Everlock 0.12.0

The 0.12.0 release brings workflows in line with forgejo-runner 13.2, keeps Immich phones in step with the server after an interrupted sync or a duplicate cleanup, closes a photo instance's Immich API to callers without Everlock credentials, and tightens what git over HTTP serves and accepts. Binaries are on the download page; the container image is published as cr.everlock.sh/everlock:0.12.

Highlights

Workflows follow forgejo-runner 13.2. The runner protocol is checked against forgejo-runner 13.2 and the forgejo/actions-proto v0.8.0 definitions it is built on, which replace the copy Everlock carried. Running real builds against it closed a set of gaps: ${{ github.event.* }} reaches the job instead of reading empty; a job checks out its own commit after the branch has moved on, where every run but the newest used to fail with "Server does not allow request for unadvertised object"; github.ref_name is the whole branch name, so feature/x and bugfix/x no longer share a concurrency: group, and github.ref_type is set. A cancelled job stays open until its runner closes it, so it keeps the output of its shutdown and reads cancelled, where the runner used to retry its closing report for most of a minute and lose the end of the log. A log line holding a line break no longer swallows the start of the next batch, a poll whose answer was lost gets the same task back, and a run whose runner disappeared is written out with its log. See workflows.
Immich phones stay in step with the server. Image instances report Immich 3.3.0 and serve the AuthUsersV2 and AssetFacesV3 sync types apps of that version ask for. Two sync paths that lost changes for good are closed. A phone can apply an older sync after a newer one — a sync that froze while the app was suspended resumes later — and then holds the older records again; the server kept the higher position and never sent the newer ones back, so a capture date fixed in the web UI never reached the phone, not even after an app restart. The phone's last report now counts, as it does in Immich, and the next sync heals it. And when duplicate cleanup trashed one of two identical copies, the sync could pick the trashed copy and delete the kept one from the phone; the kept copy of each duplicate group now goes out with every sync, so a phone catches up on its next one.

Behavior changes

Creating on a disabled backend is refused. /site create, /image create, /calendar create, /contacts create, /files create, /vault create and /oci create need their backend enabled. On a disabled backend they save nothing and say why: nothing would serve the new instance, /backends enable <backend> fixes it, and enabling restarts Everlock, cutting off open SSH sessions and running operations. Previously the instance was saved but never served — and /site create with a vhost restarted the server without enabling anything.
A job without runs-on is refused. A workflow with a job that names no runner label creates no run: a push logs the reason with the job's name, and /git workflow start returns it. Previously such a job was handed to any runner, which then failed it with "the workflow file is not usable". A job that calls a reusable workflow with uses: may still leave runs-on out, and runs-on is also read in its mapping form, labels and group.

Security

A photo instance's Immich API takes Everlock credentials. Every /api operation except the public ones — /api/server/ping, the server version, the login itself — answers 401 without a credential: an evapi_ key in x-api-key, the session token from /api/auth/login, or Basic login credentials. A reader grant is an Immich guest and reaches only the operations that serve its albums — originals, thumbnails, video playback, search and the timeline; the album list, uploads and deletes answer 403. Previously a token only narrowed a guest's view: a request without one acted as the library owner on every instance — listing albums and users, reading originals, deleting assets — and a share link passed every changing operation.
Branch and pull-request names stay inside their repository. Closing, opening, checking and merging a pull request, and deleting a branch, turned the name from the request into a file path without checking it, so a name with ../ — %2F in a URL — reached the refs of other repositories, the system store included. A :pulls grant on any repository was enough. Every ref name from a request now has to be a valid git ref name, as pushes already did.
A fetch is served only what a ref reaches. git-upload-pack answered a want for any object id in the store, so a client that asked for one directly — a stock git client never did — could fetch a commit that had been force-pushed away or belonged to a deleted branch, until git.gc removed it. A want has to name what a ref points at or a commit in a ref's history; anything else is refused with not our ref. The same rule is what lets a workflow fetch its commit by id.

Fixes

/backends enable|disable keeps the rest of the config file. For vault-http, files-http, mail-smtp, mail-imap and git-ssh the flag shares a file with other settings, and toggling it rewrote the file with the flag alone — dropping every vault instance and file share, and the mail store name. Only enabled changes now; a file that does not parse is left untouched and the command reports it.
git.gc keeps the objects of a repository that has no refs. Such a repository counted every object as unreachable and lost all of them on the next sweep; it is now left as it is, with a warning when it holds objects.
Merging a pull request locks the exact target branch. The lock for v1.2 was shared with v1.3 and not taken exclusively, so two merges could both write the branch.
last login counts every credential. /users list read only password credentials, so a user who signs in with an SSH key or an API key showed never. It now reports the most recent use across password, SSH key and API key credentials.
Site messages say "site" once: "No site site named …" lost the doubled word.

Upgrading

Self-updating servers pick 0.12.0 up on their daily check. For a manual upgrade, download the new binary (or pull the new image tag) and restart — stores, mail, and all versioned content carry over untouched. Two things can need attention afterwards:

A script or tool that calls a photo instance's /api without a credential now gets 401; give it an evapi_ key in x-api-key.
A workflow whose jobs name no runs-on stops creating runs; the push log names the job to fix.

The full list of changes is in the changelog.