Changelog

All notable changes to this project will be documented here.

The format follows Keep a Changelog.

2026-10-29

Changed

• Slack messages for preview deploys, thread replies included, no longer carry the Release Notes attachment; staging and production messages still do

2026-10-27

Fixed

• claude:scheduled fails with a message that says so when a schedule's AGENT_SCHEDULED_PROMPT names a variable without a value, such as $AGENT_PROMPT_MERGE, instead of failing with Claude's "Input must be provided", or running Claude on only the text after the name

2026-10-26

Breaking Changes

• The agent jobs ship no prompts: the texts of AGENT_PROMPT_REVIEW, AGENT_PROMPT_WORK, AGENT_PROMPT_UPDATE, AGENT_PROMPT_AUDIT, AGENT_PROMPT_BACKLOG, AGENT_PROMPT_MERGE and AGENT_PROMPT_STATUS are removed, so claude:review and claude:work run only when a group or project sets AGENT_PROMPT_REVIEW or AGENT_PROMPT_WORK, and a schedule that sets $AGENT_PROMPT_UPDATE fails until it names a prompt of its own, such as a command of its agent image

Added

• You can now run the agent jobs on an agent image of your own with AGENT_CLAUDE_IMAGE, and keep the prompts there as Claude Code commands, such as /review
• A scheduled run whose answer is only NO_REPORT posts nothing to Slack, so a prompt can keep the runs that changed nothing out of the channel

2026-10-23

Added

• You can now set the name and icon that a Slack message shows as its sender, with SLACK_MESSAGE_USER and SLACK_MESSAGE_USER_ICON_URL, when the Slack app has the chat:write.customize scope; SLACK_MESSAGE_USER is empty by default instead of the GitLab login, which it never sent

Changed

• uninstall:preview always posts its Slack message on its own in the channel, never as a reply in the branch's preview thread

2026-10-22

Breaking Changes

• The predefined prompts are named AGENT_PROMPT_<name>: AGENT_PROMPT_REVIEW, AGENT_PROMPT_WORK, AGENT_PROMPT_UPDATE, AGENT_PROMPT_AUDIT and AGENT_PROMPT_STATUS replace AGENT_REVIEW_PROMPT and its siblings; a schedule that sets AGENT_SCHEDULED_PROMPT to $AGENT_UPDATE_PROMPT now fails until it says $AGENT_PROMPT_UPDATE
• yamllint also runs in a project whose only YAML files end in .yml, such as a lone .gitlab-ci.yml; without a .yamllint, it uses yamllint's default config, which fails a line over 80 characters, so such a project adds a .yamllint or fixes its files
• Preview releases are named preview-<branch> instead of <branch>: a preview that is running when a project picks this up gets a second release with the same hostname on its next deploy, and uninstall:preview only removes the new one, so stop open previews first or remove the old release with helm uninstall <branch> --namespace preview-<project>
• claude:work takes one prompt, AGENT_PROMPT_WORK, and rebases a conflicting branch itself; AGENT_WORK_IMPROVE_PROMPT, the AGENT_REBASE_* variables and AGENT_CLAUDE_REBASE_ALLOWED_TOOLS are removed
• The agent jobs are named <agent>:<task>: code:claude is claude:work, review:claude is claude:review and scheduled:claude is claude:scheduled, and the work job's variables are AGENT_WORK_* instead of AGENT_CODE_*; a project that overrides one of these jobs or sets one of those variables renames it

Changed

• claude:work finishes only after the pipeline of its last push: it fixes a job its change broke and tests the preview environment, when there is one, the way a person would; its timeout is 60 minutes instead of 30, and the merge preset tests the preview the same way before it merges
• The agents title their merge requests the way the project does, which may start with the issue number, instead of Resolve "<issue title>", and claude:work retitles a merge request that still has GitLab's default title
• The update and audit presets name their branches after what they change, such as update-inventree-1-6-1 or fix-broken-links, without an update/ or audit/ prefix, and follow the repository's own branch naming when it has one
• The audit preset acts on what it finds instead of only reporting: it sweeps the repository, compares it with the reference repositories it checks out without ever changing them, opens a merge request per group of related fixes, asks questions as threads on those merge requests, files issues for bigger work, adds notes for ideas, and reports to Slack with the links ($AGENT_PROMPT_AUDIT)
• claude:scheduled gets 2 hours instead of 1 before GitLab stops it, so a sweep that opens several merge requests finishes; the budget and turn caps still bound its cost
• claude:work works on any branch: Claude finds the merge request, the issue (also from a branch name such as 7-update-inventree), the unresolved threads and the failed jobs itself; the job runs automatically on a branch without changes, such as one an issue's Create merge request button creates, whose merge request GitLab gives no pipeline, and is a button in every other branch and merge request pipeline
• claude:review waits for a click, so a review only costs tokens when someone wants one; a group or project that sets AGENT_REVIEW_AUTOMATIC to "true" gets a review on every push

