redwoodjs__local-ci/CHANGELOG.md

Changelog

Unreleased

• Restored SLSA provenance for the @redwoodjs/agent-ci compatibility package so pnpm's no-downgrade trust policy can upgrade safely.
• Renamed Agent CI to Local CI. The canonical npm package is now run-local-ci and the executable is local-ci; @redwoodjs/agent-ci, the agent-ci executable, AGENT_CI_*, .env.agent-ci, and legacy Docker resources remain supported compatibility aliases through the remaining 0.x releases.
• Added private registry authentication for job and service container images. Workflow credential expressions are resolved before Docker pulls missing images, while images already cached locally skip the registry request.
• Hardened the DTU mock server by requiring a cryptographically secure per-run control token for internal seed/start-runner/dump endpoints (including trailing-slash routes), failing closed if secure randomness is unavailable, constraining runner log paths to the real run log root, and removing shell interpolation from compare handling.
• Updated direct and transitive dependencies to remediate security advisories, including replacing the unpatched decompress transitive dependency.
• Fixed parallel dependency-install races by giving every job private writable node_modules. Completed pnpm, Yarn, and Bun dependency trees are now atomically published as lockfile-keyed Local CI snapshots and copied into jobs with copy-on-write when available; npm keeps private installs while reusing its shared download cache. --prewarm-through now populates this safe dependency cache instead of exposing a shared writable tree.
• Hardened opt-in Rust orchestration so matrix legs are keyed by schedule key, matrix needs results are aggregated, reusable workflows and workflow-call outputs are expanded, worker failures preserve sibling outcomes, DTU cleanup/security is enforced, cyclic dependencies error during planning, pull request branch filters use the actual branch, detached pause handling is covered directly, nested ephemeral DTU servers advertise the container IP to sibling runners, nested runner containers join the parent Docker network, Rust cleanup removes nested containers attached to per-job networks, and the Rust smoke parity gate exercises the expanded smoke suite with per-workflow timeouts, duration summaries, heartbeats, status ledgers, failure diagnostics, and timeout cleanup.