v0.5.0

What's Changed

• feat(api): refuse a config value that doesn't fit its variable's type (#135) by @vishu42 in #452
• feat(runner): pass variables to tofu as a -var-file, not TF_VAR_ (#135) by @vishu42 in #453
• feat(web): send structured variable values as JSON, refuse text that isn't (#135) by @vishu42 in #449
• feat(web): structured variables get a JSON textarea under their type (#135) by @darksied-svg in #454
• fix: api-docs-preview blank page; build with Go 1.26.10 by @vishu42 in #462
• feat(web): template registry: one list by name, a quiet Sync, an ErrorPanel (#457) by @darksied-svg in #458
• fix(sync): strip the sync workspace path from stored sync errors (#460) by @vishu42 in #463
• feat(store): template rows from registration, keys to them, template reads (#461) by @vishu42 in #464
• feat(sync): write into the registered template, survive its delete (#461) by @vishu42 in #465
• feat(app): register stores the template; template list, read, sync, revisions (#461) by @vishu42 in #466
• feat(store): a template reads its latest sync and derives its status (#460) by @vishu42 in #468
• feat(api): templates routes beside the old registration routes (#461) by @vishu42 in #469
• feat(api): templates carry latest_sync, the newest sync and its shown status (#460) by @vishu42 in #470
• feat(api): delete a template, 409 template-in-use while a stack uses it (#461) by @vishu42 in #471
• fix(site): type scale, aligned edges, one spacing rhythm; remove "In the app" by @darksied-svg in #467
• feat(site): GitHub's mark in the header, on the page's own background by @darksied-svg in #473
• feat(web): read templates, not grouped revisions; follow a sync by latest_sync (#461) by @vishu42 in #474
• refactor(api): retire template-registrations and the tenant-wide revisions list (#461) by @vishu42 in #475
• feat(web): list a template with no revision yet, and say why (#461) by @darksied-svg in #476
• feat(web): show a template's latest sync on open, poll the list while one syncs (#460) by @vishu42 in #477
• feat(web): delete a template from the registry, asked first in place (#461) by @darksied-svg in #478
• feat(web): every latest sync outcome on the template, with when it happened (#460) by @darksied-svg in #482
• feat(web): mark templates whose latest sync failed or stalled (#460) by @darksied-svg in #483
• fix(web): space the destroy dialog's buttons from its description by @darksied-svg in #485
• feat(web): set the template header one type step smaller by @darksied-svg in #486
• feat(web): one role-named type scale, held by the style guard by @darksied-svg in #487
• refactor: register tenant routes under one prefix by @vishu42 in #489
• feat(web): drop the tenant chip from the header (#488) by @darksied-svg in #490
• feat(web): read the tenant from /v1/me, not a build-time variable (#488) by @vishu42 in #491
• feat: serve the built-in tenant default, not OPENPLAN_TENANT_ID (#488) by @vishu42 in #492
• docs: retake the README screenshots on openplan UI by @darksied-svg in #494
• feat(web): let the Value box show the secret being typed (#496) by @darksied-svg in #499
• feat: store the sensitive flag on scoped credentials (#497) by @vishu42 in #498
• feat: redact only sensitive Environment values from run logs (#497) by @vishu42 in #500
• feat: accept sensitive on credential create and return values that aren't (#497) by @vishu42 in #501
• feat(web): carry sensitive and value through the credential client and panel (#497) by @vishu42 in #502
• feat(web): split Environment into Secrets and Variables tabs (#497) by @darksied-svg in #503
• docs: install the latest release from the README quick start (#440) by @vishu42 in #517
• fix: store a component-scoped credential under its template only (#480) (flat) by @vishu42 in #519
• fix(web): refresh a template's runs right after approve or discard by @vishu42 in #521
• fix(web): drop counts from page titles, section titles and tabs (#518) by @vishu42 in #525
• feat(web): put Environment and Create stack on the canvas (#524) by @vishu42 in #526
• feat: list each stack template's latest run (issue 523, 1/4) by @vishu42 in #527
• feat: list a failed plan or apply as needing attention (issue 523, 2/4) by @vishu42 in #528
• feat(web): read run_failed attention and refresh it when a run settles (issue 523, 3/4) by @vishu42 in #530
• feat(web): show failed plans and applies as needing attention (closes 523, 4/4) by @vishu42 in #531
• feat: return Terraform's first error from a failed command (issue 522, 1/3) by @vishu42 in #532
• feat: store and serve command_error on runs and executions (issue 522, 2/3) by @vishu42 in #533
• feat(web): lead a failed run with Terraform's error (issue 522, 3/3) by @vishu42 in #535
• feat: a plan waits 10 minutes for an executor, like an apply (#513) by @vishu42 in #515
• feat: add the Helm chart skeleton with the api, web and Ingress (#317) by @vishu42 in #506
• feat: add the executor Deployment to the Helm chart (#317) by @vishu42 in #507
• ci: lint and render the Helm chart, and check required values fail (#317) by @vishu42 in #508
• ci: publish the Helm chart to ghcr on a release (#317) by @vishu42 in #509
• docs: add the Helm chart README and keep CI values out of the package (#317) by @vishu42 in #512
• feat(helm): run the executor and api Guaranteed at 2 CPU / 2Gi by default (#513) by @vishu42 in #516
• feat: add a Docker Desktop evaluation harness for the Helm chart (#317) by @vishu42 in #510
• refactor: tier 1 naming fixes by @vishu42 in #542
• refactor: naming audit tier 2 by @vishu42 in #543
• refactor: name config by unit and kind (naming audit tier 3) by @vishu42 in #544
• ci: run the CI suite locally with make check, skip drafts on GitHub by @vishu42 in #545
• refactor: name the Valkey URL field ValkeyURL, after VALKEY_URL by @vishu42 in #541
• chore: use mkcert for the evaluation harness certificate by @vishu42 in #546
• feat(helm): add image.pullPolicy; evaluation runs main by default by @vishu42 in #547

Full Changelog: v0.4.0...v0.5.0