v0.4.1 · disposable previews · mesh isolation · bucket websites Agents ship · humans inspect
← Engineering log
Releases 0.3.10–0.3.19 June 28, 2026

Private images and collaborated repos

Registry credentials became workspace state, image pulls became deploy preflight, and Forgejo collaboration now reaches the deploy path: inspect a shared repo and release its image into your own workspace.

Two assumptions quietly limited early Mechanics: every image came from your own Forgejo repo, and every repo you touched was your own. A run of releases from 0.3.10 to 0.3.19 removed both.

Pull credentials became platform state

0.3.10 added workspace-scoped registry credentials for private external registries. Docker config JSON goes in over stdin, the value lives in OpenBao, and deploys resolve credentials from the image's host and path, materialized as Kubernetes imagePullSecrets without ever printing a value back. Image pulls moved into deploy preflight: a missing tag, missing credential, or pending pull secret stops the deploy before GitOps mutates, with a compact retry or repair hint instead of a later ImagePullBackOff.

private external image 

ssh -T mechanics.run -- registry credential set ghcr-acme \
  --host ghcr.io --prefix acme/ --docker-config-stdin < docker.json
ssh -T mechanics.run -- registry credential wait ghcr-acme --json
ssh -T mechanics.run -- app create api --image ghcr.io/acme/api
ssh -T mechanics.run -- app -a api deploy --tag v1.2.3

Collaboration crossed the account boundary

0.3.16 taught repo list to show repositories your Forgejo account can access through direct collaboration or organization teams, printed as unambiguous owner/repo targets that all observation commands accept. 0.3.17 completed the loop: you can create an app from a collaborated repo and release its privately built image into your own workspace, with pull credentials reconciled as caller-owned workspace credentials, never copied from the repo owner.

deploy a teammate's repo 

ssh -T mechanics.run -- repo list
ssh -T mechanics.run -- repo -r bob/api builds
ssh -T mechanics.run -- app create api --from-repo bob/api
ssh -T mechanics.run -- app -a api release --latest-success --json

The boundary that stayed

Collaborated access is artifact access. It never grants a path into the repo owner's workspace: repo create, scaffold, and delete stay account-owned, and deployment authorization is always evaluated against the caller's account and workspace. Along the way, 0.3.19 made the recovery path self-healing: stale Forgejo registry tokens with missing OpenBao material are detected and recreated during normal deploy and release, so there is no separate repair command to remember.

Share the source and the image. The workspace, credentials, and blast radius stay yours.