pubkit 0.31.1

0.31.1 - 2026-11-07

Commit 4e83a6b83234; release record pub:sha2-256:d3q63qaivbynxvpildwkxbvucpmz4odcuefps4w2e65jovbsjucq.

Added

• terraform.yml, a reusable workflow that applies a Terraform stack from the default branch (on a push there, or by hand), as a Google account it gets through Workload Identity Federation (inputs workload-identity-provider and service-account; callers grant id-token: write and pull-requests: read): it plans to a file and applies exactly that plan, one run at a time, with the plan in the job's summary. Nothing runs for a pull request, for another ref, or until the repository variable TERRAFORM_CI is on. The job runs in the environment named by environment (terraform), which the caller limits to the default branch, so a provider can trust the token's subject repo:OWNER/REPO:environment:terraform alone (or its immutable form). A plan that deletes anything, replacements included, is applied only when the merged pull request has the label terraform-destroy. With secrets (the default) every terraform command runs through ./pubkit secrets run with the environment's secret BWS_ACCESS_TOKEN; with secrets: false terraform runs plainly
• pubkit deploy check, and pubkit.json's deploy block: what a service needs before it deploys (its namespace, the Secrets its pods read and what fills them, GitHub secrets and variables, the services it calls, its host), implied where pubkit.json and the rendered manifests already say it, and checked in order, each ready, missing, drift, blocked or unknown, with what to do about it; it reads kubectl, gh, HTTPS, dig and the environment ./with-secrets gives, changes nothing, prints no value, and --json prints the walk as a deploy-journal/1 document. --offline checks what needs no network, and pubkit sync --check runs it: every Secret the rendered overlay reads must be one a need fills, with its keys, and every Secret a need fills must be read. pubkit deploy types lists the 14 need types pubkit has and any a package offers under the entry-point group sustenaut.needs. pubkit secrets run (./with-secrets) sets PUBKIT_SECRETS_PROJECT to the project it read. pubkit now depends on PyYAML, to read the manifests kustomize renders

Install:

pubkit init --kind=rust|utility|service, or pubkit sync, then pubkit lock: the lock pins the v0.31.1 wheel by its sha256