Add kernel_deployment data source

[IlyaasK]

Summary

• register a read-only kernel_deployment data source backed by the tagged Go SDK's direct deployment GET
• expose canonical ID, project scope, entrypoint, region, computed status metadata, timestamps, and environment variable names
• add focused unit coverage, an opt-in live test using the existing release-owned app fixture, generated docs, and a lookup example

Resource/data-source scope

Adds kernel_deployment data source only. The deployment resource remains deferred. This PR does not create, stop, delete, invoke, follow, or stream anything.

API contract notes

Kernel Go SDK v0.76.0 already exposes project-scoped Deployments.Get. The provider-local wrapper adds only GetDeployment; it does not expose deployment create, delete, or event-stream methods. Source provenance, app name, version, and actions remain omitted because the tagged GET model does not return them; kernel_app remains the app metadata lookup.

Terraform state semantics

id is the required canonical selector. project_id follows the existing explicit override, provider default, then API-key binding order. Computed status and status reason are inspection metadata only. Missing or null optional metadata normalizes to null, and present malformed API fields produce diagnostics.

Sensitive field handling

The API returns redacted deployment environment values. Terraform state stores only sorted env_var_keys; the schema has no environment-value field. Logs, events, source credentials, and GitHub tokens are not read or stored.

Import behavior

Not applicable to a data source. The blocked deployment resource still requires its separately documented import and deletion contracts.

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• bash scripts/check-examples.sh
• Actionlint across all workflows

Acceptance status

An opt-in acceptance test reads the deployment backing KERNEL_ACC_APP_NAME and KERNEL_ACC_APP_VERSION through explicit and provider-default project scope, then verifies a clean plan. It performs no deployment lifecycle or runtime operation. It was compiled but not run locally because live Kernel credentials are unavailable; the manual acceptance workflow includes the package.

Known deferred concerns

The kernel_deployment resource remains blocked on tagged source provenance, authoritative deletion/read-after-delete semantics, complete durable app/version readback, and accepted write-only environment/token state behavior. SDK source provenance remains deferred until a tagged release contains it.

Issues

Does not resolve a GitHub issue.

---

Note

Low Risk
Read-only data source with no lifecycle mutations; sensitive values are excluded from state by design.

Overview
Adds a read-only kernel_deployment data source so Terraform can inspect durable deployment metadata via a direct SDK GET, without create/delete, logs, or event streams.

Read path maps region, status (inspection-only), entrypoint, timestamps, and sorted env_var_keys only—never env values, source, or app metadata. project_id follows the same explicit → provider default → API-key binding resolution as other lookups. kernelclient gains GetDeployment only; lifecycle/event SDK methods stay unexposed.

Provider registration, generated docs, the lookups example (deployment ID from kernel_app), acceptance matrix + workflow job, and unit/acceptance tests complete the surface. The kernel_deployment resource remains deferred.

^{Reviewed by Cursor Bugbot for commit 190705e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a7591c. Configure here.}