From fa1fb51a1899664f7f46002e7e8becff7516d2e7 Mon Sep 17 00:00:00 2001 From: Zhenya Tikhonov Date: Thu, 30 Jul 2026 19:36:03 +0400 Subject: [PATCH 1/4] docs: add release notes for 2.12 --- _docs/whats-new/on-prem-release-notes.md | 71 ++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/_docs/whats-new/on-prem-release-notes.md b/_docs/whats-new/on-prem-release-notes.md index 7cd94ceef..0f3685895 100644 --- a/_docs/whats-new/on-prem-release-notes.md +++ b/_docs/whats-new/on-prem-release-notes.md @@ -5,6 +5,77 @@ toc: true --- Welcome to the release notes for our on-premises releases. + +## On-premises version 2.12 + +### Installation & Upgrade + +#### Installing v2.12 + +For detailed instructions on installing v2.12, visit [ArtifactHub](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh){:target="\_blank"}. + + +#### Upgrading to v2.12 + +The maximum GitOps runtime that is supported for this version is **0.29.x**. + +## Features & enhancements + +#### [Public Preview] Security: IP Allowlist for API Keys + +{{site.data.callout.callout_info}} +This feature is behind the feature flag `enableApiKeysIpAllowlist` (Default: _off_). +{{site.data.callout.end}} + +Account admins can now restrict API-token use to a defined set of IP addresses. When enabled, API requests from addresses not on the allowlist are rejected — so a leaked token is useless outside the account's own network. + +- New **API Keys Management** page (Account Settings → Access & Collaboration) with an **IP Allowlist** tab: on/off switch, add/edit/remove/enable/disable entries. +- Enforcement happens at authentication time; default is deny when the allowlist is on and no entries match. +- The user's current IP address is shown in the allowlist management UI and on the API keys section of user settings, so admins/users can self-diagnose a blocked key. + +#### Pipelines: Bulk-add Shared Configuration variables + +When adding pipeline variables, you can now select multiple Shared Configuration variables at once instead of adding them one at a time. + +#### Pipelines: Re-authorize Bitbucket OAuth git context + +If a Bitbucket OAuth git context's token expires, gets revoked, or otherwise stops working, you can now re-authorize it directly from where it's configured. Previously, the only fix was deleting the git context and setting it up again from scratch — which meant re-linking anything that pointed at it. This keeps the existing context (and its references) intact and just refreshes the credentials behind it. + +#### Pipelines: Bitbucket Integration stability hardening + +A broader push to make the Bitbucket integration more reliable: moved off deprecated Bitbucket endpoints to avoid future disruptions, improved handling of Bitbucket's API rate limits and added better monitoring capabilities for Bitbucket-related features for faster troubleshooting. + + +#### GitOps: Improved Runtime credentials drawer + +The "Update Git Runtime Credentials" drawer now points to the correct token-generation documentation and provides clearer in-drawer guidance for configuring the Runtime Git token. + +## Updated Feature Flags + +{: .table .table-bordered .table-hover} +| Feature Flag | Description | Default Value | +| --- | --- | --- | +| `enableApiKeysIpAllowlist` | Enables the IP allowlist feature for API keys (management UI + enforcement) | FALSE | + +## Bug fixes + +##### Pipelines + +- Fixed: `codecov-reporter` step failed with a GPG error on every run. +- Fixed: `deploy` step failed occasionaly with `ReferenceError`. +- Fixed: ECR integration using a Service Account ignored the configured region and logged in using the runtime's own region instead. +- Fixed: cron-triggered builds were occasionally duplicated. +- Fixed: pipelines using a Git integration with a `/` in its name could not be retrieved. +- Fixed: `git-clone` step occasionally failed downloading files tracked by Git LFS. +- Fixed: `git-clone` step failed occasionaly with `grep: command not found`. +- Fixed: builds using Bitbucket OAuth integration failed with `ForbiddenError`. + +##### GitOps + +- Fixed: runtime installation's generated GitHub App link didn't request all required permissions. +- Fixed: incorrect scopes documented for Bitbucket runtime tokens. + + ## On-premises version 2.11 ### Installation & Upgrade From 7bcaa9bb7252ecfbcfbc296af0d4da26cab24d4b Mon Sep 17 00:00:00 2001 From: Zhenya Tikhonov Date: Thu, 30 Jul 2026 19:47:21 +0400 Subject: [PATCH 2/4] style: rework headers --- _docs/whats-new/on-prem-release-notes.