Fixed

• A Helm diff job whose chart fails to render shows Helm's error in a few readable lines instead of after the chart's whole JSON schema, because HELM_DIFF_ARGS no longer passes --debug
• yamllint also runs when a merge request or branch changes a .yml file, such as .gitlab-ci.yml, so a merge request that only changes .gitlab-ci.yml no longer ends with a skipped pipeline, which blocks merging where pipelines must succeed
• A preview deploys for a branch whose name starts with a digit, such as one an issue's Create merge request button creates, because its Service name now starts with preview- instead of the digit Kubernetes rejects
• The update agent pushes the branch of a new merge request with -o ci.skip, so a branch pipeline no longer runs every job next to the merge request pipeline

Added

• A daily schedule can work through the backlog: it picks the ready issue with the highest impact for the lowest effort, says why on the issue, and starts claude:work on it with a draft merge request ($AGENT_PROMPT_BACKLOG)
• claude:work marks a draft merge request ready once the work is about 80% done and no question waits for an answer, and asks what it can't decide in a thread, so a merge request with open questions stays a draft
• claude:work moves the issue on the project's board to the list for work in progress when it starts and to the list for review when it marks the merge request ready, when the board has such lists
• A daily schedule can merge the agents' merge requests that need no person, such as typo fixes and minor updates with read release notes, and comment on the rest with what a person has to decide ($AGENT_PROMPT_MERGE)
• claude:review reads the artifacts of the pipeline's earlier jobs, such as test reports and the Helm manifest diff, which GitLab already unpacks in its checkout

2026-10-21

Added

Pipelines

• An app whose Helm values files aren't in kubernetes/helm, such as one app of a monorepo, can deploy from its own directory; the deploy rules and version commits follow it (HELM_VALUES_DIR)
• Each agent job runs on a model and effort level that fit its work: Opus at high effort for reviews, code and rebases, Sonnet at high effort for scheduled runs, which a schedule can change with AGENT_CLAUDE_MODEL and AGENT_CLAUDE_EFFORT
• Every project with the default pipeline gets the Claude agent jobs as soon as its group or project sets CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY; without one, the jobs don't appear
• Projects that include pipelines/agents.yaml next to another pipeline file get Claude agent jobs, which read and write GitLab themselves with glab and Git as their own AGENT_GITLAB_AUTH_TOKEN, and cap every run by budget, turns and job timeout
• A merge request gets a Claude code review on every push once the other jobs finish, with comments as threads on the lines they concern, code suggestions you can apply, and one summary note that each review updates (review:claude)
• An empty merge request created from an issue gets an implementation of that issue, written by Claude and pushed to its branch (code:claude)
• On a merge request with changes, playing code:claude has Claude work through the unresolved threads and the jobs its code made fail, and push the changes, so a developer can answer review comments without checking out the branch; the job replies on each thread it handled
• code:claude runs a docker:dind service, so Claude can run quick checks with tools the image lacks, such as helm, in containers before it pushes
• Commits from code:claude carry the name of the user who started the pipeline or played the job, with an Assisted-by: Claude Code trailer, and its rebases record that user as committer
• Playing code:claude on a merge request whose branch conflicts with its target first rebases the branch: Claude resolves each conflicted commit, and the job pushes it with --force-with-lease before Claude works through the threads
• The agents read the repositories a group lists in GIT_REPOSITORIES, such as its handbooks, and use the skills of the repositories in AGENT_SKILLS; each job has its own pair, such as AGENT_CODE_REPOSITORIES, so code:claude or one schedule can get more context than the review
• A pipeline schedule that sets AGENT_SCHEDULED_PROMPT runs Claude on that prompt and posts the answer to Slack, so each project can schedule its own tasks; presets cover updates, which file a security issue for each advisory that affects a pinned version and open a merge request from it once a fix exists, for code:claude to implement, and open a merge request against the schedule's branch per pinned version with a newer stable release that has been out a week ($AGENT_UPDATE_PROMPT), technical audits ($AGENT_AUDIT_PROMPT) and team status updates ($AGENT_STATUS_PROMPT) (scheduled:claude)

Helpers

• The default stages gain an agents stage before extra for the agent jobs; a project with its own stages: list adds agents to use them
• Every Claude job attaches a report of each run's model, effort, turns, duration, cost and tokens, linked from the merge request, with the totals in the metrics widget on Premium, and the full transcript for project members (.claude_report)
• Any job can check out other repositories of the same GitLab instance with its job token (.git_repositories, GIT_REPOSITORIES)
• The job log shows each step Claude takes, one line per tool call, while it works
• Jobs can run Claude Code headless with budget, turn, permission and tool caps and a chosen model and effort level, on an image with a pinned Claude Code (.claude, claude_run, AGENT_CLAUDE_MODEL, AGENT_CLAUDE_EFFORT)

Changed

Pipelines

• A preview deploys on its own in a child pipeline of a merge request pipeline too, where it was a manual job, so each app of a monorepo can run as a child pipeline
• Deploy messages name the app with GITLAB_PROJECT_NAME, so each app of a monorepo can set its own name; the default is still the project title
• Deploy messages no longer end in No changes or Version update only: a missing Configuration or Kubernetes attachment already shows that nothing changed there, and in a preview the note read as if the commits listed under Changes weren't changes

