failed reactions.
• The critical E2E configures the official Alertmanager v0.32.1 image pinned
  by digest and proves a firing alert followed by its resolution as two durable
  automation runs.

The feature CI and the post-merge main gate passed before this release was
prepared.

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.12_amd64.deb
Linux (portable)	OpsWarden_1.0.12_amd64.AppImage
Windows	OpsWarden_1.0.12_x64-setup.exe
macOS	OpsWarden_1.0.12_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:6468bd3eb43b410ccc911c3dab0cade0696180932e765559df34bd88f2ead026

Production pins this digest, never a mutable tag.

What's Changed

• Document Alertmanager and remaining roadmap by @RomeoCavazza in #127
• feat: complete Alertmanager lifecycle handling by @RomeoCavazza in #128
• Release v1.0.12 by @RomeoCavazza in #129

Full Changelog: v1.0.11...v1.0.12

OpsWarden v1.0.11

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.11_amd64.deb
Linux (portable)	OpsWarden_1.0.11_amd64.AppImage
Windows	OpsWarden_1.0.11_x64-setup.exe
macOS	OpsWarden_1.0.11_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:67daa3347a7bdc4ac15563d400f855a581230ff15d5c4095f77b63972dcffef2

Production pins this digest, never a mutable tag.

What's Changed

• Harden delivery and add Alertmanager integration by @RomeoCavazza in #125
• Release v1.0.11 by @RomeoCavazza in #126

Full Changelog: v1.0.10...v1.0.11

OpsWarden v1.0.10

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.10_amd64.deb
Linux (portable)	OpsWarden_1.0.10_amd64.AppImage
Windows	OpsWarden_1.0.10_x64-setup.exe
macOS	OpsWarden_1.0.10_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:9011f15c791e21eccb07eac7c4ef9b18e0479845b9e09dcb63118adf70c0e1a8

Production pins this digest, never a mutable tag.

What's Changed

• feat: integrate alertmanager by @RomeoCavazza in #122
• revert: restore v1.0.9 after incomplete Alertmanager integration by @RomeoCavazza in #123
• Release v1.0.10 by @RomeoCavazza in #124

Full Changelog: v1.0.9...v1.0.10

OpsWarden v1.0.9

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.9_amd64.deb
Linux (portable)	OpsWarden_1.0.9_amd64.AppImage
Windows	OpsWarden_1.0.9_x64-setup.exe
macOS	OpsWarden_1.0.9_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:7a04b42b41ab044d3fd3379d7d166fcb959bd51bbbaf4525aaf1f5d83daded1f

Production pins this digest, never a mutable tag.

What's Changed

• feat(channels): implement team channels and RBAC by @RomeoCavazza in #121

Full Changelog: v1.0.8...v1.0.9

OpsWarden v1.0.8

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.8_amd64.deb
Linux (portable)	OpsWarden_1.0.8_amd64.AppImage
Windows	OpsWarden_1.0.8_x64-setup.exe
macOS	OpsWarden_1.0.8_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:767ab6c653ece2aa06ee46babac9ae93939a499bcb4c41c27192de3cd25fa209

Production pins this digest, never a mutable tag.

What's Changed

• fix(release): annotate the release tag by @RomeoCavazza in #118
• feat(release): write release notes worth reading by @RomeoCavazza in #119

Full Changelog: v1.0.7...v1.0.8

OpsWarden v1.0.7

OpsWarden can now send an email when an automation rule fires.

A Manager configures a Team-scoped SMTP connection — host, port, username,
password and sender address, all encrypted at rest — and any rule can react with
email_notify. Subject and body accept the same templates as the other
reactions, so an alert can name the workflow, repository and branch that failed.
Delivery runs through the existing durable engine, so a failure is recorded
against the connection and surfaced like any other reaction error.

The connection can be tested before use: the probe opens an authenticated SMTP
session and issues NOOP, so credentials are verified without mailing anyone.

Also in this release

• Cutting a release is now one command, just release <version>. It rewrites
  every version-bearing file, refreshes the three lockfiles that embed the
  version, verifies all of them agree, then commits and tags.
• verify_release_version.sh checks nine values instead of five. The lockfiles
  were previously unchecked, and a stale one does not fail the gate — it dirties
  the working tree during the release build, which is far harder to diagnose.

Install

Platform	Artifact
Linux (Debian/Ubuntu)	OpsWarden_1.0.7_amd64.deb
Linux (portable)	OpsWarden_1.0.7_amd64.AppImage
Windows	OpsWarden_1.0.7_x64-setup.exe
macOS	OpsWarden_1.0.7_aarch64.dmg

Verify a download against SHA256SUMS. Every artifact carries a GitHub
build-provenance attestation.

Server image

ghcr.io/opswarden-git/opswarden-server@sha256:e6e1d4483d6074a4ac5037d338a66ca2913f60dd671f0f3286bcd8a881aa0e6c

Production pins this digest, never a mutable tag.

What's Changed

• Remove remaining pedagogical comments by @RomeoCavazza in #114
• feat(automation): implement resilient timer triggers (Run 3) by @RomeoCavazza in #115
• feat(automation): add the Email REAction vertical (Run 4) by @RomeoCavazza in #116
• chore(release): script the version bump and cover the lockfiles by @RomeoCavazza in #117

Full Changelog: v1.0.6...v1.0.7

v1.0.6

What's Changed

• Make OpsWarden branding canonical by @RomeoCavazza in #113

Full Changelog: v1.0.5...v1.0.6

v1.0.5

What's Changed

• Add Generic Webhook automation vertical by @RomeoCavazza in #111
• Release v1.0.5 by @RomeoCavazza in #112

Full Changelog: v1.0.4...v1.0.5