opendevops v0.1.2

v0.1.2 expands production deployment options while keeping the local executor and SQLite as the
defaults. It adds a production-capable remote executor topology, shared Postgres state, additional
LLM providers, external secret backends, and policy-gated cloud mutations.

Highlights

• Production-capable remote executor: requests route to dedicated
  staging/prod × ro/rw services. Signed decision tokens bind the environment, channel, and
  SSH host; executor pods reject identity mismatches before execution. ssh_run now uses the
  remote executor, so the agent process no longer needs the SSH key.
• Postgres control-plane storage: capability grants and dashboard chat can share a Postgres
  backend for multi-replica deployments. SQLite remains the default for local and single-replica
  installations.
• More model providers: provider configuration now supports Anthropic, OpenAI,
  OpenAI-compatible endpoints, Azure OpenAI, Google, and Amazon Bedrock, with optional dependency
  groups for non-default providers.
• External secret sources: {{secret:NAME}} values can come from environment variables,
  mounted files such as CSI volumes, or HashiCorp Vault KV v2.
• Curated cloud write policies: new AWS, Google Cloud, and Azure write packs allow dry-run
  operations and escalate non-dry-run mutations through the existing typed capability-grant flow.
• Dashboard grant wizard: the change-control UI now guides operators through proposal,
  approval, and activation, with clearer role gating, limits, and proposal details.

Upgrade notes

• Remote-executor deployments must replace the single executor.url setting with the complete
  executor.urls[environment][channel] map and set
  OPENDEVOPS_EXECUTOR_ENV/OPENDEVOPS_EXECUTOR_CHANNEL on every executor service.
• Cloud write packs require distinct credential_env_rw identities. Configure least-privilege
  write credentials or remove the write-pack files in read-only deployments.
• Postgres is opt-in through control_plane.backend: postgres and database_url_env. This release
  does not automatically migrate existing SQLite state.
• Install the relevant optional dependency group before selecting a non-Anthropic model provider:
  models-openai, models-google, or models-bedrock.

Install

uv tool install "opendevops[checkpoint,ssh]==0.1.2"

Deploy

curl -fLO \
  https://github.com/skundu42/opendevops/releases/download/v0.1.2/opendevops-deploy-0.1.2.tar.gz
tar -xzf opendevops-deploy-0.1.2.tar.gz
cd opendevops-0.1.2
cp .env.example .env

The deployment bundle pins ghcr.io/skundu42/opendevops:0.1.2 and supports linux/amd64 and
linux/arm64.

Full changelog: v0.1.1...v0.1.2

opendevops v0.1.1

Full Changelog: v0.1.0...v0.1.1

opendevops v0.1.0

The first public release of opendevops packages the policy-gated operations agent as prebuilt,
versioned artifacts. Users no longer need to clone the repository or compile the TypeScript
dashboard.

Install the CLI

uv tool install \
  'opendevops[checkpoint,ssh] @ https://github.com/skundu42/opendevops/releases/download/v0.1.0/opendevops-0.1.0-py3-none-any.whl'
opendevops init opendevops-workspace

The universal wheel contains the compiled dashboard, starter configuration, policy packs, and
Kubernetes bootstrap files. PyPI trusted publishing is prepared but intentionally disabled until
the project’s one-time PyPI publisher registration is completed.

Run the service

curl -fLO \
  https://github.com/skundu42/opendevops/releases/download/v0.1.0/opendevops-deploy-0.1.0.tar.gz
tar -xzf opendevops-deploy-0.1.0.tar.gz
cd opendevops-0.1.0
cp .env.example .env
# Fill every required blank in .env.
docker compose pull
docker compose up -d

The deployment bundle pins ghcr.io/skundu42/opendevops:0.1.0, published for linux/amd64 and
linux/arm64.

Image digest:

sha256:d6c08044fdfb922e80bec0eedfaeae533a709e8cc7d6e51cbf2573038e7e2155

Highlights

• Default-deny, argv-only execution with credential separation and output scrubbing.
• Kubernetes, GitHub, AWS, Google Cloud, Azure, and structured SSH policy families.
• OIDC authentication, viewer/operator/approver/admin RBAC, requester/approver separation, and
  server-side session revocation.
• Expiring capability grants, dry-run enforcement, repeat/failure limits, and bounded dangerous
  actions.
• Authenticated dashboard chat, live run telemetry, approvals, cancellations, costs, policy
  decisions, audit integrity, and OpenTelemetry signals.
• CLI, HTTP, Slack, scheduler, Alertmanager, and GitHub webhook interfaces.
• Hash-chained audit logs, release checksums, artifact provenance, container SBOMs, and signed OCI
  provenance.

Verify

Download SHA256SUMS with the release artifacts, then run:

sha256sum -c SHA256SUMS
gh attestation verify opendevops-0.1.0-py3-none-any.whl \
  --repo skundu42/opendevops
docker buildx imagetools inspect ghcr.io/skundu42/opendevops:0.1.0

See the getting-started guide,
deployment guide, and
security model
before connecting real infrastructure.