Semaphore v1.6.0

Semaphore v1.6.0 is a feature release of the Community Edition (CE) and the Enterprise Edition (EE), and the first since v1.5.0. It brings the Semaphore MCP server to self-hosted installs, reruns only the jobs that failed, adds API endpoints for artifacts, organization management and pre-flight checks, and replaces the bundled MinIO object storage with RustFS.

Read Before you upgrade first: two bundled components change, and artifacts, job logs and cache entries stored before the upgrade are not migrated.

Before you upgrade

Back up your database, including the keycloak database, before you start. The upgrade guide has the details: CE · EE.

Object storage: MinIO is replaced by RustFS

The bundled stores for artifacts, job logs and the cache now run RustFS 1.0.0 instead of MinIO (#1290).

• Stored data is not migrated. Artifacts, job logs and cache entries stored before the upgrade are not available afterwards.
• helm upgrade stops with an error while the MinIO StatefulSets from 1.5 exist. Add --set global.objectStorage.acknowledgeMinioRemoval=true to proceed. Charts rendered outside the cluster (helm template, Argo CD) cannot detect MinIO, so check for minio-* StatefulSets yourself.
• The MinIO persistent volume claims are kept. Delete them once you no longer need their data: minio-artifacts-storage-minio-artifacts-0, minio-cache-storage-minio-cache-0, minio-logs-storage-minio-logs-0.
• Do not upgrade from 1.5 with --reuse-values. It carries over the old public MinIO default credentials, which the chart refuses. Use --reset-then-reuse-values, or unset global.artifacts.username / global.artifacts.password and the same keys under global.cache and global.logs.
• Store credentials are now generated per installation and kept across upgrades. Set them yourself only when you render the chart outside the cluster.
• cache.<domain> and logs.<domain> are no longer served. Only artifacts.<domain> stays public, for presigned download URLs.
• Rolling back to 1.5 works only while your nodes still have the MinIO image cached, because that image is no longer published.

Keycloak 25.0.6 → 26.8.0

Keycloak, which handles sign-in, moves to 26.8.0 (#1339). Details: CE · EE.

• On first start, Keycloak 26 migrates its database schema. This is one-way: back up the keycloak database and the Secret tfstate-default-keycloak-configuration first. Rolling back means restoring the database backup.
• If you run more than one Keycloak replica, scale Keycloak to zero before upgrading. Keycloak 25 and 26 must not run at the same time.
• helm upgrade returns before the migration finishes. Wait for kubectl rollout status statefulset/keycloak.
• The Keycloak setup job now uses Terraform 1.16.5 and the maintained keycloak/keycloak provider. It runs only on install, but tools that run Helm post-install hooks on every sync (such as Argo CD) also run it on upgrade, and that first run needs access to registry.terraform.io to migrate its state.
• Custom login themes derived from the Semaphore theme must be updated: PatternFly assets moved under vendor/, Alpine.js is no longer shipped, and the session check now uses startSessionPolling.

API v2 is no longer deployed by default

The public-api (v2) subchart now sits behind public-api.enabled, which defaults to false (#1317). In 1.5 it was always deployed, but its requests did not work on self-hosted installs. Use the v1alpha API.

Behavior changes to check

• Rerunning a failed pipeline reruns only the failed jobs. Passed jobs in a rerun block are carried over as copies instead of running again. Set partial_rerun: block on pipelines or blocks whose jobs must run together, such as dynamically split test suites (#1095, #1307).
• SEMAPHORE_WORKFLOW_TRIGGERED_BY now holds the triggerer's login on the repository's Git provider (for example, the GitLab login for GitLab projects), and a rerun of a push or PR workflow reports the original pusher. Check scripts that rely on it (#1344).
• after_pipeline jobs without their own execution_time_limit now inherit the pipeline's limit instead of the 24-hour job default (#1217, #1242).
• Pipelines with circular block dependencies now fail at initialization with a clear error (#1057).
• On GitHub, stopped and canceled pipelines are reported with the error commit status instead of failure (#1150).
• GitHub merge queue builds (gh-readonly-queue/* branches) now report under the pull request status context instead of the push context. If your merge queue requires the push status, switch it to the pull request status (#1307).
• Service accounts can create GitHub App projects only for repository owners the organization already has a GitHub App project for (#1342).

Highlights

• MCP server in CE and EE. AI assistants and coding agents can inspect workflows, pipelines, jobs and logs, read test results and artifacts, list and run scheduled tasks, search the docs, and run or rerun workflows (#699, #728, #733, #753, #846, #979). Clients sign in with OAuth 2.1 (#869). The server is deployed by default on the mcp.<domain> host; turn it off with mcp-server.enabled=false (#1298).
• Job-level partial rerun. Rerunning a failed pipeline re-executes only the jobs that failed. Reused jobs are marked on the pipeline graph, the workflow editor can set the rerun granularity, and the logs, artifacts and test results of copied jobs resolve to the job that actually ran, in the UI and through the API (#1095, #1110, #1155). The rerun buttons are now named after what they do: Rerun Workflow and Rerun Failed Jobs (#1179).
• Artifacts API on self-hosted installs. New v1alpha endpoints list artifacts and issue signed download URLs, and the chart now routes them on CE and EE, so sem-ai artifact, sem-ai test report and sem-ai test summary work against your install (#977, #1295).
• More features on by default. Self-hosted installs now enable the Rerun Failed Jobs button (partial pipeline rebuild), listing all pipelines on the project page, date filters on the branch page, GitHub merge queues (merge-queue builds report under the pull request status context) and job-level partial rerun (#1307).
• Organization management API. v1alpha endpoints for members, roles, permissions, project members and service accounts, plus groups on EE (#1029, #1092).
• Pre-flight checks API (EE). Describe, apply and delete organization and project pre-flight checks over v1alpha, with audit events (#1136).
• OIDC token additions (EE). The tag claim is now filled for tag builds and can be mapped to an AWS session tag; the actor claim carries the triggerer's login on the repository's Git provider; and a compact sub127 subject claim suits providers with strict length limits such as Google Cloud (#1294, #1271, #1344, #559).
• More reliable GitHub statuses. Pull request checks no longer hang while GitHub computes mergeability, statuses arrive in order, and an auto-canceled run can no longer overwrite a newer run's status (#1156, #1336, #1113, #1343).

Security

• The release clears the dependency and container image scans: vulnerable Go, Elixir, Ruby and JavaScript dependencies and base images were updated across services, and the remaining advisories were reviewed and documented (#1326, #929, #967, #1214, #1228, #1252, #1257, #1340, #1345, #1359).
• Plug was updated in the affected Elixir services to fix a nested-parameters denial of service (GHSA-j43x-5hjq-rgxf) (#1272, #1284, #1286, #1287, #1288).
• The Keycloak image ships the updated CA trust store, which no longer trusts the eMudhra CAs that Red Hat distrusted (CVE-2026-114406). The upstream Keycloak image still carries the old bundle (#1364).
• The UI ships DOMPurify 3.4.17 (#1365).
• The badge service serves only the badge styles that exist (#1326).
• Credentials are kept out of logs: passwords, password hashes and OAuth tokens on the user-creation path (#1319), the RabbitMQ URL in crash reports (#1144), and passwords in SCIM payloads (EE) (#991).
• OAuth token handling: refresh-token rotation is safe under concurrent requests (#1253), guard is the only service that refreshes Bitbucket and GitLab credentials (#1267), and MCP OAuth grants take their identity from the authenticated session (#1241).
• Permission and group lookups are scoped to the organization (#1034, #1079); new deploy keys are 4096-bit RSA (#1346); secret value inputs no longer offer browser autocomplete (#1069); the session cookie sets SameSite=Lax explicitly (#758).
• Container images and the Helm chart are signed with cosign, as before.

Improvements

Pipelines & jobs

• New partial_rerun: jobs | block pipeline and block property controls rerun granularity (#1095).
• Jobs get a SEMAPHORE_ORGANIZATION_ID environment variable (#718).
• The pipeline and job pages show why a job timed out or was stopped (#997).
• Scheduled tasks: parameters can be validated against a regex (#1011), tasks can stop sending commit statuses for scheduled runs and for Run now (#1180), and the run history filter lists tags (#611).
• Webhook notifications retry with exponential backoff on timeouts, and delivery errors are logged (#813, #807).

Web UI

• Job logs render 256-color and 24-bit color, bright and background colors, bold, italic, underline and strikethrough, and handle cursor sequences (#766, #767).
• The pipeline diagram can be scrolled and dragged (#980).
• The project page can list all pipelines rather than only the latest per branch (#680).
• People page: download the member list as CSV (#664).
• Test results: a copy button next to each test path (#1016), and large gzipped reports (hundreds of MB) load without crashing the browser (#939).
• Compressed job logs produced by newer agents are displayed (#840).
• The job page shows the pipeline, block and author directly instead of in a pop-up (#743).
• EE: the project pre-flight checks secret picker includes project-level secrets (#1154).
• The activity monitor pages through all pipelines, jobs and debug sessions (#1014).
• The dashboard and project page show cached workflows or an error message instead of failing when workflow fetches are slow (#941, #985).

MCP server

• Includes after-pipeline jobs in pipeline job listings (#866, #952), reads logs of self-hosted jobs (#863) and handles large logs (#724).
• Artifact access and workflow rebuilds through the MCP server and the v1alpha API are recorded in the audit log (EE) (#1004).
• OAuth access tokens are valid for 24 hours (#1112).

Public API

• EE: project insights (performance, reliability, frequency) on v1alpha, routed by the chart (#1052, #1317).
• The role_bindings endpoints are routed on both editions (#1317).
• Fetching the logs of a reused job returns the logs of the job that actually ran (#1155).
• Creating organizations through v1alpha returns 403 on single-tenant installs (#1189).

GitHub, GitLab and Bitbucket

• GitLab repositories in subgroups are supported (#861).
• New-project onboarding can re-sync GitHub App repositories for one repository or the whole organization (#1059).
• Opening your profile refreshes your GitHub nickname (#1047).
• Fewer GitHub API calls: max-status errors are cached, branch pushes need one compare call, ref creation is idempotent, and tag resolution uses a direct lookup (#1040, #1041, #1042, #893).
• GitHub App collaborator and repository refreshes use bounded retries with backoff instead of rescheduling without limit (#921).

Access control & accounts

• EE: SAML session expiration is configurable (#838).
• Users can delete their own account; deletion is refused while they are the last owner or only member of an organization (#903, #1084).

Installation & Helm chart

• plumber and github_notifier read feature flags from the chart's feature file, so flags set there take effect (#1274, #1307).
• New environment variables: POSTGRES_FRONT_DB_POOL_SIZE for guard and rbac (#1104), IGNORE_REFRESH_REQUESTS for rbac (#810), worker counts for artifacthub and loghub2 (#822, #823), DISABLE_COLLABORATOR_WEBHOOK_SYNC (#1086), GitHub-App-only repository refresh (#1090), and retry and rate limits for unknown pull request mergeability (#1336).
• Services tolerate more worker restarts, so a RabbitMQ restart no longer takes them down (#972, #982, #1259, #1260, #1261).
• The project-page memory request is raised to 512Mi (#1121).
• Internal gRPC clients reuse connections, which stops steady memory growth (#1109, #1114).

Bug fixes

Pipelines & jobs

• With fail_fast: stop, blocks whose jobs had already passed keep their result, so partial rebuilds don't re-run them (#1087).
• Pipelines terminated during initialization no longer leave blocks stuck in waiting (#1093).
• Branch and tag names longer than about 230 characters no longer stall the pipeline (#1126).
• Debug jobs use the repository's default branch instead of assuming master (#1182).
• Jobs stopped before they started no longer show a timer or try to load logs (#1022); the job header shows the job's own start time (#1237); times are shown in the user's timezone (#1015).
• Promotions work with special characters in target names (#659), and parameterized-promotion dropdowns no longer scroll the diagram (#1308).
• Workflow editor: a clear message for a missing branch (#776), no undefined option for secrets restricted from the project (#907), and the default machine type comes from the available agent types (#1111).
• Scheduled tasks: unsuspending continues past individual failures (#708), Run now shows the actual error (#1001), schedules are validated before a project is updated (#1021), and task YAML is encoded safely (#828).
• Artifact paths containing + can be pulled (#765).

Web UI

• Mermaid diagrams render on the Reports tab (#618, #621).
• New-project onboarding scales correctly and labels the GitHub integrations correctly (#874, #932).
• Test suite durations and sorting are correct (#645), and long flaky test names wrap (#652).
• Custom dashboards save metrics and names correctly (#651, #905); the organization people page no longer errors (#663).
• EE: the audit page no longer returns 500 (#1200), audit log downloads stream (#993), and the deployment targets list and history work on large projects and keep filters across pages (#1332, #886, #891).

Integrations

• GitHub: projects with a missing organization no longer break webhook handling (#879), hooks are processed for users without a connected Git account (#732), and incomplete repository listings are treated as errors (#965).
• GitLab and Bitbucket projects no longer report a missing .semaphore/semaphore.yml when it is read from the default branch (#904).
• Bitbucket: OAuth callbacks work again after Bitbucket stopped accepting TLS 1.2-only handshakes (#1138), tokens refresh correctly (#998), API calls use workspace-scoped endpoints (#1012), and the Atlassian sign-in host is allowed by the content security policy (#1188).
• OAuth connections are no longer marked revoked after transient refresh failures or throttling (#1193, #1196, #1320); connect failures show a specific error and the outcome is shown on every entry point (#1020, #1321); Git provider lookups fall back to unauthenticated requests when a user's token is missing or invalid, which fixes invitations (#702, #865).

Access control & accounts

• Service accounts can be added to projects when project-level roles are not enabled, as on CE (#764, #730).
• EE: GitLab sign-in no longer creates duplicate user accounts (#824), SAML just-in-time provisioning works for users who were removed earlier (#1039), and Okta emails are normalized (#837).
• EE: deployment target rules that grant access by role store role IDs (#1141).
• EE: repository collaborator sync skips organizations without a repository-to-role mapping instead of crashing (#655).

Public API

• Missing job logs return 404 with the reason instead of 500 (#1091).
• Promotion listings accept numeric page and page_size values (#672).

Self-hosted agents & job scheduling

• Self-hosted jobs no longer fail intermittently with Failed to export env vars (#1222), and agent sync is more robust (#1231).
• The job scheduler keeps working when a helper task is slow and processes jobs continuously (#1354, #1358), and its caches neither block nor keep entries forever (#612, #1216).
• The self-hosted agent cleaner gets its RabbitMQ connection setting (#667).

Documentation

• Upgrade guide: moving from MinIO to RustFS, and the new volume names in the uninstall guide (#1290); upgrading from Keycloak 25 (#1363). Install instructions were streamlined (#691, #769).
• API reference: organization management and pre-flight checks endpoints for CE and EE (#1092, #1136).
• Pipelines and cache: CACHE_FAIL_ON_ERROR and cache key order (#1068, #687), hiding skipped blocks (#1045), fan-out/fan-in (#573), the containers reference (#627, #634), and SEMAPHORE_WORKFLOW_NUMBER (#710).
• Self-hosted agents: machine requirements for initialization jobs and AWS name registration (#1211, #875).
• MCP server: setup for Claude Code, Codex, VS Code and GitHub Copilot, and example prompts (#707, #722, #741, #806).
• The docs site moved to Docusaurus 3.9 with Ask AI search (#623, #755), plus typo and link fixes (#662, #682, #696, #986, #1044).

Contributors

@skipi, @dexyk, @loadez, @adbatista, @DamjanBecirovic, @radwo, @TomFern, @cchristous, @mateuscap, @hamir-suspect, @diegoguerrad, @tbogosavljevic, @bogyo210, @d-stefanovic, @VeljkoMaksimovic, @tbx1b, @sid2700, @marco2216, @d4rky-pl, @mgacesa, @MathiasWP, @lyoung-confluent, @ivanaur, @danieldiekmeier, @csidyel

Welcome to our first-time contributors @loadez, @adbatista, @cchristous, @mateuscap, @diegoguerrad, @tbx1b, @sid2700, @marco2216, @mgacesa, @MathiasWP, @lyoung-confluent, @ivanaur and @danieldiekmeier, and thanks to everyone in the community who sent changes, including @cchristous, @lyoung-confluent, @sid2700, @marco2216, @MathiasWP, @danieldiekmeier and @d4rky-pl.

Full list of changes: v1.5.0...v1.6.0