renovate-bot commented

Collaborator

This PR contains the following updates:

Package	Update	Change
ghcr.io/kimdre/doco-cd	minor	`0.133.2` → `0.134.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

kimdre/doco-cd (ghcr.io/kimdre/doco-cd)

`v0.134.0`

Compare Source

What's Changed

Role- and permission-based API keys

[!CAUTION]
Breaking change
API_SECRET and API_SECRET_FILE are no longer supported. Migrate to API_KEYS or API_KEYS_FILE (see below), assigning full to a key that needs the former all-access behavior (See the wiki for migration steps).
Remove the legacy variables entirely; their presence prevents startup.

API keys can now be assigned cumulative role presets or explicit permissions. Authorization is enforced across both the REST API and MCP tools: REST requests without the required permission are denied, and MCP exposes only the tools allowed by the key’s grant.

See REST API -> authentication to see how to set it up:

Role presets

The role presets are cumulative:

read grants read access to health, jobs, runs, and sync windows
inspect adds Compose project and Swarm stack inspection
write adds workload control, job and poll triggers, and mirror compaction
full adds project and stack deletion.

Explicit permissions

For more precise access, configure a key with an explicit permissions list instead of a role. See the wiki for available permissions.
Explicit permissions grant only the listed capabilities.

- key: read-only-key
  role: read
- key: deploy-key
  permissions:
    - projects:inspect
    - projects:control

New label to configure scheduled job timeouts

Prevent hung jobs from blocking future runs with the new cd.doco.job.timeout label:

labels:
  cd.doco.job.enabled: "true"
  cd.doco.job.schedule: "0 2 * * *"
  cd.doco.job.execution_mode: "one_off"
  cd.doco.job.timeout: "1h"

When the deadline expires, doco-cd gracefully stops the workload, restores any stop_services targets, marks the run as failed, and releases skip_running. Timeouts use the existing failure notifications and error metrics, and also apply to manual executions.

Supported modes: standalone restart and one_off, plus Swarm one_off. Swarm restart jobs cannot use a timeout.
Recovery: recovered one_off jobs retain their original deadline rather than receiving a fresh timeout. Restart-mode deadlines do not survive a doco-cd restart.
Timing: workload preparation counts toward the timeout; stopping and restoring stop_services does not. Graceful shutdown can extend beyond the deadline.

Accepts positive Go durations such as 90s, 30m, or 1h30m. Unset or empty means unlimited runtime, preserving existing behavior.

🚨 Breaking Changes

feat(api)!: add role- and permission-based API keys by @kimdre in #2180

✨ Features

feat(scheduler): add configurable job timeouts by @kimdre in #2193

🐛 Bug Fixes

fix(webhook): keep handover out of failures by @casperbiering in #2181

📦 Dependencies

chore(deps): update golang:1.27.3 docker digest to e519d3b by @renovate[bot] in #2159
chore(deps): update docker/github-builder digest to a31d231 by @renovate[bot] in #2158
fix(deps): update module filippo.io/age to v1.3.2 by @renovate[bot] in #2161
fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #2160
chore(deps): update docker/login-action action to v4.8.0 by @renovate[bot] in #2163
fix(deps): update module github.com/testcontainers/testcontainers-go to v0.45.0 by @renovate[bot] in #2165
fix(deps): update module github.com/avast/retry-go/v5 to v5.1.1 by @renovate[bot] in #2164
chore(deps): update dependency zensical to v0.1.0 by @renovate[bot] in #2162
chore(deps): update gcr.io/distroless/base-debian13 docker digest to ca90dc2 by @renovate[bot] in #2166
fix(deps): update module github.com/getkin/kin-openapi to v0.153.0 by @renovate[bot] in #2167
fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #2169
fix(deps): update module github.com/go-co-op/gocron/v2 to v2.23.1 by @renovate[bot] in #2170
fix(deps): update module golang.org/x/sync to v0.25.0 by @renovate[bot] in #2171
fix(deps): update module golang.org/x/sys to v0.50.0 by @renovate[bot] in #2172
chore(deps): update dependency zensical to v0.1.1 by @renovate[bot] in #2177
fix(deps): update aws-sdk-go-v2 monorepo by @renovate[bot] in #2179
fix(deps): update module github.com/docker/compose/v5 to v5.7.1 by @renovate[bot] in #2183
chore(deps): update dependency markdown-exec to v1.13.0 by @renovate[bot] in #2184
chore(deps): update gcr.io/distroless/base-debian13 docker digest to 0e48b9b by @renovate[bot] in #2188
chore(deps): update docker:29-dind docker digest to 7bf70dc by @renovate[bot] in #2192
chore(deps): update docker/buildx-bin docker tag to v0.39.0 by @renovate[bot] in #2189
fix(deps): update module github.com/moby/buildkit to v0.35.0 by @renovate[bot] in #2190
fix(deps): update module golang.org/x/crypto to v0.59.0 by @renovate[bot] in #2191

