From e2f1fe567a4957b45bf1d34c41e1b1b83d123414 Mon Sep 17 00:00:00 2001 From: "SREDevOps.org Agent" Date: Mon, 26 Oct 2026 10:17:43 -0300 Subject: [PATCH] chore(release): dsh-v0.2.1-rc.3-r4 (#22) Bump RELEASE_REVISION to r4 for the optional-hardening feature release and refresh every consuming manifest/doc. CHANGELOG.md is generated by the release workflow and is intentionally left untouched. Co-authored-by: SREDevOpsAgents --- .env.sample | 2 +- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- AGENTS.md | 5 +++-- Dockerfile | 2 +- README.md | 14 ++++++------ docs/README.md | 2 +- docs/main-image.md | 10 ++++----- docs/versioning.md | 22 +++++++++---------- examples/dsh-agents-as-a-service/README.md | 2 +- .../dsh-agents-as-a-service/gateway/README.md | 2 +- .../manifests/10-sandboxtemplate.yaml | 2 +- .../manifests/50-gateway.yaml | 2 +- .../manifests/sandbox-template.yaml | 2 +- versions.env | 6 ++--- 14 files changed, 38 insertions(+), 37 deletions(-) diff --git a/.env.sample b/.env.sample index a095090..ef609ae 100644 --- a/.env.sample +++ b/.env.sample @@ -21,7 +21,7 @@ CEREBRAS_API_KEY= AI_GATEWAY_API_KEY= HF_TOKEN= DSH_VERSION=dsh-v0.2.1-rc.3 -RELEASE_REVISION=r3 +RELEASE_REVISION=r4 PNPM_VERSION=11.28.5 # Container port, and the host port published by "make run". DSH_PORT=3080 diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 8fd9173..0d4cb56 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -28,7 +28,7 @@ body: id: image-tag attributes: label: Image or release - description: The pinned tag or digest, for example dsh-v0.2.1-rc.3-r3. + description: The pinned tag or digest, for example dsh-v0.2.1-rc.3-r4. - type: input id: cluster attributes: diff --git a/AGENTS.md b/AGENTS.md index 159a6e8..e94af39 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -82,8 +82,9 @@ needs kind plus the agent-sandbox CRDs (see the example README). ## Versioning and releases - Release identity = DSH_VERSION, optionally with a repository revision suffix - for re-releases at the same DSH ref (first release: dsh-v0.2.1-rc.3-r3). -- The current identity is dsh-v0.2.1-rc.3-r3 (stored in versions.env). The + for re-releases at the same DSH ref (current identity: + dsh-v0.2.1-rc.3-r4). +- The current identity is dsh-v0.2.1-rc.3-r4 (stored in versions.env). The dsh-v0.2.1-rc.3 image tag already exists and tags are immutable, which is why the first release under this scheme carries -r2. - Channels: release tags are immutable; latest follows the newest release; diff --git a/Dockerfile b/Dockerfile index e008bd2..11cca35 100644 --- a/Dockerfile +++ b/Dockerfile @@ -58,7 +58,7 @@ RUN cd /opt/dsh \ FROM $NODE_RUNTIME_IMAGE AS runtime ARG DSH_VERSION=dsh-v0.2.1-rc.3 -ARG RELEASE_REVISION=r3 +ARG RELEASE_REVISION=r4 ARG PNPM_VERSION=11.28.5 ARG VCS_REF=unknown diff --git a/README.md b/README.md index 5dcbbb7..d51d33e 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ docker run -d --name dsh-web \ -p 3080:3080 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 ``` DSH Web is **not usable at a bare `/`**. Without its launch-token cookie it @@ -45,7 +45,7 @@ docker run -d --name dsh-web -p 18081:3080 \ -e DSH_PUBLIC_URL=http://localhost:18081 \ -v dsh-home:/home/node/.dsh \ -e DEEPSEEK_API_KEY \ - ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 + ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 # then open http://localhost:18081/?token=... ``` @@ -94,21 +94,21 @@ ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway | Tag | Contents | Meaning | | --- | --- | --- | -| `dsh-v0.2.1-rc.3-r3` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | +| `dsh-v0.2.1-rc.3-r4` | DSH Web, port `3080` | **Current release identity.