Update semaphoreui/semaphore Docker tag to v2.19.8 #279
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/semaphoreui-semaphore-2.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.18.2→v2.19.8Release Notes
semaphoreui/semaphore (semaphoreui/semaphore)
v2.19.8Compare Source
v2.19.7Compare Source
Semaphore UI v2.19
Highlights
Workflows
A workflow is a graph of task templates that run as one unit.
/workflows/newand/workflows/:id/edit(Drawflow-based), with palettedrag-and-drop, edge condition selectors, live cycle/self-edge guards, a validation problems panel,
and auto-layout for position-less workflows. Node positions are persisted.
note (free-form annotation, never executed).
task_params_idon workflow nodes)./project/{id}/workflows(CRUD),/{workflow_id}/run,/runs,/runs/{run_id}/{stop,artifacts,approvals},POST /runs/{run_id}/approvals/{node_id}.Executors: Docker and Kubernetes (Pro/Enterprise)
Runners can now execute tasks in a container or a pod instead of directly on the runner host.
runner.executor.k8s):kubeconfig,namespace(defaultsemaphore),image,helper_image,service_account,pull_secrets,poll_interval_seconds,cleanup_grace_seconds.runner.executor.docker):host,tls_verify,cert_path,image,helper_image,network,pull_policy,cpu_limit,memory_limit,privileged(off by default), poll/cleanuptimings.
SEMAPHORE_RUNNER_K8S_*/SEMAPHORE_RUNNER_DOCKER_*environment variable.semaphoreui/jobandsemaphoreui/helperimages are built and published by CI; the job imageships Terraform/OpenTofu/Terragrunt and
paramiko.(
project__template.executor_image).Task JWT / OIDC ID tokens
Semaphore can now act as an OIDC provider for running tasks, so jobs authenticate to external systems
without long-lived credentials.
GET /.well-known/jwks.json.carry IDs only.
jwt:enabled,issuer,default_ttl(1h),max_ttl(24h), withSEMAPHORE_JWT_*env vars.
project__template.jwt_params.Secrets & encryption
encryptionconfig block with a labelled keyring: inlinekeys(value or file), or a
keys_folderwhere each file is a key named by its filename, plusactive.secret_key/active.option_keypointers. Ciphertext now carries a key ID, so keys can berotated without a big-bang re-encrypt.
keys_file+keys_poll_interval(default15s) allow hotreload. The legacy flat
access_key_encryptionstill works and is used whenencryptionis unset.option_encryption— separate key for encrypting DB-stored options.secretvaluelived only in the memory of the node that accepted the task, so it arrived empty on remote runners
and was lost across restarts. Secrets are now persisted as task-bound access keys
(
access_key.task_id,access_key.expire_at, cascade-deleted with the task); TTL is derived fromMaxTaskDurationSec(+1h queue allowance, 24h when unlimited).Runners
runners are always dispatch candidates).
X-Runner-Started-At, stored inrunner.started_at), which lets the server detect a runner that restarted and silently lost itsin-memory job pool.
startingtasks are reassigned to a healthy runner;runningtasks get arecovery window and are then failed with a clear message. Tunables in the new
runnersconfigblock:
offline_timeout_sec(120),task_fail_timeout_sec(420),reconcile_interval_sec(30).removes ~380 lines of key-exchange code from the runner protocol.
rejected with
400, and token prefixes are validated.runnersconfig struct (old flat options still read).activeflag was dropped from runner registration; only registered runners are used.Performance & scale
through them client-side. The backend now returns one page at a time via a
beforecursor +count(legacylimitstill accepted), with noCOUNT(*)and noOFFSET— so page depth nolonger degrades on projects with millions of tasks. Applies to project history, template task lists
(
/templates/{id}/tasks,/tasks/last,/stats) and the dashboard.KeyLock). Templates withAllowParallelTasks=trueshared one working copy, and concurrentgit pull+git checkoutcouldcorrupt it.
updateRepository()+checkoutRepository()is now one critical section, covering bothlocal and runner execution. Inventory repo operations are serialized the same way.
permanent-connection flag is gone.
Templates, tasks & UI
(
GET /repositories/{repository_id}/playbooks) instead of requiring a hand-typed path. Playbooksreset when the branch changes, and branch-load failures no longer block the playbook list.
(
target: "env") instead of the app-specific CLI way (--extra-vars/-var/ CLI arg). The envvar name is the variable name verbatim, so
TF_VAR_fooworks. Stored in the existingsurvey_varsJSON — no migration.
int,text(multiline), and restyledenum.int).requirement installation.
