v1.0.0

Externa Core v1.0.0

First stable (GA) release. Cuts from v1.0.0-beta.4 with Docker quick-deploy DX, webhook + files hardening deferred from beta.4, Packagist-first install docs, opt-in upstream sync, and admin UI polish (M2A reorder, field heights). Restored on main via #138 after an accidental wipe of the GA tree.

Highlights

Docker & deploy

• GHCR multi-arch publish on v* tags, compose.quick.yaml pull path, gated RUN_SEED first-boot, healthchecks on quick Compose (#56 / #108)
• Docker CI: skip multiarch-bake on pull requests (#136)

Security & reliability

• Outbound webhooks refuse delivery when the signing secret is empty (no empty-key HMAC) (#88 / #106)
• Chunk upload flow extracted into FileChunkUploadService (#89 / #107)

Install, upgrade & in-repo docs

• README install path: stable Packagist composer create-project qiick/externa-core → php artisan externa:install (no auto-migrate); Herd / Docker / health links (#132)
• Opt-in php artisan externa:upgrade --sync-upstream=vX.Y.Z (dry-run / confirm / merge from official upstream; default upgrade still does not pull code) (#133 / #134)

Product UI

• Drag-and-drop reorder for M2A blocks (#128)
• Unify single-line field control heights (#130)

Upgrade / ops notes

• Fresh install: composer create-project qiick/externa-core then php artisan externa:install — Packagist lists stable 1.0.0
• From beta.4: run migrations as usual; set a signing secret on every outbound webhook (empty secret → no delivery)
• Quick Docker: compose.quick.yaml + .env.docker.quick.example; images from GHCR on v* tags; RUN_SEED is gated for first boot
• Optional upstream sync: php artisan externa:upgrade --sync-upstream=v1.0.0 only when you intentionally want to merge from the official remote — default externa:upgrade remains migrate / permissions / cache only
• Herd local workflow unchanged; Compose / GHCR remain the Docker paths
• Docs site GA cut still open: externa-docs #47 (release: docs 1.1.0)

Breaking / behavior changes

• Outbound webhook delivery with an empty signing secret is rejected (must configure a secret before deliveries succeed) (#88) — was a beta.4 follow-up

What's Changed

• fix(webhooks): refuse outbound delivery without signing secret (#88) by @LucaGiardi20 in #106
• refactor(files): extract FileChunkUploadService (#89) by @LucaGiardi20 in #107
• feat(docker): GHCR quick-deploy DX (#56) by @LucaGiardi20 in #108
• chore: bump version to 1.0.0 by @LucaGiardi20 in #109
• chore: sync main into develop for 1.0.0 release by @LucaGiardi20 in #111
• feat(ui): drag-and-drop reorder for M2A blocks by @LucaGiardi20 in #128
• fix(ui): unify single-line field control heights by @LucaGiardi20 in #130
• docs(readme): put install above Product UI by @LucaGiardi20 in #132
• feat(upgrade): opt-in --sync-upstream from official remote (#133) by @LucaGiardi20 in #134
• ci(docker): skip multiarch-bake on PRs by @LucaGiardi20 in #136
• release: 1.0.0 by @LucaGiardi20 in #110
• v1.0.0 (restore GA tree on main) by @LucaGiardi20 in #138

Full Changelog: v1.0.0-beta.4...v1.0.0

Follow-ups (not in this release)

• Merge docs LucaGiardi20/externa-docs#47 (docs 1.1.0 for core GA) — still open
• Optional human matrix from #24: full Docker Compose + browser CRUD / queue / realtime smoke; upgrade smoke Packagist beta.4 → 1.0.0
• Close milestone 1.0.0; move post-GA work to 1.1.0+

See milestone/board: 1.0.0 · Externa Core project