Skip to content

Lockstep 0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Nov 11:43
· 22 commits to main since this release
v0.2.0
c9b9f08

Added

  • Command line: lockstep compare writes a YAML report of the differences, with no values. For each secret it gives both sides' versions, a Vault UI link and a vault kv get command. lockstep apply carries out the actions you set in the report: it asks before each key (or --yes, --dry-run), reads values fresh from the source, and skips any secret that changed since the report. It logs in like the vault CLI (VAULT_ADDR, VAULT_TOKEN, ~/.vault-token, per-side overrides, userpass/LDAP prompts) and returns diff-style exit codes for CI. It's in the Python package and the container image.

Install

Helm (Kubernetes):

helm upgrade --install lockstep oci://ghcr.io/welshstew/charts/lockstep --version 0.2.0 \
  -n lockstep --create-namespace -f my-values.yaml

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/welshstew/lockstep:0.2.0

Command line (Python 3.13+), from GitHub or from the image:

pipx install "git+https://github.com/welshstew/lockstep@v0.2.0#subdirectory=backend"
docker run --rm -it --entrypoint lockstep -e VAULT_ADDR -e VAULT_TOKEN ghcr.io/welshstew/lockstep:0.2.0 --help

Image digest: sha256:beac3c8fa9dc883b0ba4502dff30f91ef9145d867d5644e3e2937ab0a1dbd2f4 · chart digest: sha256:215253b37baaec96784bd4eeac2b1021c82cf5efde74f15f0e07e0bd6d7e59fd

Verify

The image and the chart are signed with cosign (keyless, by this repository's release workflow), and the image carries an SBOM and build provenance:

cosign verify ghcr.io/welshstew/lockstep:0.2.0 \
  --certificate-identity "https://github.com/welshstew/lockstep/.github/workflows/release.yml@refs/tags/v0.2.0" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
Assets 2
Loading