Helpers

• A project that includes helpers/docker.yaml without pipelines/docker.yaml defines the DOCKER_IMAGE_* names its jobs read, such as DOCKER_IMAGE_CACHE, itself

Fixed

Pipelines

• Helm deploys of a chart without an image of the project's own, such as cert-manager or sealed-secrets, no longer get image.repository, image.tag and version values: the image names, DOCKER_IMAGE_BRANCH among them, come from the Docker pipeline instead of the Docker helper, which the agent jobs include for .docker

Helpers

• A DOCKER_BUILD_TARGETS stage image carries DOCKER_IMAGE_SUFFIX in its tag, so it matches DOCKER_IMAGE_BUILD, and two variants of one project no longer overwrite each other's stage image
• A chart from a Helm repository, such as jetstack/cert-manager, deploys and diffs at HELM_CHART_VERSION instead of the repository's newest version

2026-10-20

Added

Pipelines

• Branches with hotfix in their name can deploy test, staging and production with a click, each on its own, besides their preview; production deploys through production:hotfix, and the dry runs those deploys need run without a click (.hotfix:test, .hotfix:staging, .hotfix:production, .hotfix)
• Version commits can go to another branch than the default one, for example main in a gitflow project (HELM_VALUES_COMMIT_BRANCH)

Changed

Pipelines

• The helm:test and helm:production dry runs follow their deploy's rules, so they no longer run in scheduled pipelines
• Version commits record every deploy except previews, also one from a hotfix branch, a merge request pipeline or a tag, so a hotfix deployed to production shows in its values file
• Deploy messages outside previews show the app URL beside the View app button, instead of the commit or merge request description; SLACK_MESSAGE_TEXT_SUCCESS and SLACK_MESSAGE_TEXT_FAILURE still replace it
• The Commits section of deploy messages is called Changes
• Preview deploy messages read as one sentence: "deployment successful for version my-feature" instead of "deployment successful, version my-feature"; update any Slack filter that matches the old wording
• The Configuration attachment of deploy messages is grey on success too, instead of green; set SLACK_MESSAGE_ATTACHMENTS_CONFIG_COLOR to choose another color

Fixed

Pipelines

• Deploy messages from merge request pipelines list the branch's commits under Changes; GitLab sets CI_COMMIT_BEFORE_SHA to the pipeline's own commit there, which left the list empty
• The helm:<environment> dry run waits for a deploy of the same release that is still running in an older pipeline, instead of failing with "another operation (install/upgrade/rollback) is in progress"; it shares the deploy's resource group
• The deploy message's Kubernetes workload list shows the long-running pods only, so an old failed CronJob run no longer turns a successful deploy red; a failed hook job still fails the deploy and shows in the job logs

2026-10-19

Added

Docs

• The documentation site counts page views and clicks on outbound links with Plausible Analytics, which sets no cookies
• The Kubernetes pipeline page lists the three settings a group needs before its first deploy (chart access, cluster token, registry deploy token), with the error each missing setting causes

Pipelines

• Deploys can commit the image values they pass to Helm to the environment's values file on the default branch, so git shows which version runs where (HELM_VALUES_COMMIT)
• Projects can pass the image to Helm under other keys, for example as one image string, by setting HELM_IMAGE_ARGS

Changed

Pipelines

• Slack deploy messages name the app first, so titles read "My App (production): Deployment successful" or "My App (production): Deployment failed" and preview messages read "My App (preview) deployment successful, version my-feature"; update any Slack filter or alert that matches the old wording

Fixed

Docs

• The cert-manager and F5 NGINX Ingress examples create their namespace on the first deploy: they set HELM_ARGS on .deploy, where --create-namespace reaches Helm, instead of globally, where the job-level HELM_ARGS of .helm:install overrode it

Helpers

• The Helm values summary in the job log and the Slack message lists keys in the order of the chart's values.yaml, as intended; the order lookup used keys_unsorted, which yq doesn't have, so the summary kept the diff's order

Pipelines

• The automatic rollback after a failed deploy and the rollback:<environment> jobs no longer fail on a field that another field manager, such as an old kubectl apply, last wrote; like the deploy, they apply server-side with --force-conflicts (HELM_ROLLBACK_ARGS)
• A version commit that the group refuses because it allows Git over SSH only says so in the job log, instead of pointing at the job token setting

2026-10-16

Added

Helpers

• Every pushed image records the commit it was built from and its project URL as OCI annotations (org.opencontainers.image.revision, org.opencontainers.image.source), which docker buildx imagetools inspect --raw and registries that read OCI annotations show

Changed

Helpers

• Helm deploys apply server-side with --force-conflicts, so a field changed by hand with kubectl or written by another controller gets the chart's value on the next deploy instead of failing it; set HELM_ARGS on .deploy without the flag to keep the old behavior
• The Helm diff compares the chart against the live objects (--three-way-merge), so it shows the manual changes a deploy reverts

Pipelines

• Deploys to test, staging, and production wait for a running deploy of the same environment instead of colliding with it on the Helm release, and each rollback:<environment> job waits in the same queue

Fixed

Pipelines

• Preview deploys no longer fail with release: already exists when a branch pipeline and a merge request pipeline deploy the same branch at once; preview and uninstall:preview queue per branch

2026-10-13

Breaking Changes

Pipelines

• The preview stop job is renamed from preview:uninstall to uninstall:preview, matching the action-first names of helm:<environment> and rollback:<environment>; move any override of preview:uninstall to the new name, since an override left on the old name becomes a separate job without a script and breaks pipeline creation

Added

Pipelines

• You can roll back test, staging, and production from the pipeline with the manual rollback:test, rollback:staging, and rollback:production jobs, which print helm history and roll their deploy job's release back to the last successful revision before the live one, skipping failed revisions
• You get a one-line Slack message in the deploy channel when a rollback:<environment> job finishes, naming the environment and the revisions it rolled back from and to, or saying that the rollback failed

Docs

• Every page of the documentation site has a footer saying that GitLab Pipelines is not affiliated with, endorsed, sponsored, or approved by GitLab Inc.

Changed

Helpers

• The first docker:image job on a new branch starts from the default branch's BuildKit registry cache (DOCKER_IMAGE_CACHE_DEFAULT) instead of rebuilding every layer
• Images and their registry cache are pushed with zstd-compressed OCI layers, which inflate several times faster on pull than gzip; clusters need containerd 1.5 or later, or set DOCKER_BUILD_COMPRESSION: gzip
• Images are pushed as a plain single-platform manifest without a provenance attestation (--provenance=false)

Pipelines

• Tag pipelines read and refresh the default branch's BuildKit cache instead of writing a cache image per tag
• Slack deploy messages no longer contain em-dashes: titles read "Deployment successful: My App (production)", the kubectl pipeline's Kubernetes header reads "Kubernetes: main", and preview thread replies separate the link with ·; update any Slack filter or alert that matches the old titles

Fixed

Helpers

• The branding link in Slack deploy messages works again: SLACK_MESSAGE_BRANDING now defaults to "by gitlabpipelines.com", linking to https://gitlabpipelines.com, because gitlab.hosst.io no longer serves the docs
• A diff job whose helm upgrade --dry-run fails shows Helm's error in the job log and the helm-dry-run.txt artifact again: under GitLab Runner's set -eo pipefail the failing pipe ended the script before the dump, so the log stopped at the command with no reason given

Pipelines

• Stopping a preview environment now uninstalls its release when a project moves previews to another namespace or release name through PREVIEW_KUBERNETES_NAMESPACE and PREVIEW_HELM_RELEASE; the stop job ignored overrides of KUBERNETES_NAMESPACE and HELM_RELEASE on .deploy:preview, reported "nothing to uninstall" and left the release running

2026-10-12

Fixed

Pipelines

• Deploys of a commit whose short SHA is all digits, such as 17716742, no longer fail the standard chart's schema check with "got number, want null or string"; the image tag and version now reach Helm as strings

2026-09-30

Breaking Changes

Pipelines

• Production deploys automatically on the default branch once the test and staging jobs pass instead of waiting for a click, while the gitflow pipeline keeps it manual on tags; set when: manual on .deploy:production to keep the click

Fixed

Pipelines

• The gitflow pipeline deploys staging and production on tags, with production manual, instead of on the default branch like the continuous deployment pipeline; its overrides targeted the old .deploy_* aliases, which no deploy job extends

2026-09-29

Changed

Pipelines

• You can read the commits straight in the rich Slack deploy message again (test, staging, production, and the .apply equivalents): they sit under a bold Commits title right below the summary, where the text used to say "(see all changes below)". The Commits attachment and SLACK_MESSAGE_ATTACHMENTS_COMMITS_COLOR are removed; the branch link and compare view it carried are still in the Version field and the Code changes button

Added

Pipelines

• You now get a Slack message when a preview environment is uninstalled, in the same channel as the preview deploy messages: preview:uninstall replies in the branch's preview thread while it is within SLACK_THREAD_TTL_SECONDS, posts on its own otherwise, and reports a failed uninstall too. The next preview deploy of that branch starts a new thread

2026-09-16

Changed

Pipelines

• Slack deploy messages no longer send the status emoticon as icon_emoji, so the Slack app keeps its own avatar
• The status emoticon, including :warning: and :danger: for a successful deploy that needs attention, shows only in preview thread replies; message titles keep their fixed success and failure emoticons
• Setting SLACK_MESSAGE_EMOTICON on a job still sets the bot icon

Helpers

• Slack messages omit icon_emoji from the payload when SLACK_MESSAGE_EMOTICON is empty instead of sending an empty string

2026-08-20

Fixed

Helpers

• A failing helm upgrade --dry-run in the diff jobs now prints its output in the job log and keeps it as the helm-dry-run.txt artifact
• The dry-run output goes to /tmp with stdout discarded, so until now a failure ended the job inside the collapsed Helm Values (new) section with only the command echoed: no error, no artifact

2026-08-19

Added

Pipelines

• preview:uninstall job tears down a preview release when its environment is stopped: manually, when the source branch's merge request merges or closes, or automatically after PREVIEW_AUTO_STOP
• preview:uninstall is wired to the preview deploy via environment:on_stop and runs helm uninstall for the branch release only; the shared preview namespace stays intact
• preview:uninstall uses GIT_STRATEGY: none, so it still runs after the source branch is deleted
• preview:uninstall rules mirror .deploy:preview on both pipeline types, which GitLab requires: a stop job that is absent from the pipeline that created the environment can never stop it

Changed

Pipelines

• The commits list in the rich Slack deploy message (test, staging, production, and the .apply equivalents) moved out of the message body into its own Commits attachment, so it gets a colored bar and a header instead of running into the metadata fields above it
• The Commits attachment leads the attachments on success and comes last on failure, where the job logs and rollback output are read first; it carries a context line linking the branch and the compare view
• Preview deployments keep their commits inline in the compact message: SLACK_MESSAGE_ATTACHMENTS_COMMITS is empty there, and setting it empty on any job restores the old inline layout

2026-08-17

Changed

Pipelines

• Slack deploy messages for a successful deployment carry the Kubernetes pod list and Kubernetes Containers (logs) attachments only when a pod is in a failed state, a pod restarted more than five times, or the container logs hold a warning or error
• A healthy deploy's message holds the title, the configuration diff and the release notes
• The Kubernetes and Kubernetes Containers (logs) attachments are sent together, so the pod list can still be read against the logs
• A failed deployment still sends everything it collected
• The preview-only suppression is removed: it hid the pod list whenever preview pods looked healthy, and the container logs on every green preview, whatever either contained

2026-08-11

Fixed

Pipelines

• Deploy and apply jobs no longer run on scheduled pipelines
• A scheduled pipeline sets CI_COMMIT_BRANCH like a branch pipeline, so .deploy:test, .deploy:staging, .deploy:production, .apply:staging, .apply:production and gitflow's .deploy_test matched their default-branch rule and would have deployed the default branch, production included, on every scheduled run

Added

Pipelines

• pre-commit:autoupdate runs pre-commit autoupdate on scheduled pipelines and fails when pinned hook revisions have fallen behind upstream, giving projects a place for the check other than a per-commit hook, which reaches the network on every commit and cannot work as a local hook, since pre-commit invoking itself fails

2026-07-13

Changed

Pipelines

• Feature branches now run merge request pipelines when an MR is open and fall back to regular branch pipelines when no MR is active; the workflow:rules no longer disable merge request pipelines and now suppress the duplicate branch pipeline while an MR is open
• Job rules that previously guarded on $CI_PIPELINE_SOURCE != "merge_request_event" were reworked so quality, diff, and preview jobs run in merge request pipelines: preview deploys (.deploy:preview, .apply:preview) run automatically on merge request pipelines and remain manual on branch pipelines without an open MR
• Long-lived branches (the default branch and develop/main/master) never deploy to a preview environment, in both the merge request and branch pipeline paths
• The default branch never switches to a merge request pipeline: it always keeps its branch pipeline, so gitflow's develop keeps deploying to test while a develop → main MR is open

Helpers

• .gitlab_merge_request and .git_changes_summary now resolve the merge request IID from $CI_MERGE_REQUEST_IID (set in merge request pipelines) before falling back to $CI_OPEN_MERGE_REQUESTS, so MR links and change summaries work in both pipeline types

2026-06-08

Added

Helpers

• .slack_auth verifies SLACK_AUTHENTICATION_TOKEN against auth.test in a collapsed job log section; prints HTTP status, parsed JSON response, and X-OAuth-Scopes header (one scope per line, sorted); warns on auth failure without failing the job
• .slack_message now prints the Slack API response (was silently discarded)
• SLACK_THREAD_FILE (default empty): when set, .slack_message reads thread_ts from the file before posting to reply to an existing thread and writes the new ts back
• SLACK_THREAD_TTL_SECONDS (default 28800, 8 h) starts a new thread when SLACK_THREAD_FILE is older than the limit; set to 0 to never expire
• SLACK_MESSAGE_TEXT_REPLY (default empty): when set and posting as a thread reply, overrides SLACK_MESSAGE_TEXT for that reply only
• SLACK_MESSAGE_BLOCKS_REPLY (default empty): when set and posting as a thread reply, overrides SLACK_MESSAGE_BLOCKS for that reply only

Pipelines

• The after_script now runs .slack_auth between the GitLab env section and the Slack notification to surface token scopes and connectivity in the job log for debugging
• .deploy:preview and .apply:preview now use SLACK_THREAD_FILE: .slack-thread-ts with a per-branch cache ($CI_PROJECT_ID-slack-thread-$CI_COMMIT_REF_SLUG) so repeated preview deploys on the same branch reply to the same Slack thread; SLACK_THREAD_TTL_SECONDS is set to 14400 (4 h) for preview; thread replies for successful re-deploys show only the commit list (SLACK_MESSAGE_BLOCKS_REPLY), dropping the deployment summary and branding; failed deploys post as a new top-level message and clear the thread so the next success starts fresh
• PREVIEW_AUTO_STOP variable (default 7 days) configures how long before a preview environment is automatically stopped; accepts any GitLab duration string (e.g. 30 days, never)

Changed

Pipelines

• Slack deploy message now shows pod health summary (2/2 pods · 0 restarts) as a second line in the Kubernetes field; shows unhealthy status and total restart count when non-zero
• Slack deploy message now includes the deployed image tag in the Version field as · `tag` when DOCKER_IMAGE_BRANCH is set
• Slack deploy message no longer wraps No changes and Version update only in parentheses; preview deploys that only change the image tag now show Version update only instead of silently omitting the suffix
• Slack deploy message Roll back button now shows a confirmation dialog explaining that it opens the environment page, not an automated rollback
• Slack deploy message Job logs attachment context now includes a direct link to helm-install.txt artifact alongside the job link
• Slack deploy message success emoticon now overrides to :warning: when max pod restarts > 5 and to :danger: when logs contain error keywords
• The after_script resource color logic now sets SLACK_COLOR_WARNING when no error keywords are detected but any pod has more than 5 restarts
• Slack deploy message Kubernetes Resources attachment renamed to Kubernetes; now queries pods and jobs directly via kubectl get pods,jobs --selector app.kubernetes.io/instance=<release> instead of piping helm get manifest, and shows real pod status columns (NAME, READY, STATUS, RESTARTS, AGE)
• Slack deploy message no longer shows the inline Kubernetes diff; diff is now accessible via three links in the Kubernetes attachment footer: colored workloads log, colored diff log, and helm-kubernetes-dyff.txt artifact
• Slack deploy message Kubernetes attachment default color changed from grey to blue (SLACK_COLOR_INFO)
• Slack deploy message attachment context lines now name the chart, release, and namespace explicitly: Configuration shows Helm Chart <chart> · Release <release> in namespace <namespace>; Kubernetes shows Containers for release <release> in namespace <namespace>; Container Logs shows Container logs for release <release> in namespace <namespace>
• Slack deploy message Container Logs attachment prepends :warning: WARNING: The container logs contain warnings above the log block when the attachment color is orange
• Slack deploy message attachment headers simplified: Configuration and Release Notes no longer include the branch name suffix
• Release Notes attachment now uses a root-level markdown block instead of section/mrkdwn so standard markdown (headings, bold, lists) renders correctly in Slack
• Kubernetes apply Slack deploy message no longer wraps No changes in parentheses

Helpers

• SLACK_THREAD_TTL_SECONDS default reduced from 86400 (24 h) to 28800 (8 h); redundant :- fallbacks removed since the variable always has a value from the defaults
• .slack_message now sets reply_broadcast: true when posting a thread reply on a failed job, so the failure is also visible in the main channel

Fixed

Helpers

• .git_commits now exports GITLAB_CODE_CHANGES_URL using the computed GIT_COMMITS_FROM/GIT_COMMITS_TO; previously used the static CI_COMMIT_BEFORE_SHA which is 0000...000 for scheduled/API-triggered pipelines, producing a broken compare URL
• GITLAB_ROLLBACK_URL now points to the environment page ($CI_PROJECT_URL/-/environments/$CI_ENVIRONMENT_ID) instead of the pipelines list; the environment page lists deployments with a direct Re-deploy action

Docs

• Homepage feature cards now split Multi-environment strategy into Preview environments and Test / Staging / Production; all cards simplified and linked to relevant docs; summary paragraph added
• Pipelines sidebar reorganized into General / Build / Deploy / Programming sections

2026-06-04

Added

Helpers

• .helm:diff now generates helm-plan.json (Terraform plan JSON) from rendered Kubernetes manifests; surfaced as a Terraform MR widget via artifacts: reports: terraform:; each Kubernetes resource maps to one resource_change entry with create/update/delete/no-op actions; includes mode, provider_name, and after_unknown fields for full Terraform plan schema compliance; prints a colored summary (+/~/-) to the collapsed job log section
• log_env <pattern> prints matching env vars with the key in cyan bold and value in yellow; replaces all env | grep "^PREFIX_" | sort call sites
• Global before_script now loads .gitlab_section_helpers so all helpers (section*, print_command*, log_*) are available in every job without explicit !reference
• HELM_VALUES_ALL uses computed (chart defaults + user) values in the diff summary when set; generates helm-values-all.txt and helm-values-summary-all.txt alongside the user-supplied equivalents

Pipelines

• Test suite extracts shell functions from YAML at runtime via yq (awk fallback for local dev); split into test_format_summary.sh and test_helm_plan.sh orchestrated by run_tests.sh; covers format_summary and helm_plan jq generation across first deploy, update, delete, noop, and mixed scenarios
• tests job runs tests/run_tests.sh in the test stage on every pipeline using the cloud-toolbox/main:helm image
• diff:staging now also runs on preview branches to give cross-environment diff visibility before merging to the default branch

