v1.2.0

Support for murk 0.14.0.

murk 0.14 checks who signed a vault before it trusts it. A CI runner has no record of your team's signers, so it needs to be told. Do that in one of these ways:

• Pass the whole grant key file as murk-key (recommended). The file that murk agent grant --out - writes carries its own trusted signers and expiry, so one repository secret is enough.
• Set the new trusted-signers input if you pass a bare AGE-SECRET-KEY-1 line. Each teammate runs murk trust --print-key to get their entry.

version: latest now installs murk 0.14. To stay on 0.13 until your team upgrades, pin version: '0.13.0'.

Changes

• New trusted-signers input.
• murk-key accepts a whole grant key file as well as a bare key line.
• Only the key line is masked in logs, and a malformed key is refused without being printed.
• A bare grant key with no trusted signers fails with a hint saying what to add.
• The action can run more than once in the same job.

v1.1.0

Moved to interrupted-sh

Use interrupted-sh/murk-action@v1. Workflows that still reference interrupted-inc/murk-action or iicky/murk-action must update: GitHub doesn't redirect action references after an org rename.

Changes

• The murk download is verified before it runs: the release checksum and its build-provenance signature. A missing or invalid signature fails the step.
• Requires murk 0.10.2 or newer, the first signed release. Pinning an older version now fails with a clear error.
• New outputs: version (the installed murk version) and keys (the exported key names).
• Multi-line secret values are exported and masked correctly.
• The key input is validated, and keys written by newer murk init (the MURK_KEY_FILE form) are accepted.