All notable changes to this project will be documented in this file.
- Added a repository notice that the
@udx/worker-deploymentCLI is entering maintenance mode and new workflow work should prefer repo-owned Rabbit/worker contracts anddev.kitguidance.
- Disabled the automated npm release workflow to prevent repo-driven package releases while the currently published CLI remains available.
- Fix YAML key listing to output real newlines so env vars are passed correctly.
- Quote command display in deploy make target to avoid shell parse errors.
- Update default deploy config and docs to use
command+args.
- Change release branch from
mastertolatestin npm release workflow
- Removed
gh_tokenfrom npm release workflow
- Bump version to 3.0.1 to resolve immutable tag issue
- Replaced
worker-configandworker-runbinaries with a singleworkerCLI and subcommands. - Commands now use
worker <subcommand>(for example,worker config,worker run).
- New CLI subcommands:
config,run,gen, andimages. - Documentation for config/run/gen/images plus deploy configuration and CLI env docs.
- Worker generation templates and repo scaffolding assets.
- CI build and release scripts plus an npm release workflow.
- Package entrypoints and release scripts updated for the unified CLI.
- Test harness reorganized with new command coverage.
- Network Configuration - Containers can now be deployed with custom Docker networks
- Useful for connecting containers to existing networks or using host networking
- If not specified, Docker uses default bridge network
- Container Name Configuration - Containers can now have custom names
- Specify custom container names via
container_namefield - If not specified, Docker auto-generates a random name
- Useful for container management and inter-container communication
- Specify custom container names via
- Comprehensive Config Template - Updated
deploy.ymltemplate with:- All supported configuration options documented
- Format specifications for volumes, ports, network, and container names
- Practical examples for each option
- Clear comments explaining optional vs required fields
- Added
NETWORKparsing and formatting with--networkflag indeploy.sh - Added
CONTAINER_NAMEparsing and formatting with--nameflag indeploy.sh - Updated
deploy.mkto include network and container name in docker run commands - Both
runandrun-ittargets display network and container name settings - Added test coverage for both network and container_name configurations
- Better Networking - Connect containers to custom networks or use host networking
- Easier Management - Named containers are easier to identify and manage
- Complete Docker Support - Now supports all common Docker run options
- Better Documentation - Config template serves as comprehensive reference
- Ports Parameter now supported - Containers can now can be deployed with specified ports
- If
portsis not specified indeploy.yml, the container's default ports will be used
- If
- Updated
deploy.mkwith conditional logic to only include ports in docker run when present - Both
runandrun-ittargets handle empty ports gracefully
- More Flexible - Can deploy containers that have their own default ports
- Better UX - Clear indication when using container defaults vs custom ports
- Command Parameter Now Optional - Containers can now run with their default CMD/ENTRYPOINT
- If
commandis not specified indeploy.yml, the container's default command will be used - Useful for containers with well-defined default behavior
- Display shows
<using container default>when no command is specified - Dry-run output correctly reflects whether command is present or using default
- If
- New Example - Added documentation example showing usage without command parameter
- Enhanced Guidance - Updated config template and help text to indicate command is optional
- Removed validation that required
commandfield indeploy.sh - Updated
deploy.mkwith conditional logic to only include command in docker run when present - Both
runandrun-ittargets handle empty command gracefully - Config template includes helpful comment explaining optional nature
- More Flexible - Can deploy containers that have their own default commands
- Cleaner Configs - No need to specify command when container default is sufficient
- Better UX - Clear indication when using container defaults vs custom commands
- Unified Authentication Approach - Simplified GCP credential handling by delegating to worker image
- All credential types (service account keys, workload identity tokens, impersonation) now use single
GCP_CREDSenvironment variable - Worker's
gcp.shmodule handles credential type detection, normalization, andGOOGLE_APPLICATION_CREDENTIALSsetup - Removed complex dual-variable approach for impersonation
- Cleaner, more maintainable implementation
- All credential types (service account keys, workload identity tokens, impersonation) now use single
- Simplified
src/providers/gcp.mkto use unifiedGCP_CREDSvariable for all authentication methods - Worker image now handles all credential normalization (private_key escaping, type detection, etc.)
- Reduced complexity in deployment tool by centralizing auth logic in worker
- Maintains full backward compatibility with all three authentication methods
- Simpler codebase - Less authentication logic in deployment tool
- Single source of truth - Worker image controls authentication behavior
- Better maintainability - Authentication changes only need to happen in worker image
- Consistent behavior - All tools using worker get same authentication handling
- Adjusted environment variable settings and volume mounts for GCP authentication
- Service Account Impersonation - Now fully compatible with Terraform, SDKs, gcloud CLI, and all Google Cloud client libraries
- Uses user's Application Default Credentials (ADC) as source for impersonation
- Generates proper
impersonated_service_accountcredential file (official Google format) - Sets both
GOOGLE_APPLICATION_CREDENTIALS(for Terraform/SDKs) andCLOUDSDK_AUTH_ACCESS_TOKEN(for gcloud) - Dual authentication ensures all tools work seamlessly
- Eliminates the need for service account key files even when using Terraform
- ADC Integration - Automatically uses
~/.config/gcloud/application_default_credentials.json - Fallback Support - Falls back to access token if ADC not configured
- Setup Guidance - Clear instructions for
gcloud auth application-default login
- Creates
impersonated_service_accounttype credential file using user's ADC as source - Mounts credential file as read-only in container
- Passes access token as environment variable for gcloud CLI compatibility
- Follows official Google Cloud authentication best practices
- Token remains valid for 1 hour
- Impersonation Error Handling - Improved error detection and display for gcloud impersonation failures
- Better filtering of WARNING messages from gcloud output
- README Simplification - Prioritized impersonation method, merged auth sections, focused on worker examples
- Service Account Impersonation - Use your gcloud credentials to impersonate service accounts
- Automatic token generation on host
- No key files needed
- Temporary tokens (1 hour validity)
- Works with gcloud CLI commands
- Modular Provider System - Extensible architecture for multiple cloud providers
- GCP provider with full authentication support
- Ready for AWS, Azure providers
- Config-Based Authentication - Specify custom credential paths in deploy.yml
service_account.key_path- Custom key file locationservice_account.token_path- Custom token file locationservice_account.email- Service account impersonation
- Enhanced Error Messages - Clear, actionable error messages with fix suggestions
- Improved Security - Docker commands no longer echo sensitive tokens to terminal
- Authentication Priority - Clearer credential detection order
- Config-specified paths
- Default file paths (gcp-key.json, gcp-credentials.json)
- Service account impersonation
- Simplified CLI - Only 2 commands:
worker-configandworker-run - Better Documentation - Comprehensive README with all authentication methods
- UID/GID Mismatch - Resolved permission issues with credential files
- Token Filtering - Properly filters gcloud WARNING messages from tokens
- Error Handling - Improved error detection and reporting for impersonation
- Modular makefile architecture (src/providers/gcp.mk)
- Automatic credential detection and validation
- Secure token handling (no hardcoded OAuth credentials)
- Read-only credential mounts where appropriate
- Dry-run capability with
--dry-runflag - Docker and yq availability checking
- Configuration validation for required fields
- Enhanced error messages with colors
- Better volume path resolution
- Comprehensive test coverage
- YAML-based configuration
- Docker container execution
- Basic GCP credential mounting
- Volume and environment variable management