v2.30.0-pre3 63e7f3a

2026-03-23

63e7f3aMerge pull request #142 from bnema/token-exchange-client merge GPG Unverifiedtag v2.30.0-pre3bnema
37ca27dfix(security): reject colon in token subject to prevent Basic Auth encoding issues GPG Verifiedbrice
925cad7feat(auth): idempotent auth login — verify existing token when no --token provided GPG Verifiedbrice
7d67af7fix: linter — use cliWriteLine, sentinel error in admin middleware GPG Verifiedbrice
38c0e79fix: TTY warning on show-token, remove --revoke stub, fix tests for token exchange GPG Verifiedbrice
ff4c2ddfix(auth): don't validate JWT client-side, let server handle it GPG Verifiedbrice
f05fed4fix(security): fail on invalid JWT instead of sending long-lived token as Bearer GPG Verifiedbrice
2c89614fix: address CodeRabbit review — context propagation, sentinels, mutex, CLI patterns GPG Verifiedbrice

2026-03-22

7c8965bdocs: update auth CLI docs for token exchange and new commands GPG Verifiedbrice
16515bffeat(auth): add show-token and logout CLI commands GPG Verifiedbrice
8f94295refactor(auth): remove password login and token rotation dead code GPG Verifiedbrice
76ac5f4feat(auth): client-side token exchange for admin API calls GPG Verifiedbrice
589c4c3fix(security): reject long-lived tokens on admin and registry endpoints GPG Verifiedbrice
b9504fcfix(security): reject ephemeral tokens as credentials on /auth/token GPG Verifiedbrice
2a0009cfeat(auth): add IsEphemeral flag to TokenClaims for token type discrimination GPG Verifiedbrice
70ea140fix(auth): resolve token from pass store in auth status GPG Verifiedbrice
f03ab25docs: add TLS warning to README GPG Verifiedtag v2.30.0-pre2brice
bc2cbd5Merge pull request #141 from bnema/security-hardening merge GPG Unverifiedbnema
62a6579Merge branch 'main' into security-hardening merge GPG Unverifiedbnema
5c72601refactor: extract startProxyServers helper from runServers GPG Verifiedbrice
e4d9ea0fix: address CodeRabbit review — internal auth scope restriction, IPv6 redirect, TTL cap, docs GPG Verifiedbrice
c8a82f0fix: address CodeRabbit PR review — error wrapping, redirect, validation, dedup GPG Verifiedbrice
68c61a5Merge pull request #140 from bnema/dependabot/go_modules/go_modules-9c5197dcb8 merge GPG Unverifiedbnema
3094000fix: address CodeRabbit review — dedup validation, testify, docs clarity GPG Verifiedbrice
175d6d6refactor(auth): move scope matching helpers to domain layer GPG Verifiedbrice
a98b865docs(upgrading): clarify ephemeral token revocation behavior GPG Verifiedbrice
a5ba9carefactor(auth): reject auth.type=password, remove stale config fields GPG Verifiedbrice
4a0fe8fdocs: update auth documentation for token-only mode GPG Verifiedbrice
8d39436feat(auth): configurable TTL (default 15m) and admin scope support in /auth/token GPG Verifiedbrice
d22746brefactor(auth): remove password authentication from domain and service layer GPG Verifiedbrice
28746f8fix(security): harden auth, container limits, input validation, and proxy GPG Verifiedbrice
f17c66ebuild(deps): bump google.golang.org/grpc GPG Unverifieddependabot[bot]
3fb38f6Merge pull request #136 from bnema/dependabot/go_modules/golang.org/x/mod-0.34.0 merge GPG Unverifiedbnema
2149a22Merge pull request #137 from bnema/dependabot/go_modules/github.com/google/go-containerregistry-0.21.3 merge GPG Unverifiedbnema
08e7abcMerge pull request #138 from bnema/dependabot/go_modules/golang.org/x/time-0.15.0 merge GPG Unverifiedbnema
60bdb78build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0 GPG Unverifieddependabot[bot]
7cc0db8build(deps): bump github.com/google/go-containerregistry GPG Unverifieddependabot[bot]
ce25f34build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 GPG Unverifieddependabot[bot]

2026-03-18

7341e0efeat: preview environment variable inheritance and CLI fixes merge tag v2.30.0-prebrice

2026-03-19

83b82b4fix(eventbus): attach logger to bus context so handlers get a working logger brice
2b4c159fix(auth): try JWT validation before password in token exchange brice
b72aa77Merge pull request #134 from bnema/feat/preview-environments merge bnema
c5e1989fix: use 0o750 directory permissions to satisfy gosec brice
13bd9a4fix: address CodeRabbit review — sentinels, safety, docs, test robustness brice
7fa1856fix: use UTC in PreviewStore test to survive JSON round-trip brice
7fb924cfix: lint — use presentation helpers, extract functions to reduce complexity brice
950bfdcrefactor(admin): replace NewHandler positional params with HandlerDeps struct brice
2439aa3refactor(admin): replace NewHandler positional params with HandlerDeps struct brice
13bd0f0feat(cli): wire preview commands — build/push, list, delete, extend brice
a4b282ffix(preview): address review — error handling, logging, and cleanup in handler and service brice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close