Skip to main content

v0.5 Release Notes

v0.5.x was the prior stable line (superseded by v0.6, now superseded by v0.7).

v0.5.0 — the DSL parameter/import release​

  • First-class task parameters: task [arg] [arg="default"].
  • @import directive with circular-import detection and depth guardrails; name-collision protection across imported task/alias/variable declarations.
  • Shebang task execution with temporary script lifecycle cleanup.
  • Cross-platform shell resolution: POSIX /bin/sh on Unix, pwsh first / cmd fallback on Windows (later hardened further in v0.5.2, see below).
  • Decorators @private and @confirm.
  • Built-in interpolation: {{ os() }}, {{ arch() }}, {{ env("KEY", "default") }}.
  • The Docusaurus-based docs portal (this site) shipped for the first time.
  • TOML and DSL 0.3/0.4 broskifiles kept working with deprecation warnings; legacy-format removal was deferred to v0.6.

v0.5.1​

  • Installer/release flow switched to broski-*-only artifacts; docs route canonicalized at /broski_docs/.

v0.5.2 — security hardening​

  • Removed the Windows cmd.exe fallback — Windows tasks now execute via PowerShell script files (pwsh preferred, powershell fallback) to reduce command-injection risk.
  • Reworked interactive @secret_env redaction to stream process output instead of buffering, preventing interactive deadlocks and unbounded output buffering.
  • Hardened strict Linux bwrap isolation with explicit base-directory mounts and $HOME tmpfs masking (instead of a blanket --ro-bind / /).
  • Secret manifest entries switched to keyed BLAKE3 with a workspace-local salt (.broski/config/salt) instead of unsalted fast hashes — still true in the current release, see Annotations for the @secret_env details.
  • Dynamic top-level variable commands gained a 1 MiB output cap with bounded draining.
  • Runtime lock checks started including Linux process-start identity (/proc/<pid>/stat start ticks) to reduce false active-lock blocks from PID reuse.
  • Cache restore began validating artifact relative paths and object hashes before writing into the workspace.

Full technical write-up: v0.5.2 Security Hardening Report.

Included across the v0.5 line​

  • first-class task parameters
  • imports with cycle/collision guardrails
  • decorators (@private, @confirm)
  • built-in interpolation helpers (os, arch, env)
  • shebang task execution
  • graph and interactive mode split
  • cache explainability (--explain)
  • secret-aware output and explain redaction

Operational impact​

  • reproducible graph tasks with explicit input/output contracts
  • interactive workflows that preserve terminal-native behavior
  • actionable rerun diagnosis via manifest delta reasoning
  • safer output handling through transactional promotion semantics