Skip to content

Pullbox v1.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Jul 05:38
· 170 commits to main since this release
v1.0.2
This tag was signed with the committer’s verified signature.
DeusExTaco Adam Hernandez
SSH Key Fingerprint: mHRcR4TPWY0fMlFnIjUhngiaGSPyU+vEhYkiHS9e7vk
Verified
Learn about vigilant mode.
74ef781
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Maintenance release focused on container runtime reliability, migration
correctness, and faster self-hosted CI without weakening release gates.

Fixed

  • Added the missing PostgreSQL enum migration for paused import jobs so
    PostgreSQL deployments upgrade cleanly.
  • Made shell-free production images resilient to Python path changes between
    Docker Hardened Image builder and runtime releases.

CI / Build

  • Hardened release image validation with an Expat runtime floor, exact reviewed
    Grype exceptions, and pre-signing checks for both AMD64 and ARM64 images.
  • Routed lightweight checks to a dedicated runner, increased Python test
    parallelism, sharded browser tests, and disabled routine E2E video encoding
    while retaining opt-in diagnostics.
  • Updated the pinned CodeQL actions to 4.37.0.

Commit Details

🐛 Bug Fixes

  • preserve venv interpreter in DHI runtime (#74)
  • harden container validation and enum migrations (#72)

🧰 Chores

  • bump version to 1.0.2 for release
  • sync develop after v1.0.1 release

🏗️ CI / Build

  • bump the actions-all group across 1 directory with 3 updates (#70)
  • separate lightweight checks from test runners (#73)

🐳 Docker Images

docker pull ghcr.io/pullboxapp/pullbox:1.0.2
docker pull docker.io/pullbox/pullbox:1.0.2

Digest: sha256:fb5952ac34f13bbfdf93803732bceac1dd6569b316911fe7223f5ea08474b00d

🔐 Image Verification

Release images are signed with keyless Sigstore/Cosign using GitHub Actions OIDC.
These commands verify the exact multi-architecture image digest published by this release.

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.2$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/pullboxapp/pullbox@sha256:fb5952ac34f13bbfdf93803732bceac1dd6569b316911fe7223f5ea08474b00d

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.2$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  docker.io/pullbox/pullbox@sha256:fb5952ac34f13bbfdf93803732bceac1dd6569b316911fe7223f5ea08474b00d

Full Changelog: v1.0.1...v1.0.2

Assets 2
Loading