Skip to content

release: dashboard v1.5.0#97

Merged
Jaro-c merged 3 commits into
mainfrom
develop
Jun 5, 2026
Merged

release: dashboard v1.5.0#97
Jaro-c merged 3 commits into
mainfrom
develop

Conversation

@Jaro-c

@Jaro-c Jaro-c commented Jun 5, 2026

Copy link
Copy Markdown
Member

Dashboard release covering the post-extraction runtime cutover:

  • Agent updates resolve from panel-agent releases (v* tags); the compose binary (podup) resolves from podup releases — the dashboard release no longer ships it.
  • install.sh delegates agent installs to the panel-agent installer.
  • Release verification key rotated to the organization-level signing key — artifacts signed with the previous key no longer verify.
  • Dashboard workflows comply with the organization Actions policy (no third-party actions).
  • Site and security docs point at the new repository locations.

Jaro-c added 3 commits June 5, 2026 16:50
Closes #76

After #75 the runtime still pointed at the old in-repo layout and the
`lynx-agent`/`lynx-compose` release flow of this repository. Everything
now resolves from the extracted repositories.

## Changes

**Backend (Rust):**
- `scheduler.rs` — agent releases resolve from `Glyndor/panel-agent`
(`v*` tags) and dashboard releases from `Glyndor/panel`, each with its
own release listing.
- `admin/handlers/updates.rs` — update check targets `Glyndor/panel`;
`update.self` download URLs target `Glyndor/panel-agent` with `v*` tags.
- `agents/heartbeat.rs` — same switch for the heartbeat-triggered update
dispatchers (not listed in #76 but same bug).

**Scripts:**
- `install.sh` — the agent option fetches `setup-agent.sh` from
`Glyndor/panel-agent` instead of executing a path that no longer exists.
- `setup-dashboard.sh` / `update-dashboard.sh` — dashboard artifacts
resolve from `Glyndor/panel`; the compose binary (renamed to `podup`)
resolves from `Glyndor/podup` releases independently of the dashboard
release.

**CI:**
- `release-dashboard.yml` — compose build/sign/upload removed (the
workspace no longer contains the crate; a release run would fail today).
- `lint-shell.yml` / `scripts/lint.sh` — extracted agent scripts dropped
from the lint lists.
- `audit-urls.py` — extracted agent update modules dropped from the scan
targets.

**Cleanup:**
- Orphaned `lynx/translators/compose/GAP_ANALYSIS.md` removed.
- README badge of the removed agent workflow dropped; stale repository
links updated.

## Test plan

- `cargo clippy -p lynx-dashboard-server` and `cargo fmt --check` clean
with `SQLX_OFFLINE=true`.
- `bash -n` on `install.sh`, `setup-dashboard.sh`,
`update-dashboard.sh`; `audit-urls.py` passes.
- No sqlx query changes — committed `.sqlx` cache untouched.

## Notes

- `Glyndor/podup` has no releases yet — the first `v*` release there
must ship `podup-linux-{x86_64,arm64}` + `.sig` signed with the shared
release key before a dashboard install/update can complete. Same for
`Glyndor/panel-agent` (release workflow added in
Glyndor/helmly-agent#20).

---------

Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Follow-up to #94 — doc-level references that still pointed at the old
monorepo:

- `docs/index.html` — repository links and install commands now target
`Glyndor/panel` and the `install.sh` entry point (the
`install-dashboard.sh`/`install-agent.sh` release assets never existed
in the new flow).
- `docs/security-architecture.md` — support matrix row no longer
references the retired `agent@*` tag scheme; agent support tracks
`panel-agent` releases.

Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
The Ed25519 release signing key was regenerated and moved from this
repository's Actions secrets to an organization-level secret
(`RELEASE_SIGN_KEY`, visibility: selected — `panel`, `panel-agent`,
`podup`). The old repository-level secret was deleted.

This swaps the hardcoded verification key in every verifier:

- `lynx/dashboard/server/src/update.rs`
- `lynx/dashboard/setup-dashboard.sh`
- `lynx/dashboard/update-dashboard.sh`

Artifacts signed with the previous key no longer verify — existing
releases predate the new key, so the next `dashboard@*` release must be
cut after this lands.

Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
@Jaro-c Jaro-c added effort:XS Less than an hour prio:P1 High status:review Waiting for review type:chore Maintenance task, no production code change labels Jun 5, 2026
@Jaro-c Jaro-c merged commit 64df8e5 into main Jun 5, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

effort:XS Less than an hour prio:P1 High status:review Waiting for review type:chore Maintenance task, no production code change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant