OpenFace v0.2.0

OpenFace v0.2.0 turns repository content into a safer delivery workflow. These notes cover the changes since v0.1.0: guided Pages publishing, Forgejo Actions-backed Pipelines, authenticated Space environment APIs, portable Automations, and stricter merge delivery controls.

Highlights

• Guided OpenFace Pages: inspect whether gh-pages/index.html or default-branch docs/index.html is actually publishable, then deploy static HTML, docs, or a VitePress starter from a confirmation-based wizard.
• Repository Pipelines: install and dispatch a seeded Forgejo Actions workflow, inspect runs, jobs, steps, logs, actors, commits, and artifacts, then retry, cancel, approve, or roll back with audited controls.
• Protected Space configuration: PAT-authenticated APIs create, rotate, disable, delete, audit, and apply runtime/build Variables and encrypted Secrets without returning secret values.
• Portable Automations: public automation.toml repositories are validated at an immutable revision and exported in a normalized, disabled form. Embedded secrets, private URLs, destructive commands, and mutable revisions are rejected.
• Reliable public Spaces: anonymous visitors can launch and use public CPU Spaces while configuration and destructive lifecycle actions remain protected.
• Delivery guardrails: issue-scoped worktrees, time checkpoints, scope budgets, exact-head Codex Review evidence, stable review snapshots, required GitHub Actions identity, and SHA-bound merges prevent stale evidence from authorizing a merge.

Pipeline and Pages safety

Pipeline artifact downloads and archive entries are bounded. Deployments retain immutable revisions, prevent older backfill runs from rolling staging backward, serialize production publication, expire stale previews, and wait for Space HTTP readiness before reporting success. Release/tag jobs take production precedence, while clean Pages URLs and missing-output retirement keep published state aligned with repository state.

Visual capture remains a focused local or deployed-environment review. It is intentionally not treated as an automatic CI verdict.

Operator impact

• Configure runner concurrency, resource limits, timeouts, and retention with the documented .env settings before enabling repository Pipelines broadly.
• Use the Space environment API or owner UI for Variables and Secrets; build settings synchronize to Forgejo Actions while runtime values stay in the application container path.
• Existing Pages repositories remain compatible. The inspector now explains whether content came from gh-pages or the default branch docs/ fallback.
• Existing Docker Spaces do not require a migration. Public launch and owner-only management are now covered by a production-browser regression audit.

Documentation

Read the v0.2.0 delivery walkthrough, OpenFace Pages, Repository pipelines, Space Variables and Secrets, and change delivery.

Validation

The release candidate is checked with the repository CI suites, frontend type/build checks, Space runner tests, merge-guard tests, bilingual docs validation, the VitePress production build, SVG validation, and the release QA inventory gate. The tag and GitHub Release are published only after the release Pull Request and docs deployment succeed.