v0.1.3

Bug fixes

• Increase CI wait timeout to 15 minutes for security scan (549f71e)
• Enforce tenant isolation on 8 endpoints missing requireProjectMatch (0ae12ca)
• Add SSRF protection to notification senders and log drain service (2e15036)
• Reject unsigned webhooks, encrypt secrets before storage (6ec79b0)
• Scope CLI device-code keys, return 404 for cross-project triggers (b07c9a8)
• Release mutex before network I/O in MachinePool Prune/Release (84f03cb)
• Return errors from enterprise contract, fix audit event, use atomic downgrade (b8940d8)
• Make replay atomic, bound recursive CTE, add LIMIT to bulk cancel (2835ba4)
• Address 6 low-severity concurrency and correctness issues (f7b3f0e)
• Add LIMIT to unbounded queries, fix circuit breaker TOCTOU race (42921c2)
• Upsert project budget, increase spending lock TTL, parameterize SLA target (9b7e5bb)
• Enforce tenant isolation on 9 workflow handlers (276d988)
• Add nil check to QueryRow, prevent Stop-without-Start deadlock (89debe9)
• Add regex pattern length limit to prevent ReDoS (a9ae6fc)
• Prevent panics, retry 429s, bound UNION queries (4061342)
• Enforce tenant isolation on 15 workflow run handlers (fe9f139)
• Enforce tenant isolation on RBAC roles, secrets, and job groups (61a5231)
• Verify project_id on create handlers, validate sub/dep ownership (c8aaaf5)
• Add rate limiting to internal secret auth to prevent brute force (816fd58)
• Prevent privilege escalation via role creation and API key scoping (c525469)
• Add SSE connection limits and max duration to prevent exhaustion (bbcf81e)
• Reject URLs on DNS lookup failure to prevent DNS rebinding (6c5e02b)
• Apply statement_timeout at pool level to prevent runaway queries (82a815f)
• Resolve lint, race, and integration test failures (ad15012)
• Enforce tenant isolation on 5 remaining create handlers (a0edc73)
• Add Cache-Control no-store, validate payload_contains as JSON (757ed40)
• Block octal/hex IP SSRF bypass, cap max_attempts at 100 (cb5fc24)
• Enforce tenant isolation on 13 run-level handlers (0c731b5)
• Enforce timeout_secs cap on update and batch create paths (0ff950d)
• Fix executor shutdown deadlock and DLQ replay error mapping (297b54a)
• Suppress gosec G118 for context cancel in closure defer (cd07b93)
• Simplify health endpoint, move edition to internal-only (fd9117a)
• Bake edition into binary at compile time via build tags (25fe24e)
• Resolve all 79 lint issues in loadtest package (95bd134)
• Remove duplicated header nav controls (cff26b2)
• Show mobile header nav at lg breakpoint (00d5ba3)
• Resolve source_uri DB bug, TOCTOU double-build, and RowsAffected silencing (55cf55d)
• Prevent duplicate builds with FOR UPDATE SKIP LOCKED claim pattern (d7e0d19)
• Resolve integration test issues (edb58fe)
• Batch DeleteExpiredDeployments and index build_node_claimed_at (26abcef)
• Correct four issues in strait.json schema (STR-382) (ae91563)
• Address review findings from deployment hardening (f8b2033)
• Presigned URL size binding, GC cap, build_logs slim queries (2309fa7)
• Resolve four failing CI checks on PR #87 (c241a04)
• Add missing columns to job_run and job SELECT queries (4ad6cb5)
• Add missing $34 param for is_rollback in CreateRun INSERT (4229823)
• Correct SDK pre-install, update versions, add Trivy scan (54ea551)
• Harden code deployment pipeline against OWASP Top 10 (b9e41e9)
• Re-pin runtime image action SHAs after upstream re-tag (92dcef3)
• Upgrade trivy-action to v0.35.0 to fix missing setup-trivy dep (1d7c1b9)
• Skip row panels in dashboard validation tests (c89ce49)
• Fix -1 sentinel bug, add URL validation, cache ReverseProxy, full test coverage (d6755ed)
• Fix +Inf/NaN/negative depth parsing, duplicate name validation, goroutine context; add fuzz tests (cd031e8)
• Three correctness and performance fixes from code review (312967a)
• Harden build pipeline against credential leaks and supply chain attacks (c248064)
• Allowlist generated JS bundles in gitleaks config (f0bfc0c)
• Enforce RLS via per-request transaction and fail closed (fb8f811)
• GetWebhookSubscription takes only (ctx, id), not projectID (bf6d087)
• Apply fillfactor to job_runs partitions instead of parent (bbaef2d)
• Unblock integration tests — rls role, stream scan, jsonb assert (4171f6b)
• Seed TestRLS_JobSLOEvaluations through the pool, not an uncommitted tx (29b174e)
• Bump alpine to 3.22 and SOCI to 0.13.0 to patch CVEs blocking v0.1.3 release (#113) (201dd09)
• Bump alpine runtime to 3.23 to patch libcrypto3/libssl3 HIGH CVEs (#114) (33bc533)
• Move runtime stage to distroless/static to escape alpine CVE loop (#115) (e7cc5d3)
• Publish-images check-ci prefers successful CI runs over stale cancelled ones (#116) (4721bf1)
• Security always runs on master push; check-ci fails fast on missing runs (#117) (61e3ba2)
• Cosign TSA flag is --timestamp-server-url, not --tsa-server-url (#118) (ccd6cf8)
• Drop cosign TSA flag until compatible with signing-config auto-discovery (#119) (9b4a805)
• Drop cosign --oidc-issuer for signing-config compatibility (#120) (294af9d)
• Drop cosign verify-attestation steps; BuildKit attestations are OCI referrers (#121) (a8f8358)