DropdownCard/HighlightedCardcomponents.padding fixed.
Observability
metricsconfig block (enabled,username,password, plusSEMAPHORE_METRICS_*) exposing/api/metricswith Go/process collectors,semaphore_tasks_running(gauge) andsemaphore_tasks_total{status}(counter). The endpoint is offby default and can be protected with basic auth.
debug-style filter via--debug-filter/SEMAPHORE_DEBUG_FILTERlets you turn on verbose tracing for one subsystem (runners, LDAP,schedules, git) without the noise from everything else. Applies to syslog hooks too.
SEMAPHORE_LOG_LEVEL/--log-levelbehave exactly as before.ssh.known_hosts_file,ssh.config_path,ssh.strict_host_key_checking(no/yes/accept-new). With no known-hosts file configured,Semaphore uses a persistent trust-on-first-use file under
TmpPath— first connection pinned, laterhost-key changes rejected.
Security
unverified password change).
Secureover HTTPS.AllowOverrideBranchInTask.--end-of-optionspassed to git so a crafted ref cannot be read as a flag;commit hashes format-checked; branches validated before repository browsing; playbook paths
validated.
appvalidated.template_idverified onvault update.
SECURITY.md; release artifacts signed with thesecurity@semaphoreui.comGPG key.Upgrade notes
Breaking / behavioural changes
MySQL/Postgres) before upgrading.
boltis no longer a validdialect.no longer exists. Make sure runner↔server traffic is TLS-protected.
GET /project/{id}/tasksand the template task endpoints returnone page and take a
beforecursor pluscount.limitis still accepted for backwardcompatibility, but clients relying on getting the newest 200 tasks in one response must page.
activeflag removed from registration.restore to carry credentials.
New configuration
encryption,jwt,metrics,runners,ssh,runner.executor.{docker,k8s},ldap_tls_skip_verify,option_encryption,external_auth_email_matching.All are optional; existing configs keep working.
use_remote_runnerand the flat runner options aredeprecated in favour of
runners. The JSON schema (config.schema.yaml) and the config-optionreference docs have been regenerated.
Documentation
Docs are now a git submodule and are embedded in the binary, so they ship offline. New/updated pages:
Docker & Kubernetes executors, encryption and key rotation, JWT auth during task execution, OpenBao
secret storage, IdP-initiated OIDC, PingFederate TLS, license activation, dev setup, logging, runner
registration, and regenerated CLI reference.
Dependencies & build
Go 1.26.5; Debian 13 and Alpine 3.24 base images;
go-git5.19.2,go-oidc3.20.0,golang.org/x/crypto0.54.0,go-ldap3.4.14,modernc.org/sqlite1.54.0; frontendaxios1.19,cron-parser5.7,nanoid6,shell-quote1.10. MariaDB 12.1 migration compatibility fixed.THIRD-PARTY-LICENSES.mdregenerated.Known gaps
Two plans in
AGENTS/plans/2_19did not ship in this line and are still open:password-hash-argon2id(bcrypt → Argon2id) andrunner-token-hash(hashing the runner bearer tokenitself — only registration tokens are hashed today). The
runner-version-platform-uptimeplanshipped partially: uptime and online/offline status landed, but runner version/OS/arch columns did
not.
v2.19.6Compare Source
v2.18.29Compare Source
Changelog
91719b9fix(secrets): do not remove synchronized fields and readonly secretsv2.18.28Compare Source
Bugfixes
v2.18.27Compare Source
Changelog
240e595fix(templates): validate appv2.18.26Compare Source
Changelog
ee781a0feat(auth): verify current password to fix CWE-620v2.18.25Compare Source
Changelog
7c3789cfix(runners): close connectionsv2.18.24Compare Source
v2.18.23Compare Source
Changelog
74d8dd5feat(ui): placeholder for enterprise storagesv2.18.22Compare Source
Changelog
debf7a0feat(ui): return extra vars for secretsv2.18.21Compare Source
Changelog
2d6e2e3feat: secure flag for session when https enabledv2.18.20Compare Source
Bugfixes
v2.18.19Compare Source
v2.18.19 Release Summary
This patch release includes several important security and validation fixes.
