Skip to main content

v2.86.1

Binaries and the merged-pull-request list are on the GitHub releases page.

Credentials come from the connection the build is bound to​

A bootstrap resolved in the Orunbase console binds one connection per provider. The inputs it hands the build are read from those connections; for Cloudflare that includes the account's workers.dev subdomain, which the product's files, its smoke checks and its verify URLs are built from.

orun.integrations/reconcile@v1 did not know about the binding. A hook that pins no connection minted from the first active connection of the provider. In a workspace that can use two Cloudflare accounts, the product's Workers were deployed into one account while its files named the other account's subdomain, and every smoke check failed against an address nothing answered on.

From this release, the connection a reconcile mints from is, in order:

  1. the hook's own connection parameter, as before;
  2. the connection the build is bound to for that provider, from ORUN_CONNECTIONS (provider=int_… pairs, comma-separated);
  3. the first active connection, as before, when the build is bound to none.

A bound connection is treated exactly like a pinned one: when it is not an active connection of the workspace, the hook waits rather than minting from another account.

orun baseline new --from bst_… sets ORUN_CONNECTIONS from the bootstrap record. Orunbase's build box sets it for builds started from the console. Blueprints need no change.