KofTwentyTwo/Munitor
2
0 Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

12 Releases 19 Tags

RSS Feed
  • v0.3.8 5d4a9ea420
    Compare

    Munitor 0.3.8 Stable

    KofTwentyTwo released this 2026-10-19 14:30:13 +00:00 | 20 commits to develop since this release

    Release Munitor 0.3.8 to fix supplemental images reusing stale package-upgrade layers. The supplemental builder passes --pull --no-cache for both repository-owned and generated Dockerfiles, while preserving enforced HIGH/CRITICAL Trivy scans before publication.

    The fix addresses the backend db-backup scan finding for libexpat CVE-2026-77214. Consumer scans must confirm the rebuilt backup, migration and geoip images are clean; publication alone is not proof of remediation.

    Validation: full make all (lint, orb validation, scripts and templates), all seven BATS tests and twelve focused image-scan checks passed. All PR42 CI checks passed before merge. This release adds only README/session metadata to that verified source; release CI passed before main merge/tagging. Stable registry source was retrieved and verified after publication.

    AI assistance: prepared and reviewed with Codex.

    Downloads
  • v0.3.7 baca55bd77
    Compare

    Munitor 0.3.7 Stable

    KofTwentyTwo released this 2026-10-19 13:23:04 +00:00 | 25 commits to develop since this release

    JVM image builds now pull current base images and rerun package upgrades, preventing reuse of vulnerable cached runtime layers. Node build caching remains enabled.

    Filesystem Trivy findings now fail the job. Semgrep uses the pinned official image and rejects missing or empty scans and invalid configuration.

    Validation: all release CI checks passed, together with full local make all and seven BATS tests. The signed v0.3.7 tag points to main commit baca55bd77. CircleCI registry publication and the published orb source were verified. Consumers still need their own image and scanner verification.

    Downloads
  • v0.3.6 57dffdd9a3
    Compare

    Munitor 0.3.6 Stable

    KofTwentyTwo released this 2026-10-13 22:23:52 +00:00 | 32 commits to develop since this release

    kof22/munitor@0.3.6 is published to the CircleCI orb registry from tag v0.3.6 (main at 57dffdd, release PR #36).

    • Fix for a 0.3.5 regression (#35): release builds push supplemental images again. In 0.3.5 the new boolean push parameter was rendered by CircleCI as 1, and the script only pushed for the string true. Release builds built and scanned supplemental images but never pushed them, so deployments that reference them (for example kof22 0.1.75) hit ImagePullBackOff. PUSH_IMAGES now accepts true/1/yes/on and false/0/no/off, unset means push, and an invalid value fails before building. The Trivy scan still gates every push. Only PR docker_scan builds skip the push. New tests cover release-mode pushes.
    • README adoption examples point at 0.3.6.

    Upgrade: anyone on 0.3.5 with supplemental images should move to 0.3.6. Consumers on @0.3 get it automatically.

    Downloads
  • v0.3.5 16079c5ca8
    Compare

    Munitor 0.3.5 Stable

    KofTwentyTwo released this 2026-10-13 20:39:01 +00:00 | 37 commits to develop since this release

    kof22/munitor@0.3.5 is published to the CircleCI orb registry from tag v0.3.5 (main at 16079c5, release PR #33).

    • PR pipelines scan container images (#32): image vulnerabilities are caught at pull-request time, not only on release builds.
    • README adoption examples point at 0.3.5.

    Consumers on @0.3 pick this up automatically. Website-Backend and Website-Frontend pin exact versions and get orb_version bump PRs.

    Downloads
  • v0.3.4 687944e872
    Compare

    Munitor 0.3.4 Stable

    KofTwentyTwo released this 2026-10-12 11:20:39 +00:00 | 42 commits to develop since this release

    Published to the CircleCI orb registry as kof22/munitor@0.3.4 on 2026-10-12.

    Changes

    • Signed GitOps commits: update_cd_repo creates the CD-repository commit with the GraphQL createCommitOnBranch mutation instead of pushing a local commit. GitHub signs API-created commits, so the GitOps repository can require signed commits on its branch with no bypass actor. Concurrent bumps retry against the refreshed head through expectedHeadOid. The commit is authored by the GITHUB_TOKEN identity, and the source repository and commit stay in the commit body. ci_git_email/ci_git_name are kept for compatibility but no longer apply (#29).
    • CI: circleci/orb-tools is pinned to 12.5.0, and a test job runs the script, template and BATS suites on every branch.
    • Snapshots (#26): only develop publishes dev:snapshot; feature branches publish the immutable dev:<sha> tag only.
    • Generator (#27): the documented org key no longer produces an "Unknown key" warning.

    No new or removed orb parameters.

    Assets

    • munitor-0.3.4.orb.yml: the packed orb source exactly as published to the CircleCI registry.
    • SHA256SUMS: verify with sha256sum -c SHA256SUMS.