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/_docs/whats-new/on-prem-release-notes.md b/_docs/whats-new/on-prem-release-notes.md index 0f3685895..716f6836e 100644 --- a/_docs/whats-new/on-prem-release-notes.md +++ b/_docs/whats-new/on-prem-release-notes.md @@ -19,9 +19,9 @@ For detailed instructions on installing v2.12, visit [ArtifactHub](https://artif The maximum GitOps runtime that is supported for this version is **0.29.x**. -## Features & enhancements +### Features & enhancements -#### [Public Preview] Security: IP Allowlist for API Keys +##### [Public Preview] Security: IP Allowlist for API Keys {{site.data.callout.callout_info}} This feature is behind the feature flag `enableApiKeysIpAllowlist` (Default: _off_). @@ -33,31 +33,31 @@ Account admins can now restrict API-token use to a defined set of IP addresses. - Enforcement happens at authentication time; default is deny when the allowlist is on and no entries match. - The user's current IP address is shown in the allowlist management UI and on the API keys section of user settings, so admins/users can self-diagnose a blocked key. -#### Pipelines: Bulk-add Shared Configuration variables +##### Pipelines: Bulk-add Shared Configuration variables When adding pipeline variables, you can now select multiple Shared Configuration variables at once instead of adding them one at a time. -#### Pipelines: Re-authorize Bitbucket OAuth git context +##### Pipelines: Re-authorize Bitbucket OAuth git context If a Bitbucket OAuth git context's token expires, gets revoked, or otherwise stops working, you can now re-authorize it directly from where it's configured. Previously, the only fix was deleting the git context and setting it up again from scratch — which meant re-linking anything that pointed at it. This keeps the existing context (and its references) intact and just refreshes the credentials behind it. -#### Pipelines: Bitbucket Integration stability hardening +##### Pipelines: Bitbucket Integration stability hardening A broader push to make the Bitbucket integration more reliable: moved off deprecated Bitbucket endpoints to avoid future disruptions, improved handling of Bitbucket's API rate limits and added better monitoring capabilities for Bitbucket-related features for faster troubleshooting. -#### GitOps: Improved Runtime credentials drawer +##### GitOps: Improved Runtime credentials drawer The "Update Git Runtime Credentials" drawer now points to the correct token-generation documentation and provides clearer in-drawer guidance for configuring the Runtime Git token. -## Updated Feature Flags +### Feature Flags {: .table .table-bordered .table-hover} | Feature Flag | Description | Default Value | | --- | --- | --- | | `enableApiKeysIpAllowlist` | Enables the IP allowlist feature for API keys (management UI + enforcement) | FALSE | -## Bug fixes +### Bug fixes ##### Pipelines From bbdc6c3bb07dfb94e5bd390c80b402f28c79ff32 Mon Sep 17 00:00:00 2001 From: Zhenya Tikhonov Date: Thu, 30 Jul 2026 21:34:37 +0400 Subject: [PATCH 3/4] docs: improve documentation --- _docs/whats-new/on-prem-release-notes.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/_docs/whats-new/on-prem-release-notes.md b/_docs/whats-new/on-prem-release-notes.md index 716f6836e..176039c3e 100644 --- a/_docs/whats-new/on-prem-release-notes.md +++ b/_docs/whats-new/on-prem-release-notes.md @@ -12,11 +12,13 @@ Welcome to the release notes for our on-premises releases. #### Installing v2.12 -For detailed instructions on installing v2.12, visit [ArtifactHub](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh){:target="\_blank"}. +For detailed instructions on installing v2.12, visit [Chart Documentation](https://github.com/codefresh-io/codefresh-onprem-helm#codefresh-on-premises){:target="\_blank"}. #### Upgrading to v2.12 +For detailed instructions on upgrading to v2.12, visit [Chart Documentation](https://github.com/codefresh-io/codefresh-onprem-helm#to-2-12-0){:target="\_blank"}. + The maximum GitOps runtime that is supported for this version is **0.29.x**. ### Features & enhancements From e8466fb9b222c5f39e860d665c8a847e47a94b7b Mon Sep 17 00:00:00 2001 From: Zhenya Tikhonov Date: Thu, 30 Jul 2026 21:43:17 +0400 Subject: [PATCH 4/4] docs: add Bitbucket repo name fix --- _docs/whats-new/on-prem-release-notes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/_docs/whats-new/on-prem-release-notes.md b/_docs/whats-new/on-prem-release-notes.md index 176039c3e..bf222049b 100644 --- a/_docs/whats-new/on-prem-release-notes.md +++ b/_docs/whats-new/on-prem-release-notes.md @@ -71,6 +71,7 @@ The "Update Git Runtime Credentials" drawer now points to the correct token-gene - Fixed: `git-clone` step occasionally failed downloading files tracked by Git LFS. - Fixed: `git-clone` step failed occasionaly with `grep: command not found`. - Fixed: builds using Bitbucket OAuth integration failed with `ForbiddenError`. +- Fixed: for Bitbucket repositories, the owner's UUID was displayed instead of their name under some conditions. ##### GitOps