Build

• Pin base image digests and track via dependabot (a0d96b2)

CI

• Add cloud API image build with BUILD_TAGS=cloud (f1a138d)
• Add release gate and post-push image verification (19ce63e)
• Multi-arch builds, cosign signing, SBOM, tighter tag strategy (d178e16)
• Arm64 trivy scan, cosign TSA timestamping, explicit CODEOWNERS (51e9256)
• Auto github release and SBOM diff via git-cliff (9007816)

Chores

• Remove all Fly.io references across the codebase (f3b42fe)
• Updated dependencies (362e53d)
• Updated dependencies (1222335)
• Drop strait-loadtest image and unused loadtest assets (613511e)
• Bump go.opentelemetry.io/otel/exporters/prometheus (6a43fce)
• Bump github.com/aws/aws-sdk-go-v2/service/ecr (65c86ee)
• Bump github.com/testcontainers/testcontainers-go/modules/postgres (a73b788)
• Bump actions/github-script from 8.0.0 to 9.0.0 (87f65f3)
• Bump actions/download-artifact from 4.3.0 to 8.0.1 (219b4a1)
• Bump docker/setup-buildx-action from 3.10.0 to 4.0.0 (6d7f325)
• Merge master into release-gate branch (3f5f832)
• Bump setup-buildx-action to v4 in publish-images.yml (3ce9d65)
• Bump github.com/testcontainers/testcontainers-go/modules/redis (2295637)
• Bump go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (b1d01b2)
• Merge master into release-gate branch (c253f52)
• Bump orhun/git-cliff-action from 4.5.1 to 4.7.1 (2d3aa93)
• Bump orhun/git-cliff-action from 4.5.1 to 4.7.1 (#104) (d1b8f8b)
• Bump actions/checkout from 4.2.2 to 6.0.2 (687570a)
• Bump docker/metadata-action from 5.10.0 to 6.0.0 (82968a9)
• Bump github.com/grafana/pyroscope-go in /apps/strait (19aad12)
• Bump github.com/danielgtaylor/huma/v2 in /apps/strait (39768b6)
• Bump golang.org/x/crypto in /apps/strait (8497394)
• Bump github.com/docker/cli in /apps/strait (48cae73)

Documentation

• Update CLAUDE.md with k8s/Hetzner infra, edition system, remove Fly.io refs (0df0018)
• Add contributor guide for the Go backend service (3d97f20)

Features

• Add end-to-end completion tracking, fix compilation and chaos bugs (c09b891)
• Add code-first job execution foundation (Phase 1) (5676a7f)
• Add build package and deployment API for code-first jobs (fb73050)
• Add build orchestrator and BuildKit integration (37598fd)
• Pin image at queue time for code-first jobs (STR-392) (b780a90)
• Phase 4 security — cache partitioning, seccomp profile, SOCI, security tests (74fb548)
• Verify tarball SHA-256 and size at confirm time (eec3016)
• Support multiple BuildKit addresses for multi-node dispatch (fdbd4af)
• Add background GC for stale pending and old failed deployments (97d4088)
• Stream build logs over SSE while build is in progress (882ef35)
• Mark runs created after rollback with is_rollback flag (a738ff0)
• Allow personality syscall for QEMU cross-compilation in BuildKit (d3881bb)
• Support authenticated private base images in BuildKit session (b63bb3a)
• Add admin endpoint to list deployments across an org (295cd3b)
• Serve strait.json schema at /schemas/v1/strait.json (STR-382) (73cc75f)
• Add deploy, auth, deployments, jobs, and init commands (ad1ae51)
• Wire IMAGE_PULL_POLICY config into K8s job container spec (5d26775)
• Instrument build pipeline with Prometheus metrics (5b7b85f)
• Add code deployments observability dashboards (eb25127)
• Tenant metrics, gvisor runtime class, and dispatcher mode (538d3b4)
• Add SOCI lazy image loading for cold-start optimization (STR-396) (1968fbf)
• Enable RLS on 16 tenant tables and FORCE on existing ones (61fb5bb)
• Add project_id to webhook_deliveries and enable RLS (0f2f264)

