Repository navigation
docs(release): add changelog for v1.6.0 - #3429
Merged
Merged
Conversation
Signed-off-by: Myasnikov Daniil <[email protected]>
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
Contributor
📝 WalkthroughWalkthroughChangesRelease documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/changelogs/v1.6.0.md`:
- Line 312: Update the NATS changelog entry’s source link to use the HTTPS
scheme while preserving the existing repository URL and surrounding attribution.
- Line 7: Correct the “ten-PR sweep” wording in the v1.6.0 changelog to match
the 12 distinct cleanup PRs referenced in the cleanup list, or use “ten-package
sweep” if that is the intended scope. Keep the surrounding application-storage
cleanup description unchanged.
- Around line 223-225: Clarify the release-integrity wording in the changelog
paragraph around “renamed release candidate” and “restamps the version-stamped
assets” by distinguishing immutable container images and tested build artifacts
from promotion-generated version-stamped assets. State that images remain
byte-identical and are retagged by digest, while only the explicitly regenerated
assets change during promotion.
- Around line 255-259: Update the release links in the Velero, Keycloak, and
csi-driver-nfs changelog entries to point to their exact patch tags—1.18.1,
26.6.3, and 4.13.3—or explicitly state that the existing links cover the full
patch series.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: bcdfbaaf-2c25-45d9-98eb-9fdb824852a1
📒 Files selected for processing (1)
docs/changelogs/v1.6.0.md
|
|
||
| # Cozystack v1.6.0 | ||
|
|
||
| Cozystack v1.6.0 replaces the Ubuntu + kubeadm bootstrap of **tenant Kubernetes workers with Talos Linux** driven by Cluster API, completes the **etcd-operator `v1alpha2` migration** with in-place adoption of live clusters, adds **OIDC single sign-on for tenant kube-apiservers and per-instance Grafana**, introduces the tenant-facing **`SecurityGroup` firewall API**, makes **tenant resource quotas hierarchical** so a sub-tenant can no longer escalate past its parent's budget, gives Keycloak an optional **KMS-encrypting database proxy**, a separate admin hostname and S3 backups, propagates **operator-provided wildcard certificates** down to every tenant termination point, and reworks the release pipeline around **immutable tags and rc→stable promotion** so a stable release is the byte-identical promotion of the release candidate that was tested. A ten-PR sweep also makes **application deletion actually reclaim its storage** instead of leaking PVCs. The release rolls up every fix from v1.5.1, v1.5.2 and v1.5.3. |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the “ten-PR sweep” count.
The changelog calls this a ten-PR sweep, but the referenced cleanup work lists 12 distinct PRs in Lines 233. Either change the wording to “ten-package sweep” or update the count.
Also applies to: 227-233
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/changelogs/v1.6.0.md` at line 7, Correct the “ten-PR sweep” wording in
the v1.6.0 changelog to match the 12 distinct cleanup PRs referenced in the
cleanup list, or use “ten-package sweep” if that is the intended scope. Keep the
surrounding application-storage cleanup description unchanged.
Comment on lines
+223
to
+225
| A stable release is now a **renamed release candidate**: the bytes shipped as `vX.Y.Z` are bit-for-bit the bytes built and end-to-end tested as `vX.Y.Z-rc.N`. No tag is ever force-moved and stable is never rebuilt — it is promoted by retagging the rc's existing images by digest. | ||
|
|
||
| The enabler was decoupling the operator's self-reported version from its image: it now reads `COZYSTACK_VERSION` from the environment (threaded through `cozystackOperator.platformVersion`), falling back to the build-time value, so the same bits can report any release name. All five force-retag sites in the release workflows are removed and replaced with write-once or fast-forward-only semantics, and the cron-driven `auto-release.yaml` patch-tag workflow is deleted outright — stable tags now exist only through explicit promotion. A `promote-rc.yaml` workflow validates the rc, `skopeo copy`s every digest-pinned image reference to the stable tag, restamps the version-stamped assets, and opens a `release-X.Y.Z` PR whose merge cuts the write-once stable tag ([**@myasnikovdaniil**](https://github.com/myasnikovdaniil) in #3017). A companion **Cut Pre-release Tag** workflow covers the rc side of the same flow (#3253). |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Resolve the byte-identical versus restamped-assets contradiction.
Line 223 promises that stable is a byte-identical promotion of the tested release candidate, while Line 225 says promotion “restamps the version-stamped assets.” Clarify which artifacts change during promotion; otherwise the release-integrity guarantee is misleading.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/changelogs/v1.6.0.md` around lines 223 - 225, Clarify the
release-integrity wording in the changelog paragraph around “renamed release
candidate” and “restamps the version-stamped assets” by distinguishing immutable
container images and tested build artifacts from promotion-generated
version-stamped assets. State that images remain byte-identical and are retagged
by digest, while only the explicitly regenerated assets change during promotion.
