Skip to main content

v2.35.0

Release notes for orun v2.35.0 — everything landed since v2.34.0. The headline is orun-workflows-v3: the workflow engine comes home, in-process, with a new language and no backward compatibility with torkflow/v1 files. This note supersedes the engine model described in the v2.32.0 notes.

Highlights​

  • Workflows v3 — one language, one binary. The external torkflow engine boundary is deleted; apiVersion: orun.dev/v1, kind: Workflow files are parsed, validated, and executed in-process by orun itself.

    • The language: pull-only needs: edges, CEL expressions, three verbs — run: (argv, never a shell), action: (built-ins http.request, script, sleep), workflow: (nested, cycle-detected). See the new Workflow schema reference.
    • orun workflow validate is now a full compile check — DAG, verb exclusivity, action with: validation, CEL compilation, and reference visibility (a step can only read ancestors' outputs, so cross-branch races are rejected by construction). orun plan runs the same check on embedded workflows, so an invalid file fails the plan, not the run.
    • poll: — the wait primitive. Re-execute a step's verb on an interval until a CEL condition holds; a non-zero run: exit is an evaluable attempt, not a fault — built for gh pr checks-style wait loops.
    • Resume. Run state lives under .orun/wfruns/<execId>/; orun workflow run --resume <execId> re-executes only non-succeeded steps and refuses a changed file digest.
    • envInherit — a declared, review-visible allowlist of host env vars passed through to run: steps (SSH_AUTH_SOCK and kin). Nothing ambient leaks in.
    • Live step streaming — step output streams line-buffered as it happens; parallel steps never interleave mid-line.
    • The self shim — a step invoking orun always gets the binary running the workflow, never a stale install on PATH.

  • Remote workflow refs. orun workflow run accepts github:owner/repo@ref//path/to/workflow.yaml and https://… references — fetched (with GITHUB_TOKEN/GH_TOKEN), pinned to a resolved commit, and exposed to steps as ORUN_FLOW_SOURCE_{REPO,REF,SHA,URL} so a flow can fetch its own payload at exactly the commit it ran from.

  • Resume-aware CI reruns: --retry got real. With exec-id = run id, a CI rerun resumes the same execution. orun run --job <id> --retry now (1) re-opens the job's failed remote claim (the platform's sanctioned JOB_RETRIED re-open) and (2) waits out failed upstream dependencies while their own retry lanes recover, bounded by the 30-minute dependency deadline. gh run rerun --failed on an orun-driven workflow just works.

  • Secrets, end to end. New docs: Secrets, orun secrets, Scope references.

    • optionalSecretEnv — best-effort component references: an unseeded key is skipped at resolve instead of failing the job. Wire now, seed later.
    • secretOutputs — declared job output secrets. Steps append KEY=value lines to $ORUN_SECRET_OUTPUTS; after the job succeeds the runner enforces the declared-key allow-list and publishes the batch over the run's lease-bound channel. A minted database password reaches the platform without transiting CI logs or a human.
    • Scope-reference grammar — secret://, config://, and flag:// share one named-dimension grammar (secret://project:api/env:prod/KEY@3) with contextual omission: an omitted dimension binds to the run context, so one manifest line works in every environment. Legacy positional references still parse and pin identically.
    • Secrets UX — scope selectors (--env/--project/--workspace) on reveal/rotate/versions, one-shot composite reveal preflight, typo suggestions that exit non-zero, --json everywhere (metadata only), set --from-broker for provider-rotated secrets and rotate --remint for break-glass re-mints.

  • orun integrations — the console-parity verb tree. List connections, check provider status, author integration-bound secrets (<provider> secret create … --mode brokered|rotated), and manage scope templates — registry-served, offline-capable via orun integrations sync, and value-less by design. See orun integrations.

  • Terraform state on the platform. Remote component jobs export a complete TF_HTTP_* environment pointing backend "http" {} at Orun Cloud's native Terraform state store — per (component, environment) addressing, per-step re-minted tokens, no tenant S3 bucket or OIDC role. See Terraform state on the platform.

  • Headless cloud linking. orun cloud link and orun cloud check honor ORUN_TOKEN, so containers and CI drivers can self-link without a browser login.

  • Auth resilience. Browser login and device-flow polls ride out 429 rate_limited and transient transport errors; concurrent orun processes no longer race the session store into a dead token family.

Upgrade notes​

  • torkflow/v1 workflow files are rejected — there is no converter. The v3 design's mapping table is the manual path: drop the spec: wrapper, replace outboundEdges/nextStepName/branchName with needs: pull edges, actionRef with one of the three verbs, Trigger.* with inputs.*, maxParallelSteps with maxParallel.
  • An intent declaring execution.workflowEngine fails to load — delete the block. orun workflow engine-digest is removed and ORUN_TORKFLOW_ENGINE is no longer read.
  • Workflow digests are unchanged (sha256: over raw bytes) — plans and provenance locks for unchanged files stay stable.
  • orun secrets set --from-broker is deprecated (works for one release); it prints the exact orun integrations <provider> secret create replacement for your invocation.
  • orun policy test --component-type is retired — component.type was never a resolvable fact. Use --component <name>, or scope the secret to the component directly.