New Contributors

@casperbiering made their first contribution in #2181

Full Changelog: https://github.com/kimdre/doco-cd/compare/v0.133.2...v0.134.0

Configuration

📅 Schedule: (in timezone Europe/Rome)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/kimdre/doco-cd](https://github.com/kimdre/doco-cd) | minor | `0.133.2` → `0.134.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>kimdre/doco-cd (ghcr.io/kimdre/doco-cd)</summary> ### [`v0.134.0`](https://github.com/kimdre/doco-cd/releases/tag/v0.134.0) [Compare Source](https://github.com/kimdre/doco-cd/compare/v0.133.2...v0.134.0)  ##### What's Changed ##### Role- and permission-based API keys > \[!CAUTION] > **Breaking change** > `API_SECRET` and `API_SECRET_FILE` are no longer supported. Migrate to `API_KEYS` or `API_KEYS_FILE` (see below), assigning `full` to a key that needs the former all-access behavior (See the wiki for [migration steps](https://doco.cd/next/Endpoints/REST-API/#roles:~:text=Migration%20from%20API_SECRET)). > Remove the legacy variables entirely; their presence prevents startup. API keys can now be assigned cumulative role presets or explicit permissions. Authorization is enforced across both the REST API and MCP tools: REST requests without the required permission are denied, and MCP exposes only the tools allowed by the key’s grant. See [REST API -> authentication](https://doco.cd/next/Endpoints/REST-API/#authentication) to see how to set it up: ##### Role presets The [role presets](https://doco.cd/next/Endpoints/REST-API/#roles) are cumulative: - `read` grants read access to health, jobs, runs, and sync windows - `inspect` adds Compose project and Swarm stack inspection - `write` adds workload control, job and poll triggers, and mirror compaction - `full` adds project and stack deletion. ##### Explicit permissions For more precise access, configure a key with an explicit `permissions` list instead of a role. See the wiki for [available permissions](https://doco.cd/next/Endpoints/REST-API/#explicit-permissions). Explicit permissions grant only the listed capabilities. ```yaml - key: read-only-key role: read - key: deploy-key permissions: - projects:inspect - projects:control ``` ##### New label to configure scheduled job timeouts Prevent hung jobs from blocking future runs with the new `cd.doco.job.timeout` label: ```yaml labels: cd.doco.job.enabled: "true" cd.doco.job.schedule: "0 2 * * *" cd.doco.job.execution_mode: "one_off" cd.doco.job.timeout: "1h" ``` When the deadline expires, doco-cd gracefully stops the workload, restores any `stop_services` targets, marks the run as failed, and releases `skip_running`. Timeouts use the existing failure notifications and error metrics, and also apply to manual executions. - **Supported modes:** standalone `restart` and `one_off`, plus Swarm `one_off`. Swarm `restart` jobs cannot use a timeout. - **Recovery:** recovered `one_off` jobs retain their original deadline rather than receiving a fresh timeout. Restart-mode deadlines do not survive a doco-cd restart. - **Timing:** workload preparation counts toward the timeout; stopping and restoring `stop_services` does not. Graceful shutdown can extend beyond the deadline. Accepts positive Go durations such as `90s`, `30m`, or `1h30m`. Unset or empty means unlimited runtime, preserving existing behavior. ##### 🚨 Breaking Changes - feat(api)!: add role- and permission-based API keys by [@kimdre](https://github.com/kimdre) in [#2180](https://github.com/kimdre/doco-cd/pull/2180) ##### ✨ Features - feat(scheduler): add configurable job timeouts by [@kimdre](https://github.com/kimdre) in [#2193](https://github.com/kimdre/doco-cd/pull/2193) ##### 🐛 Bug Fixes - fix(webhook): keep handover out of failures by [@casperbiering](https://github.com/casperbiering) in [#2181](https://github.com/kimdre/doco-cd/pull/2181) ##### 📦 Dependencies - chore(deps): update golang:1.27.3 docker digest to [`e519d3b`](https://github.com/kimdre/doco-cd/commit/e519d3b) by [@renovate](https://github.com/renovate)\[bot] in [#2159](https://github.com/kimdre/doco-cd/pull/2159) - chore(deps): update docker/github-builder digest