Skip to content

v0.1.25.44 — production compose hardening: Prometheus tenant-label off, SpringDoc off, exec PID-1, fleet pins

Choose a tag to compare

View all tags
@amavashev amavashev released this 26 Jun 17:50
· 137 commits to main since this release
v0.1.25.44
53333a4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[benchmark-skip] — Deployment-config-only release (production Compose hardening, Dockerfile, docs, pom dependency pins). Zero Java, Lua, or hot-path change since 0.1.25.43, so the reserve/commit/release/event latencies the benchmark measures cannot have regressed. The release gate flaked on shared-runner noise (all metrics uniformly +32–44%, with the rolling median itself inflated by today's slower runners). Bypassed per the workflow's documented policy for infra-only releases.

[0.1.25.44] — 2026-06-26

Fixed

  • Production Compose now disables tenant labels on custom Prometheus domain
    metrics via CYCLES_METRICS_TENANT_TAG_ENABLED=false, avoiding tenant-id
    disclosure and high-cardinality series when /actuator/prometheus is exposed
    to a shared scrape path.
  • Production Compose now disables public SpringDoc API docs and Swagger UI by
    default. Local/developer defaults remain unchanged.
  • Production Compose no longer sets DASHBOARD_CORS_ORIGIN on the runtime
    server, because the runtime service does not consume that variable. The
    admin service still owns dashboard CORS in the full-stack deployment.
  • Full-stack production Compose now references current sibling service images:
    cycles-server-admin:0.1.25.47 and cycles-server-events:0.1.25.20.
  • Full-stack production Compose now probes admin/events readiness endpoints
    instead of aggregate health, matching the sibling services' Redis-aware
    readiness split. The events worker is published on its management port
    9980, not the internal worker port 7980.
  • Full-stack production Compose now requires WEBHOOK_SECRET_ENCRYPTION_KEY
    for the admin/events deployment path and sets
    WEBHOOK_SECRET_ENCRYPTION_REQUIRED=true for admin.
  • Production Compose examples now point at the cycles-server:0.1.25.44 image
    tag.
  • The runtime image entrypoint now uses exec java ... so the JVM is PID 1 and
    receives container SIGTERM directly for Spring Boot graceful shutdown.

Compatibility

  • Deployment hardening only. No HTTP API schema, Redis data model, Lua, event,
    evidence, or protocol behavior change. Custom Prometheus metrics emitted from
    the production Compose deployment no longer include the tenant label unless
    explicitly re-enabled. Full-stack production deployments now fail fast if the
    webhook secret encryption key is missing.
Assets 2
Loading