pubkit 0.34.0

0.34.0 - 2026-11-09

Commit ad3b30b986df; release record pub:sha2-256:db6xh6bj7bdqhpr6kohn6zocireos3fmt7vzt3g3z2fxxeewjq2q.

Changed

• The nightly's pins calls the sustenaut.bump hooks, as pubkit bump does, so a new pubdeploy or pubsec release reaches each repository's deploy.providers, launchers and lock without a bump by hand; the nightly installs the latest pubdeploy for its hook
• In the merge queue, pr.yml's sonar job is skipped, like the tests, when the pull request's own run already passed on the same tree; main's push still scans it with that run's coverage. A repository whose ruleset requires SonarQube Cloud's "SonarCloud Code Analysis" check drops it from protect.checks and runs pubkit protect, or its queue runs wait for a check that never comes
• pubkit pins moves every other repository's reusable workflow that a hand-written workflow pins at a release (OWNER/REPO/.github/workflows/...@) to that repository's latest release, by its tag's commit, except a deploy.providers package's, which its own bump hook moves

Removed

• actions/deploy-ssh leaves pubkit: it is pubdeploy's, whose k8s-deploy.yml calls its own copy from pubdeploy 0.2.0; a workflow of a repository's own that uses Sustenaut/pubkit/actions/deploy-ssh moves to Sustenaut/pubdeploy/actions/deploy-ssh
• The commands a control plane runs across many repositories moved to pubfleet, with the same arguments: board, board-publish, state, variables and freshness, with the reusable board.yml and nightly.yml and .github/nightly/; pubkit keeps protect and the repos file, the variables block's shape that sync checks, bump, and the per-repository nightly (pubkit nightly, pins, crates, record)

Install:

pubkit init --kind=rust|utility|service, or pubkit sync, then pubkit lock: the lock pins the v0.34.0 wheel by its sha256