v1.2.1

DevOpsLedger v1.2.1

What's in this release

• Fixed PATCH on decision records: null for a nullable field (say, clearing a stale description) was silently dropped instead of clearing it. Explicitly nulling a required field like title now returns a 422 instead of attempting a broken write.
• The Argo CD ingest endpoint no longer 500s when a payload has spec, status, or operationState set to null — Argo notification templates do emit these as null in some states.
• Incident webhooks with a malformed started_at timestamp no longer crash the correlation pass; the timestamp is dropped and the incident still correlates.
• The release compose file defaulted to the 1.1.0 images even in the 1.2.0 package. It now defaults to the version it ships with.
• Release notes in the demo package are now generated from this changelog instead of repeating the same v1.1.0 marketing blurb on every release.
• The release workflow can be run manually with a version input; it cuts the tag itself instead of requiring a tag push.

Demo package

• API service release image: ghcr.io/gerardrecinto/devopsledger/api:1.2.1
• Web portal release image: ghcr.io/gerardrecinto/devopsledger/web:1.2.1
• Worker release image: ghcr.io/gerardrecinto/devopsledger/worker:1.2.1
• Docker Compose release file, Helm chart, env reference, docs, demo GIF

cp env.example .env
docker compose -f deploy/docker-compose/docker-compose.release.yml up -d

• API health: http://localhost:8000/health
• API docs when ENABLE_DOCS=true: http://localhost:8000/docs
• Web portal: http://localhost:3000

Full Changelog: v1.1.0...v1.2.1

v1.2.0

What's in this release

A hardening pass on the API, containers, and deploy manifests. No new features, no breaking API changes.

• CI actually gates now. The lint step used to just run python -m py_compile (syntax check, not lint) and the test step had || true on it, so a failing test suite could never fail the build. Both are fixed: ruff runs for real, pytest gates, and pip-audit + bandit run on every push/PR and fail on findings. Added a worker lint/audit job and a web build job, neither existed before.
• Patched dependency CVEs. pip-audit found 9 known vulnerabilities on a clean install of the old requirements.txt: several starlette CVEs sitting under fastapi 0.115.5, plus one on pytest 8.3.4. Bumped fastapi to 0.139.0 (pulls starlette 1.3.1), pytest to 9.0.3, pytest-asyncio to 1.4.0 for compatibility. pip-audit is clean after, full 41-test suite still green.
• Patched a moderate PostCSS XSS advisory pulled in transitively through Next.js's bundled postcss, via an npm override. Build output unchanged.
• API, web, and worker containers now run as a non-root user instead of root. Verified all three images build and start correctly under the new user.
• The release Docker Compose file no longer publishes Postgres or Redis ports to the host - they were reachable outside the Docker network by default with the placeholder creds from .env.example, which contradicted the documented security model. The local dev compose file binds them to 127.0.0.1 instead of 0.0.0.0 so local debugging still works.
• Added the MIT LICENSE file the README and badge already claimed but the repo didn't actually have.
• Corrected docs/security-model.md: it claimed decision records were "immutable, append-only" with versioning "enforced at the data model layer" - the CRUD layer does a plain in-place update, no such enforcement exists yet. Docs now say what's actually true.
• Fixed the Helm chart, which pointed at a nonexistent devopsledger/api Docker Hub image instead of the actual ghcr.io/gerardrecinto/devopsledger publish target - helm install off the shipped chart would have failed to pull any image.
• Replaced the README demo GIF. The old one was a marketing pitch-deck animation, not a real screen recording. The new one is a real terminal recording of the API running end to end: health check, create a decision record, dashboard, list.
• Ran ruff --fix across the API codebase (57 findings - import ordering, datetime.UTC modernization). The linter was configured in pyproject.toml but CI never actually ran it.

Tests: 41/41 passing. pip-audit and bandit clean on the API. ruff check clean on API and worker.

Demo package

• API service release image: ghcr.io/gerardrecinto/devopsledger/api:1.2.0
• Web portal release image: ghcr.io/gerardrecinto/devopsledger/web:1.2.0
• Worker release image: ghcr.io/gerardrecinto/devopsledger/worker:1.2.0
• Docker Compose release file, Helm chart, env reference, docs, demo GIF

cp env.example .env
docker compose -f deploy/docker-compose/docker-compose.release.yml up -d

• API health: http://localhost:8000/health
• API docs when ENABLE_DOCS=true: http://localhost:8000/docs
• Web portal: http://localhost:3000

Full Changelog: v1.1.0...v1.2.0

v1.1.0

DevOpsLedger v1.1.0: API + Web Portal Demo Package

This release turns DevOpsLedger into a cleaner evaluation package: one download,
release-tagged images, a runnable web portal, API surface, worker, deployment
manifests, and the docs a platform team needs to judge the product seriously.

DevOpsLedger is for the moment after an infrastructure change ships and someone
asks: why did this happen, what changed, who approved it, how risky was it, and
could we roll it back?

It includes:

• API service release image: ghcr.io/gerardrecinto/devopsledger/api:1.1.0
• Web portal release image: ghcr.io/gerardrecinto/devopsledger/web:1.1.0
• Worker release image: ghcr.io/gerardrecinto/devopsledger/worker:1.1.0
• Docker Compose release file
• Helm chart
• Environment variable reference
• Product, architecture, security, on-prem, and data-model docs
• Demo GIF for the API and web portal flow

Why this matters:

• The API proves the operational-memory model is inspectable and automatable.
• The web portal gives evaluators a fast visual read on records, resources, deployments, and incidents.
• The release Compose file runs pinned images instead of local build contexts.
• The default posture remains self-hosted, offline-friendly, and telemetry-free.

Quick run:

cp env.example .env
docker compose -f deploy/docker-compose/docker-compose.release.yml up -d

Endpoints:

• API health: http://localhost:8000/health
• API docs when ENABLE_DOCS=true: http://localhost:8000/docs
• Web portal: http://localhost:3000

Best demo path:

1. Open the web portal.
2. Show the changed-resource timeline.
3. Hit API health and API docs.
4. Walk the architecture, security, and on-prem docs.
5. Point out that integrations are optional and disabled by default.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

Open-source operational memory for GitOps teams. Turns every infrastructure change into a decision record: intent, Terraform/OpenTofu diff, risk assessment, approval, rollback readiness, deployment event, incident correlation, and learning note. Self-hosted, no required SaaS, no telemetry.

Added

• HEALTHCHECK in the API Dockerfile: GET /health returns 200 when the API is ready; Docker and orchestrators detect startup failures without an external probe
• GHCR image for the API published: docker pull ghcr.io/gerardrecinto/devopsledger:latest

Docker

docker pull ghcr.io/gerardrecinto/devopsledger:latest

Quick start

git clone https://github.com/gerardrecinto/devopsledger.git
cd devopsledger
cp .env.example .env   # edit POSTGRES_PASSWORD at minimum
make up
# API:  http://localhost:8000/health
# Web:  http://localhost:3000

Stack

FastAPI + PostgreSQL + Redis + Next.js + background worker. Docker Compose for on-prem. Helm chart included.