Releases

v2.1.1 2026-10-02

latest

• `gtcnsl runner reconfigure --admin-token` now really removes the old runner registration from Gitea — until now the cleanup called an API route that never existed, so the orphan always stayed in Site Admin.
• The old registration is identified by the id stored in its `.runner` file and double-checked by name and instance address before anything is deleted; it needs Gitea ≥ 1.24 and a site-admin token with `write:admin`.

→

v2.1.0 2026-10-02

• Gitea 28 is supported: 28.0.0 — the successor of 1.27, now without the `1.` prefix — is validated, and a fresh `gtcnsl gitea install` gets the newest 28.x.
• Gitea Runner 4.x is supported: runner 4.1.0 is validated with the host, docker and dind-rootless executors, and a fresh `runner install` gets the newest 4.x.
• Existing Gitea 1.x and runner 3.x installs stay on their major; moving to 28 or 4 is a consented `--to` crossing, and the upgrade guide lists what each one changes in your setup.
• `gitea enable-https` and the docs follow Gitea 28's rule that the domain comes from `ROOT_URL`; SECRET_KEY re-encryption now covers Gitea 28.0.

→

v2.0.0 2026-10-02

• Upgrades now stay within the major version you run: `gitea`, `runner` and `self-update` without `--to` pick the newest release of your current major and warn when a newer one exists — so Gitea 1.27 no longer jumps to 28.0.0 on its own.
• Moving to a new major is your explicit decision: gtcnsl asks on a terminal, or you pass `--allow-major-upgrade` in cron and CI. `--yes` alone is not consent, and without consent nothing on the host changes.
• The TUI shows a separate confirmation step for a major upgrade of Gitea or the runner, and its version pickers now say "(recommended)" instead of "(latest stable)".
• Everything else is unchanged: commands, config and secrets files, backup format and unit names; a 1.x backup restores on 2.x, and a 1.x binary self-updates to 2.0.0 on its own.

→

v1.6.0 2026-08-10

• Gitea Actions Runner 3.x is a validated target: v3.1.0 passed the full container matrix, including the dind-rootless image and the new ≥ 3.0 single-process `.runner` lock.
• `runner register --force` over a live daemon is safe again — the service is stopped before the old registration is dropped, so the ≥ 3.0 `.runner.lock` can no longer leave the host unregistered.
• Baseline `config.yaml` generation follows the upstream rename: `config generate` on runner ≥ 3.1.0, the deprecated `generate-config` on older binaries — chosen automatically per installed version.
• The upgrade guide documents the three Runner 3.x changes that live in your workflows, not in gtcnsl: cache v2 on by default, `container.options` host flags requiring privileged mode, and the `ACTIONS_ALLOW_UNSECURE_COMMANDS` opt-in.

→

v1.5.0 2026-08-06

• openSUSE Leap 16 joins the supported matrix as the first zypper-based family — `internal/pkgmgr` gained `FamilySUSE`, with the explicit `zypper refresh` its disabled-autorefresh default repos require.
• Alpine Linux joins the supported matrix in a host-mode-only MVP, running on a new OpenRC backend behind the init-agnostic `service.Manager` abstraction — container-based runner executors refuse cleanly rather than failing partway through.
• Downloads no longer hang forever: a 30s stall-watchdog retries a wedged connection (up to 3 attempts) with byte-range resume, and download/version-discovery clients are now forced onto HTTP/1.1 after a Cloudflare-fronted HTTP/2 wedge caused a real production incident.
• The TUI's operation screen now shows a live spinner and percentage progress instead of silence, and Esc on a running operation is honest — offering to cancel it or hide the screen — instead of pretending to leave while it keeps running underneath.

→

v1.4.0 2026-08-04

• `gtcnsl` with no arguments now opens onto a live dashboard — Gitea/runner install status and config state at a glance — instead of a bare menu.
• Five new distributions join the supported matrix in one release — AlmaLinux 9/10, Rocky 10, Ubuntu 22.04 LTS and 26.04 LTS — growing the tested container matrix from three images to eight, behind a new `pkgmgr.Family` dispatch that makes the next one a two-line change.
• TUI screenshots on the marketing site are now produced from byte-for-byte golden captures of the real terminal, so the site can no longer silently drift from what `gtcnsl` actually renders.

