conf/config-dev.yaml mirrored the production default, so a local run had no
builder entry in the menu and no way to create builds without editing the
file. Enable it there: the development config is the one used when running
against a local builder.
Verification:
- helm/conf not affected; loaded by `go run . server -c conf/config-dev.yaml`
The source-code providers a deployment can use were implied by
auth.oauth2.*, so disabling OAuth login also disabled code repository sync
and every build that clones source code, and there was nowhere to configure
a self-hosted GitLab or Gitea at all: the gitea client was created with an
empty base URL.
Make provider capability explicit and independent from login:
- add scm.providers[] with provider and baseUrl; github and gitlab default
to their hosted endpoints, gitea and other self-hosted instances require
a base URL and are skipped with a warning when it is missing
- derive the provider list from the enabled OAuth2 providers when
scm.providers is empty, so existing configurations keep working
- expose Configuration.ResolveScmProviders and Configuration.ScmProvider
- add auth.credentialKey for the master key that encrypts SCM credentials
at rest, plus the credential.master_key settings key used as fallback
conf/config.yaml, both configuration docs and the Helm chart (values and
configmap) document the two new sections.
Verification:
- go test -run "TestConfigurationScm|TestConfigurationResolveScm" -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config/...
- helm template test ./deploy/sigma
Sigma shipped three overlapping ways to operate a remote server: the
embedded MCP server, sigma-cli, and the sigma-api-operator skill. All
three wrapped the same HTTP API, yet each covered a different subset:
user CRUD existed only in the CLI, system-* only in MCP, and builders,
daemons, webhooks, validators, code repositories and tokens were
reachable only through raw HTTP. MCP was disabled by default and still
carried 1246 lines of production code plus 606 lines of tests to
maintain that partially overlapping surface.
Keep two surfaces instead: sigma-cli for execution and the skill for
API discovery.
- delete pkg/server/mcp and its mcp-go dependency, which also drops the
jsonschema-go, jsonschema/v6 and uritemplate/v3 transitives
- drop ConfigurationMCP, its defaults and the authz/audit skipper
bypasses that existed only to let the MCP endpoint bypass both
- remove the mcp section from conf/config*.yaml, docs/configuration.md,
and the Helm chart values and configmap
- replace docs/mcp.md with docs/cli.md covering sigma-cli login, global
flags, per-resource commands, jq composition and agent usage
- make sigma-cli the preferred path in the sigma-api-operator skill and
rebuild its examples around the resources the CLI does not wrap yet,
using the paths and request schemas from swagger.yaml
Lint was already red on dev for an unrelated reason: golangci-lint
v2.13.0 vendors golang.org/x/tools v0.49.0, which only decodes export
data version 4, so every import of a Go 1.27.2 standard library package
failed typecheck with "export data version 5 is greater than maximum
supported version 4". Bump to v2.15.0 (x/tools v0.52.0) and fix the two
modernize findings it reports for Go 1.27's strings.CutLast.
- .github/workflows/lint.yml: golangci-lint v2.13.0 -> v2.15.0, and
document the export data constraint next to the pin
- pkg/authz/resolver.go, pkg/logger/logger.go: replace LastIndex slicing
with strings.CutLast
- bump github.com/docker/cli v29.9.0 -> v29.9.1
BREAKING CHANGE: the `mcp` configuration section and the /api/v1/mcp
endpoint are gone. Use sigma-cli or the REST API for automation.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- golangci-lint v2.15.0 run --build-tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./... (0 issues)
- golangci-lint config verify
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/authz/... ./pkg/logger/... ./cmd/cli/... ./pkg/app/... ./pkg/background/build/...
- go test -run TestConfiguration -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config/...
- go mod tidy
- make swagen
- helm template sigma ./deploy/sigma
- bun run docs:build
- make build
- make build-cli
Populate auth.admin.email in the example configurations, docs and Helm
values so the bootstrap sets the initial administrator's email address.
Verification:
- parsed conf/config*.yaml and confirmed auth.admin.email is read
Replace the hard-coded library namespace seed with an idempotent bootstrap
task driven by a new namespace.initialize config list, so users can declare
any number of namespaces and set the visibility of each one (public or
private). The task only creates namespaces that do not exist yet.
Remove the seed INSERT from the four 0001 migrations and wire the new config
into the example configs, the docs and the Helm chart (values + configmap).
Run the self-hosted rs3 service instead of Minio in test.yml and swap the
local helper script, Makefile helm values, and AGENTS.md notes accordingly.
Fix the E2E workflow (refs #426): it only triggered on the `main` branch,
which does not exist in this repository, so the job never ran. Trigger it
on `dev` for both push and pull_request like test.yml, build the image via
the consolidated `make docker-build`, bump the checkout/setup-go actions,
drop the hosted-toolcache cleanup, and refresh the E2E tooling to k6
v2.3.0 and skopeo v1.24.1.
Repair the image startup path as well: start nginx with an explicit
/etc/nginx/nginx.conf and a /dev/stderr error log so the non-root user does
not touch the compiled-in log path, create /etc/sigma with mode 0755 before
copying config.yaml (COPY --chmod made the directory non-traversable), and
disable redis in the shipped default config since cache, locker and work
queue are inmemory.
Add login failure rate limiting with per-username tracking, supporting both delay-based throttling and lockout via configurable backend.
Update all sample configs, Helm templates, and documentation to include the new auth loginRateLimit settings.
Verification:
All config files, Helm charts, and docs are updated to match the new configuration schema.
Add a cache-backed failed-login throttler for Basic auth. Once a username
reaches auth.loginRateLimit.maxFailures failures within window, each
subsequent authentication attempt is delayed by delay (capped at 5s)
instead of being rejected; the counter is cleared on a successful login.
- add pkg/infra/ratelimit backed by pkg/infra/cache (inmemory/redis) with
Count/Incr/Reset and Prometheus metrics for failures, delayed attempts,
and cache errors
- wire ConfigurationAuthLoginRateLimit with defaults (5 failures, 5m window,
1s delay) and document it in conf/config.yaml
- integrate the limiter into the authn middleware, counting all Basic
failures including /v2/, and honor request context cancellation
- add unit tests for threshold behavior, delay, and cancellation
- mark the login rate limit item complete in TODO.md
Add tlsVerify configuration field to control TLS certificate verification
for the builder API client. Update all sample config files and helm
templates to include the new setting, and add supporting code to handle
the config value, pass it through the client chain, and add tests for both
the config parsing and client behavior.
Verification:
go test ./pkg/builder/... ./pkg/config/...
Switch the Docker Compose stack from MySQL and Minio to PostgreSQL and rs3,
with the compose-specific configuration updated to use PostgreSQL and the rs3
S3 endpoint.
Adapt code for upgraded resty and GitLab client APIs, including the renamed
response parsing option and int64 pagination and ID fields.
Also refresh agent guidance and the Chinese README automation notes.
Verification:
docker compose -f compose.yml config
ruby -e 'require "yaml"; YAML.load_file("conf/config-compose.yaml"); YAML.load_file("compose.yml"); puts "yaml ok"'
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config ./pkg/service/token
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/builder ./pkg/distribution/clients ./pkg/background/daemon/webhook
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/background/daemon/coderepo
make build
Tosone