Embeds ezbake functionality into kiln as a Go library, adding full lifecycle support for baking, uploading, publishing, and reproducibly re-baking Carvel/Kubernetes tiles.

New commands

• kiln carvel bake — Transforms an imgpkg bundle into a BOSH release and bakes it into a .pivotal file. When a Kilnfile.lock is present, downloads the cached BOSH release from Artifactory instead of regenerating locally.
• kiln carvel upload — Generates a BOSH release from Carvel tile source, uploads the tarball to Artifactory, and writes Kilnfile.lock with the remote location and checksum.
• kiln carvel publish — Bakes a final tile with version stamping and produces a JSON bake record for reproducible builds.
• kiln carvel re-bake — Reproduces a tile build from a bake record, verifying source revision matches the git checkout.

New packages

• internal/carvel — Core Baker that reads tile metadata (base.yml) and imgpkg bundles, generates a BOSH release via bosh create-release, creates a kiln-compatible structure in .ezbake/, and invokes kiln bake to produce the final .pivotal file.
• internal/carvel/models — Data models for tile metadata, Carvel lockfiles, package installs, runtime configs, and jobs.

Architecture

The kiln carvel command group is registered in main.go and delegates to subcommands via jhanda.CommandSet. Each subcommand uses the standard flags.Standard embedded struct to load Kilnfiles with variable interpolation (e.g., from ~/.kiln/credentials.yml), keeping credential handling consistent with existing kiln commands. The Baker interface drives the imgpkg-to-BOSH transformation and tile assembly.

Other changes

• Consistent lockfile serialization — CarvelLockfile now uses releases (plural, as a slice) instead of release (singular), matching the standard KilnfileLock format in pkg/cargo.
• CI lint fixes — Resolved all staticcheck and unused findings across the new files (capitalized error strings, redundant embedded field selectors, unnecessary fmt.Sprintf, unused functions).
• CI test stability — Test BeforeEach blocks that run git commit now pass -c user.name / -c user.email inline so they work on CI runners without global git config.
• Acceptance and unit tests — Full test coverage for all four subcommands, the Baker, and the Carvel model types.

Usage

# Bake a Carvel tile locally
kiln carvel bake --source-directory /path/to/tile --output-file tile.pivotal

# Upload the BOSH release to Artifactory (writes Kilnfile.lock)
kiln carvel upload --source-directory /path/to/tile --kilnfile /path/to/Kilnfile

# Publish a versioned tile and produce a bake record
kiln carvel publish --source-directory /path/to/tile --output-file tile.pivotal --version 1.0.0 --final

# Reproduce a tile from a bake record
kiln carvel re-bake --output-file tile.pivotal bake-record.json

Test plan

• go test ./internal/carvel/... — Baker and model unit tests
• go test ./internal/commands/... — All carvel subcommand tests (bake, upload, publish, re-bake)
• go test ./internal/acceptance/carvel/... — Integration/acceptance tests
• golangci-lint run ./... — Zero lint issues