→

v1.3.2 2026-07-23

• HTTPS installs set LOCAL_ROOT_URL — fixes ssh pushes on Gitea 1.27+
• Backups work on runner-only hosts

→

v1.3.1 2026-07-23

• The release workflow now guards its own inputs

→

v1.3.0 2026-07-18

• Gitea 1.27.x and Runner 2.x are officially supported, verified end to end — and `secrets rotate SECRET_KEY --reencrypt` now refuses to run against any Gitea minor gtcnsl hasn't re-verified its crypto against.
• Safe `SECRET_KEY` rotation now covers `SECRET_KEY_URI`-configured instances too: gtcnsl resolves the key exactly the way Gitea does at boot, and rotation keeps the URI-backed file in sync instead of silently diverging from it.
• `gtcnsl runner adopt` brings an existing Gitea Actions Runner under management without ever re-registering it — the runner twin of `gitea adopt`.
• Runner state — `.runner`, `config.yaml`, its systemd unit — now travels with `gtcnsl backup`/`restore`, so losing the file no longer means a fresh registration token.
• First-class `gtcnsl gitea upgrade`/`runner upgrade` commands, and a failed Gitea upgrade now restores the previous binary automatically instead of leaving the host without one.
• Runner registration tokens no longer have to sit in process argv: `runner register`/`reconfigure --token-file <path>` reads the token from a file instead.

→

v1.2.1 2026-07-12

• Download progress no longer floods ssh sessions, CI logs or the TUI: throttled at the source, plain sparse lines on non-terminals, one in-place-updating line in the TUI.

→

v1.2.0 2026-07-12

• Safe `SECRET_KEY` rotation: `secrets rotate SECRET_KEY --reencrypt` migrates every encrypted database row — Actions secrets, 2FA seeds, webhook auth headers, LDAP bind passwords — to the new key, with a backup and automatic rollback. The rotation Gitea itself has never shipped (go-gitea/gitea#16832).
• Safety guard: a plain `secrets rotate SECRET_KEY` now hard-stops before touching anything instead of silently orphaning encrypted data, and `--dry-run` previews exactly what a migration would touch.
• `doctor` now warns when `SECRET_KEY` is empty — Gitea then encrypts with a public default baked into its own source, so the data is effectively unprotected.

→

v1.1.2 2026-07-08

• Fixed: health checks work on sign-in-only instances (`REQUIRE_SIGNIN_VIEW`) — liveness now uses the unauthenticated `/api/healthz` endpoint.

→

v1.1.1 2026-07-08

• Fixed: health checks against installs with built-in Let's Encrypt no longer fail falsely — `secrets rotate`, `config apply` and in-place upgrades work on ACME hosts again.

→

v1.1.0 2026-07-08

• Point `gitea install` at a host that already runs Gitea and it upgrades in place — live paths detected, data never moved, a hand-written unit preserved byte-for-byte.
• `gtcnsl gitea adopt` brings a hand-rolled install under management without moving any data: secrets out of `app.ini`, permissions tightened, a template for the declarative loop.
• Serving profiles at install time: HTTP behind a proxy (default), direct HTTPS with built-in Let's Encrypt, or your own certificate.
• `gtcnsl gitea enable-https` switches a live HTTP install to HTTPS — and rolls back to the working config automatically if anything fails.
• Doctor now catches the classic time bomb: an https config on :443 whose unit can't actually bind the port.

→

v1.0.0 2026-07-02

• First stable release — the CLI and on-disk layout are now covered by a SemVer compatibility guarantee (COMPATIBILITY.md).
• `gtcnsl backup` / `restore` — snapshot your Gitea install and roll back with a safe, self-undoing flow.
• `dind-rootless` runner executor — run the Actions runner in a rootless container, no host binary.
• Signing-key self-refresh keeps download verification working across the Gitea key's yearly renewal.
• Fixed: in-place `gitea install --to` upgrades now restart onto the new binary.

→

v0.6.3 2026-05-30

• Reliable release mirroring to the download host

→

v0.6.1 2026-05-30

• Fixes the release workflow's download-host mirror step

→