    Pull requests: #29, #30.

    Downloads
  • v0.3.3 d9b4da9e9e
    Compare

    Munitor 0.3.3 Stable

    KofTwentyTwo released this 2026-10-12 10:50:43 +00:00 | 53 commits to develop since this release

    Published to the CircleCI orb registry as kof22/munitor@0.3.3 on 2026-10-11.

    Fixes

    • Atomic release versions (allocate_version, new): on main, build_and_test reserves vX.Y.Z through the GitHub refs API before the version is baked into the jar or image. A version already owned by another commit moves to the next patch; tags are never moved. This fixes version collisions when two merges to main ran close together (Website-Backend 0.1.24 and 0.1.32).
    • Immutable image tags (guard_image_tags, new): every image carries the org.opencontainers.image.revision label, and the push refuses to overwrite a version tag that belongs to a different commit or lacks the label. Registry errors fail closed.
    • update_cd_repo: on main, verifies that vX.Y.Z points at the building commit before bumping GitOps, and records the source commit in the GitOps commit body.
    • github_release: targets CIRCLE_SHA1 instead of main, and refuses when the tag points elsewhere.
    • Generator: cd_path is rendered only when cd.path is set, fixing Unexpected argument(s): cd_path for manifests pinned to older orb versions.

    No new orb parameters; generated pipelines remain compatible.

    Assets

    • munitor-0.3.3.orb.yml: the packed orb source exactly as published to the CircleCI registry (retrieved from the registry by version).
    • SHA256SUMS: checksum of the orb source. Verify with sha256sum -c SHA256SUMS.

    Pull requests: #22, #23.

    Downloads
  • v0.3.2 ac3eb0e162
    Compare

    Munitor 0.3.2 Stable

    KofTwentyTwo released this 2026-10-10 20:14:30 +00:00 | 58 commits to develop since this release

    This patch unblocks the website publishing release CI.

    • Optional repository-reviewed development-only npm audit exceptions retain the full audit and a separate production audit. The guard checks exact advisory/package/version, development lockfile paths, expiry, registry changes and audit errors. Default auditing and Trivy remain unchanged.
    • Java APT installation runs without interactive debconf or needrestart prompts.
    • Linux shell/BATS scripts retain LF in Windows checkouts.

    Verification: full make all, official orb validation, six BATS regression tests, actual website lockfile checks, and CircleCI lint/pack/review passed. The stable production orb publish job passed; CircleCI registry confirms kof22/munitor@0.3.2. Website consumers select that exact version.

    Downloads
  • v0.3.0 1dc88ef564
    Compare

    v0.3.0 Stable

    KofTwentyTwo released this 2026-07-12 15:03:54 +00:00 | 68 commits to develop since this release

    Stable release of Munitor 0.3.0. Adds first-class pnpm and Obsidian pipeline support, opt-in repository Dockerfiles for node-webapp, and consolidated production-only Kustomize GitOps write-back with bounded push-race retries.

    Downloads
  • v0.2.0 af150158ab
    Compare

    v0.2.0 Stable

    KofTwentyTwo released this 2026-03-22 23:40:39 +00:00 | 102 commits to develop since this release

    What's Changed

    Full Changelog: https://github.com/KofTwentyTwo/Munitor/compare/v0.1.2...v0.2.0

    Downloads
  • v0.1.2 d766747246
    Compare

    v0.1.2 Stable

    KofTwentyTwo released this 2026-03-21 21:02:11 +00:00 | 103 commits to develop since this release

    Munitor v0.1.2

    Makes org-level defaults overridable, enabling other organizations to adopt Munitor without forking. Published as kof22/munitor@0.1.2.

    New Features

    Overridable Org Defaults (#1)

    All five hardcoded KofTwentyTwo org defaults are now configurable via an optional org section in .munitor.yml:

    Key Default Description
    docker_registry ghcr.io/koftwentytwo Container registry prefix
    npm_scope @koftwentytwo npm package scope
    ci_email ci@kof22.com Git committer email for CD updates
    ci_name kof22-ci Git committer name for CD updates
    orb_slug kof22/munitor CircleCI orb reference

    Existing repos require no changes. New organizations add:

    org:
  docker_registry: ghcr.io/my-org
  npm_scope: "@my-org"
  ci_email: ci@my-org.com
  ci_name: my-org-ci
  orb_slug: my-ns/munitor

    Updated orb description to be org-neutral.

    Files Changed

    • src/scripts/extract_munitor_vars.sh - Read org values from config with fallback defaults
    • src/scripts/packed_generate_config.sh - Propagate org values
    • src/scripts/packed_generate_dockerfile.sh - Propagate org values
    • src/scripts/update_cd_repo.sh - Use configurable CI identity
    • src/@orb.yml - Org-neutral description

    Stats

    • 5 files changed, 25 insertions, 24 deletions
    • Fully backward compatible
    Downloads