** Immutable: once published it never moves. | | `latest` | DSH Web | Most recent release; same digest as the current identity. | | `main` | DSH Web | Development channel rebuilt from every push to `main`. Not a release; not for production. | -| `dsh-v0.2.1-rc.3` | DSH Web | **Legacy tag** published before the release-identity scheme. It is not updated. New deployments use `dsh-v0.2.1-rc.3-r3`. | +| `dsh-v0.2.1-rc.3` | DSH Web | **Legacy tag** published before the release-identity scheme. It is not updated. New deployments use `dsh-v0.2.1-rc.3-r4`. | The example gateway is published under its nested path with the same release identity, e.g. -`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3`. +`ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4`. Release identities, channels and rollback rules are explained in [docs/versioning.md](docs/versioning.md). Production deployments should pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -189,7 +189,7 @@ required checks and releases: [docs/gitflow.md](docs/gitflow.md). The release identity is the upstream DSH ref plus an optional repository revision: `DSH_VERSION` and `RELEASE_REVISION` in [versions.env](versions.env). -The current identity is **`dsh-v0.2.1-rc.3-r3`** — the first release under the +The current identity is **`dsh-v0.2.1-rc.3-r4`** — the first release under the mirrored-DSH scheme at the same upstream DSH ref as the legacy `dsh-v0.2.1-rc.3` tag. Tags are immutable; a broken release is fixed by publishing `-r(N+1)`, never by re-tagging. diff --git a/docs/README.md b/docs/README.md index 3fe8d88..299999c 100644 --- a/docs/README.md +++ b/docs/README.md @@ -15,7 +15,7 @@ gets a DSH Web container running before anything else. | [main-image.md](main-image.md) | The primary artifact: build args, runtime environment, entrypoint, probes, volumes/ports/signals, non-root contract, image names, tags and digests. | | [examples.md](examples.md) | The example contract: required layout, manifest rules, exposure variants, components and image naming, scripts, docs, and how to add a new example. | | [gitflow.md](gitflow.md) | Branches, protected `main`, squash merges, Conventional PR titles, required CI checks, release branches, hotfixes and the one-time GitHub settings checklist. | -| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), why the current identity is `dsh-v0.2.1-rc.3-r3`, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | +| [versioning.md](versioning.md) | Release identity (`DSH ref` + optional `-rN`), why the current identity is `dsh-v0.2.1-rc.3-r4`, channels, compatibility matrix, bumping pins, the release checklist, rollback, git-cliff and digest pinning. | ## Project skills diff --git a/docs/main-image.md b/docs/main-image.md index c973996..ec9b162 100644 --- a/docs/main-image.md +++ b/docs/main-image.md @@ -32,10 +32,10 @@ To reproduce the equivalent by hand: ```bash docker build \ --build-arg DSH_VERSION=dsh-v0.2.1-rc.3 \ - --build-arg RELEASE_REVISION=r2 \ + --build-arg RELEASE_REVISION=r4 \ --build-arg PNPM_VERSION=11.28.5 \ --build-arg VCS_REF="$(git rev-parse --short HEAD)" \ - -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 . + -t ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 . ``` ### Build args @@ -164,7 +164,7 @@ GitHub Container Registry: | Tag | Meaning | | --- | --- | -| `dsh-v0.2.1-rc.3-r3` | Current release identity. **Immutable**: once published it never moves. | +| `dsh-v0.2.1-rc.3-r4` | Current release identity. **Immutable**: once published it never moves. | | `latest` | Most recent release; points at the same digest as the current identity. | | `main` | Development channel rebuilt from every push to `main`; not a release, not for production. | | `dsh-v0.2.1-rc.3` | Legacy tag published before the release-identity scheme existed. Do not use it for new deployments; see the migration table in the [root README](../README.md). | @@ -174,7 +174,7 @@ Release identities, channels and rollback rules are defined in pin a digest: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 # ... pin the digest in your deployment manifests: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` @@ -182,7 +182,7 @@ docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbo ## Verifying an image ```bash -docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 \ +docker inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 \ --format '{{json .Config.Labels}}' # org.opencontainers.image.title / .version / .source ``` diff --git a/docs/versioning.md b/docs/versioning.md index bec5dff..863dc5e 100644 --- a/docs/versioning.md +++ b/docs/versioning.md @@ -22,15 +22,15 @@ Examples: - `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=` → identity `dsh-v0.2.1-rc.3` (first release at that upstream ref). -- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=r2` → identity - `dsh-v0.2.1-rc.3-r3` (documentation, CI or gateway changes on top of the same +- `DSH_VERSION=dsh-v0.2.1-rc.3`, `RELEASE_REVISION=r4` → identity + `dsh-v0.2.1-rc.3-r4` (documentation, CI or gateway changes on top of the same upstream DSH; no DSH upgrade). A DSH upgrade produces a new base identity (for example the next upstream ref with an empty revision); a repository-only change at the same DSH ref increments `rN`. -## Why the current identity is `dsh-v0.2.1-rc.3-r3` +## Why the current identity is `dsh-v0.2.1-rc.3-r4` The image tag `dsh-v0.2.1-rc.3` was already published to GHCR for an earlier repository state. **Container tags are immutable** in this project: re-pushing a @@ -42,19 +42,19 @@ revision at the same upstream ref is `r2`. The identity is stored in [versions.env](../versions.env) and consumed everywhere: the Dockerfile label, the example manifests, the Makefile and the release workflow. The legacy `dsh-v0.2.1-rc.3` tag remains published but is not updated; -new deployments use `dsh-v0.2.1-rc.3-r3`. +new deployments use `dsh-v0.2.1-rc.3-r4`. The gateway image moved from the repository-level `:gateway` tag to a nested -package (`/dsh-agents-as-a-service/gateway`). For exactly one -release the release workflow also republishes the legacy -`:gateway` tag as a deprecated alias; it is removed in the next -release, so deployments should pin the nested package. +package (`/dsh-agents-as-a-service/gateway`). The release workflow +also republishes the legacy `:gateway` tag as a deprecated +compatibility alias; it may be removed in a later release, so deployments +should pin the nested package. ## Channels | Channel | Image tag | Meaning | | --- | --- | --- | -| Release | `dsh-v0.2.1-rc.3-r3` | The current immutable release identity. What production should pin (preferably by digest). | +| Release | `dsh-v0.2.1-rc.3-r4` | The current immutable release identity. What production should pin (preferably by digest). | | `latest` | `latest` | Alias for the most recent release; moves only when a new release is published. | | `main` | `main` | Development channel, rebuilt from every push to `main`. Never treat it as a release; it exists so `main` can be tested. | @@ -69,7 +69,7 @@ Values from [versions.env](../versions.env) at the current identity: | --- | --- | --- | | Upstream DSH source | `DSH_REPO` | [versions.env](../versions.env) | | DSH ref | `dsh-v0.2.1-rc.3` | `DSH_VERSION` | -| Repository revision | `r2` | `RELEASE_REVISION` | +| Repository revision | `r4` | `RELEASE_REVISION` | | pnpm | `11.28.5` | `PNPM_VERSION` | | agent-sandbox (CRDs) | `v1.0.7` | `AGENT_SANDBOX_VERSION`, used by the examples and CI dry-run | | Kubernetes Gateway API | `v1.2.1` | `GATEWAY_API_VERSION`, used by the SSO exposure variant | @@ -153,7 +153,7 @@ Release identities are mutable only in theory; deployments should still pin the