mattrobinsonsre/terrapod v1.3.1

on GitHub

A patch release. v1.3.0 shipped with VCS polling completely broken, and anyone running it with VCS-connected workspaces should upgrade.

Bug Fixes

• VCS polling failed on every workspace, every cycle (#1244). A transposed positional argument meant a list was passed where the per-cycle metadata cache was expected, so each poll died on 'list' object has no attribute 'get_or_fetch'. No branch pushes were detected and no speculative PR/MR plans were created; every workspace showed a VCS error. Introduced in #1097, released in v1.3.0. Agent and CLI-driven runs were unaffected — this was the poller only, and no state or run history was lost. The tail arguments are now passed by keyword, and a structural gate fails the build if any call in that module passes an optional argument positionally again.
• Concurrent OPA fetches clobbered each other (#1250). The API's write-time Rego check streamed into a fixed scratch path, so two fetchers racing — API replicas sharing the ephemeral PVC — could rename the file out from under one another. The loser reported OPA unavailable despite having downloaded and verified it successfully. Each fetch now gets its own scratch file. The symptom was a policy-set write reporting validation as unavailable; Rego was still checked at evaluation time on the runner, which fails closed, so nothing unvalidated could reach an apply.

Features

• Runs report which agent pool executed them (#1231). With multi-pool routing a queued run is offered to every pool in the workspace's set and whichever has a live listener claims it first, so the answer was previously only in the database. Runs now carry agent-pool-id (the pool that took it), candidate-agent-pool-ids (every pool that could have), and an agent-pool relationship — surfaced through go-terrapod, the MCP run tools, and the run detail page.

Why the outage got past CI

Worth stating, because the lesson is general. The metadata cache added in #1097 is a wrapper reached through an optional parameter — and an optional parameter makes the bypass the default. Every existing poll-cycle test omitted it and took the short-circuit; the tests that did build a cache called the inner helpers directly. Production was the only caller that supplied it, so the wrapper was never once executed through the code path that uses it, and a transposition inside it could not fail a green suite.

Both halves are now closed: a behavioural test drives the real caller with the parameter supplied and mocks at the provider boundary below the wrapper, and the contributor guide carries a routing rule for optional parameters that gate an alternate path.

Dependencies

CodeQL actions to v4.37.3; docker/setup-buildx-action to 4.2.0 and docker/login-action to 4.5.2; next and eslint-config-next to 16.2.12; react/react-dom to 19.2.8; next-intl to 4.13.4; lucide-react to 1.27.0; prometheus-client and ruff constraints widened.

Upgrade notes

Drop-in from v1.3.0 — image tags and chart version only. No schema change, no config change. The v1.3.0 upgrade notes still apply if you are coming from v1.2.x.

Status

Stable, and the release v1.3.0 should have been.

Full Changelog: v1.3.0...v1.3.1