pubkit 0.31.2

0.31.2 - 2026-11-08

Commit c59e1b582490; release record pub:sha2-256:suxorjdsqg6kwezcdomhkb7trnroozpfgi5bhdabzjhlyd67sfia.

Added

• pubkit deploy walk: the deploy check (deploy check is now walk without --fulfil), and with --fulfil it makes what is missing. It prints the plan, waits for a typed yes (--yes skips it), asks once at a hidden prompt for a Bitwarden write token when a need wants one, and fulfils each auto need that is missing and whose dependencies are ready, checking it again: namespaces over the admin channel (ssh root@HOST), Secrets from the values that fill them on kubectl's standard input with a restart of what reads them, manifests, GitHub secrets and variables from Bitwarden as app-secrets sends them, the gate, the rollout, CronJob runs, generated Bitwarden secrets and service account keys; propose needs print the change to make. The deploy channel (--kubectl naming the server's kubectl-read verb) reads only, and lists a Secret's key names with secret-keys. New need types gcp.service-account-key, auth.sign-in-client, storage.tenant, github.variable-entry and k8s.cronjob; deploy.units walks several units, each journaled; deploy.providers runs ./pubkit with the packages whose types the needs use, each wheel checked against its sha256, and pubkit bump moves them; --journal URL writes the deploy-journal/2 document to storage; the reusable deploy-check.yml walks it every 30 minutes, read-only, and pubkit sync seeds its caller. pubkit sync manages with-secrets in every repository with a with-secrets.json, and sync --check fails when the deploys lines of k8s-deploy.yml and the units disagree, or when a deploy calling k8s-deploy.yml 0.31.0 or later is not started by workflow_run, which pubkit bump rewrites

Install:

pubkit init --kind=rust|utility|service, or pubkit sync, then pubkit lock: the lock pins the v0.31.2 wheel by its sha256