resolved digest for reproducibility and supply-chain safety: ```bash -docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 +docker buildx imagetools inspect ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 # then, in the deployment: # image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox@sha256: ``` diff --git a/examples/dsh-agents-as-a-service/README.md b/examples/dsh-agents-as-a-service/README.md index 0665196..13c5932 100644 --- a/examples/dsh-agents-as-a-service/README.md +++ b/examples/dsh-agents-as-a-service/README.md @@ -244,7 +244,7 @@ kubectl delete -f manifests/40-claim-rejected.yaml ```bash # Published image (on kind, load it into the cluster; on a real cluster the # kubelet pulls it from GHCR): -GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3 +GW=ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4 docker pull "$GW" kind load docker-image "$GW" --name diff --git a/examples/dsh-agents-as-a-service/gateway/README.md b/examples/dsh-agents-as-a-service/gateway/README.md index 2e233f8..913d11a 100644 --- a/examples/dsh-agents-as-a-service/gateway/README.md +++ b/examples/dsh-agents-as-a-service/gateway/README.md @@ -22,7 +22,7 @@ It does four things: The DSH version pin lives in [`versions.env`](../../../versions.env) (`DSH_VERSION` plus the optional repository `RELEASE_REVISION`); the example manifests and published images use the release identity built from it (currently -`dsh-v0.2.1-rc.3-r3`). DSH binds `:3080`, serves `/`, gates `/api` behind a +`dsh-v0.2.1-rc.3-r4`). DSH binds `:3080`, serves `/`, gates `/api` behind a `dsh-auth-*` cookie and requires a WebSocket at `/api/remote.mux`. ## Flow diff --git a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml index 75a6294..5210cd2 100644 --- a/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml +++ b/examples/dsh-agents-as-a-service/manifests/10-sandboxtemplate.yaml @@ -64,7 +64,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml index db21600..d962d3b 100644 --- a/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml +++ b/examples/dsh-agents-as-a-service/manifests/50-gateway.yaml @@ -101,7 +101,7 @@ spec: type: RuntimeDefault containers: - name: gateway - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r3 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox/dsh-agents-as-a-service/gateway:dsh-v0.2.1-rc.3-r4 imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false diff --git a/examples/minimal-single-tenant/manifests/sandbox-template.yaml b/examples/minimal-single-tenant/manifests/sandbox-template.yaml index 1b673ae..75f86f8 100644 --- a/examples/minimal-single-tenant/manifests/sandbox-template.yaml +++ b/examples/minimal-single-tenant/manifests/sandbox-template.yaml @@ -52,7 +52,7 @@ spec: fsGroupChangePolicy: OnRootMismatch containers: - name: dsh-web - image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r3 + image: ghcr.io/sredevopsorg/deepseek-kubernetes-sandbox:dsh-v0.2.1-rc.3-r4 imagePullPolicy: IfNotPresent ports: - name: web diff --git a/versions.env b/versions.env index ef1ccfe..8bf172b 100644 --- a/versions.env +++ b/versions.env @@ -11,9 +11,9 @@ PNPM_VERSION=11.28.5 # Release identity = DSH_VERSION plus an optional repository revision. # An empty RELEASE_REVISION is the first release at this DSH ref; rN (N >= 2) # marks a repository-only re-release at the same DSH ref. The dsh-v0.2.1-rc.3 -# image tag is already published on GHCR and tags are immutable, so the first -# release under the current scheme is dsh-v0.2.1-rc.3-r3. -RELEASE_REVISION=r3 +# image tag is already published on GHCR and tags are immutable, so the current +# scheme started at -r2; the current identity is dsh-v0.2.1-rc.3-r4. +RELEASE_REVISION=r4 # Control-plane versions used by the examples and their manifests. AGENT_SANDBOX_VERSION=v1.0.7