pubkit 0.30.0

0.30.0 - 2026-11-06

Commit 7ac743dbdf0c; release record pub:sha2-256:tfdmnylcg4w7powbxns4nesmtscnavctllkbiwdehx3xni3ox5rq.

Changed

• The managed AGENTS.md asks every branch to take in origin/main before each push: a rebase if it was never pushed, a merge if it was, and a stop on any conflict whose resolution is not clear

Added

• actions/deploy-ssh takes input, a file sent as it is on the command's standard input in place of a bundle, such as rendered manifests for a program that applies what it reads
• k8s/components/app, a kustomize Component a service takes by a pinned remote URL: it patches the Deployment app to run as user 1000, not root, under RuntimeDefault seccomp, with no API token, its container app with no privilege escalation, no capabilities and a read-only root filesystem, and probes /healthz to start and be ready and /livez to stay alive, on the port http
• k8s-deploy.yml, a service's whole deploy workflow for a k3s server: it builds the image with actions/docker-build, runs the caller's check, pushes it to ghcr.io, renders each overlay deploys lists with kustomize and sends it to the server's forced command with actions/deploy-ssh over the tailnet, one run at a time per unit, in the environment server; a unit can wait on a variable set to on, and nothing deploys without SUSTENAUT_SERVER

Install:

pubkit init --kind=rust|utility|service, or pubkit sync, then pubkit lock: the lock pins the v0.30.0 wheel by its sha256