Skip to main content

CI Tools digest — October 2026

October 2026 — month to date​

The calendar reporting period is 1 October 2026, 00:00 UTC to 1 November 2026, 00:00 UTC (exclusive). This is a month-to-date preview, collected through 2026-10-31T15:23:37Z, not a completed month. A final October report can be collected only after the calendar month closes. The former 2–30 October rolling window omitted the first day and was not an October monthly digest.

Complete API pagination for this snapshot found 38 published releases and 68 merged merge requests in the calendar period so far. The published version range is 4.210.1 to 4.228.6. Merged changes and published releases are separate evidence sets; a merge alone does not prove release. Open work is listed separately as of the collection time.

Branch-specific approval policy​

Workflow components now configure approvers within individual protected-branch rules. Branch patterns use branch instead of name, and each rule can set its own required approval count. An omitted or empty approvers list selects project Maintainers and Owners with zero required approvals unless overridden; a nonempty list defaults to one required approval. See branch-specific approvers and required approval counts.

Native test components and JUnit reports​

The catalog adds the checksum-verified bashunit runner and renames the Python component to python-unittest. Both components expose configurable discovery, job names and JUnit destinations. Failed assertions fail the job while retaining their reports; missing or empty discovery is covered by behavioral regressions. The merged test-component change includes migration guidance. The separate native Node component is still open and is not part of this release summary. The month also includes explicit npm authentication.

Mirroring and dependency write-back​

oci-mirror accepts image references, project-relative YAML files, inline YAML and image lists spanning several lines. Its target is a destination namespace prefix, not a complete image reference. Registry authentication is explicit rather than implicitly using GITHUB_TOKEN. See OCI synchronization and authentication.

Helm mirroring can update matching parent-chart dependencies, lock files and bundled chart archives, with write-back enabled by default and an explicit opt-out. Dependency write-back preserves unrelated staged files and rejects conflicting pushes. The destination-convention change removes the extra charts/ prefix from examples and integration jobs; it does not silently rewrite custom targets. Archive comparison without diffutils is now merged; it is no longer open work.

Runtime isolation and visible cleanup failures​

Shared runtime roots such as /dev/shm now receive a private child directory for runtime files and registry credentials without changing the caller's directory. Container initialization probes native OverlayFS permissions and uses isolated VFS storage when the automatic native probe is denied; explicit driver choices remain intact. See private runtime directories and native-overlay fallback.

The full calendar period also includes Molecule lifecycle state persistence.

Review cleanup no longer suppresses permission or transport failures from required Helm uninstall operations. Missing releases remain idempotent, but a successful stop job must not conceal an unsuccessful cleanup. See cleanup failure propagation.

Release visibility, date filters and security tracking​

Semantic Release exposes CI_RELEASE_VERSION as a dotenv artifact for dependent jobs. The documentation changelog adds UTC calendar filters, Monday-start weeks and paginated release retrieval before applying the display limit. See release-version output and calendar filters.

Opt-in Trivy/workflow security automation can create CVE issues without duplicates and add expiring ignore entries where token permissions allow. It remains disabled by default; CI_WORKFLOW_SECURITY_ENABLED can override component inputs. See security tracking.

Migration checklist​

  • Move workflow approvers into branch rules, replace name with branch, and choose required deliberately. Do not assume the default requires approval.
  • Replace python-unit-tests includes with python-unittest. Update job/report consumers or retain old names through explicit name and junit-report inputs.
  • Configure GHCR authentication explicitly. Treat oci-mirror.target as a namespace prefix; do not pass a complete image name or tag.
  • Review Helm mirror write permissions and dependency constraints before adopting default-enabled write-back. Set update-dependencies: false when repository updates are not wanted. Existing explicit destination prefixes remain literal.
  • Investigate newly visible review-cleanup failures instead of bypassing them. Runtime fallback does not grant missing host privileges or reset shared container stores.

Not yet released​

These merge requests were open in the collected snapshot; none is presented as shipped: