v1.2.0

Support for murk 0.14.0.

murk 0.14 checks who signed a vault before it trusts it. A CI runner has no record of your team's signers, so it needs to be told. Do that in one of these ways:

• Pass the whole grant key file as murk-key (recommended). The file that murk agent grant --out - writes carries its own trusted signers and expiry, so one repository secret is enough.
• Set the new trusted-signers input if you pass a bare AGE-SECRET-KEY-1 line. Each teammate runs murk trust --print-key to get their entry.

version: latest now installs murk 0.14. To stay on 0.13 until your team upgrades, pin version: '0.13.0'.

Changes

• New trusted-signers input.
• murk-key accepts a whole grant key file as well as a bare key line.
• Only the key line is masked in logs, and a malformed key is refused without being printed.
• A bare grant key with no trusted signers fails with a hint saying what to add.
• The action can run more than once in the same job.