Comment on lines
+255
to
+259
| * **Velero**: 1.17.0 → 1.18.1 (chart 11.0.0 → 12.0.3), with velero plugins moved to velero-1.18-compatible releases and `kubevirt-velero-plugin` v0.8.0 → v0.9.0. ([release notes](https://github.com/vmware-tanzu/velero/releases/tag/v1.18.0)) ([**@lexfrei**](https://github.com/lexfrei) in #2974) | ||
| - **Concurrent backup processing** — multiple backups now run simultaneously without interfering, a direct win on multi-tenant clusters. | ||
| - **Cache volumes for data movers** on restore (CSI snapshot data movement and fs-backup), so data-mover pods no longer fail on limited node ephemeral disk, and restore throughput improves. | ||
| - Incremental backup size is now observable for data-mover backups. | ||
| - v1.18.1 fixes list-scoping bugs that made restores, PodVolumeRestores and CSI PVC backups list across all namespaces instead of the install namespace, and migrates `VolumeGroupSnapshot` to `v1beta2` for Kubernetes 1.34+. |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Link the patch-specific release pages. The Velero, Keycloak, and csi-driver-nfs entries describe 1.18.1, 26.6.3, and 4.13.3, but the links point to the 1.18.0, 26.6.0, and 4.13.0 release pages. Use the exact patch tags or say the linked pages cover the whole patch series.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/changelogs/v1.6.0.md` around lines 255 - 259, Update the release links
in the Velero, Keycloak, and csi-driver-nfs changelog entries to point to their
exact patch tags—1.18.1, 26.6.3, and 4.13.3—or explicitly state that the
existing links cover the full patch series.
|
|
||
| * **OpenCost**: 1.111.0 → 1.120.3 (chart 1.41.0 → 2.5.23). ([sources](https://github.com/opencost/opencost-helm-chart)) ([**@lexfrei**](https://github.com/lexfrei) in #3000) | ||
|
|
||
| * **NATS**: 2.11.8 → 2.11.10 (chart 1.3.13 → 1.3.16). ([sources](http://github.com/nats-io/k8s)) ([**@lexfrei**](https://github.com/lexfrei) in #2976) |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Use HTTPS for the NATS source link.
Replace the http://github.com/nats-io/k8s URL with HTTPS to avoid relying on an insecure redirect.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/changelogs/v1.6.0.md` at line 312, Update the NATS changelog entry’s
source link to use the HTTPS scheme while preserving the existing repository URL
and surrounding attribution.
dosubot
Bot
added
area/release
Aleksei Sviridkin (lexfrei)
approved these changes
Jul 22, 2026
github-actions
Bot
added
the
size/XL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Adds
docs/changelogs/v1.6.0.md(667 lines), generated locally with the process indocs/agents/changelog.md. Normallytags.yaml'sgenerate-changelogjob produces this on the stable tag push, but that job never ran forv1.6.0— see the note below.Coverage boundary. The changelog runs through #3386, i.e. the release period ending at the
v1.6.0-rc.4cut. Roughly eight PRs merged tomainafter that cut are deliberately absent, becausev1.6.0is a promotion rather than a rebuild: every shipped artifact is pinned to an rc.4 digest (cozystack-packages@sha256:bf682087…,cozystack-operator@sha256:93b305f7…), so that later code is in the tagged tree but not in anything users install. The changelog describes what shipped.Why this is a manual PR.
generate-changelogandupdate-website-docsare jobs intags.yaml, triggered bypush: tags. Thev1.6.0tag was pushed bypull-requests-release.yaml's finalize job using thecozystack-ciapp token, and no workflow run was created for that ref — every rc tag, pushed bycut-prerelease.yamlwith the same app, did trigger it.v1.6.0is the first stable tag created through the promote flow, so this path had never run before. The cause is not yet established and needs a repro rather than a guess; the website docs versioning is still outstanding for the same reason.Screenshots
N/A — documentation only.
Downstream repositories
Walked the trigger map in
docs/agents/contributing.mdagainst the diff, which is a single new file underdocs/changelogs/. No trigger matches: the map covers package layout, release assets, CRDs, workflow behaviour and naming contracts, none of which a changelog file touches. The separate repository list indocs/agents/changelog.mdwas already consumed while generating this file — it feeds the notes, it is not a code coupling.Release note
Summary by CodeRabbit