netresearch/ofelia v1.2.0 on GitHub

Highlights

The Compose project in label-defined job names. With [global] job-exec-label-scope = project-service, a job-exec job defined by container labels is named {project}.{service}.{job}, so one daemon that watches several Compose projects keeps their jobs apart when the projects reuse a service name such as app. The default scope stays service (#932) — reported by @landure in #927, implemented by @CybotTM.

Job output in the mail body. mail-output-in-body puts the job output into the notification mail instead of the stdout.log and stderr.log attachments: N for the last N lines of stdout and of stderr, -1 for the whole captured output, 0 or unset for the attachments as before (#916) — requested by @eingemaischt in mcuadros#341 (tracked here as #316), first implemented by @Area128 in #882, finished by @CybotTM.

Go 1.27.4. The binaries and images are built with Go 1.27.4; Go 1.27.3 carries GO-2026-6859 in net/http (#933).

Fixed

Mail notifications need email-to. A mail behaviour flag alone, such as mail-only-on-error or mail-output-in-body in [global], no longer attaches the mail middleware, so a run without a recipient no longer logs a mail error (#919, fixing #917), by @duongynhi000005-oss.
ofelia validate rejects an unknown job-exec-label-scope value, and so does the daemon at startup with enable-strict-validation = true; before, the value fell back to service with a warning (#932), by @CybotTM.

Changed

The image's Alpine base moves to 3.24.4 (#929).
Module updates: docker/cli 29.9.3, go-smtp 0.25.1, validator 10.30.6, klauspost/compress 1.20.4, golang.org/x/term 0.48.0 and golang.org/x/text 0.44.0 (#920, #921, #925, #930, #931, #934).
README and the configuration docs describe the default label prefix (Compose service name, container name as fallback) and job-exec-label-scope (#936), by @CybotTM.

Full changelog: v1.1.0...v1.2.0

Container image

ghcr.io/netresearch/ofelia:1.2.0
ghcr.io/netresearch/ofelia:1.2
ghcr.io/netresearch/ofelia:1

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ofelia-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ofelia-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ofelia:1.2.0 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ofelia:1.2.0 \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml