v0.11.0-alpha.1

Proto Breaking Changes

Install

0.11.0-alpha.1: Pulling from opendecree/decree
526604835308: Already exists
990a9c434e5e: Already exists
ef49c20a7b35: Already exists
bf7a4185f015: Already exists
2780920e5dbf: Already exists
7c12895b777b: Already exists
3214acf345c0: Already exists
52630fc75a18: Already exists
dd64bf2dd177: Already exists
b839dfae01f6: Already exists
dcaa5a89b0cc: Already exists
069d1e267530: Already exists
f93b3fd16470: Pulling fs layer
f93b3fd16470: Verifying Checksum
f93b3fd16470: Download complete
f93b3fd16470: Pull complete
Digest: sha256:5b147ae62a2376820e786a198a99ebea9a85d5075342f15c540978cc4938166e
Status: Downloaded newer image for ghcr.io/opendecree/decree:0.11.0-alpha.1
ghcr.io/opendecree/decree:0.11.0-alpha.1
0.11.0-alpha.1: Pulling from opendecree/decree-cli
526604835308: Already exists
990a9c434e5e: Already exists
ef49c20a7b35: Already exists
bf7a4185f015: Already exists
2780920e5dbf: Already exists
7c12895b777b: Already exists
3214acf345c0: Already exists
52630fc75a18: Already exists
dd64bf2dd177: Already exists
b839dfae01f6: Already exists
dcaa5a89b0cc: Already exists
069d1e267530: Already exists
47afc6404fd4: Pulling fs layer
47afc6404fd4: Verifying Checksum
47afc6404fd4: Download complete
47afc6404fd4: Pull complete
Digest: sha256:d08067e608a6c4da9e492094d8df32ab357069b825d269c1881f2094a9276502
Status: Downloaded newer image for ghcr.io/opendecree/decree-cli:0.11.0-alpha.1
ghcr.io/opendecree/decree-cli:0.11.0-alpha.1

Verify provenance

All binaries and Docker images are signed with Sigstore via GitHub Actions artifact attestations.

What's Changed

Server

• test(e2e): role × action × tenant × type matrices by @zeevdr in #208
• fix(audit): enforce tenant access on read handlers by @zeevdr in #209
• feat(server): add panic recovery interceptor by @zeevdr in #229
• feat(server): enforce TLS for gRPC + gateway dial by @zeevdr in #230
• feat(schema): configurable ingest limits + functional options for NewService by @zeevdr in #254
• feat(validation): JSON-Schema compile timeout + depth pre-scan by @zeevdr in #256
• auth: bound metadata header lengths and sanitise resolution errors by @zeevdr in #260
• perf(server): parallelize independent reads + bootstrap via errgroup by @zeevdr in #264
• feat(server): add per-tenant + per-method rate limiting by @zeevdr in #267
• feat(auth): enforce role-based RPC policy by @zeevdr in #268
• feat(authz): pluggable Guard interface + ChainGuard by @zeevdr in #269
• refactor(config/schema/audit): extract resolveTenantWithAccess and errToStatus by @zeevdr in #270
• Inject tenant_id, actor, request_id into every log record via context by @zeevdr in #271
• fix(server): fresh shutdown ctx and sanitize panic log values by @zeevdr in #318
• fix(config): fail-closed on validator-lookup errors in validateField by @zeevdr in #319

Infrastructure

• ci+build: digest-pin base images, SHA-pin non-trusted actions by @zeevdr in #227
• ci: add stale bot for inactive issues and PRs by @zeevdr in #228
• helm: sane resource defaults, NetworkPolicy template, pull-Always by @zeevdr in #261
• ci: add artifact attestations for Docker images and Go binaries by @zeevdr in #266
• fix(ci): replace docker/helm labels with infra in release.yml by @zeevdr in #315
• infra(helm): add TLS configuration to chart values by @zeevdr in #321
• build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #337
• build(deps): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #333
• build(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #334
• build(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #336
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #335
• build(deps): bump the minor-and-patch group across 1 directory with 9 updates by @dependabot[bot] in #348
• build(deps): bump distroless/static-debian12 from a932952 to 20bc6c0 in /build by @dependabot[bot] in #330
• build(deps): bump golang from 47ce563 to b54cbf5 in /build by @dependabot[bot] in #331
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #349
• build(deps): bump azure/setup-helm from 4.3.1 to 5.0.0 by @dependabot[bot] in #350
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #351
• build(deps): bump actions/attest-build-provenance from 2 to 4 by @dependabot[bot] in #352
• build(deps): bump actions/checkout from 4 to 6 by @dependabot[bot] in #353
• build(deps): bump the minor-and-patch group across 3 directories with 1 update by @dependabot[bot] in #347

Documentation

• docs(readme): replace prose comparison with scannable table (#34) by @zeevdr in #265
• docs: fix README quickstart for TLS-by-default by @zeevdr in #316
• docs: update CLAUDE.md with authz, ratelimit, corrected auth row by @zeevdr in #317

Other Changes

• docs: expand PR template with checklist and related issues by @zeevdr in #210
• perf(ci): add GHA cache tier to e2e and examples pre-build by @zeevdr in #211
• feat(server): enforce configurable gRPC message size limits by @zeevdr in #226
• docs(security): audit findings for security review (#26) by @zeevdr in #225
• refactor(server): functional options for New + NewGateway by @zeevdr in #235
• refactor(audit,auth): functional options for NewUsageRecorder + NewInterceptor by @zeevdr in #236
• refactor(config,adminclient): functional options for NewService + New by @zeevdr in #249
• docs: add feature_request.yml issue template by @zeevdr in #257
• ci: add Dependencies category + exclude noise from release notes by @zeevdr in #258
• chore(schemas): rename schemas.opendecree.io → schemas.opendecree.dev by @zeevdr in #259
• fix(schema): correct metaSchemaURL to decree-schema.json by @zeevdr in #262
• feat(schemas): publish meta-schemas to schemas.opendecree.dev via Pages by @zeevdr in #263
• fix(schema): reject bad regex constraints at import time by @zeevdr in #320
• fix(cli): pin man-page date so docs check is deterministic by @zeevdr in #329
• test(ratelimit): add StreamInterceptor table-driven tests by @zeevdr in #322
• docs(migration): add MIGRATION.md for functional-options API break by @zeevdr in #323
• test(validation): cover CompileTimeout fired path by @zeevdr in #324
• test(cmd/server): cover option wiring with extracted helpers by @zeevdr in #325
• refactor(schema): dedupe UUID validator by @zeevdr in #326
• test(e2e): cover rate-limit enforcement by @zeevdr in #327
• test(e2e): cover validation-limit rejections by @zeevdr in #328
• chore: record v0.10.0-alpha.2 P0 resolutions in agents context by @zeevdr in #338
• docs(security): populate supported-versions table by @zeevdr in #342
• docs(checklists): fix TLS smoke flag, add supply-chain pin and attestation steps by @zeevdr in #343
• fix(ratelimit): bound InProcessLimiter.keys with LRU cap by @zeevdr in #344
• docs(context): add alpha.2 security hardening and functional options rollups by @zeevdr in #345
• ci(dependabot): split gomod tiers, add per-tier go-version floor guards by @zeevdr in #346
• fix(configwatcher): add missing logger to direct Watcher construction in race tests by @zeevdr in https://github.com/opendecree/...

v0.10.0-alpha.1

Proto Breaking Changes

Install

0.10.0-alpha.1: Pulling from opendecree/decree
526604835308: Already exists
990a9c434e5e: Already exists
ef49c20a7b35: Already exists
bf7a4185f015: Already exists
2780920e5dbf: Already exists
7c12895b777b: Already exists
3214acf345c0: Already exists
52630fc75a18: Already exists
dd64bf2dd177: Already exists
b839dfae01f6: Already exists
dcaa5a89b0cc: Already exists
069d1e267530: Already exists
8057052c37d5: Pulling fs layer
8057052c37d5: Verifying Checksum
8057052c37d5: Download complete
8057052c37d5: Pull complete
Digest: sha256:9d1a655a0729eafe2561bddc2a05ae2ddf9a0eedbf79c0d3a3e4c498b6a7790c
Status: Downloaded newer image for ghcr.io/opendecree/decree:0.10.0-alpha.1
ghcr.io/opendecree/decree:0.10.0-alpha.1
0.10.0-alpha.1: Pulling from opendecree/decree-cli
526604835308: Already exists
990a9c434e5e: Already exists
ef49c20a7b35: Already exists
bf7a4185f015: Already exists
2780920e5dbf: Already exists
7c12895b777b: Already exists
3214acf345c0: Already exists
52630fc75a18: Already exists
dd64bf2dd177: Already exists
b839dfae01f6: Already exists
dcaa5a89b0cc: Already exists
069d1e267530: Already exists
2a906b66d8c1: Pulling fs layer
2a906b66d8c1: Download complete
2a906b66d8c1: Pull complete
Digest: sha256:5e3f1ce5b3bba9405c822449a46cec9033f6447313ccfc40cffd99ea3a59024e
Status: Downloaded newer image for ghcr.io/opendecree/decree-cli:0.10.0-alpha.1
ghcr.io/opendecree/decree-cli:0.10.0-alpha.1

What's Changed

Server

• test(e2e): cover UpdateTenant RPC + restricted-claim tenant filtering by @zeevdr in #187
• feat(schema): reject prefix-overlapping field paths (#194) by @zeevdr in #195
• feat(schema): dependentRequired parser + runtime enforcement (#193) by @zeevdr in #197
• feat(schema): reserve validations key in schema spec v0.1.0 (#192) by @zeevdr in #198
• feat(schemas): v0.1.0 meta-schemas + CI validation (#123, #124) by @zeevdr in #199
• feat(schema,config): pluggable parser registry (#129) by @zeevdr in #201

