v0.4.0

Added

• A project's last pulls: history on each project in GET /api/v1/projects, newest first, up to 50, in memory since the process started, as an application's runs are. Each says when it started, how long it took, why (scheduled, manual, check before an application's check or sync, kept only when it moved the commit or failed, startup), who asked a manual one (the API key's name or the signed-in user), how it ended, and the commit it found the checkout at and left it at (see docs/projects.md).
• Credentials name their environment variables in full with env_vars: {<field>: <VAR>} (env_vars: {password: LDAP_PASSWORD} reads LDAP_PASSWORD as password), and API keys with env_vars: {key: <VAR>}; env_vars and env_prefix on one credential, env_vars beside a vault_path, secret_file or secret_keys (a credential reads from one place), an API key env_vars field other than key, and an API key with both or neither of env_vars.key and env are refused at load (see docs/secrets.md).
• Every credential field also reaches the connector under its credential's id, CREDENTIAL_<ID>_<FIELD> (the name without a leading cred-/cred_, anything outside a-z0-9 made _: cred-portainer-ldap's password is CREDENTIAL_PORTAINER_LDAP_PASSWORD), so an application can use two credentials with the same fields; a field no other credential has and already named after its own (portainer_url on cred-portainer) is not prefixed again, and two values that would still reach one variable fail the run naming both.
• A Vault is a credential of type: vault (address, mount, env_vars: {token: <VAR>} or kubernetes_role, timeout_seconds, cache_ttl_seconds), as AWX models a Vault lookup; a credential reads from it with vault: <its name> and vault_path, so several Vaults can coexist, each with its own login and cache. Naming a Vault credential as an application's, project's, webhook's or LDAP bind's credential, a Vault field on another type, and a vault: that is not a Vault are refused at load; GET /api/v1/credentials adds vault, used_by.credentials on a Vault lists the credentials reading from it, and vault_connection (address, mount, auth, kubernetes_role, token_env, timeout_seconds, cache_ttl_seconds) describes each Vault, null for any other type (see docs/secrets.md).
• A project names its credential with credentials:, a list as on every other item (at most one: a clone authenticates once); a project listing more than one, or setting both forms, is refused.
• The web UI from unified-ui 0.6.0 (was 0.4.0): a History panel on a project's page, an Order menu on every list, cron schedules in words, counts with thousands separators, linked items as tables on each page, Overview cards that hold their place while they load, a Secrets card on Configuration with one row per Vault, and project cards that always show their Credentials (None for a public repository).

Changed

• Breaking (scripts reading a field two credentials share, and webhooks with several credentials): CREDENTIAL_<FIELD> is delivered only when exactly one of the application's credentials has that field, instead of one credential silently overwriting the other; read CREDENTIAL_<ID>_<FIELD>. Two credentials one application or webhook would deliver under one id (cred-vc-aa1 and cred_vc_aa1) are refused, a webhook whose credentials share a field it reads by its bare name is refused (token, or username and password, and the signing secret, as its auth and signature say; a shared field loses its bare name), and env_vars beside a vault_path, secret_file or secret_keys is refused instead of one side being silently ignored.
• Env and file credentials are read on every resolution instead of being reused for 60 seconds: a rotated mounted file is seen on the next check. Only a Vault caches, for its own cache_ttl_seconds; GET /api/v1/settings answers secrets.cache_ttl_seconds as null unless config.yaml still sets it.

Deprecated

• A credential's env_prefix + secret_keys and an API key's env: VAR still load, with a notice at startup and from --check-config naming the env_vars to write in their place; a later release refuses them.
• The secrets: block in config.yaml (cache_ttl_seconds, and vault: with token_env) still loads, with a notice saying to declare the Vault as a type: vault credential; while set, its cache still covers every credential and a vault_path with no vault: reads from it. A later release refuses it.
• A project's singular credential: <id> still loads, with a notice naming the credentials: [<id>] to write; a later release refuses it.

Fixed

• A field shared by two credentials is never delivered under its bare name, even when it starts with its credential's id (ssh_key_path on cred-ssh beside cred-ssh-dc4); fields are compared as the variable they become (TOKEN and token), and two values that would reach one variable fail the run naming both instead of one winning.
• A credential reading from two places in the older forms too (vault_path, env_prefix, secret_file) is refused instead of one being silently ignored; a project listing one credential twice is not refused; the deprecated secrets.vault with timeout_seconds: 0 is refused.
• An explicit secrets.cache_ttl_seconds: 0 means no cache for every credential, Vaults included, as in 0.3.0; vault_connection.cache_ttl_seconds reports the cache in effect, and GET /api/v1/settings adds secrets.deprecated. A project's history rows add age_seconds, measured on the server.
• A webhook's shared-field check covers only the fields it reads by bare name (its auth's and its signature's), compared as the variable they become, so a shared field it never reads no longer fails the configuration and Token beside token does; used_by on GET /api/v1/credentials adds webhooks, so a credential only a webhook sends with no longer looks unused.
• --check-config <dir> checks <dir> instead of ignoring it and reading CONFIG_DIR or ./config, which could report OK about a directory it never read.
• A configuration still on the deprecated secrets.vault keeps its 60-second cache when secrets.cache_ttl_seconds is absent, as 0.3.0 did by default, instead of reading Vault on every resolution; set, that outer cache replaces each Vault's own instead of stacking on it.
• A field already named after its credential is recognised in any case (AVAMAR_AA1_URL on cred-avamar-aa1) and not prefixed again.
• A webhook send whose token, username, password or signing field two of its credentials share says the field is shared instead of "the credential has no 'token' field", and a default auth fails the same way instead of silently sending no Authorization.
• A reload logs the same deprecation notices startup does; a Vault credential with timeout_seconds: 0 is refused.
• Starting connector scripts retries briefly on "text file busy" (ETXTBSY) instead of failing the run: a script still open for writing elsewhere, such as one a project pull is rewriting, or a file another thread's child briefly held, now runs once the writer lets go.