SecondShift v0.1.0b2

Pull the service image

docker pull ghcr.io/piotrekno1/second-shift:0.1.0b2

Public image for Linux amd64 and arm64; no registry login required. Both native builds and an anonymous pull were verified. Production Compose uses this version for all application services.

Multi-platform digest: sha256:360419e18da82c731dba45503291336cd50db8de8160703f2f19809c0dc5a372.

Package and image versions.

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0b2-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0b2-py3-none-any.whl
secondshift up

SecondShift 0.1.0b2

This beta updates the TLS certificate bundle and adds published service images.

Security update

Require certifi>=2026.10.19 and update the lockfile to a patched release. GitHub
Dependabot reported that the older bundle trusts emSign root CAs with compromised
intermediate CA keys. Upgrade beta 1 installations to beta 2 before deployment.

Container deployment

The service image is published at
ghcr.io/piotrekno1/second-shift:0.1.0b2 for Linux amd64 and arm64. Web, worker,
gateway, and runner use the same image with separate role configuration.
Production Compose now pulls the versioned image instead of building locally.
Beta releases do not advance the stable latest image tag.

The container publishing job runs after the wheel release; wait for that job to
finish before pulling a newly released version.

Upgrade compatibility

From beta 1, retain your existing data, private configuration, and encryption
keys; install the new wheel or update the pinned container image and follow the
normal migration commands. This release adds no database migrations.

From older alpha builds, fresh databases are still required. The migration
reset has no automated data conversion path. Stop and back up the installation,
then follow the detailed beta 1 upgrade instructions.
Repositories, connections, approvals, and schedules need to be configured again
when starting fresh.

The existing beta limitations still apply: target-host gVisor execution, a full
GitHub import and production job run, public HTTPS issuance, production S3
permissions, and backup restoration require deployment validation. See the
deployment guide.

What's Changed

• Publish GHCR images and release security beta 0.1.0b2 by @piotrekno1 in #38

Full Changelog: v0.1.0b1...v0.1.0b2

SecondShift v0.1.0b1

Upgrade to v0.1.0b2. Beta 2 fixes the certifi CA trust advisory affecting beta 1’s locked dependencies. Use beta 2 for new installations and deployments.

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0b1-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0b1-py3-none-any.whl
secondshift up

SecondShift 0.1.0b1

The first beta adds GitHub App repository import and synchronization, a
production Compose example, and service-scoped container configuration.
This is a prerelease for broader testing, not a release candidate.

Upgrade from alpha: fresh database required

Database migrations were reset to the current application structure, and the
legacy automations and integrations apps were removed. Existing alpha databases
cannot be upgraded in place with migrate. This release has no automated data
conversion path.

Stop SecondShift and back up the existing databases, private environment files,
and runner storage before upgrading. Keep the old version available if you need
to return to its data.

For an installed local build using the default data directory, move
~/.secondshift aside before starting the beta. It creates a fresh installation;
repositories, connections, approvals, and schedules must be configured again.
Use the corresponding directory if you configured a different data location.

For a server deployment with an existing alpha database, provision fresh
application and runner databases and initialize them using the deployment guide.
Preserve the old databases and storage until the new deployment is verified.

Included

• GitHub App authorization, repository and branch selection, pinned source
  imports, and polling for changes. Source access is separate from job MCP
  permissions and GitHub sign-in.
• A single-server Docker Compose deployment with Caddy HTTPS, separate
  PostgreSQL application and runner databases, private S3 artifacts, and gVisor.
• Separate environment files for web, worker, gateway, and runner services.
• A workspace switcher that matches the dashboard, shows membership roles,
  and clearly marks the current workspace.

Validation and limitations

Local integration checks cover fresh PostgreSQL migrations, private S3 artifact
uploads and reads through RustFS, and HTTPS through Caddy's local CA. Release
checks build and install the wheel in a clean environment and exercise sandbox
execution, reports, and webhook delivery with a simulated model provider.

Full production execution under gVisor still requires a target-host test. Verify
one complete GitHub import and job run, the production bucket's permissions,
public certificate issuance, and backup restoration before enabling schedules.
GitHub sync uses polling; bundles are limited to 64 MiB, and Git LFS objects and
submodule contents are not downloaded. The Compose example uses a single server
and updates have downtime.

Setup guides: GitHub App,
production deployment.

What's Changed

• Add local repository directory browser by @termin86 in #20
• Organize API endpoints and schemas by owning submodules by @piotrekno1 in #21
• Split automation domains into jobs, runs, and connections apps by @piotrekno1 in #22
• Package reusable review skills as examples and add security regression review by @piotrekno1 in #23
• Propose on-call coverage checks against explicit time off by @piotrekno1 in #24
• Propose quarterly access review example by @piotrekno1 in #25
• Replace icon fonts with MDI SVGs and preserve Vite asset hashes by @piotrekno1 in #27
• Use SECONDSHIFT environment names without compatibility aliases by @piotrekno1 in #28
• Centralize Gunicorn configuration for HTTP services by @piotrekno1 in #29
• Unify service logging and fix Django logger propagation by @piotrekno1 in #30
• Simplify local development configuration and initialization by @piotrekno1 in #31
• Prepare the production image with scoped service configuration by @piotrekno1 in #26
• Reset migrations and remove obsolete automation and integration apps by @piotrekno1 in #34
• Add GitHub App repository import and syncing by @piotrekno1 in #35
• Add a production Compose deployment example by @piotrekno1 in #33
• Clarify local quick start and production deployment by @piotrekno1 in #36
• Prepare SecondShift 0.1.0b1 beta release by @piotrekno1 in #37

New Contributors

• @termin86 made their first contribution in #20

Full Changelog: v0.1.0a6...v0.1.0b1

SecondShift v0.1.0a6

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0a6-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0a6-py3-none-any.whl
secondshift up

What's Changed

• Add OpenRouter and automatic searchable model pickers by @piotrekno1 in #18
• Squash migrations and keep the files they replace by @piotrekno1 in #19

Full Changelog: v0.1.0a5...v0.1.0a6

SecondShift v0.1.0a5

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0a5-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0a5-py3-none-any.whl
secondshift up

What's Changed

• Multi-workspaces & access by @piotrekno1 in #12
• Repository background sync by @piotrekno1 in #13
• Complexity lint by @piotrekno1 in #14
• Key runner sessions by a random per-run key by @piotrekno1 in #15
• Put the run status on its own line in notifications by @piotrekno1 in #16
• Separate the notification title, summary and link with blank lines by @piotrekno1 in #17

New Contributors

• @piotrekno1 made their first contribution in #12

Full Changelog: v0.1.0a4...v0.1.0a5

SecondShift v0.1.0a4

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0a4-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0a4-py3-none-any.whl
secondshift up

Full Changelog: v0.1.0a3...v0.1.0a4

SecondShift v0.1.0a3

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0a3-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0a3-py3-none-any.whl
secondshift up

Full Changelog: v0.1.0a2...v0.1.0a3

SecondShift v0.1.0a2

Second alpha release with the fixes and setup flow shown in the product demo.

Changes

• Fix approval of capability requests that already have a pending grant.
• Align connection forms, connection actions, and job rows with webhook requirements.
• Improve the README with the product demo, configuration guide, and clear ownership boundaries.
• Add a private vulnerability reporting policy in SECURITY.md.

Try it out

Install uv and start Docker, then run:

release=https://github.com/piotrekno1/second-shift/releases
uv tool install --force --python 3.13 \
  "$release/download/v0.1.0a2/secondshift-0.1.0a2-py3-none-any.whl"
secondshift up

The install command also replaces an existing SecondShift tool installation.

This is an early alpha for trusted repositories on a single machine. Command sandboxes are offline. MCP and API tool execution is not available yet. Webhook notifications are supported.

SecondShift v0.1.0a1

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0a1-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0a1-py3-none-any.whl
secondshift up

Full Changelog: https://github.com/piotrekno1/second-shift/commits/v0.1.0a1