control-worker 1.1.2

Changelog

• 11416bf: Dev: consolidate dev Docker build into single shared stage with named ta (#6755) (@chronark)
• 02d091b: Disable Depot cache mount in Go CI workflow (#6675) (@chronark)
• 5b37212: Enable parallel golangci-lint runners (#6733) (@chronark)
• aa55b0e: Prevent env var draft persistence from leaking secrets to storage (#6695) (@MichaelUnkey)
• 38f5a2e: Replace memory metric separator (#6633) (@chronark)
• 69f7e4f: Show SDK error details in dashboard toasts (#6657) (@chronark)
• 85fdddd: Stale data page clamp races filter sort (#6650) (@MichaelUnkey)
• 40b4887: Unvalidated region env var healthcheck (#6653) (@MichaelUnkey)
• 9bc15ae: Update dashboard task to remove build option (@chronark)
• 21f1fe0: Update overview.mdx (@perkinsjr)
• fae559c: Update overview.mdx (@perkinsjr)
• e419877: Update regions.mdx (#6753) (@perkinsjr)
• 2d8019f: Update secret_scanning_key_detected.tsx (@perkinsjr)
• f75b574: Update turbo.json (@perkinsjr)
• 13bd066: chore(api): add generated TypeScript SDK source (#6717) (@chronark)
• ede3e96: chore(api): log denied principal permissions (#6663) (@chronark)
• 3af203b: chore: remove Bazel build files (#6651) (@chronark)
• 4ab5743: chore: replace Radix with Base UI (#6689) (@perkinsjr)
• 698ce98: ci: use local path for cache (#6676) (@chronark)
• 95b3d57: dev: docker prune settings and scoped image watches for Tilt (#6674) (@Flo4604)
• 898017f: docs(billing): compute billing and spend cap guides (#6619) (@Flo4604)
• 0cd9f7c: docs(frontline): expand control env names (#6725) (@chronark)
• 414d70d: docs: define deploy instance availability expectations (#6647) (@chronark)
• fbf5aa0: docs: document krane deployment model (#6646) (@chronark)
• d2658f4: docs: fix key migration guide and add internal runbook (#6614) (@chronark)
• 3a95359: drop bazel (#6648) (@chronark)
• 6165ae7: feat(api): add env update (#6555) (@ogzhanolguncu)
• e670bc7: feat(api): add environment variable list endpoint (#6601) (@ogzhanolguncu)
• f98f9cb: feat(api): add environments list endpoint (#6534) (@ogzhanolguncu)
• 5c94778: feat(api): add get environment endpoint (#6509) (@ogzhanolguncu)
• a3191ec: feat(api): add getDeployment endpoint (#6623) (@ogzhanolguncu)
• eb10216: feat(api): add key-related permissions to api handlers (#6584) (@chronark)
• 138a127: feat(api): add list policies endpoint (#6727) (@ogzhanolguncu)
• dd1c02d: feat(api): add remove environment variables endpoint (#6596) (@ogzhanolguncu)
• 8db8e7d: feat(api): add set environment variable (#6573) (@ogzhanolguncu)
• 9ffecc1: feat(api): add update policy endpoint (#6730) (@ogzhanolguncu)
• 5c6a0b1: feat(api): authorize identity actions on project-scoped URNs (#6732) (@chronark)
• 30c1262: feat(api): deployments list endpoints (#6636) (@ogzhanolguncu)
• c38a3ca: feat(api): free-form search for identities list (#6639) (@chronark)
• 830c43d: feat(api): free-form search for roles list (#6640) (@chronark)
• 58027cd: feat(api): promote deployment endpoint (#6660) (@ogzhanolguncu)
• bd66959: feat(api): rollback deployment endpoint (#6661) (@ogzhanolguncu)
• 086599b: feat(api): start deployment endpoint (#6659) (@ogzhanolguncu)
• a9abbc9: feat(api): stop deployment endpoint (#6658) (@ogzhanolguncu)
• be7213a: feat(api,frontline): write verification source again (#6706) (@Flo4604)
• 464040c: feat(billing): Deploy spend-cap detection and budget alerts (ENG-2904) (#6486) (@Flo4604)
• 76dea29: feat(billing): meter active keys for Deploy (#6450) (@Flo4604)
• 9ff03ac: feat(clickhouse): insert only the columns we want to (#6696) (@Flo4604)
• d12888f: feat(clickhouse): source dimension for verifications (#6448) (@Flo4604)
