Skip to content

BaseHarbor v0.4.3

BaseHarbor v0.4.3 makes repository understanding a first-class, deterministic capability and establishes the open provider-integration contract that later BaseHarbor integrations will follow.

The release is intentionally compatibility-preserving: Manifest v1 and the current Compose lifecycle remain unchanged.

Added

  • Read-only repository inspection through baha app inspect . and baha app inspect . --json.
  • A shared inspection core that collects evidence from common Compose/Dockerfile files, dependency manifests, environment-variable names, source imports, configuration files, published ports and health checks.
  • Explicit Detected, Suggested and Possible confidence levels for repository findings.
  • Versioned Capability Specifications and the baseharbor.provider/v1 Provider Integration Contract.
  • A shared semantic boundary for built-in and future external providers.
  • Future external-provider direction based on gRPC/Protocol Buffers, JSON Schema 2020-12 and digest-first OCI distribution.
  • Explicit async-operation, idempotency, deadline/cancellation and binding-secret rules for provider integrations.
  • Open supply-chain direction using OCI referrers plus standard signature/SBOM/provenance mechanisms.

Changed

  • Guided baha app init now reuses the shared repository inspection core rather than maintaining separate CLI-only detection logic.
  • Repository understanding is reusable infrastructure for CLI and future Web UI/API/Operator surfaces.
  • A repository with an explicit application workload but no backend-capability evidence no longer receives an invented PostgreSQL requirement from app init --quick.
  • Compose provider detection is scoped to service identity/image evidence so application variables such as DATABASE_URL do not by themselves classify a workload as a provider.
  • Suggested and Possible findings remain advisory and are not promoted automatically.

Security

Repository inspection is strictly read-only and bounded:

  • it does not write baseharbor.yaml;
  • it does not materialize BaseHarbor runtime state;
  • environment-file values are discarded before inspection/output and only variable names are retained;
  • symlinked files are skipped so repository-controlled links cannot escape the inspected tree;
  • generated/vendor directories such as .git, .baseharbor, node_modules, vendor, build output and virtual environments are ignored;
  • large candidate files are bounded rather than loaded without limit;
  • app init --quick fails closed when only Suggested/Possible evidence exists and no explicit workload is detected.

Deprecated

No public baha command, Manifest v1 field or current Compose workflow is deprecated in v0.4.3.

Removed

Nothing from the supported v0.4.2 CLI, Manifest v1 or Compose lifecycle is removed in v0.4.3.

Compatibility & upgrade notes

No baseharbor.yaml migration is required.

Existing repositories and explicit app init flags continue to work. Compose remains the complete current runtime implementation. PostgreSQL, Valkey and OpenBao provisioning behavior is unchanged.

The provider protocol is an architecture/API foundation for later external providers; installing or loading external provider modules is intentionally deferred.

v0.4.3 does not yet add AI-assisted repository analysis, automatic mutation based on Suggested/Possible evidence, external provider loading/execution, Kubernetes/OpenShift/cloud runtime providers, or later S3/observability/messaging capability implementations.