Infrastructure

• build(deps): bump actions/first-interaction from 1 to 3 by @dependabot[bot] in #178
• build(deps): bump actions/github-script from 7 to 9 by @dependabot[bot] in #179
• build(deps): bump golang from 1.25-bookworm to 1.26-bookworm in /build in the minor-and-patch group across 1 directory by @dependabot[bot] in #177
• fix(ci): use underscore input names for first-interaction@v3 by @zeevdr in #188
• ci: migrate CodeQL to advanced setup by @zeevdr in #190
• ci: native ARM runners for multi-arch Docker builds (#9) by @zeevdr in #202
• fix(ci): correct matrix refs in main.yml build job by @zeevdr in #203
• fix(ci): anchor digest-artifact pattern on non-shared image suffix by @zeevdr in #204

Documentation

• docs: CEL validation discovery brief (#76) by @zeevdr in #191
• docs(concepts): schema-format.md + meta-schema.md (#127) by @zeevdr in #200

Other Changes

• docs: add repostatus alpha badge to README by @zeevdr in #173
• build(deps): bump github.com/jackc/pgx/v5 from 5.9.0 to 5.9.2 in the go_modules group across 1 directory by @dependabot[bot] in #172
• feat: add social preview image (#147) by @zeevdr in #174
• fix: shift social preview content left to prevent right-edge clipping by @zeevdr in #175
• chore: add dependabot.yml by @zeevdr in #176
• chore(go): hold CLI + SDK transport at Go 1.24 by @zeevdr in #181
• chore(deps): ignore otel >=1.43 (Go 1.25 floor) by @zeevdr in #184

Full Changelog: v0.9.0-alpha.1...v0.10.0-alpha.1

v0.9.0-alpha.1

Proto Breaking Changes

Install

What's Changed

Other Changes

• fix(ci): surface test failures in check-coverage instead of 0% by @zeevdr in #107
• fix(cli): config set/set-many send typed values matching schema by @zeevdr in #108

Full Changelog: v0.8.0-alpha.1...v0.9.0-alpha.1

v0.8.0-alpha.1

Proto Breaking Changes

Install

What's Changed

Other Changes

• feat(sdk): decouple SDK from gRPC with transport interfaces by @zeevdr in #79
• chore: SDK Go 1.22 compat CI + README update by @zeevdr in #80
• fix(ci): remove broken workflow_dispatch + update pre-commit skill by @zeevdr in #82
• feat(server): cursor-based pagination for list endpoints by @zeevdr in #83
• feat(audit): implement async batched usage stats recording by @zeevdr in #85
• feat(server): replace VersionService with ServerService by @zeevdr in #86

Full Changelog: v0.7.0-alpha.1...v0.8.0-alpha.1

v0.7.0-alpha.1

Highlights

• Slug-based lookup — all API endpoints accept tenant/schema names alongside UUIDs (#71, #72, #74)
• CLI --wait flag — health-check the server before executing commands (#69)
• Auth slug resolution — x-tenant-id: demo-company works for non-superadmin roles (#72)

Install

# CLI
go install github.com/opendecree/decree/cmd/decree@v0.7.0-alpha.1

# SDK
go get github.com/opendecree/decree/sdk/configclient@v0.7.0-alpha.1
go get github.com/opendecree/decree/sdk/adminclient@v0.7.0-alpha.1

# Docker
docker pull ghcr.io/opendecree/decree:0.7.0-alpha.1

Note: Docker images with versioned tags will be available once the release workflow issue is resolved. Use :main in the meantime.

What's Changed

Other Changes

• Fix release workflow for workflow_dispatch on tag refs by @zeevdr in #67
• CLI: add --wait flag for server readiness check by @zeevdr in #69
• Slug-based lookup for tenants and schemas by @zeevdr in #71
• Auth: resolve tenant slugs in x-tenant-id header by @zeevdr in #72
• Audit service: add slug resolution for tenant IDs by @zeevdr in #74

Full Changelog: v0.6.0-alpha.1...v0.7.0-alpha.1

v0.6.0-alpha.1

Install

# CLI
go install github.com/opendecree/decree/cmd/decree@v0.6.0-alpha.1

# SDK
go get github.com/opendecree/decree/sdk/configclient@v0.6.0-alpha.1
go get github.com/opendecree/decree/sdk/adminclient@v0.6.0-alpha.1

# Docker
docker pull ghcr.io/opendecree/decree:0.6.0-alpha.1

Note: Docker images for this release are available as ghcr.io/opendecree/decree:main (built from the same commit). Versioned Docker tags will be available starting with the next release after the release workflow fix (#67).

What's Changed

SDK

• Remove testify from SDK modules and CLI by @zeevdr in #63

Infrastructure

• chore: bump dorny/paths-filter v3 → v4 by @zeevdr in #60

Documentation

• Community health: YAML bug template, welcome bot, cleanup by @zeevdr in #61
• Add discussion templates for Q&A and Ideas by @zeevdr in #62

Other Changes

• Add demos section to README by @zeevdr in #64
• Fix server coverage badge, remove cross-repo badges by @zeevdr in #66

Full Changelog: v0.5.0...v0.6.0-alpha.1