SecondShift v0.1.0b2

Pull the service image

docker pull ghcr.io/piotrekno1/second-shift:0.1.0b2

Public image for Linux amd64 and arm64; no registry login required. Both native builds and an anonymous pull were verified. Production Compose uses this version for all application services.

Multi-platform digest: sha256:360419e18da82c731dba45503291336cd50db8de8160703f2f19809c0dc5a372.

Package and image versions.

Install uv and start Docker, then download the wheel below and run:

uvx --python 3.13 --from ./secondshift-0.1.0b2-py3-none-any.whl secondshift up

For a persistent installation:

uv tool install --force --python 3.13 ./secondshift-0.1.0b2-py3-none-any.whl
secondshift up

SecondShift 0.1.0b2

This beta updates the TLS certificate bundle and adds published service images.

Security update

Require certifi>=2026.10.19 and update the lockfile to a patched release. GitHub
Dependabot reported that the older bundle trusts emSign root CAs with compromised
intermediate CA keys. Upgrade beta 1 installations to beta 2 before deployment.

Container deployment

The service image is published at
ghcr.io/piotrekno1/second-shift:0.1.0b2 for Linux amd64 and arm64. Web, worker,
gateway, and runner use the same image with separate role configuration.
Production Compose now pulls the versioned image instead of building locally.
Beta releases do not advance the stable latest image tag.

The container publishing job runs after the wheel release; wait for that job to
finish before pulling a newly released version.

Upgrade compatibility

From beta 1, retain your existing data, private configuration, and encryption
keys; install the new wheel or update the pinned container image and follow the
normal migration commands. This release adds no database migrations.

From older alpha builds, fresh databases are still required. The migration
reset has no automated data conversion path. Stop and back up the installation,
then follow the detailed beta 1 upgrade instructions.
Repositories, connections, approvals, and schedules need to be configured again
when starting fresh.

The existing beta limitations still apply: target-host gVisor execution, a full
GitHub import and production job run, public HTTPS issuance, production S3
permissions, and backup restoration require deployment validation. See the
deployment guide.

What's Changed

• Publish GHCR images and release security beta 0.1.0b2 by @piotrekno1 in #38

Full Changelog: v0.1.0b1...v0.1.0b2