pubkit 0.31.0

0.31.0 - 2026-11-07

Commit d9131ec530aa; release record pub:sha2-256:juscqofinzetmunbyjjpgdjb7p7hg7iezd67qwjnnup5eaxxgxaq.

Changed

• k8s-deploy.yml deploys a commit only once CI has passed on it: a ready job finds the commit (the one a workflow_run tested, when that run passed on a push to the default branch; a pull request's or the merge queue's run deploys nothing) and waits, up to wait minutes, for the latest push run on it of each workflow require names, main and, where there is one, integrations, failing if one did not pass; build and deploy check out, tag and deploy that commit, and a commit the default branch has moved on from is not deployed, except by hand. A caller grants actions: read and moves its trigger from push to a workflow_run of its CI. pubkit k8s preflight, for a server's deploy program to run before it applies, checks through kubectl that every Secret rendered manifests read is there with every key they name (env, envFrom, secret and projected volumes, imagePullSecrets; an optional reference may be missing), and that oauth2-proxy's cookie secret is 16, 24 or 32 bytes as it is or after URL-safe base64 decoding, naming standard base64 as the likely mistake; it fails in seconds, naming the Secret, the key and what reads it, and never prints a value. pubkit k8s diagnose prints the state, last exit, warning events and last logs of each pod that is not ready. Both are one file that runs without pubkit

Added

• pubkit init and sync add .env to a repository's .gitignore when it is missing, leaving the rest of the file as it is, and pubkit sync --check fails until it is there: local tools such as ./with-secrets read secrets from .env, so no repository may commit one

Install:

pubkit init --kind=rust|utility|service, or pubkit sync, then pubkit lock: the lock pins the v0.31.0 wheel by its sha256