102 releases 152 tags

RSS feed

• v2.0.0 b9ca1b74fe

  Compare

  v2.0.0 Stable

  ryangr0 released this 2026-07-20 17:55:17 +00:00 | 298 commits to main since this release

  2.0.0 (2026-07-20)

  • refactor(agent-runner)!: rename from openhands-runner and drop baked language toolchains (98bc5b1)
  • refactor(ci-runner)!: rename github-runner -> ci-runner (5e83c4c)

  Bug Fixes

  • added a bunch of stuff to the openhands runner (ff321a8)
  • added forgejo workflows (928cb8d)
  • added sha and patched version of openjdk (f71be9b)
  • added sha and patched version of openjdk (a9fdb4e)
  • agent-runner: apply the slim contents the rename commit claimed (4bd3ce9)
  • agent-runner: clone the skills marketplace from the repo that exists (0d1b8a8)
  • agent-runner: drop the hardcoded SDK version from the image metadata (b88762e)
  • agent-runner: send key_alias when minting the per-run litellm key (e64d60c), closes #31
  • agent-runner: unbreak entrypoint — apostrophe inside single-quoted python (4f8fe1a)
  • another techdocs-builder build (f0c7b65)
  • arc-runners: Added dotnet 9.0 to the runner image (5e3ae58)
  • arm (e1d0e8f)
  • attestation: fixed some weird quirks with UTF codes in the build summary (3c16e50)
  • ci-runner: clean apt lists in the gh and PHP layers too (be4cdd0)
  • ci-runner: document the dual-forge contract and cut the first release (5a2be47)
  • ci-runner: guard envsubst at build time + clean apt lists in layer 1 (41567e9)
  • ci-runner: install gettext-base so cosign-installer v4 can sign (d85ef92), closes #88
  • ci-runner: pin the CodeQL install script to a commit SHA (5f10ced)
  • ci-runner: restore the glibc node20 external the runner base dropped (ee7e7ec)
  • ci: collapse prerelease/final distribute+sign into single jobs (fd9de38)
  • ci: diagnose OIDC->OpenBao sign failure (claims + error body) (29a3f85)
  • ci: dispatch on_release_published from the release step (Forgejo can't emit release events) (4833bf0)
  • ci: dispatch on_release_published with the namespaced tag, not bare semver (ca732f2)
  • ci: force release docker builds to linux/amd64 (af853d3)
  • ci: gate Forgejo publish plugin on a literal flag, not an empty vars lookup (daf888c)
  • ci: give workflow_dispatch inputs an explicit type (Forgejo rejects untyped) (794c997)
  • ci: pin cosign-installer + sbom-action to github.com (679157f)
  • ci: publish Forgejo releases via Gitea plugin, not GitHub GraphQL (5a052b8)
  • ci: stop doubling the release tag and hardcode the Harbor owner (56a2cf9)
  • ci: stop uploading signatures to the public sigstore tlog (6ade3a7)
  • cosign-sign-attest: bump syft v1.21.0 -> v1.48.0 and stop it going stale (5da16be)
  • deps: update dependency webgrip/renovate-config ( v1.4.4 ➔ v1.4.5 ) (ea9ed32)
  • deps: update dependency webgrip/renovate-config ( v1.5.1 ➔ v1.5.3 ) (c718bc5)
  • Dockerfile: update runner version to 2.334.0 and install GitHub CLI (a0a325a)
  • fast build (5d89afc)
  • forgejo: check out repo before the local semantic-release action (23f6752)
  • forgejo: rename caller job to avoid id collision with reusable's inner job (efceab5)
  • forgejo: target the in-cluster runner's honest 'docker' label (drop arc-runner-set) (b43f3af)
  • gha: updated comment to get a new versioned release (1555c00)
  • github-runner re-release (b23b105)
  • open the lootbox (9a8a401)
  • php: added pcov and upped to 8.4 (d2d59fa)
  • php: have the base image be php cli 8.4 etc (e3b5986)
  • release all dockerfile (a23159d)
  • release techdocs builder (4f9576f)
  • renovate: own multi-ARG base images via annotated-ARG manager (0c6419d)
  • renovate: webgrip/renovate-config 1.4.1 -> 1.4.2 (5acbe3b)
  • renovate: webgrip/renovate-config 1.4.2 -> 1.4.3 (0bdaba7)
  • renovate: webgrip/renovate-config 1.4.3 -> 1.4.4 (9d39c62)
  • rerun release (c683753)
  • techdocs-builder release (5a84954)
  • techdocs-builder: add node-gyp build deps in release image build (6586e5b)
  • techdocs-builder: bump to exercise the absolute-URL composite-action fix (a7b63dc)
  • techdocs-builder: bump to exercise the namespaced-tag dispatch path (b5b860e)
  • techdocs-builder: bump to exercise the tag/owner/github-script fixes (b762fd6)
  • techdocs-builder: bump to print OIDC claims for the sign-role fix (13a1170)
  • techdocs-builder: bump to verify signing after the cosign-signer rebind (de2dee2)
  • techdocs-builder: bump to verify the fully hardened pipeline (57ef88a)
  • techdocs-builder: bump to verify the single-distribute fix (96fca30)
  • techdocs-builder: move FINAL_BASE ARG to global scope before first FROM (5e8d739)
  • techdocs-builder: opencontainers spec (9bf2302)
  • techdocs-builder: put more docs in (9242cd3)
  • techdocs-builder: release job by adding native Node build toolchain (c7cfae5)
  • techdocs-builder: replace EOL openjdk:11-buster with eclipse-temurin:11-alpine (bc2611e)
  • techdocs-builder: rerelease (16e7238)
  • techdocs-builder: rerelease (57e9d17)
  • techdocs-builder: switch eclipse-temurin from alpine to jammy for ARM64 multi-platform support (e65b432)
  • techdocs-builder: verify Option A end-to-end (dual-registry signed + GitHub release) (d661712)
  • techdocs: bump reusable pin to pick up the forgejo artifact forks (3459b47)
  • techdocs: bump reusable pin to the Harbor techdocs-builder workflows (8a39921)
  • techdocs: repair links that broke the strict mkdocs build (65e1fc2)
  • test (58ff2ee)
  • trigger techdocs-builder release via Forgejo Gitea publish path (9d7fe8a)
  • Update mkdocs.yml to include new documentation sections (c4beaa5)
  • workflows: Added image created, version and rev to docker build stuff (d7803f8)
  • workflows: concurrency should be on release id level (86b6863)
  • worklflows: platforms doens't exist lol (aca228e)