Fixed

Helpers

• format_summary now skips dyff meta-blocks at indent 0 ((root level) headers and - N map/list entries removed/added lines) that caused garbled output when top-level keys were structurally different between environments; any stale pold accumulated inside a skipped block is discarded before processing the next real path
• .helm:diff now uses --namespace $HELM_NAMESPACE instead of $HELM_RELEASE_ARGS for helm get manifest; preview environments set --set nameOverride/fullnameOverride in HELM_RELEASE_ARGS which helm get manifest does not accept, causing it to fail silently and leave helm-kubernetes-current.yaml empty so dyff always reported every resource as new
• .helm:diff Helm Values Summary awk parser now correctly handles dyff's output format: dotted paths like image.tag: are split into proper YAML hierarchy, change-type lines are skipped, and list index path components ([0]) are handled
• .helm:diff helm-plan.json before/after fields now contain only kind, metadata.name, metadata.labels, and metadata.annotations instead of the full Kubernetes manifest; full manifests caused GitLab's terraform MR widget to fail to render due to deeply nested spec objects

Pipelines

• _kubectl_logs no longer redirects stderr with 2>&1 so kubectl output goes to the job log only and does not end up in kubernetes-logs.txt or the Slack attachment
• .slack_deploy_notification now changes the Slack icon to :danger: on success when SLACK_MESSAGE_ATTACHMENTS_KUBERNETES_LOGS_COLOR is not the default (i.e. logs contain warnings or errors)

Changed

Helpers

• Helper functions renamed for a consistent public API: _section* → section*, run → print_command, run_pty → print_command_pty, _log_* → log_*
• .helm:diff _run_summary_awk renamed to format_summary; helm-template.txt artifact renamed to kubernetes-manifests.txt
• .kubernetes_state removed; resource capture moved into the Kubernetes Helm pipeline; artifact renamed kubernetes-state.txt → kubernetes-resources.txt; export renamed KUBERNETES_STATE_CONTENT → KUBERNETES_RESOURCES_CONTENT

Pipelines

• Resource capture (helm get manifest | kubectl get, current + --previous logs) is now inlined in deploy script after install, before rollback
• Rollback failures now fail the job; kubernetes resources and logs included in Slack success notifications
• SLACK_MESSAGE_ATTACHMENTS_KUBERNETES_* limit and color variables moved from helpers to pipeline

2026-06-02

Added

Helpers

• .helm:install mixin provides generic Helm deploy using composable variables; output saved to helm-install.txt artifact; uses set -o pipefail so failures propagate through tee; expire_in: 30 days
• .helm:diff mixin extends .helm:install and runs helm diff; captures current/incoming values, computes values diff, renders helm template; interruptible: true; expire_in: 7 days; skips Slack notifications; environment: action: prepare
• .helm_repository, .helm_values_args, .helm_values_current, .helm_values_new, .helm_chart_version helper mixins added
• HELM_ACTION, HELM_ARGS, HELM_VALUES, HELM_FILES, HELM_EXTRA_ARGS, HELM_ARGS_SECRET, HELM_EXTRA_ARGS_SECRET, HELM_IMAGE_ARGS, HELM_RELEASE_ARGS, HELM_DIFF_OUTPUT, HELM_DIFF_CONTEXT, HELM_DIFF_ARGS, HELM_DIFF_SUMMARY_ARGS variables added
• .kubectl_docker_registry mixin creates or updates an image pull secret in the target namespace before the Helm upgrade runs
• .gitlab_job_duration and .gitlab_pipeline_duration mixins added
• SLACK_COLOR_* semantic color variables (DANGER, WARNING, SUCCESS, INFO, DEFAULT) added; per-attachment SLACK_MESSAGE_ATTACHMENTS_*_LINES and *_COLOR limit variables; SLACK_MESSAGE_BLOCKS_SIMPLE variant
• DOCKER_IMAGE_SUFFIX appended to every image tag to build variants from the same repo (e.g. -alpine); included in DOCKER_IMAGE_CACHE so parallel variant builds use separate caches

Pipelines

• New Kubernetes manifest pipeline deploys raw manifests via kubectl apply; mirrors the Helm pipeline structure with preview/test/staging/production and diff jobs; configurable via KUBERNETES_MANIFESTS and KUBECTL_ARGS variables
• diff:preview, diff:test, diff:staging, diff:production jobs now run at pipeline start (needs: [])
• HOSTNAME_PREVIEW, HOSTNAME_TEST, HOSTNAME_STAGING, HOSTNAME_PRODUCTION variables added
• .slack_deploy_notification mixin assembles Slack attachments conditionally from available content (config diff, Kubernetes diff, release notes on success; job logs, rollback, state, container logs on failure)
• needs: on all deploy jobs now waits for the corresponding diff:* job and docker:image (optional: true so pipelines without a build job are unaffected)

Docs

• cert-manager example shows deployment from the Jetstack Helm repository with version pinning, --create-namespace, CRD management, and per-environment values
• F5 NGINX Ingress Controller example shows deployment from an OCI registry with HELM_REPOSITORY: oci://... and automatic HELM_CHART resolution
• Docker helper now includes an Image variants section with parallel build example
• Kubernetes pipeline now includes an examples section with public Helm chart and OCI chart walkthroughs

Changed

Helpers

• DOCKER_IMAGE_NAME renamed to DOCKER_IMAGE_REPOSITORY; variables grouped by concern
• .git_changes_summary MR lookup now uses || true to prevent job failure when no MR matches
• .git_release_notes now initializes to empty; for tag pipelines falls back to the matching CHANGELOG section; for branch pipelines extracts only lines added to CHANGELOG.md in the current range; output truncated to 2900 characters
• HELM_REPOSITORY_GIT and HELM_REPOSITORY_URL merged into HELM_REPOSITORY, auto-detected: oci:// → helm pull --untar; .git/git@ → git clone; other URL → helm repo add; empty → skipped
• HELM_REPOSITORY_NAME is now required for plain Helm repos: an empty value causes a hard failure, preventing a silent helm repo add ""
• HELM_CHART_VERSION default changed to "": git clone uses the default branch, OCI pull gets latest
• HELM_REPOSITORY_USER fixed to gitlab-ci-token (was $CI_JOB_USER, not a valid GitLab CI variable)
• HELM_EXPERIMENTAL_OCI removed; OCI support is enabled by default since Helm 3.8
• HELM_VALUES default changed to "": avoids a silent failure when values.yaml does not exist
• HELM_VALUES_ARGS and HELM_FILES_ARGS removed from variables:, computed by .helm_values_args; pre-setting them skips the automatic expansion of HELM_VALUES/HELM_FILES
• Kubernetes helper image changed to cloud-toolbox:kubectl
• .kubectl_docker_registry now skips registry secret creation when KUBERNETES_DOCKER_REGISTRY_PASSWORD is not set
• Slack helper image changed from curlimages/curl:latest to cloud-toolbox:base; attachment content truncated to 2900 characters to stay within Slack's 3000 character block limit

Pipelines

• pre-commit and yamllint now set interruptible: true
• hadolint and docker:image now set interruptible: true; hadolint artifact expires in 7 days
• .deploy now extends .helm:install, uses k8s image, and sets dependencies: []; after_script restores cluster auth, captures state and logs, and runs helm rollback on failure; deploy artifacts expire in 30 days
• Preview deploy now sets nameOverride to project name; ingress host simplified to --set ingress.hosts[0]=$HOSTNAME

2026-05-21

Added

• Extra default stage named extra added

Changed

• Helm helper now uses cloud-toolbox:helm instead of cloud-toolbox:latest (172 MB vs 1.05 GB)
• Kubernetes helper now uses cloud-toolbox:ci instead of cloud-toolbox:latest (279 MB vs 1.05 GB)
• Google helper now uses cloud-toolbox:gcloud instead of cloud-toolbox:latest (863 MB vs 1.05 GB)
• GitLab helper now uses cloud-toolbox:base instead of cloud-toolbox:latest (50.8 MB vs 1.05 GB)

2026-05-15

Fixed

• .gitlab_message now uses Authorization: Bearer header instead of PRIVATE-TOKEN, making it compatible with the default CI_JOB_TOKEN
• .git_release_notes CHANGELOG fallback now guards against unset GIT_COMMITS_FROM/GIT_COMMITS_TO when .git_commits is not in the chain

2026-05-01

Added

• Release notes are now resolved automatically from the GitLab release description, tag message, or CHANGELOG.md
• Failed deployments now include the stderr job log in the Slack notification
• Successful deployments now include release notes in the Slack notification

2026-04-29

Added

• GitFlow pipeline: test environment deploys automatically from the default branch; staging and production deploy on tag push
• Slack helper for deployment notifications with success, failure, and warning message templates
• GitLab helper for posting merge request notes and creating releases
• Google Cloud helper for authentication and project setup
• Sentry helper for release tracking and error reporting integration
• HTTP helper for generic HTTP request jobs
• Documentation site covering all pipelines and helpers

Changed

• Preview deployments now trigger automatically when a merge request is open, and fall back to manual otherwise
• Preview deployments now trigger on feature branch pushes instead of merge request events
• The test environment has been renamed to staging
• The tests pipeline stage has been renamed to test

2025-11-11

Added

• Kubernetes/Helm deployment pipeline with preview, test, staging, and production environments
• DigitalOcean helper for doctl authentication and Kubernetes cluster setup
• Helm helper for deploying charts from a GitLab Helm registry
• Kubernetes helper with kubectl jobs and Docker registry secret management
• Docker buildx support for multi-platform and multi-stage builds
• Docker variables and base jobs extracted into a standalone helper

Changed

• Gitflow helper renamed to git.yaml

2024-07-07

Added

• pre-commit job runs pre-commit hooks automatically in the quality stage
• yamllint job for YAML linting in the quality stage
• Default pipeline stages defined: quality, build, test, publish, deploy, release
• hadolint report output is now configurable with custom args, ignore rules, and report path

2024-07-02

Added

• Docker build pipeline with GitLab registry integration, layer caching, and optional multi-stage build support
• GitFlow helper with rules scoping jobs to merge requests, tags, and the default branch