mattrobinsonsre/terrapod v1.3.0 on GitHub

Features

fetch opa, trivy and checkov instead of shipping them (#1225)
pull-through cache opa, trivy and checkov (#1223)
record re-scan findings in draft advisories, not a public issue (#1218)
re-scan supported releases and raise an issue on new findings (#1213)
peering set up in one place — Helm-seeded, database-persisted (#1170)
say how far behind replication is, not just when it last ran (#1167)
an HA indicator on every page, and the page hangs off it (#1166)
an HA page you can actually read during an incident (#1164)
copy the object store to the peer — irreplaceable first, streamed, throttled (#1160)
decide verify-or-copy per object-store class, not for the whole bucket (#1152)
split module VCS polling from workspace polling, and give tag publishing the webhook it lacked (#1150)
blob readiness — prove the object store is there before trusting a failover (#1148)
the CA stays node-local — decided, enforced and documented (#1146)
replicate the remaining workspace-scoped settings (#1142)
replicate variables and variable sets, and pin that keys never travel (#1139)
replicate workspaces, their agent-pool set and their module links (#1137)
replicate the workspace dependency chain (#1135)
replicate VCS connections, and fix the encrypted-column path they broke (#1133)
refuse mutating requests on a follower at one chokepoint (#1131)
HA status — PDB coverage and placement spread, without false findings (#1129)
report in-cluster component readiness (#1127)
report whether the follower is caught up (#1123)
composite primary keys, and the identity classes (#1120)
peer replication framework — outbox, backfill, and the peer read surface (#1111)
client_credentials grant for peer authentication (#1109)
enforce the leadership gate at the write, not the scheduler (#1103)
node role resolution for leader/follower HA (#1102)
multi-pool surfaces — web editor, MCP tool, docs, e2e (#1090)
route a workspace's runs to more than one agent pool (#1086)
JSON:API house style — links as relationships (slice 2) (#1084)
JSON:API house style — error envelope + pagination helper (slice 1) (#1083)
state-based AI architecture critic — consumer layer (#1081)
AI architecture-critic service + endpoints (Part 2 slice 2) (#1078)
ai_architecture config block + architecture-critique schema (Part 2 slice 1) (#1076)
web Security panel + grounded AI design review folded into the plan summary (#1074)
security-scan consumers (go-terrapod + MCP) + docs (Slices 3-4) (#1055)
prove + improve horizontal scalability — O(page) lists, HA scale profile, graceful degradation under exhaustion (#1057)
runner Checkov/Trivy security-scan phase (Slice 2) (#1054)
IaC security-scan backend foundation (schema, gate, config surface) (#1051)

Bug Fixes

v1.3.0 pre-release blockers (#1229)
drop curl from every published image (#1227)
clear the three code-scanning alerts in the re-scan scripts (#1224)
give the source job permission to upload SARIF (#1220)
keep code findings out of the public re-scan issue (#1216)
make source-scan findings actionable and consistent (#1215)
triage the remaining lint warnings and close the gate (#1211)
bump OPA to 1.19.0, correct the CVE register, publish the CVE policy (#1207)
put the semgrep suppression where semgrep will read it (#1205)
clear the code-scanning alerts, and close the gap that hid one (#1204)
a listener no longer has to know which node it reached (#1193)
namespace-qualify cluster-scoped names so two installs can share a cluster (#1183)
one unappliable row no longer stops all replication (#1182)
the registry's rows, and a backfill for classes registered later (#1179)
replicate the rows that name the objects, not just the objects (#1176)
let CI date the package-refresh, so security patches stop waiting on a human (#1178)
three bugs a live two-node pair found, and the pair that found them (#1174)
let an operator actually create the peer client the HA link needs (#1162)
follow GCS's pagination, and let a listing be bounded by key (#1158)
a cancelled poll no longer takes every workspace on that repo with it (#1157)
encrypt the run-task HMAC key and the GPG private key at rest (#1145)
a single-node install now does no replication work at all (#1118)
backfill could not converge a deletion — a revoked token survived (#1116)
a follower must not run periodic tasks either (#1105)
make the nil-check control flow explicit for staticcheck (SA5011)
bump golang.org/x/text to v0.39.0 (CVE-2026-56852) (#1107)
release the VCS commit claim when run creation fails (#1100)
make an agent_pool_id-only config work against a multi-pool workspace (#1095)
make removing an Optional+Computed list attribute visible, not silent (#1093)
report the real VCS poll failure, and make a stall detectable (#1092)
stop rate limiter freezing streamed run logs behind the BFF (#1080)
MCP — don't send the bearer token to presigned object URLs (#1079)
hoist mutating call out of assert in security-scan runner test (#1062)
serialize CA init across replicas with a Postgres advisory lock (#1061)
ship terrapod-query as a universal darwin binary (#1050)

Documentation

empty the register and make the version review a release step (#1226)
a patch is the smallest fix, not necessarily a cherry-pick (#1221)
say plainly that the API needs outbound access (#1210)
a standby's listener fleet attaches before it is needed (#1192)
the HA operator procedures #960 asked for (#1187)
an HA topology guide, and HA where enterprises actually look (#1185)
how to size VCS polling for a large estate (#1154)
stop claiming the follower adopts the leader's CA (#1144)
drop the removed matrix rows from the written contract (#1126)
promote four public contributor conventions into AGENTS.md

Refactoring

model the workspace pool set as a mapping table with real FKs (#1088)

Tests

fail the build when a replicated class lacks its test matrix (#1113)

Maintenance

install from the promoted node's registry, not just check its rows (#1202)
pin the pair's runner image too, so execution rows can run (#1201)
strip MinIO — the upstream project is abandoned (#1196)
the E2E compose stack was still pulling from Docker Hub (#1194)
pull CI's third-party images from the mirror, not Docker Hub (#1190)
mirror the third-party images CI pulls into GHCR (#1189)
make the HA release-gate table runnable and honest (#1184)
remove master-master residue from replication (#1125)
dependabot rollup — CI actions + web deps (#1082)
allowlist the dev-only brace-expansion advisory in npm audit (#1059)
bump postcss to 8.5.23 to clear GHSA-r28c-9q8g-f849 (#1053)

Other Changes

test+docs: cover the re-scan scripts and correct where findings go (#1222)
Make HA gate rows 9 and 10 real, and fix the two defects that found (#1199)
perf(1096): deduplicate VCS metadata calls across workspaces sharing a repo (#1097)

Full Changelog: v1.2.0...v1.3.0