to [`a31d231`](https://github.com/kimdre/doco-cd/commit/a31d231) by [@renovate](https://github.com/renovate)\[bot] in [#2158](https://github.com/kimdre/doco-cd/pull/2158) - fix(deps): update module filippo.io/age to v1.3.2 by [@renovate](https://github.com/renovate)\[bot] in [#2161](https://github.com/kimdre/doco-cd/pull/2161) - fix(deps): update aws-sdk-go-v2 monorepo by [@renovate](https://github.com/renovate)\[bot] in [#2160](https://github.com/kimdre/doco-cd/pull/2160) - chore(deps): update docker/login-action action to v4.8.0 by [@renovate](https://github.com/renovate)\[bot] in [#2163](https://github.com/kimdre/doco-cd/pull/2163) - fix(deps): update module github.com/testcontainers/testcontainers-go to v0.45.0 by [@renovate](https://github.com/renovate)\[bot] in [#2165](https://github.com/kimdre/doco-cd/pull/2165) - fix(deps): update module github.com/avast/retry-go/v5 to v5.1.1 by [@renovate](https://github.com/renovate)\[bot] in [#2164](https://github.com/kimdre/doco-cd/pull/2164) - chore(deps): update dependency zensical to v0.1.0 by [@renovate](https://github.com/renovate)\[bot] in [#2162](https://github.com/kimdre/doco-cd/pull/2162) - chore(deps): update gcr.io/distroless/base-debian13 docker digest to [`ca90dc2`](https://github.com/kimdre/doco-cd/commit/ca90dc2) by [@renovate](https://github.com/renovate)\[bot] in [#2166](https://github.com/kimdre/doco-cd/pull/2166) - fix(deps): update module github.com/getkin/kin-openapi to v0.153.0 by [@renovate](https://github.com/renovate)\[bot] in [#2167](https://github.com/kimdre/doco-cd/pull/2167) - fix(deps): update aws-sdk-go-v2 monorepo by [@renovate](https://github.com/renovate)\[bot] in [#2169](https://github.com/kimdre/doco-cd/pull/2169) - fix(deps): update module github.com/go-co-op/gocron/v2 to v2.23.1 by [@renovate](https://github.com/renovate)\[bot] in [#2170](https://github.com/kimdre/doco-cd/pull/2170) - fix(deps): update module golang.org/x/sync to v0.25.0 by [@renovate](https://github.com/renovate)\[bot] in [#2171](https://github.com/kimdre/doco-cd/pull/2171) - fix(deps): update module golang.org/x/sys to v0.50.0 by [@renovate](https://github.com/renovate)\[bot] in [#2172](https://github.com/kimdre/doco-cd/pull/2172) - chore(deps): update dependency zensical to v0.1.1 by [@renovate](https://github.com/renovate)\[bot] in [#2177](https://github.com/kimdre/doco-cd/pull/2177) - fix(deps): update aws-sdk-go-v2 monorepo by [@renovate](https://github.com/renovate)\[bot] in [#2179](https://github.com/kimdre/doco-cd/pull/2179) - fix(deps): update module github.com/docker/compose/v5 to v5.7.1 by [@renovate](https://github.com/renovate)\[bot] in [#2183](https://github.com/kimdre/doco-cd/pull/2183) - chore(deps): update dependency markdown-exec to v1.13.0 by [@renovate](https://github.com/renovate)\[bot] in [#2184](https://github.com/kimdre/doco-cd/pull/2184) - chore(deps): update gcr.io/distroless/base-debian13 docker digest to [`0e48b9b`](https://github.com/kimdre/doco-cd/commit/0e48b9b) by [@renovate](https://github.com/renovate)\[bot] in [#2188](https://github.com/kimdre/doco-cd/pull/2188) - chore(deps): update docker:29-dind docker digest to [`7bf70dc`](https://github.com/kimdre/doco-cd/commit/7bf70dc) by [@renovate](https://github.com/renovate)\[bot] in [#2192](https://github.com/kimdre/doco-cd/pull/2192) - chore(deps): update docker/buildx-bin docker tag to v0.39.0 by [@renovate](https://github.com/renovate)\[bot] in [#2189](https://github.com/kimdre/doco-cd/pull/2189) - fix(deps): update module github.com/moby/buildkit to v0.35.0 by [@renovate](https://github.com/renovate)\[bot] in [#2190](https://github.com/kimdre/doco-cd/pull/2190) - fix(deps): update module golang.org/x/crypto to v0.59.0 by [@renovate](https://github.com/renovate)\[bot] in [#2191](https://github.com/kimdre/doco-cd/pull/2191) ##### New Contributors - [@casperbiering](https://github.com/casperbiering) made their first contribution in [#2181](https://github.com/kimdre/doco-cd/pull/2181) **Full Changelog**: <https://github.com/kimdre/doco-cd/compare/v0.133.2...v0.134.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate/container

