Skip to main content

v2.19.0

Release notes for orun v2.19.0.

This release makes a repo's Orun Cloud tenancy a committed, enforced property of intent.yaml instead of a per-invocation flag, and gives the credential-free CI path a clear pre-flight and actionable denials. It completes the CLI half of the oidc-ci-tenancy spec.

Highlights​

  • Declare your org in intent.yaml. execution.state gains org, project, and requireOrg. The declared org is sent on every remote op — including the GitHub Actions OIDC exchange — so the server can enforce claim ⊆ authorized. Enforcement now lives in the committed, reviewable artifact, not a forgettable --org flag.
  • Strict mode. Declaring org (or setting requireOrg: true) makes a non-interactive remote op that resolves no org fail fast, pointing at execution.state.org, instead of exchanging an empty claim into an ambiguous scope.
  • orun cloud check. A new pre-flight: "is this repo allow-listed for the org a run would use?" It lists the org allow-list and reports a clear ✓/✗ with the exact command to add the repo — turning a mysterious CI 404 into a one-command local diagnosis.
  • Actionable allow-list denials. When a remote op 404s where a link is expected, the CLI consults the org allow-list and, only if the repo is genuinely absent, emits an "add your repo" message. Because the platform hides denials as 404 (resource-hiding), the CLI never over-claims "forbidden" / "not allow-listed" from a status code alone.
  • project = repo, first-class. The project defaults to the repository; --project / execution.state.project are demoted to an advanced override for a rename or monorepo split.

Declaring tenancy in intent.yaml​

execution:
  state:
    mode: remote
    backendUrl: https://api.orun.cloud
    org: acme            # slug or org_… — the declared, enforced tenancy
    # project: <repo>    # advanced override only; default is the repo
    requireOrg: true     # strict mode (implied whenever org is set)
    autopushCatalog: true # publish the resolved catalog after a clean default-branch plan

Org-claim precedence (unchanged): --org > ORUN_ORG > execution.state.org > the cached link. The resolved org is always sent in the exchange body and the API-key request.

Pre-flighting CI with orun cloud check​

orun cloud check                 # resolve the org the way a run does, then check the allow-list
orun cloud check --org acme      # check against a specific org
✓ sourceplane/lumen is allow-listed for org acme
  project: lumen

A repo that is not allow-listed exits non-zero and prints how to add it (console Git Repos → add from GitHub, or orun cloud link). See orun cloud for details.

Platform note​

The Orun Cloud OIDC exchange returns a stable 404 resource-hiding denial for a repo that is not linked (or whose declared org matches no authorized link) — the same shape as the state-worker push gate — so the CLI keys on one denial code. The exchange never auto-provisions an unknown repo on the workflow path: onboarding is always an explicit add.

Upgrading​

No action required for existing repos — the new intent.yaml fields are additive and optional. To adopt enforced tenancy, add execution.state.org (and optionally requireOrg: true) and run orun cloud check to confirm the repo is allow-listed before CI runs.