v0.42.0

0.42.0 (2026-09-15)

⚠ BREAKING CHANGES

• auth: a personal key issued by 0.41.0 holds nothing until it is reissued. That release wrote the credential at the identity provider and nothing on the platform, because there was nothing yet to narrow; a key now holds what its entry on the Kitchen singleton says, and a key with no entry is refused rather than read as unrestricted — which is what makes removing an entry a revocation. Such a key reads as unrecognised in kitchen keys list and on the Account screen.

Features

• api: read a variable's own value back, never what it points at (#606) (68a8318), closes #610
• auth: narrow a personal key to named projects and a role inside them (#596) (f5f53d5)

Bug fixes

• operator: say why a deploy failed on the deployment status and in the pull request (#605) (b1dbc2e)
• ui: focus the shell's main landmark so a new screen can be scrolled by keyboard (25bccf2), closes #600
• ui: make the shell a fixed-height frame so the sidebar stays put (9cd43e8), closes #600

Install

helm install kitchen oci://ghcr.io/bermos/charts/kitchen --version 0.42.0 \
  --namespace kitchen-system --create-namespace \
  --set kitchen.baseDomain=apps.example.com \
  --set kitchen.tls.acme.email=you@example.com \
  --set kitchen.tls.acme.dns01.cloudflare.apiTokenSecretName=cloudflare-api-token

The kitchen CLI is not published as a binary; it is built
from this tag by the Go toolchain:

go install github.com/Bermos/Kitchen/cmd/kitchen@v0.42.0

Artifacts

Artifact	Reference	Digest
Operator image	ghcr.io/bermos/kitchen:0.42.0	sha256:00a22ff9a7894bd47168859f129f899b507bce69114ad41761d17a856eed1f75
Auth image	ghcr.io/bermos/kitchen-auth:0.42.0	sha256:0063c8a2d688e4886b26599f2d3f714172d0917b0bd8b655da90367f7eb00e8b
Chart	oci://ghcr.io/bermos/charts/kitchen:0.42.0	sha256:0e7df09042739ce02bd2ff16d60581ce8a7fe15444793ecdc7269dc7f126fb18

Both images are linux/amd64 and linux/arm64 and carry a signed
build provenance attestation. The chart is attached below as well.