Skip to content

kit 1.13.0

Choose a tag to compare

View all tags
@sandstream sandstream released this 24 Jul 22:22
v1.13.0
bf65955
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Context-lock now covers your SSH identity per project. A new [context.ssh] block locks which key a repo pushes/deploys with — declare any of identity (the IdentityFile path), fingerprint (SHA256:…, machine-portable), or host_alias (the ~/.ssh/config Host the remote uses). kit context check reads the repo's effective identity — a per-repo core.sshCommand -i override wins, otherwise it resolves the remote host through ssh -G — derives the key fingerprint via ssh-keygen -lf, and verifies it matches. Pushing a repo with the wrong account's key is a mismatch, not a silent pass — the SSH analog of the git-host remote lock. Pure parsers (core.sshCommand -i, ssh -G identityfile, keygen fingerprint, remote host) are unit-tested; the live ssh -G read smoke-tests on a real machine.
  • kit health now covers all three git hosts: GitLab CI and Bitbucket Pipelines sensors (GitHub was already there). Both probe the platform REST API via a new httpGet on HealthDeps (the HTTP-probe path the sentinel design anticipated): GitLab GET /api/v4/projects/:path/pipelines with GITLAB_TOKEN, Bitbucket GET /2.0/repositories/:ws/:repo/pipelines/ with BITBUCKET_TOKEN (or BITBUCKET_USERNAME + BITBUCKET_APP_PASSWORD). Each flags the most recent terminal pipeline as red when it failed, records the host/path it checked, and reports unknown (never a false green) on a missing token, a non-OK response, or no git remote. Sensors are selected by CI-file presence (.gitlab-ci.yml / bitbucket-pipelines.yml). Also: analyze's CI-file detection now recognizes bitbucket-pipelines.yml (it knew .github/workflows + .gitlab-ci.yml but missed Bitbucket). Live API smoke is pending a real GitLab/Bitbucket project + tokens; the parsers + auth + remote-parsing are fixture-tested against the documented schemas.
  • Context-lock now covers GitLab and Bitbucket, not just GitHub. [context.gitlab] (group, remote) and [context.bitbucket] (workspace, remote) join [context.github]: kit context check parses the live origin remote per host and verifies it matches the declared values, so a repo pushed to the wrong GitLab group or Bitbucket workspace is a mismatch, not a silent pass (same cross-account guard as GitHub). The brownfield kit init offer (suggestContextToml / hasLockableContext) now also surfaces a detected GitLab/Bitbucket binding. One (tool, field) row each — the lock table stays data-driven.
  • Two services in the registry: Keycloak and Atlassian (acli). Keycloak is detected from its clients (keycloak-js, keycloak-connect, keycloak-admin-client, keycloak-angular, python-keycloak, Go gocloak) and declares its realm/admin secrets (KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID/SECRET, KEYCLOAK_ADMIN/_PASSWORD); it carries no mise tool because it is a self-hosted server (run via Docker), with admin through the server's own kcadm.sh. Atlassian is detected from bitbucket-pipelines.yml / .bitbucket, provisions the Atlassian CLI via mise (tool: acli → aqua:atlassian.com/acli), and tracks ATLASSIAN_API_TOKEN / ATLASSIAN_SITE_URL; its auth is left as an informational note rather than a guessed login command. Adding each was a single registry data row (no detector/generator edits), per the unified-registry design.
  • kit check verifies full-disk encryption and flags an exposed memory store. A new check confirms the disk is encrypted (FileVault on macOS, BitLocker on Windows, LUKS/crypt on Linux) and warns when kit's memory database sits inside the repo tree (where it could be committed) rather than the home-dir store. Read-only and best-effort: an undeterminable state is reported, never assumed encrypted.
  • secrets validate and env diff are now wired into the CLI. Both were documented but unrouted; secrets validate checks declared secret sources resolve, and env diff compares the declared vs present environment.

Fixed

  • Flaky local test runs (intermittent file-level failures + drifting test counts) traced to a dirty dist/. The build script (unlike build:prod) never cleaned dist/, so compiled output from deleted/renamed sources accumulated, and editor/sync conflict copies ( 2.ts, 3.ts, …) left stale dist/* [0-9].js files. The test glob (dist/*.test.js) then ran those orphans as duplicate/divergent tests, producing nondeterministic counts (e.g. 2355 → 2359 → 2361) and sporadic "not ok" with zero failing subtests. Fix: build now rm -rf dist before compiling (matching build:prod), so every run tests only current sources, and the tsconfig conflict-copy exclude was widened from * 2.ts to * [0-9].ts/.tsx to cover all numbered copies. Verified: 16 consecutive clean runs held a stable 2355 tests / 0 failures.
  • .gitignore hardening no longer hides the curated shared-memory tier. check-gitignore now ignores .kit/* (contents) but re-includes !.kit/shared/, so kit's local state stays ignored while the committed-by-design .kit/shared/ (e.g. shared memory) remains tracked. The old wholesale .kit/ rule made git refuse to descend into the dir, so a later negation could not re-include it.

Removed

  • Flushed ~30k lines of dead, unreferenced code — the app-ops + SaaS-scaffold cluster and the marketplace/monetization cluster. tsc confirmed nothing remaining imported them (the build stays green), so this is pure dead-weight removal, not a behavior change. Trims kit toward its focused CLI/governance core.

Full changelog: https://github.com/sandstream/kit/blob/v1.13.0/CHANGELOG.md

Verify this release:

git tag -v v1.13.0
npm audit signatures
Assets 4
Loading