hcavarsan/pipedash v0.3.0

Pipedash - v0.3.0

on GitHub

Pipedash v0.3.0

New provider: Gitea Actions

• Gitea Actions joins GitHub Actions, GitLab CI, Bitbucket, Buildkite, Jenkins, Tekton and ArgoCD. Workflow list, run history, run details, trigger and cancel. Needs Gitea 1.25 or newer, which added the Actions runs API. (#94)

  

• The trigger dialog lists the workflow_dispatch inputs declared in the workflow file, with their type, default and description. (#94)

  

New

• Pin workflows to the top of the pipelines list. Pinned workflows get their own page in the sidebar with live status cards. (#58, #73)

  

• Cancel several running runs at once from run history, with a single confirmation. One notification names any run that failed to cancel. (#57)

• System notification when a pipeline starts failing. Off by default, in Settings > General. It asks for permission before turning on and does not re-notify failures that already existed when you opened the app. (#74)

• Dark, light and system theme in Settings > General. (#73)

  

• GitLab: picking a group now includes projects from every subgroup, not only the group's direct projects. (#93)

• iOS app on the App Store. (#30)

• Privacy policy published in PRIVACY.md. (dc1abf4)

UI

• Redesign: theme-aware surfaces, shared loading, empty and error states, calmer status colors, right-aligned numbers, consistent spacing, one short date format, provider icons bundled locally, sharper app logo on desktop. (#73)

• Accessibility: real links and buttons, accessible names, keyboard navigation, reduced-motion respected. Browser zoom and text selection are no longer blocked on mobile. (#73)

• Sidebar collapses to an icon rail and remembers the choice. Provider edit and remove buttons show on hover or focus. (#73)

  

• In-app notifications moved to the bottom right. (#73)

• Renamed: "Repositories & Workflows" is now "Pipelines", "Storage Configuration" is "Storage", "Reset Storage" is "Factory reset", "Flush" is "Delete pipeline metrics" / "Delete all metrics", "Sum" is "Total". (#73)

• Empty states now offer an action: Add provider, Browse pipelines, Clear filters, Clear search, Load more, Configure storage. (#73)

• Startup, invalid config, permission check and provider loading errors show a screen with Retry instead of a blank or disabled state. (#73)

• Removed: floating Add provider button on mobile, Reset tab in mobile settings, "Auto-refresh / Idle" indicator in the header, estimated storage bar in metrics settings, decorative motion, emoji status labels, count badges. (#73)

Pipelines list

• Search, organization and provider filters, table sorting and the 60-day range work again. Provider selection has one source of truth, the URL. (#73)
• Repository status shows the worst workflow (failed > running > pending > cancelled > success > skipped) instead of the most recent one. (#73)
• Filters expand matching repositories automatically. Date filters use the workflow's last run. Name sorting is natural and case-insensitive. (#73)
• Going back from run history or metrics restores the list URL with its filters. (#73)
• A new provider shows its pipelines right after it is added, without duplicate filter options, and its spinner stops when the first fetch finishes. (#73)
• A provider page shows only its repositories; pinned cards stay on the all-providers page. (#73)
• Pins survive a storage migration. They are keyed by provider name and workflow path instead of the database id. (#66)

Runs, triggers and metrics

• Run history: opening a run older than the latest 100 returned "Run N not found" from page 6 on. It now loads. (#85)
• Workflows without parameters can be triggered. Trigger dialog gets Cancel, "Rerun workflow" wording and Retry when parameters fail to load. (#73)
• Run details on mobile show the status explanation, the 10 s refresh interval and why a pending run cannot be stopped. (#73)
• Metrics: PNG export works, missing periods are shown as missing instead of zero, CSV exports raw numbers with units, export is disabled without data, chart titles describe aggregation and range, ranges beyond retention are labeled. (#73)
• Table links open in a new tab and only for http(s) values. JSON cells are formatted, commit cells have a copy button. (#73)

Providers

• GitHub: runs that ended as timed_out, startup_failure, action_required, stale or neutral showed as pending and kept polling. They now get a final status. (#55)
• Tekton: pipelines selected in the add provider dialog showed 0 pipelines. (#71)
• Tekton: a namespace the token cannot list now fails the refresh with an error instead of silently dropping its pipelines. (#71)
• Tekton: cancel and run details only look at the selected pipeline. With two runs created in the same second, cancel could delete the other pipeline's run. (#63, #66, 9208f79)
• Buildkite: a provider added through the UI failed every refresh with "Could not determine organization". A selection spanning organizations fetched the wrong pipelines. (#54, #66)
• ArgoCD: one app with multiple sources, no targetRevision, no namespace or a destination name broke the whole app list. (#64)
• A failed fetch no longer blocks later refreshes and run history until a restart. (#53)

Security

• POST /api/v1/setup/config accepted a new configuration on an already configured instance without a token. It now returns 409. (#40)
• API token stays in memory: locking or unlocking the vault no longer turns off auth, and both need the current token. A wrong unlock password shows "Incorrect vault password". (#76, #77, GHSA-g8qr-9jj3-fcpc, GHSA-j98r-h9r3-r46w)
• The vault binds to the first password used and refuses any other, even with no providers or after a factory reset. (#77)
• Token comparison is constant-time. (#40)
• CORS is restricted by default (cors_allow_all = false). Cross-origin requests that change state get 403, with X-Forwarded-Proto support behind a proxy. Set PIPEDASH_CORS_ALLOW_ALL=true if you serve the frontend from another origin. (#40, #75, GHSA-84x9-w68h-25xr)
• Vulnerable dependencies patched. (#44, 7233813)
• Connection logs are debug-only in dev builds, and run history responses are no longer printed to the console. (#73)

Storage, config and setup

• SQLite migration backups now include data committed to the write-ahead log. Before, a recovery could lose providers added since the last checkpoint. (#92)
• A failed migration from PostgreSQL no longer overwrites pipedash.db with the JSON export. (#86)
• Storage migration failed with a consistency error after deleting a provider. (#72)
• Desktop config editor validates edits and plans the storage migration. Before, switching the storage backend there saved the file without copying providers and tokens. (#59)
• Web storage wizard loads the current config and data dir. Before, it opened on SQLite and could migrate a PostgreSQL instance to SQLite on save. (#56)
• First-run web setup no longer expires the session or skips the success step. The wizard cannot be dismissed before it finishes and shows the PostgreSQL host and database without credentials. (#73)
• A failed desktop restart after migration stays on an error screen with instructions instead of silently finishing setup. (#73)
• Factory reset also clears pins, theme and the notification preference. (#73)
• The web server honors server.bind_addr and server.cors_allow_all from config.toml. Environment variables still override them. (#73)
• Copying a storage path no longer adds quotes. Opening the folder works on Windows. (#73)

Install, Docker and docs

• pipedash-web on crates.io ships with its built UI. (8604943)
• Docker images are built natively per platform. (#69)
• README: Docker steps point at the compose files under examples/. PIPEDASH_PORT was documented but never read; change the port mapping in the compose file instead. (#60)

Upgrade notes

• Cached Tekton and Buildkite run history is cleared by a migration and refetched on the next refresh. (#66)
• PostgreSQL run number columns become BIGINT. (#66)
• CORS default changed from allow-all to restricted. (#40)