chore(main): release 0.1.0

[github-actions]

🤖 I have created a release beep boop

0.1.0 (2026-07-31)

Features

• add dynamic assume role support via scope-configurations provider (085964a)
• add OpenTofu installation setup for Lambda scope (#4) (3439713)
• add permissions boundary support to Lambda execution role (#10) (f4d893b)
• add requirements module with IAM policies for Lambda scope operations (d9ff61b)
• adjust configuration (#8) (edecc50)
• adjust configuration (#9) (47c2c57)
• adjust values (#7) (425d397)
• asset types support (#3) (6f58a3a)
• assume-role: resolve role ARN from nullplatform IAM provider by selector (779eef9)
• dynamic assume-role support, configurable placeholder image & install tofu consolidation (847e5fd)
• iam: make Lambda execution-role prefix configurable (23e2515)
• implement entrypoints and base configuration for specs (b34586f)
• install/specs: add scope-configuration.json.tpl (e39b5bf)
• install/specs: add scope-configuration.json.tpl (e25024b)
• lambda: optional public ALB in requirements module (#30) (fae610e)
• lambda: update ZIP runtime list and default to nodejs22.x (#31) (d5982f0)
• placeholder: make placeholder image configurable via PLACEHOLDER_IMAGE_URI_DEFAULT (bd26af4)
• tofu refactor (#13) (e753833)
• workflows: assume IAM role via dedicated first step in every workflow (5109c0e)

Bug Fixes

• correct nullplatform provider version constraint in specs/tofu (d49d2b9)
• deploy: add missing diagnose.yaml workflow for diagnose-deployment action (c04e9cc)
• deploy: ensure Lambda pull policy on the image's ECR repo before update (2dc0a3e)
• iam: add modern CloudWatch Logs tagging actions to lambda requirements policy (b9e41d3)
• iam: prefix lambda execution role with np-lambda- to match requirements policy (97121e4)
• parameters (#12) (c63f0c1)
• permissions boundary and least-privilege IAM for Lambda scope (#11) (47e50d0)
• publish: remove hardcoded --profile kwik from ECR setup calls (b076628)
• publish: remove hardcoded --profile kwik from ECR setup calls (cfc6e87)
• read TOFU_STATE_BUCKET from .provider.aws_state_bucket as fallback (3f89288)
• remove automatic arch suffix from placeholder image URI (fc8bc76)
• specs/tofu: bump aws provider constraint to ~> 6.47.0 (6752bee)
• specs: derive asset_type from deployment_type (fa34054)
• surface sts:AssumeRole errors to stdout for visibility in NP logs (33842ec)
• tofu: surface tofu apply stderr to stdout for visibility in NP logs (684d9f7)
• use exact PLACEHOLDER_IMAGE_URI when explicitly set, skip arch suffix (14d3ad5)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v0.1.0

🌻