Security fixes
--end-of-optionsto Git commands to make repository URL and branch handling safer.Reliability and tests
v2.18.18Compare Source
v2.18.17Compare Source
v2.18.16Compare Source
Bugfixes
v2.18.15Compare Source
v2.18.14Compare Source
v2.18.12Compare Source
Features
v2.18.10Compare Source
v2.18.9Compare Source
Changelog
0a37ea2feat(cli): allow create tokenv2.18.8Compare Source
Changelog
459cceeci: fix branchv2.18.5Compare Source
v2.18.4Compare Source
Changelog
7ca373dfix(docker): check reg token fileWhat's Changed
New Contributors
Full Changelog: https://github.com/semaphoreui/semaphore/compare/v2.18.2...v2.18.4
v2.18.3Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Update semaphoreui/semaphore Docker tag to v2.18.3to Update semaphoreui/semaphore Docker tag to v2.18.43e6a7c894bto5db64a7230Update semaphoreui/semaphore Docker tag to v2.18.4to Update semaphoreui/semaphore Docker tag to v2.18.55db64a7230tod105c585cdUpdate semaphoreui/semaphore Docker tag to v2.18.5to Update semaphoreui/semaphore Docker tag to v2.18.8d105c585cdtod408617740Update semaphoreui/semaphore Docker tag to v2.18.8to Update semaphoreui/semaphore Docker tag to v2.18.9d408617740to6dffa6f58dUpdate semaphoreui/semaphore Docker tag to v2.18.9to Update semaphoreui/semaphore Docker tag to v2.18.106dffa6f58dtocc68e25fd3Update semaphoreui/semaphore Docker tag to v2.18.10to Update semaphoreui/semaphore Docker tag to v2.18.12cc68e25fd3to7c11291e897c11291e89tob064b76cd0b064b76cd0to7c74c8e544Update semaphoreui/semaphore Docker tag to v2.18.12to Update semaphoreui/semaphore Docker tag to v2.18.147c74c8e544toc65e4913c5Update semaphoreui/semaphore Docker tag to v2.18.14to Update semaphoreui/semaphore Docker tag to v2.18.16c65e4913c5to43f2e4adceUpdate semaphoreui/semaphore Docker tag to v2.18.16to Update semaphoreui/semaphore Docker tag to v2.18.1743f2e4adcetod514263adeUpdate semaphoreui/semaphore Docker tag to v2.18.17to Update semaphoreui/semaphore Docker tag to v2.18.18d514263adetocd9e035bd6Update semaphoreui/semaphore Docker tag to v2.18.18to Update semaphoreui/semaphore Docker tag to v2.18.19cd9e035bd6to90e07ea8a7Update semaphoreui/semaphore Docker tag to v2.18.19to Update semaphoreui/semaphore Docker tag to v2.18.2090e07ea8a7to502f18ebc2Update semaphoreui/semaphore Docker tag to v2.18.20to Update semaphoreui/semaphore Docker tag to v2.18.21502f18ebc2to53a7478d2dUpdate semaphoreui/semaphore Docker tag to v2.18.21to Update semaphoreui/semaphore Docker tag to v2.18.2253a7478d2dto960f12c729Update semaphoreui/semaphore Docker tag to v2.18.22to Update semaphoreui/semaphore Docker tag to v2.18.23960f12c729to591e04c466Update semaphoreui/semaphore Docker tag to v2.18.23to Update semaphoreui/semaphore Docker tag to v2.18.24591e04c466to6abae30f36Update semaphoreui/semaphore Docker tag to v2.18.24to Update semaphoreui/semaphore Docker tag to v2.18.256abae30f36todb6e279363Update semaphoreui/semaphore Docker tag to v2.18.25to Update semaphoreui/semaphore Docker tag to v2.18.26db6e279363to1c01e0bdb6Update semaphoreui/semaphore Docker tag to v2.18.26to Update semaphoreui/semaphore Docker tag to v2.18.271c01e0bdb6toe33cc17f47Update semaphoreui/semaphore Docker tag to v2.18.27to Update semaphoreui/semaphore Docker tag to v2.18.28e33cc17f47to64cd0bf5a664cd0bf5a6toddf74464d1Update semaphoreui/semaphore Docker tag to v2.18.28to Update semaphoreui/semaphore Docker tag to v2.18.29ddf74464d1tof39edd306bUpdate semaphoreui/semaphore Docker tag to v2.18.29to Update semaphoreui/semaphore Docker tag to v2.19.6f39edd306bto5bdc307835Update semaphoreui/semaphore Docker tag to v2.19.6to Update semaphoreui/semaphore Docker tag to v2.19.75bdc307835to9eb89d1f77Update semaphoreui/semaphore Docker tag to v2.19.7to Update semaphoreui/semaphore Docker tag to v2.19.8View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.