Dry-run plans and leases for desktop Kubernetes releases
How DevOpsPad releases from a laptop with no server: single-use plans, server-side dry-run, a Lease per Deployment, resourceVersion checks and honest results.
Engineering
Design notes on how DevOpsPad is built: read-only access, SSH tunnels, keychain secrets, release plans and leases, and app signing.
Signing and notarizing a Wails app in GitHub Actions
The GitHub Actions workflow that builds, signs, notarizes and staples the DevOpsPad macOS app, CLI and DMG, including a temporary keychain and stapler retries.
SSH tunnels without a local listener
How DevOpsPad sends database and Kubernetes traffic over in-process SSH channels, with no local port, no direct fallback and strictly verified host keys.
Storing connection secrets in the OS keychain
How DevOpsPad splits connection metadata from secrets, keeps the keychain and workspace.json consistent on failure, and refuses to fall back to plaintext.
Why DevOpsPad is read-only first
Why the DevOpsPad query workspace only reads, how each engine adapter enforces it, where the separate write paths live, and what read-only cannot protect.
Why the AI never sees your credentials
What DevOpsPad sends to an AI provider, what it never sends, and the request rules that keep an API key on the right host and stop queries running on their own.