type/minor

labels

2026-11-13 16:07:19 +01:00

renovate-bot added 1 commit

2026-11-13 16:07:19 +01:00

feat(container)!: Update image ghcr.io/kimdre/doco-cd (0.133.2 ➔ 0.134.0)

Labeler / Labeler (pull_request) Successful in 3s

Details

Lint / actionlint (pull_request) Successful in 14s

Details

Lint / yamllint (pull_request) Successful in 19s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m9s

Details

Konflate 0 resources changed

Details

321e6728bb

lab-assistant-bot commented

2026-11-13 16:09:22 +01:00

Collaborator

No rendered changes.

_{konflate 0.6.6 · rendered 321e672 · full diff →}

No rendered changes. <sub>konflate 0.6.6 · rendered `321e672` · [full diff →](https://konflate.aresu.eu/#/pr/2665)</sub>

forgejo-actions commented

2026-11-13 16:11:22 +01:00

AI Automated Review

Analysis engine: (model unavailable) · pr-reviewer-action v3.8.0

AI review could not run

The configured model endpoint(s) did not return a usable review for this run (reason: Fallback model failed).

This is an automated notice, not a substantive review. Re-run the workflow once the endpoint is reachable; see the action logs for the underlying error.

# AI Automated Review _Analysis engine: (model unavailable) · pr-reviewer-action v3.8.0_ ## AI review could not run The configured model endpoint(s) did not return a usable review for this run (reason: Fallback model failed). This is an automated notice, not a substantive review. Re-run the workflow once the endpoint is reachable; see the action logs for the underlying error.

Labeler / Labeler (pull_request) Successful in 3s

Details

Lint / actionlint (pull_request) Successful in 14s

Details

Lint / yamllint (pull_request) Successful in 19s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m9s

Details

Konflate 0 resources changed

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "renovate/major-ghcr.io-kimdre-doco-cd-0.x:renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"

git merge --no-ff "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git rebase "main"

git switch "main"

git merge --ff-only "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git rebase "main"

git switch "main"

git merge --no-ff "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "main"

git merge --squash "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "main"

git merge --ff-only "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git switch "main"

git merge "renovate/major-ghcr.io-kimdre-doco-cd-0.x"

git push origin "main"

Rows
Columns

feat(container)!: Update image ghcr.io/kimdre/doco-cd (0.133.2 ➔ 0.134.0) #2665

Release Notes

v0.134.0

What's Changed

Role- and permission-based API keys

Role presets

Explicit permissions

New label to configure scheduled job timeouts

🚨 Breaking Changes

✨ Features

🐛 Bug Fixes

📦 Dependencies

New Contributors

Configuration

AI Automated Review

AI review could not run

Checkout

Merge

`v0.134.0`