Other

• Merge pull request #86 from strait-dev/leonardomso/irvine (eeb8c6b)
• Merge pull request #88 from strait-dev/leonardomso/website-header-nav-fixes (9c86de8)
• Merge pull request #87 from strait-dev/leonardomso/houston (afe767e)
• Merge pull request #91 from strait-dev/leonardomso/houston (e39bbce)
• Merge pull request #92 from strait-dev/leonardomso/andorra (514345b)
• Merge pull request #103 from strait-dev/dependabot/go_modules/apps/strait/go.opentelemetry.io/otel/exporters/prometheus-0.65.0 (beb63df)
• Merge pull request #102 from strait-dev/dependabot/go_modules/apps/strait/github.com/aws/aws-sdk-go-v2/service/ecr-1.57.0 (377e115)
• Merge pull request #99 from strait-dev/dependabot/go_modules/apps/strait/github.com/testcontainers/testcontainers-go/modules/postgres-0.42.0 (2af9894)
• Merge pull request #96 from strait-dev/dependabot/github_actions/actions/github-script-9.0.0 (17de821)
• Merge pull request #94 from strait-dev/dependabot/github_actions/actions/download-artifact-8.0.1 (79936e6)
• Merge pull request #95 from strait-dev/dependabot/github_actions/docker/setup-buildx-action-4.0.0 (8a2ac06)
• Merge pull request #100 from strait-dev/dependabot/go_modules/apps/strait/github.com/testcontainers/testcontainers-go/modules/redis-0.42.0 (41ab219)
• Merge pull request #98 from strait-dev/dependabot/go_modules/apps/strait/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp-0.19.0 (c8b4c7c)
• Merge pull request #93 from strait-dev/leonardomso/release-gate (45888a9)
• Merge pull request #105 from strait-dev/dependabot/github_actions/actions/checkout-6.0.2 (d1e9af2)
• Merge pull request #107 from strait-dev/dependabot/github_actions/docker/metadata-action-6.0.0 (899af6f)
• Merge pull request #108 from strait-dev/dependabot/go_modules/apps/strait/github.com/grafana/pyroscope-go-1.2.8 (b774736)
• Merge pull request #110 from strait-dev/dependabot/go_modules/apps/strait/github.com/danielgtaylor/huma/v2-2.37.3 (7708c0f)
• Merge pull request #112 from strait-dev/dependabot/go_modules/apps/strait/golang.org/x/crypto-0.50.0 (6f0d9a9)
• Merge pull request #109 from strait-dev/dependabot/go_modules/apps/strait/github.com/docker/cli-29.4.0incompatible (3fa0d60)

Performance

• Drop 19 redundant indexes and add missing batch job index (eef0588)
• Restore four job_runs indexes lost during partitioning migration (0cf0ad8)
• Composite parent_run_id index and jobs metadata GIN (207f4ae)
• Fillfactor 85 and extended autovacuum coverage (921fd28)
• Pool HealthCheckPeriod and expand REINDEX targets (a2a1166)
• Rewrite AggregateHourlyStats to eliminate ARRAY_AGG correlated subquery (e88350b)
• Partial indexes for active api_keys and enabled log_drains (a6818ea)

Refactoring

• Extract buildExecutor interface for testable orchestrator dispatch (878072d)
• Add context-aware DBTX wrapper for per-request transactions (d572842)

Reverts

• Move CLI commands to strait-dev/cli repo (d5b410e)

Tests

• Add 38 tests for SDK terminal, guardrails, and telemetry handlers (90fe4b6)
• Add 48 tests for 10 untested webhook event handlers (fbec687)
• Add environment CRUD, export edge case, and fuzz tests (fd1038d)
• Add reaper, shutdown, version policy, and trigger tests (056de7a)
• Add 100+ adversarial SSRF tests and 2 fuzz targets (2e6ab64)
• Adversarial + fuzz tests for code-first pipeline (STR-397) (7850e12)
• Adversarial trigger tests for code-first jobs (af85b78)
• Fuzz targets for Dockerfile generation, log channels, and pagination (d05a81e)
• Add timed_out API status unit test (c3586da)
• Verify ConfirmNotCalled when hash verification fails (5067011)
• Comprehensive store integration tests for deployment methods (b7b91c2)
• Fill adversarial and fuzz coverage gaps (STR-397) (022377c)
• Cover ListBuildingDeployments and CreateCodeDeployment edge cases (102b288)
• Cover handler branches in list, rollback, admin, logs, confirm endpoints (2a179af)
• Cover orchestrator dispatch and releaseStale branches (eb7c0b3)
• Cover handlePodPhase, extractExitInfo, and nil-metrics paths (00016f1)
• Expand SOCI test coverage with adversarial, integration, and fuzz tests (1b9ad07)
• Cross-tenant RLS isolation integration tests (e0e6df0)
• Integration tests for idempotency, rotation, log drains (072ec83)
• Integration tests for streams, counts, and cross-tenant gets (6e525be)
• Cross-tenant adversarial test suite (b929edc)
• Fill coverage for 4 remaining untested store methods (2b8ff62)
• Delayed run promotion and dequeue integration (6ed7fff)
• Fuzz targets for metadata filters, keys, secrets, validators (cd5e6de)