oscbot
released this
2026-07-07 20:08:23 +02:00
| 14 commits to main since this release
5.0.0 (2026-07-07)
⚠ BREAKING CHANGES
- communities: move community management to /api/communities/{slug}
- webhooks: require repo identity on community CI events
- webhooks: repo-identified community CI events
- picks: community picks name their community
- db: slug-keyed community collections
- api: drop osc_member from payloads; swiss_like -> perk_eligible
- perk gating driven by community flags
- db: community perk flags, description, multi-country auto-join
- move community skin to /api/community/{slug}, drop bot API
Features
- add created_at, rank and skin_count to the admin users list (40c04e8)
- add HMAC-signed media URL service (7329bd2)
- add osc_member flag and group=osc filter to the community roster (18ae948)
- add per-skin revision to the skins read model (ad0fa33)
- admin activity feed endpoint (81930d5)
- admin: PATCH /api/admin/communities/{slug} (2dad96c)
- api: drop osc_member from payloads; swiss_like -> perk_eligible (40189c4)
- auth: viewer community state on /me (2ed69f4)
- backfill per-skin source_oid from git for pre-rollout tags (a47d791)
- communities: community logo upload and public serving (86dacf3)
- communities: join requests (7ba059e)
- communities: move community management to /api/communities/{slug} (fe70169)
- db: community management schema (f3eb335)
- db: community perk flags, description, multi-country auto-join (620f19c)
- db: slug-keyed community collections (3babe8d)
- embed deeper skin page + ?limit for the integration token (1d7eaa7)
- expose per-skin version_tags on the skin detail endpoint (f6f7598)
- expose Prometheus /metrics with HTTP request instrumentation (6ec81a3)
- forgejo reachability health endpoint with osc_forgejo_up gauge (0813880)
- gate profile picks on the owner's OSC membership and expose osc_member (2e64f23)
- include the skin-CI actions in the changelog feed (b89d572)
- inquiries: file support inquiries as Forgejo issues (5a99580)
- instrument business events (downloads, uploads, logins, CI, ingest, upstream, caches, rate limits) (01ed089)
- keep oscbot working under the lock — bot-token picks read + signed osk URLs (fc9330c)
- lock all reads behind auth; account-based rate limits (f6f08d9)
- move community skin to /api/community/{slug}, drop bot API (39d0ef6)
- multi-community membership model (ab3a459)
- og: community link previews (f43344d)
- open uploads to all members, gate render picks behind swiss-like (7793ea1)
- periodic DB-derived gauge collector for Prometheus (5459743)
- perk gating driven by community flags (e620725)
- picks: community picks name their community (5da4c35)
- public OG preview endpoint with signed image URLs (31d0903)
- read-model admin stats with users/skins/ci/storage breakdown (d569eba)
- rebrand user-visible api strings to SkinHub (a665a97)
- serve admin ci-health from local ci_runs, keep Forgejo behind ?deep=true (2897c41)
- tie perks to OSC membership and let admins manage communities (07a0f0b)
- webhooks: repo-identified community CI events (5679c8b)
Bug Fixes
- bind oauth state to the session secret (6eafdb6)
- bind the resolved tag into signed media URLs (no cross-ref reuse) (8b9c3d7)
- bound skin upload/download decompression and archive size (2cbbeab)
- cap each download-all object fetch at the upload ceiling (4ae8757)
- communities: allow appointing auto-joined members as community admins (cb178b4)
- community: fall back to osu identity country for roster membership (18f5cfa)
- derive deep ci-health status from the latest run, not a workflow name (d76f918)
- exempt signed media requests from rate limiting (45cf6c3)
- gate /api/og behind OG_SHARED_SECRET to block roster scraping (ed39d0a)
- OG skin preview is thumbnail-only (no gameplay video embed) (d82bc20)
- og: embed image URLs no longer expire (ec7af70)
- plain ascii in user-facing text (380911f)
- redact secrets in Settings Debug output (3c8b6ec)
- reject replayed ci-status requests (040de43)
- require SESSION_SECRET >= 32 bytes in release builds (78bee65)
- saturating sum in download-all size pre-check to prevent i64 overflow (4e83541)
- scope default trusted-proxy CIDRs to the proxy network (df6035c)
- stream .osk overrides rewrite to a tempfile to bound memory (7447a19)
Refactors
- move ci-notify secret backfill to a --backfill-notify-secrets CLI flag (40bac33)
- webhooks: require repo identity on community CI events (d5fbe04)
Documentation
- document the ?limit query param on GET /api/users/{id} (4ae8d67)
Tests
- add forgejo REST client coverage (f714244)
- cover admin deploy-ci, reproject SSE, download-all (75f70b1)
- cover avatar proxy cache and garage-serve paths (9b45eb9)
- cover community media 404s and rate-limit DB-fault fallback (6cce65d)
- cover community skin detail/list and rate-limit catalog (002bd4d)
- cover notify-secret backfill, ci-load and pending-run tracking (5b5931d)
- cover osu OAuth callback success and failure paths (8e8f979)
- cover reproject_all stream and community ingest (2307ae4)
- cover Settings::from_env parsing and secret redaction (b0f18aa)
- cover skin_repo provisioning and changelog feed (44f330b)
- cover skins.json save authz, ci-active and no-op branches (afca831)
- cover upload validation issue branches (8904214)
- share one postgres + minio across the suite via nextest (4cd8395)
- tolerate poisoned ENV_LOCK in config tests (751b784)
Dependencies
- update actions/checkout action to v7 (9efc393)
- update rust crate aws-sdk-s3 to v1.137.0 (a271dac)
- update rust crate bytes to v1.12.0 (c0bc36a)
- update rust crate rand to v0.10.2 (be53ceb)
- update rust crate tower-http to 0.7 (a1fc5f6)
- update rust to v1.96.1 (6c2491c)
Downloads