# ForgeFlow 0.3.0 release notes

Release date: 2026-07-24  
Release type: self-service test release

## Goal

Version 0.3.0 closes the gap between a functional developer preview and a build
that can be configured and tested by its owner without sharing credentials with
a developer. The release concentrates on setup guidance, deterministic
preflight checks, safe diagnostics and server-side allowlisting.

## Setup and readiness

- Replaced the lightweight onboarding with a five-step setup wizard.
- Added a computer readiness preflight for Git, Git identity, writable app data,
  writable diagnostics and OS credential encryption.
- Added a Gitea validation stage before setup completion.
- Added visible repository discovery results.
- Added safe setup diagnostics before Gitea is connected.
- Added a comprehensive start page and end-to-end setup guide.
- Added a JSON-capable command-line doctor for local environment validation.

## Deployment preflight

A deployment now receives a visible preflight before confirmation and a second
mandatory backend validation immediately before dispatch. Checks include:

- linked local Git repository;
- allowed deployment branch;
- clean working tree;
- configured upstream;
- local/remote ahead and behind state;
- exact full SHA on the remote branch;
- local deploy and rollback workflow files;
- remote workflow visibility through Gitea;
- Gitea Actions API availability;
- deployment status endpoint;
- application health endpoint.

Optional environment checks can warn without hiding required failures.
Deployment cannot bypass the mandatory checks through the renderer.

## Diagnostic logging

- Added ordered structured JSONL logging in the Electron app-data directory.
- Added daily files, size rotation and retention pruning.
- Added configurable logging level, retention and file-size policy.
- Added process, renderer, Git, repository, Gitea, IPC, preflight and deployment
  diagnostics.
- Added per-launch session IDs and per-operation deployment request IDs.
- Added a no-throw logging design so diagnostic storage does not crash the app.
- Added local clear and open-folder controls.

## Secret and privacy protection

- Added recursive sensitive-key detection, including camelCase variants.
- Added bearer/basic/token/password/API-key/client-secret redaction.
- Added runtime-secret replacement.
- Added URL credential, token query parameter and private-key redaction.
- Added common hosting-token pattern redaction.
- Added user-home and source-root path aliases.
- Added strict privacy mode with deterministic identifier hashing.
- Stopped automatically ingesting or persisting raw runner logs; full output stays in Gitea.
- Added fail-closed bundle auditing before the ZIP is written.
- Added SHA-256 output for every generated support bundle.

No Gitea token, SSH key or server password is needed by the developer to use
these diagnostics.

## Support bundle contents

A support bundle can contain:

- manifest and safety audit;
- system and application version information;
- sanitized public configuration;
- sanitized repository state;
- sanitized operation history;
- latest preflight report;
- safe diagnostic status;
- redacted JSONL logs.

It intentionally excludes protected token blobs, authorization headers,
private keys, source files, Git diffs, environment dumps and raw runner output.

## Server deployment hardening

- Moved target definitions to a root-owned `/etc/forgeflow/targets.conf` file.
- Added exact repository/environment allowlisting.
- Made the server status URL mandatory and require matching SHA plus request ID before success.
- Added configuration ownership and permission checks.
- Added absolute and restricted path validation.
- Added exact remote-SHA and branch ancestry validation.
- Added per-target `flock` locking.
- Added Docker Compose result and health verification.
- Added current, previous, requested SHA, request ID and exit code to server
  status output.
- Added a restrictive sudoers template for the runner.
- Added explicit deploy and rollback workflow request-ID inputs.
- Added backend repository re-resolution so renderer-supplied paths and identities
  cannot select an arbitrary local folder or Gitea repository.
- Captured pre-dispatch Actions run IDs so polling cannot attach to an older run
  with the same commit SHA.
- Required repository, environment, live SHA, requested SHA, request ID, zero
  server exit code and explicit health success before marking a release complete.
- Restricted rollback to the exact previous SHA currently reported by the server
  status endpoint.

## User interface

- Added a dedicated Diagnostics workspace.
- Added system and deployment preflight presentation.
- Added diagnostic policy controls.
- Added Standard and Strict support-bundle export.
- Added support-bundle checksum and reveal action.
- Added readiness explanations to onboarding.
- Replaced duplicate sidebar navigation with a compact safe-diagnostics state.

## Validation

- 39 required project files validated.
- 35 JavaScript files passed syntax checks.
- 36 of 36 automated tests passed.
- Two real temporary Git remotes remain part of the integration suite.
- New tests cover redaction, diagnostic rotation/export, support ZIP generation,
  fail-closed safety auditing, preflight and Gitea workflow-file checks.

## Known boundaries

- The release is not code-signed.
- A platform-native installer is not guaranteed by the source ZIP alone.
- The private Gitea, runner and server environment still requires the documented
  local acceptance test.
- Application-specific compose commands and health endpoints remain target
  configuration, because they cannot be inferred safely.
- No redactor can mathematically identify an arbitrary unknown secret printed by
  custom third-party code; raw runner logs therefore remain only in the trusted
  Gitea Actions interface, and exported bundles should still be inspected before
  sharing.