• 6e00bfc: feat(ctrl): Deploy spend-cap enforcement suspend/resume (ENG-2923) (#6542) (@Flo4604)
• e701097: feat(ctrl): Deploy teardown service (ENG-2922) (#6540) (@Flo4604)
• 8b610e4: feat(ctrl): month-end invoice closing webhook for Deploy billing (#6424) (@Flo4604)
• 64a09e7: feat(ctrl): rewire Deploy cancel through ctrl-api (ENG-2922) (#6541) (@Flo4604)
• 8581c9a: feat(dashboard): Add customer portal settings page for keyspaces (#6686) (@dave-hawkins)
• e2b0d9d: feat(dashboard): Compute plans dialog (#6612) (@dave-hawkins)
• d57629d: feat(dashboard): create keys through api sdk (#6587) (@chronark)
• 564e359: feat(dashboard): delete keys through api sdk (#6585) (@chronark)
• ff3ed32: feat(dashboard): during key creation a user cannot set permissions (#6630) (@chronark)
• 774a9d7: feat(dashboard): mirror Deploy included credit and local billing UI (#6679) (@Flo4604)
• 0bb0dcd: feat(dashboard): multi-select combobox on Base UI chips for region pickers (#6752) (@dave-hawkins)
• 9cab453: feat(dashboard): one-time secure share links for key secrets (#6599) (@chronark)
• 0a20bda: feat(dashboard): reroll keys through api sdk (#6586) (@chronark)
• 6cada8f: feat(dashboard): store Compute spend budget settings (#6432) (@Flo4604)
• 065a43b: feat(frontline): serve suspended deployments a distinct offline error (#6748) (@Flo4604)
• 58031ad: feat(obs): add SQLCommenter tags for PlanetScale Query Insights (#6632) (@Flo4604)
• 3ad264b: feat(pkg): email sending package (Resend templates) (#6456) (@Flo4604)
• 1bb3f20: feat(portal): audit logging for portal actions (#6603) (@mcstepp)
• 40bb03e: feat(portal): portal configuration landing page and feature flag (#6604) (@mcstepp)
• 7bcf998: feat(portal): scope analytics for portal sessions (#6581) (@mcstepp)
• 2cd2cd3: feat(ui): add resource list components (#6737) (@chronark)
• 1b05195: feat(vector): use strip_ansi_escape_codes (#6605) (@Flo4604)
• 2e52631: feat: add schema (#6698) (@ogzhanolguncu)
• c96c91b: feat: allow ratelimit configuration for keys (#6562) (@perkinsjr)
• dbcf08e: feat: mirror main into canary (#6694) (@Flo4604)
• 2ed233f: feat: more dockerbuild things for tilt (#6702) (@Flo4604)
• c92beac: feat: support multi-line environment variable values end-to-end (#6761) (@Flo4604)
• 0d043ae: fix (#6610) (@perkinsjr)
• 7b61801: fix ratelimit global counter deadlocks (#6665) (@chronark)
• 586b96b: fix(ci): configure service monorepo releases (#6701) (@chronark)
• 68a9285: fix(ci): keep v prefix on service image tags (#6704) (@Flo4604)
• 79c1a7c: fix(ci): specify test sizes (#6607) (@Flo4604)
• c8627ff: fix(config): allow for loading config via envar (#6762) (@Flo4604)
• d19e715: fix(ctrl): authenticate acme verification (#6724) (@chronark)
• f250af9: fix(ctrl): authenticate deployment status before logging (#6671) (@chronark)
• 5d30830: fix(ctrl): cap OpenAPI spec parsing size (#6681) (@chronark)
• 990b3e8: fix(ctrl): no-op ChangeDesiredState when deployment row is missing (#6626) (@Flo4604)
• eb77056: fix(ctrl): return precise connect codes from promote and rollback (#6662) (@ogzhanolguncu)
• 602a330: fix(ctrl): stop retrying domain verification when record is deleted (#6627) (@Flo4604)
• c65b2c9: fix(ctrl): validate git build context path (#6672) (@chronark)
• 755f4ec: fix(dashboard): center workspace ID copy button icon (#6634) (@Flo4604)
• 5019ea8: fix(dashboard): give option to override vercel url (#6699) (@Flo4604)
• 82163e6: fix(dashboard): invite form alignment (#6754) (@ogzhanolguncu)
• 536c38a: fix(dashboard): remove orphaned deleteRole tRPC handlers (#6758) (@MichaelUnkey)
