bump to 0.8

[rgarcia]

and a 100% vibe-coded script / github action to do this nightly

---

TL;DR

Bumped kernel and @onkernel/sdk versions to 0.8.0 across all templates and introduced a nightly GitHub Action to automate future version updates.

Why we made these changes

To ensure all project templates consistently use the latest SDK versions, providing users with the most current features and bug fixes without manual intervention.

What changed?

• Automated Version Bumping: Added a nightly-version-bump.yml GitHub Actions workflow to run a new update_versions.py script daily.
• Version Update Script: The update_versions.py script fetches the latest kernel (PyPI) and @onkernel/sdk (npm) versions and updates pyproject.toml and package.json files accordingly.
• Template Version Bumps: Manually updated kernel dependency to >=0.8.0 in Python pyproject.toml files and @onkernel/sdk dependency to >=0.8.0 in TypeScript package.json files across all relevant templates.

Validation

• Confirmed kernel and @onkernel/sdk versions are correctly updated to 0.8.0 in all template files.
• Verified the update_versions.py script correctly identifies and updates versions locally.
• Ensured the nightly-version-bump.yml workflow triggers and executes the script as expected (manual run or observation of first nightly run).
  

[mesa-dot-dev]

What Changed

This PR bumps the kernel (Python) and @onkernel/sdk (TypeScript) dependencies to version 0.8.0 across all project templates. The most significant change is the introduction of a new nightly GitHub Actions workflow and a Python script (scripts/update_versions.py) to automate these version bumps going forward. This new automation will check for new package versions daily and open a PR with the necessary updates.

Risks / Concerns

This is a great addition for keeping templates up-to-date. However, there are a couple of risks to consider with the new automation. First, the use of secrets.GITHUB_TOKEN in the nightly workflow at .github/workflows/nightly-version-bump.yml:17 might prevent CI from running on the auto-generated PRs. Second, changing the dependency constraint to >=0.8.0 in package.json and pyproject.toml files could introduce future breaking changes (e.g., from a 1.0.0 release), potentially causing instability in projects generated from these templates.

^{11 files reviewed | 2 comments | Review on Mesa | Edit Reviewer Settings}

[mesa-dot-dev]

Using secrets.GITHUB_TOKEN here may cause permission issues. The default GITHUB_TOKEN has limited permissions and PRs created with it typically don't trigger other workflows (like CI). Consider using a personal access token or GitHub App token stored as a secret (e.g., secrets.PAT_TOKEN) if you need the created PR to trigger other workflows.

^{Type: Logic | Severity: Medium}

[mesa-dot-dev]

The change from ^0.6.0 to >=0.8.0 significantly relaxes the version constraint. ^0.6.0 follows semver and only allows compatible changes within 0.6.x, while >=0.8.0 allows any future version including potentially breaking changes (0.9.0, 1.0.0, etc.).

While this aligns with the automated nightly bump strategy, consider if this could introduce instability in template projects. You might want to either:

1. Use ^0.8.0 to maintain semver compatibility, or
2. Add an upper bound like >=0.8.0 <1.0.0 to prevent major version jumps

^{Type: Logic | Severity: Medium}

[masnwilliams]

lgtm