v0.39.1

0.39.1 (2026-07-23)

Bug Fixes

• attribution: resolve the audit route from one ClusterProvider read (#264) (686fb00)

Documentation

• clear the markdownlint backlog and gate structure tree-wide (#265) (81b7648)

Installation

Quick Install (plain manifests)

The CRDs ship as their own file and must be applied first — the bundle
contains a custom resource that cannot be created before its CRD exists:

kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.39.1/crds.yaml
kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.39.1/install.yaml

Helm Chart

helm install gitops-reverser oci://ghcr.io/configbutler/charts/gitops-reverser --version 0.39.1

Docker Images

This release is available as a Docker image:

docker pull ghcr.io/configbutler/gitops-reverser:0.39.1
docker pull ghcr.io/configbutler/gitops-reverser:latest

Platforms: linux/amd64, linux/arm64
Digest: sha256:5428f6919111f8de067d05e98b17e3af515f07aea929a259870fd4088d11f8b5

Verify this release

Images are signed with cosign (keyless) and carry SLSA build provenance
and an SPDX SBOM as registry attestations:

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/gitops-reverser/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/gitops-reverser:0.39.1

gh attestation verify \
  oci://ghcr.io/configbutler/gitops-reverser:0.39.1 \
  --repo ConfigButler/gitops-reverser

v0.39.0

0.39.0 (2026-07-22)

⚠ BREAKING CHANGES

• attribution: --author-attribution-cluster-annotation-key is renamed to --author-attribution-audit-route-annotation-key, and the chart value attribution.clusterAnnotationKey to attribution.auditRouteAnnotationKey. There is no deprecated alias: an operator still passing the old flag fails to start. The fact-key infix changes from cluster: to route: with no dual-read, so a rolling upgrade has a TTL-bounded window where events commit as the configured committer.
• api: a resync no longer deletes Git documents whose resources are absent from the desired snapshot. Set spec.prune.mode: always on a GitTarget that needs full desired-state convergence. Deleting a resource in the cluster still deletes its file. Ships in the same release as the rule-kind scope change, which it exists to make non-destructive.
• api: ClusterWatchRule is cluster-scope-only and WatchRule.spec.sourceNamespace moved to spec.rules[].sourceNamespace. A namespaced ClusterWatchRule becomes a WatchRule in the tenant namespace; its namespaced items become sourceNamespace: "*" (or explicit names). A target that declares no allowedSourceNamespaces admits NOTHING to a "*" item, so converting without also declaring that policy narrows production data. See docs/UPGRADING.md.

Features

• api: add GitTarget.spec.prune.mode and stop inferring deletions (#260) (f103ca8)
• api: scope by kind — per-item WatchRule source namespaces, cluster-only ClusterWatchRule (#259) (982e816)
• make unresolved attribution explicit and harden operations (#257) (e41f69c)

Bug Fixes

• attribution: partition author facts by declared audit route (#263) (0d61128)
• watch: a cluster-wide selection must not collapse named-namespace streams (#255) (10a530a)
• watch: enforce ClusterProvider admission wherever rules compile (#258) (82d0c39)

Documentation

• five-PR plan for WatchRule source namespaces, plus PR 1 — namespace-scoped resync (#254) (a60590b)

Installation

Quick Install (plain manifests)

The CRDs ship as their own file and must be applied first — the bundle
contains a custom resource that cannot be created before its CRD exists:

kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.39.0/crds.yaml
kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.39.0/install.yaml

Helm Chart

helm install gitops-reverser oci://ghcr.io/configbutler/charts/gitops-reverser --version 0.39.0

Docker Images

This release is available as a Docker image:

docker pull ghcr.io/configbutler/gitops-reverser:0.39.0
docker pull ghcr.io/configbutler/gitops-reverser:latest

Platforms: linux/amd64, linux/arm64
Digest: sha256:359fedd5212acc693d86a24ebd03717cd846e298d23a94d5d0e435acb696c7f3

Verify this release

Images are signed with cosign (keyless) and carry SLSA build provenance
and an SPDX SBOM as registry attestations:

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/gitops-reverser/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/gitops-reverser:0.39.0

gh attestation verify \
  oci://ghcr.io/configbutler/gitops-reverser:0.39.0 \
  --repo ConfigButler/gitops-reverser

v0.38.0

0.38.0 (2026-07-18)

• BREAKING: review your attribution setup and webhook setup, thjs requires you attention.

Features

• ClusterProvider — source clusters by name, reconcile-time namespace authorization (#251) (5065b09)
• config-plane split, immutable GitTarget.spec.kubeConfig for remote-cluster mirroring (#249) (9dc5da7)

Installation

Quick Install (plain manifests)

The CRDs ship as their own file and must be applied first — the bundle
contains a custom resource that cannot be created before its CRD exists:

kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.38.0/crds.yaml
kubectl apply -f https://github.com/ConfigButler/gitops-reverser/releases/download/v0.38.0/install.yaml

Helm Chart

helm install gitops-reverser oci://ghcr.io/configbutler/charts/gitops-reverser --version 0.38.0

Docker Images

This release is available as a Docker image:

docker pull ghcr.io/configbutler/gitops-reverser:0.38.0
docker pull ghcr.io/configbutler/gitops-reverser:latest

Platforms: linux/amd64, linux/arm64
Digest: sha256:01826ec5802168eb043f70de73eaa71b4dbd56a66f18bc8ccf6ff20dca46c6d2

Verify this release

Images are signed with cosign (keyless) and carry SLSA build provenance
and an SPDX SBOM as registry attestations:

cosign verify \
  --certificate-identity-regexp '^https://github.com/ConfigButler/gitops-reverser/\.github/workflows/release\.yml@refs/heads/main$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/configbutler/gitops-reverser:0.38.0

gh attestation verify \
  oci://ghcr.io/configbutler/gitops-reverser:0.38.0 \
  --repo ConfigButler/gitops-reverser

v0.37.0

0.37.0 (2026-07-16)

Features

• acceptance: accept benign repo-hygiene passengers instead of refusing the folder (#242) (49327fd)
• acceptance: treat a release-referenced values file as read-only context (#245) (d25c013)
• overlay: prove new-object placement; author images/replicas overrides and $patch:delete (#244) (38590d1)
• render-root scoping + tolerate patches and patched overlays reading ../../base (#239) (e9d6be1)
• scan-repo: adopt external-base overlays instead of refusing them (#243) (c7650f9)

Bug Fixes

• kustomize: stop writing the build's own output into the build's input (#234) (8444cd0)

Documentation

• boundary: consolidate support records (#241) (3b937f9)

gitops-reverser: v0.36.0

0.36.0 (2026-07-14)

⚠ BREAKING CHANGES

• kustomize: attribute overrides with a dyed render, verify by re-render, delete the re-implementation (#233)
• kustomize: read kustomization.yaml with kustomize, not a hand-written parser (#229)

Features

• kustomize: attribute overrides with a dyed render, verify by re-render, delete the re-implementation (#233) (61ed1e7)
• kustomize: read kustomization.yaml with kustomize, not a hand-written parser (#229) (6b3f202)

Bug Fixes

• kustomize: a digest: override no longer strips the tag out of the source file (#231) (8a835f0)
• kustomize: refuse a folder kustomize cannot build, and read the override chain from the renderer (#232) (960e3bd)

gitops-reverser: v0.35.0

0.35.0 (2026-07-14)

⚠ BREAKING CHANGES

• gitops-api: layout corpus, support baseline, and doc-link checker (#224)

Features

• bi-directional ArgoCD advise/tests + strip Argo tracking-id from Git writes (#225) (ddd75cb)
• gitops-api: layout corpus, support baseline, and doc-link checker (#224) (c48cc58)

Bug Fixes

• sanitize: strip the kcp.io/cluster annotation from Git writes (#227) (d9b6d9d)

gitops-reverser: v0.34.0

0.34.0 (2026-07-10)

⚠ BREAKING CHANGES

• rbac: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 (#223)

Features

• API-surface trigger gating, Redis key prefix, pkg/manifestanalyzer + scan-folder/scan-repo rename (#221) (0a940b3)
• rbac: least-privilege RBAC, a strict chart values schema, and informers that stop on 403 (#223) (21a0565)

gitops-reverser: v0.33.0

0.33.0 (2026-07-09)

Features

• git: write-boundary L1/L2 preconditions, WriteBoundaryRefused status, and go 1.26.5 refresh (#216) (e9a2476)
• manifest-analyzer: repo-walker onboarding discovery (F8 first cut) (22e9e92)

Documentation

• gitops-api: onboarding repo-discovery design (F8); archive shipped F1/F7 (#213) (4469e2b)

gitops-reverser: v0.32.0

0.32.0 (2026-07-08)

Features

• chart: Redis-optional install by default; rename modes to configured-author/attributed-author (#211) (3bd40c0)

gitops-reverser: v0.31.0

0.31.0 (2026-07-08)

Features

• gitops-api: treat higher-level KRM objects (HelmRelease, Argo Application, KRO) as first-class documents (#203) (e5722a7)
• secrets: stop retaining Secret values in the control plane (#208) (535c5ed)