• 4b784ad: fix(dashboard): show redeploy banner on new env add (#6736) (@ogzhanolguncu)
• d1641ce: fix(docs): use absolute GitHub URLs in query-insights-tags (#6664) (@Flo4604)
• 985e985: fix(keys): align key byte length minimum (#6656) (@chronark)
• c40134c: fix(krane): set UnhealthyPodEvictionPolicy to AlwaysAllow (#6723) (@imeyer)
• 4a7ed46: fix(lint): isolate golangci-lint cache per worktree (#6673) (@chronark)
• 34fc7d0: fix(logger): quote pretty log control sequences (#6667) (@chronark)
• 66fe6c9: fix(portal): harden session boundaries (#6712) (@chronark)
• 5ce3bc0: fix(portal):split portal auth into dedicated auth service (#6637) (@mcstepp)
• 34a5ae6: fix(pprof): require auth credentials (#6687) (@chronark)
• b337881: fix(uid): remove modulo bias from secure tokens (#6669) (@chronark)
• 9f8b76e: fix(zen): only log failed requests (#6666) (@chronark)
• 0b5e1d3: fix: Eng 3071 stop logging full user details and query (#6765) (@perkinsjr)
• 7ea6781: fix: Raw internal error message returned to client on invitation acceptance failure (#6744) (@MichaelUnkey)
• ba25ac4: fix: Unbounded limit resource exhaustion (#6670) (@MichaelUnkey)
• 023f2a3: fix: add missing admin gate to workspace name and Stripe mutations (#6600) (@MichaelUnkey)
• 6967df1: fix: dashboard lacks csp hsts and other security hardening headers (#6742) (@MichaelUnkey)
• ecbe818: fix: hide readiness check errors (#6668) (@chronark)
• 47dc920: fix: oauth callback open redirect via unvalidated redirectUrlComplete in OAuth state (#6726) (@MichaelUnkey)
• 38c7ff7: fix: prevent stale baseline in EditRole (#6577) (@MichaelUnkey)
• f9dea49: fix: run distroless images as nonroot (#6684) (@chronark)
• e7d8c8e: fix: sentry transactions and spans are captured without PII scrubbing (#6731) (@MichaelUnkey)
• 1fe82ee: fix: share bearer id sent to sentry on unexpected reveal errors (#6678) (@MichaelUnkey)
• bd7dd86: fix: use single partion for restate locally (#6750) (@Flo4604)
• 7deb486: perf(clickhouse): compress api_requests and key_verifications raw tables with ZSTD (#6722) (@Flo4604)
• f8a5c89: perf(dev): cache Go artifacts in Docker builds (#6700) (@chronark)
• 95b7b55: refactor(api): add generic pagination helper (#6654) (@ogzhanolguncu)
• 512d5d3: refactor(api): map list rows with array.Map (#6677) (@ogzhanolguncu)
• 0f43036: refactor(ctrl)!: per-workspace push invocations for deploy billing (#6452) (@Flo4604)
• e41f274: refactor(ctrl): migrate GitHub webhook onto pkg/webhook receiver (#6427) (@Flo4604)
• dde800d: refactor(dashboard): Move keyspace pages to PageHeader layout with chart cards (#6685) (@dave-hawkins)
• 92f454a: refactor(dashboard): Share timeseries card between keyspace and ratelimit lists (#6692) (@dave-hawkins)
• 8571790: refactor(dashboard): migrate logs and audit pages to PageHeader layout (#6571) (@dave-hawkins)
• 2136ace: refactor(dashboard): move env settings init to create app step (#6739) (@ogzhanolguncu)
• 1b0d8ce: refactor(db): move billing state into workspace_billing table (#6729) (@Flo4604)
• f50a6c7: refactor(portal): authorize exact capabilities (#6713) (@chronark)
• ffea044: refactor(testutil): manage test containers with compose (#6680) (@chronark)
• 9a7169a: style(dashboard): unify card surfaces on 8px border radius (#6688) (@dave-hawkins)
• 26401dc: test(billing): shadow-mode meter validation (ENG-2879) (#6451) (@Flo4604)
• 1f23771: test(ctrl): gate webhook harness on restate readiness to fix flake (#6611) (@Flo4604)
• 4a44439: update Pullfrog to latest version (#6691) (@perkinsjr)
• fadb778: validate client IP before recording it as audit location (#6743) (@MichaelUnkey)