v0.13.0

Breaking changes

• fix(webhook): enforce non-empty webhook secret by @corrieriluca in #953
  • 🛡️ This fixes a critical vulnerability in Burrito: Unauthenticated /api/webhook accepts forged events when webhookSecret is unset, triggering unauthorized Terraform plans GHSA-7m68-72r6-3jx8
  • This is a breaking change, Burrito does not accept anymore empty webhook secrets, webhooks events are rejected if they target a repository that has no/empty webhook secret

New features / Bug fixes

• fix(controller): plan and apply should use last branch commit by @corrieriluca in #948
  • Fix a bug where a Layer could infinitely stay in Idle because the TerraformRun cannot find the bundle in datastore (e.g. when using lifecyles in S3)
• feat: pull request polling by @DjinnS in #936
  • Webhook are no longer needed by Burrito to catch new Pull Requests opened on a repository. If the provider is supported (GitHub/GitLab) Burrito polls regularly API to detect new Pull Requests
• fix(docker): add libc6-compat for glibc compatibility by @Watakolo in #956
  • This makes work Terraform providers needing glibc (e.g. IBM Cloud)

Minor changes

• feat(helm): add Gateway API HTTPRoute support to the burrito-server by @somaz94 in #927
• docs: explain private provider registry auth by @ded-furby in #922
• docs: add Burrito scheduling recommendations by @narutamaaurum in #919
• feat(ci): add trivy scan by @Alexandre-BARBIER in #929
• chore(ai): initiale AGENTS.md file by @DjinnS in #902
• docs: add nested AGENTS.md for internal packages, clarify commit scopes by @nlevee in #942
• feat(ci): rework release process to make changes before tag is pushed by @Alexandre-BARBIER in #917
• feat(ci): sign images and charts by @Alexandre-BARBIER in #944

Dependency updates

• chore(release): bump version to v0.12.0 by @github-actions[bot] in #918
• chore(deps): update module github.com/coreos/go-oidc/v3 to v3.18.0 by @renovate[bot] in #879
• chore(ui): update dependencies by @Alexandre-BARBIER in #930
• chore(deps): update module google.golang.org/api to v0.287.0 by @renovate[bot] in #880
• chore(deps): update module github.com/labstack/echo/v4 to v4.15.4 by @renovate[bot] in #934
• chore(deps): update cloud storage libraries by @renovate[bot] in #872
• fix(renovate): lowercase commit subject to satisfy commitlint by @DjinnS in #937
• chore(deps): update module github.com/coreos/go-oidc/v3 to v3.20.0 by @renovate[bot] in #932
• chore(deps): update kubernetes monorepo to v0.36.2 by @renovate[bot] in #883
• chore(docker): Update Docker images by @renovate[bot] in #924
• chore(gha): daily schedule for trivy scan by @corrieriluca in #955
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 by @dependabot[bot] in #957
• chore(deps): update all UI libs by @corrieriluca in #958
• chore(deps): update github actions by @renovate[bot] in #870
• chore(deps): update module github.com/go-git/go-git/v5 to v5.19.2 by @renovate[bot] in #959
• chore(deps): update to react-router v8 by @corrieriluca in #966
• chore(deps): update go toolchain directive to v1.26.5 by @renovate[bot] in #874
• chore(release): bump version to v0.13.0 by @github-actions[bot] in #968

New Contributors

• @ded-furby made their first contribution in #922
• @narutamaaurum made their first contribution in #919
• @Alexandre-BARBIER made their first contribution in #930
• @somaz94 made their first contribution in #927
• @nlevee made their first contribution in #942
• @dependabot[bot] made their first contribution in #957
• @Watakolo made their first contribution in #956

Full Changelog: v0.12.0...v0.13.0