Versioning and releases
TruStacks ships on two version lines.
| Line | Artifacts | Current |
|---|---|---|
| Product | ghcr.io/trustacks/runner, control-plane, ui, and the chart ghcr.io/trustacks/charts/runner | 0.2.13 stable; 0.2.14-rcN release candidates |
| Policy | ghcr.io/trustacks/policy/constitution | 1.3.0 |
Both follow Semantic Versioning 2.0.0 .
Tags in git carry a v prefix (v0.2.13); OCI tags do not (0.2.13).
Product releases
The runner, control-plane, and UI images and the runner chart are built and
signed together from one tag in trustacks-mvp. The chart is published with
the runner image of the same version pinned inside it.
Which runner version to install
Copy the install or upgrade command from the app. Settings → Runners shows
the version the hosted control plane currently advertises and the version
your runner is running, and generates the command with the right --version.
Don’t hardcode a version from a doc page, this one included.
A stable release cannot be published unless the hosted control plane is set to advertise that same version, so the version the app shows is always one that exists and has been signed.
Release candidates
Tags such as 0.2.14-rc23 are release candidates. They publish their
versioned tag only. They never move :latest. The app advertises
stable releases.
:latest on the images points at the newest stable release.
Beta caveat
The product line stays on 0.x through the Beta. Under semver, a 0.x
minor release may change behavior you rely on.
Policy releases
The constitution is published from the public
trustacks-policy
repository on its own schedule, independent of product releases.
| Tag | Moves when |
|---|---|
1.0.0 | Points at exactly that release |
1 | Every stable 1.x.y release |
latest | Every stable release |
Hosted runners follow :1. A rule fix in the 1.x line reaches your runner the
next time it starts, without a runner upgrade. A 2.x release is tagged :2, so a
change that needs a newer runner never reaches a runner that follows :1.
Before 1.0.0, the constitution was published from trustacks-mvp with
the product’s version (0.x, 0.2.14-rcN) and a different signing
identity, now retired. See
Supply-chain verification.
Signed-policy pull for hosted runners ships in runner 0.2.14-rc24 and
later, which are pre-releases; no stable release includes it yet.
Earlier runners enforce the copy of the constitution baked into the runner
image, which is the version that was current when that image was built. See
Policy in force.
Where to go next
- Runner Helm chart · install and upgrade
- Supply-chain verification · verify each artifact
- Constitution · what is in the policy