What's new
The latest changes to the OrkStage platform, console, CLI and OpenTofu modules, from the changelog that each repository keeps for every release.
Each OrkStage repository keeps a CHANGELOG.md, written from the titles of the pull requests
merged into it: features, fixes, performance and documentation. This page shows the latest
sections of each one; changes merged since the last release are under Unreleased. See the
release process.
Platform
The Control API, worker, domain packages and provider adapters (orkstage).
Unreleased
Features
- default cloud target per environment for unbound slots (#43)
- target environments and the target-environment policy; unique target names (#42)
- slogan "Orchestrate every cloud from one stage" and Slack (#41)
- feature flags follow plan entitlements (#24)
- team members and email invitations (#19)
- template marketplace with curated listings and review badges (#15)
- feature flags for providers (AWS and simulation on, others off until tested) (#13)
- ten more providers, web frontends, cross provider credentials and template triggers (#12)
- console: English and Brazilian Portuguese UI
- site: English and Brazilian Portuguese landing, full SEO, docs rewritten to the writing rules
- brand: flat vector logo (kit v4); keep private material out of git
- site: orkstage.io landing page and documentation (Next.js + Fumadocs)
- drift: scheduled drift detection for real providers, with remediation on redeploy
- aws: ECS service autoscaling from the template's autoscaling block
- aws: permission probing and a deployment-role CloudFormation template
- cli: ork CLI and the scan engine (Rust), wired into imports
- runtime: aws-sm:// secret references (AWS Secrets Manager)
- provisioning: real provider plans before apply, production approval on destructive changes, live existence probes
- console: use the official OrkStage brand kit v3 (logo, mark, favicons)
- console: integrations (API keys, webhooks), IaC import page, edition badge
- open-core licensing (AGPL-3.0 core + Enterprise ee/)
- API keys, webhooks, CI intake and IaC import endpoints
- OrkStage platform foundation
Fixes
- database: no demo data in production; bootstrap the platform owner (#27)
- api: template validation tries every compatible target per slot (#26)
- worker: atomic deployment slots; per tenant and per provider region limits (#23)
- authorization: every tenant member can see the team (#20)
- worker: incident dedup index, orphan incidents, health history retention, stuck deployments (#18)
- provisioning: delete removed resources, safe upgrades, production destroy approval (#17)
- security: tenant filter leak, SSRF bypass, shared rate limits, proxy trust and more (#16)
- run the full stack from orkstage-dev; drop monorepo only tooling (#9)
- polyrepo: split commits use the repository identity as committer too
- polyrepo: installable core lockfile before the scan engine is published; publish.sh dry run
- polyrepo: core installs without the published scan engine; LF in the meta repo
- close gaps found while writing the docs
- explicit package files lists so published tarballs contain dist
- fresh clones build without DATABASE_URL; split renames prisma comments
Documentation
- legal texts 1.0 (Enterprise License, CLA, trademarks) and the CLA bot (#37)
- the CLI has releases and install scripts (#25)
- accurate provider status; ROADMAP points to the plans in orkstage-dev (#22)
- agent guide for AI coding assistants (#14)
- github: branded READMEs, community files and publishing tooling for every repository
- site: application registration for CI, refreshed OpenAPI (bearer auth, servers)
- polyrepo plan and local split script
Console
The web console (orkstage-console).
Unreleased
Features
- default cloud targets (slots left unbound) (#29)
- choose the environment a cloud target serves (#28)
- slogan "Orchestrate every cloud from one stage" and Slack (#27)
- team page and invitation acceptance (#13)
- upgrades preview their plan and open the deployment (#12)
- template marketplace pages (#10)
- feature flags page; disabled providers in the target form (#8)
- forms for every provider, web frontends in the builder, triggers tab (#7)
- console: English and Brazilian Portuguese UI
- brand: flat vector logo (kit v4); keep private material out of git
- drift: scheduled drift detection for real providers, with remediation on redeploy
- cli: ork CLI and the scan engine (Rust), wired into imports
- runtime: aws-sm:// secret references (AWS Secrets Manager)
- console: use the official OrkStage brand kit v3 (logo, mark, favicons)
- console: integrations (API keys, webhooks), IaC import page, edition badge
- OrkStage platform foundation
Fixes
- security: Content Security Policy, HSTS and Permissions-Policy (#11)
- declare @types/node, ignore build output, normalize line endings (#5)
Documentation
- legal texts 1.0 (Enterprise License, CLA, trademarks) and the CLA bot (#24)
- agent guide for AI coding assistants (#9)
- github: branded READMEs, community files and publishing tooling for every repository
CLI
ork and the scan engine (orkstage-cli).
Unreleased
Features
- default cloud targets (slots left unbound) (#32)
- publish orkstage-scan and orkstage-cli to crates.io (#31)
- ork preview, upgrade, incidents, triggers and marketplace (#19)
- ork init writes a starter when nothing is detected; ork init --from <marketplace slug> (#17)
- release pipeline with checksums, install scripts and an install test (#12)
- ork instances create, ork up and ork template publish (#11)
- cli: ork CLI and the scan engine (Rust), wired into imports
Fixes
- install: fall back to the newest prerelease while there is no stable release (#28)
- retry rate limited requests; clearer approval and cancellation; instances list hides destroyed (#18)
- ci: install test serves files on 127.0.0.1 and waits for the server (#16)
- ci: archives and ork --version use the tag version (#15)
- ci: package archives into artifacts/, not the committed dist/ (#14)
- ci: release files in out/, not the committed dist/ (#13)
- reproducible WebAssembly build (remap Cargo home and checkout paths)
Documentation
- how to get the Windows and macOS signing certificates (#33)
- legal texts 1.0 (Enterprise License, CLA, trademarks) and the CLA bot (#29)
- agent guide for AI coding assistants (#9)
- the local Compose network is orkstage_default (#8)
- github: branded READMEs, community files and publishing tooling for every repository
OpenTofu modules
The modules and the runner image (orkstage-modules).
Unreleased
Features
- modules for Azure, Google Cloud, OCI, DigitalOcean, Vultr, CoreWeave and Magalu Cloud (#8)
- aws: ECS service autoscaling from the template's autoscaling block
- provisioning: real provider plans before apply, production approval on destructive changes, live existence probes
- OrkStage platform foundation