[francesconazzaro]

Add get-kube command and package the repo scripts with uv

What

• New get-kube command (src/ci_cd/get_kube.py): downloads an environment's kubeconfig from Proton Pass using pass-cli.
  • The project name (-p/--project, env CICD_PROJECT) is the Proton Pass vault, the environment name (-e/--environment, env CICD_ENVIRONMENT) is the item, and the item must have exactly one attachment: the kubeconfig.
  • Saved by default to local.<environment>.kubeconfig.yaml, with spaces in the name replaced by _. Use -o/--output-path (env CICD_OUTPUT_PATH) to save it somewhere else.
  • The file is saved with 0600 permissions (owner only), since it contains cluster credentials.
  • When something goes wrong (not logged in, pass-cli not installed, vault/item not found, wrong number of attachments, pass-cli error), it prints a single ERROR: … line and exits with code 1. When pass-cli itself fails, its error message is included.
  • Running it with no arguments prints the help.
• The repo is now a uv project: pyproject.toml, uv.lock and .python-version are new, and the scripts are exposed as console scripts (git-clone-ref, get-kube).
• scripts/git-clone-ref.py moved to src/ci_cd/git_clone_ref.py. Its code is unchanged apart from a requires-python line added to the inline script metadata.
  • git-clone action: now runs uv run --project "$GITHUB_ACTION_PATH/.." git-clone-ref … instead of running the script by path.
  • copy-git-clone-script action: copies the script from its new location and still names it git-clone-ref.py.
• .gitignore: ignores *local*, so downloaded kubeconfigs never get committed.

Usage

pass-cli login   # once
uv run get-kube -p <project> -e "<environment>"

⚠️ Breaking change

copy-git-clone-script: target-path must now be a directory, because the action writes ${target-path}/git-clone-ref.py. Workflows that pass a full file path need updating.

[hellska]

LGTM!