  Features

  • added techdocs builder (60594a8)
  • ci: cache verifyRelease build against the Harbor buildx layer-cache (6c2cb36)
  • deps: update dependency webgrip/renovate-config ( v1.4.5 ➔ v1.5.0 ) (6434502)
  • deps: update docker.io/library/rust docker tag ( 1.87.0 ➔ 1.97.0 ) (7607b49)
  • deps: update ghcr.io/actions/actions-runner docker tag ( 2.334.0 ➔ 2.335.1 ) (9a4c16a)
  • enterprise supply chain security — cosign, SBOM, SLSA, Trivy, Kyverno (001fc74)
  • erfbeeld-ci: baked job image — pinned rust + wasm32 + node + tauri headers (b9ca1b7)
  • forgejo: mirror the .github CI tree as .forgejo, publishing to in-cluster Harbor (eda9fd6)
  • forgejo: publish techdocs to Codeberg Pages on docs change (51e024a)
  • forgejo: sign + attest Harbor images via cosign + OpenBao Transit (Forgejo OIDC) (f525076)
  • github-runner: add Node 24, PyYAML and the Claude Code CLI (a46feb2)
  • mkdocs stuff (d298d46)
  • openhands-runner: add docker CLI for the DinD sandbox (Slice C) (ef4f87a), closes #268
  • openhands-runner: headless OpenHands agent image for the dark factory (5e13b9a), closes 287/#288
  • openhands-runner: hybrid skills loadout — baked core + profile (Slice E) (fd44303), closes #268
  • openhands-runner: mint + revoke a per-run litellm key (Slice D) (ebad639), closes 287/#288 #268
  • php-ci-runner: Initial commit (fa85d70)
  • skills-ci-runner: CI toolchain image for webgrip/ai-skills (6f37e77)
  • vikunja-mcp: bake supergateway + pinned vikunja-mcp (drop npx-at-startup) (fd292ce)

  BREAKING CHANGES

  • ops/docker/openhands-runner is now ops/docker/agent-runner; the
    published image becomes webgrip/agent-runner. The orphaned openhands-runner-v1.0.0
    tag can be ignored — that image never published.

  Two changes, one rationale.

  Name: the image is harness-neutral by design, so its NAME shouldn't hard-code a
  vendor. We already swapped harnesses once (ADR-0045 opencode -> ADR-0047
  OpenHands); baking "openhands" into an image name makes the next swap a rename of
  every manifest and pull-ref instead of a content change. "agent-runner" keeps the
  house *-runner suffix and uses the industry noun for an autonomous executor
  (jenkins/agent, buildkite/agent), while staying out of the *-ci-runner toolchain
  family this image is NOT part of.

  Contents: agent tooling is baked; language toolchains are not. Slice C gave the
  runner a docker CLI and a DinD sandbox, so language gates now run in the very
  images CI uses (rust-ci-runner, ci-runner, playwright-runner, php:8.5-cli) — the
  gates match CI exactly instead of approximately, and it closes the PHP gap Slice B
  deferred. Dropping rust + build-essential takes the image 2.1GB -> 1.12GB (-47%),
  which matters because the dark factory pulls this per ticket, and because the
  2.1GB build was making every CI publish crawl.

  Kept: openhands 1.16.0, node 24 (for the agent's own openspec/moon workflow
  tooling), python 3.12 + pyyaml, docker CLI + compose/buildx, the baked skills
  core. Verified post-rename: all resolve, cargo absent, 4 core skills register,
  entrypoint injects the trace-id and exits 0.

  Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

  • publishes as ghcr.io/webgrip/ci-runner (and harbor.webgrip.dev/webgrip/
    ci-runner). Consumers pinning ghcr.io/webgrip/github-runner must be repointed: the
    Forgejo ScaledJob and the two ARC scale-sets in webgrip/homelab-cluster. New tag train,
    so versions restart at v1.x for the new name -- not a downgrade; consumers pin by digest.

  Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads