Release v0.8.0 · thepartly/pgroles

Fixed

Policy names longer than 63 characters no longer break plan creation, lookup, or cleanup. Label values cap at 63 bytes while resource names allow 253, and the operator conflated the two rules. Thanks @aarons-afk for the report and original fix (#146, #152).
Plans and plan-SQL ConfigMaps are matched by controller-owner UID, not by a truncated label. Two policies sharing a 63-byte name prefix could previously cross-approve and cross-delete each other's plans (#152).
Schema owner transfers no longer strip the incoming owner's privileges when a stale explicit grant exists (#140).

Role and profile config defaults, managed with ALTER ROLE ... SET / RESET and diffed against pg_roles.rolconfig (#132, #134).

The headline use case is zero-downtime password rotation — both login roles SET ROLE to a shared owner at connect time, so objects created under either credential stay accessible after a rotation:
```
roles:
  - name: combined
  - name: blue
    login: true
    config: { role: combined }
  - name: green
    login: true
    config: { role: combined }

memberships:
  - role: combined
    members: [{ name: blue }, { name: green }]
```
Also covers general role-level defaults (search_path, statement_timeout, dot-qualified custom settings like app.tenant), with {schema}/{profile} substitution on profiles[].config. Config values must be quoted strings: statement_timeout: "30000", not `30000 (so a manifest means the same thing to the CLI and the API server).

See zero-downtime-password-rotation.yaml and the manifest reference.
Column-level grant detection. diff and apply now warn about GRANT SELECT (col) ... in managed schemas — previously a silent audit hole in authoritative mode. Detection only; the grants are still not managed.
New docs: [executor privileges](https://hardbyte.github.io/pgroles/docs/executor-privileges/) and [limitations](https://hardbyte.github.io/pgroles/docs/limitations/).

PostgreSQL support is documented as 16, 17, and 18 — the versions CI tests. PG 14–15 paths remain but are best-effort and untested.
Dependencies: OpenTelemetry 0.31 → 0.32, plus cmov, quinn-proto, next, js-yaml (#154).

ci: bump remaining Node 20 actions to Node 24 runtimes by @hardbyte in #129
feat: manage role-level config defaults (ALTER ROLE ... SET) by @hardbyte in #134
docs: executor privileges guide, limitations page, accurate PG version claims by @hardbyte in #136
test: property-based convergence harness for the diff engine by @hardbyte in #137
feat: detect and warn about column-level grants in privilege-managed schemas by @hardbyte in #138
feat: profile-level config defaults with {schema}/{profile} placeholders by @hardbyte in #139
fix: single-pass convergence for schema owner transfer with stale owner grants by @hardbyte in #141
docs: add pgroles agent skills by @hardbyte in #142
fix: valid Kubernetes identifiers from any policy name by @hardbyte in #152
chore(deps): refresh Rust and docs dependencies by @hardbyte in #154
chore(release): 0.8.0 by @hardbyte in #153

Full Changelog: v0.7.8...v0.8.0