first draft

.github/actions/slack-notify/action.yml

@@ -0,0 +1,31 @@
+# Copyright (c) Codesphere Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+# Posts a failure notification to the #team-oms-sdk Slack channel.
+name: Slack Notification on Failure
+description: Notify #team-oms-sdk on job failure
+
+inputs:
+  job-name:
+    description: Display name of the failing job (e.g. "Build", "Test", "Install-Config")
+    required: true
+  webhook:
+    description: Slack webhook URL for the notification
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Post failure to Slack
+      shell: bash
+      env:
+        SLACK_WEBHOOK: ${{ inputs.webhook }}
+      run: |
+        curl -X POST \
+          -H 'Content-type: application/json' \
+          --data "{
+            \"channel\": \"#team-oms-sdk\",
+            \"icon_emoji\": \":siren:\",
+            \"text\": \"🚨 ${{ inputs.job-name }} Job Failure 🚨\nRepository: ${{ github.repository }}\nBranch/Ref: \`${{ github.ref }}\`\nRun url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\"
+          }" \
+          "${SLACK_WEBHOOK}"

.github/workflows/cli-build_test.yml

@@ -14,52 +14,72 @@ on:
 
 jobs:
 
-  build:
+  build-test:
+    name: ${{ matrix.label }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - task: build
+            label: build
+          - task: test
+            label: test
+          - task: install-config
+            label: install-config
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
 
-      - name: Build
+      - name: Build CLI
+        if: ${{ matrix.task == 'build' || matrix.task == 'install-config' }}
         run: make build-cli
 
-      - name: Slack Notification on Failure
-        if: ${{ failure() && github.ref == 'refs/heads/main' }}
-        run: |
-          curl -X POST \
-            -H 'Content-type: application/json' \
-            --data '{
-              "channel": "#team-oms-sdk",
-              "icon_emoji": ":siren:",
-              "text": "🚨 Build Job Failure 🚨\nRepository: ${{ github.repository }}\nBranch/Ref: `${{ github.ref }}`\nRun url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            }' \
-            ${{ secrets.PACKAGE_JOB_SLACK_WEBHOOK }}
+      - name: Test
+        if: ${{ matrix.task == 'test' }}
+        run: make test
 
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Setup SOPS and age for vault encryption
+        if: ${{ matrix.task == 'install-config' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y age
+          # sops is not packaged in Ubuntu's repos, so fetch the pinned release binary.
+          curl -fsSL -o /tmp/sops \
+            https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13.3.linux.amd64
+          sudo install -m 0755 /tmp/sops /usr/local/bin/sops
+          age-keygen -o age_key.txt
+          echo "SOPS_AGE_KEY_FILE=${GITHUB_WORKSPACE}/age_key.txt" >> "$GITHUB_ENV"
 
-      - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
-        with:
-          go-version-file: 'go.mod'
+      - name: Generate and validate install configs
+        if: ${{ matrix.task == 'install-config' }}
+        run: |
+          set -euo pipefail
+          for profile in dev minimal production; do
+            echo "==> Generating install config for profile: ${profile}"
+            ./oms init install-config \
+              --profile "${profile}" \
+              --interactive=false \
+              -c "config-${profile}.yaml" \
+              --vault "prod-${profile}.vault.yaml"
 
-      - name: Test
-        run: make test
+            echo "==> Validating generated install config for profile: ${profile}"
+            # Validate the config only. The generated vault is SOPS-encrypted and
+            # its contents are covered by the round-trip unit tests, so this step
+            # stays focused on the config (--vault "" skips vault loading).
+            ./oms init install-config \
+              --validate \
+              -c "config-${profile}.yaml" \
+              --vault ""
+          done
 
       - name: Slack Notification on Failure
         if: ${{ failure() && github.ref == 'refs/heads/main' }}
-        run: |
-          curl -X POST \
-            -H 'Content-type: application/json' \
-            --data '{
-              "channel": "#team-oms-sdk",
-              "icon_emoji": ":siren:",
-              "text": "🚨 Build Job Failure 🚨\nRepository: ${{ github.repository }}\nBranch/Ref: `${{ github.ref }}`\nRun url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-            }' \
-            ${{ secrets.PACKAGE_JOB_SLACK_WEBHOOK }}
+        uses: ./.github/actions/slack-notify
+        with:
+          job-name: ${{ matrix.label }}
+          webhook: ${{ secrets.PACKAGE_JOB_SLACK_WEBHOOK }}

.github/workflows/go-lint.yml

@@ -17,11 +17,11 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
 

.github/workflows/integration-test.yml

@@ -13,10 +13,10 @@ jobs:
   integration-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
 

.github/workflows/tag-release.yml

@@ -21,13 +21,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: integration-tests
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-tags: true
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
 

.github/workflows/update-docs-and-licenses.yml

@@ -17,15 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # on push to main, use main; on PR, check out the PR head
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
           # Use PAT to ensure commits trigger other workflows
           token: ${{ secrets.PAT_UPDATE_DOCS }}
 
       - name: Set up Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: 'go.mod'
 
@@ -34,7 +34,7 @@ jobs:
           ./hack/update-docs-and-licenses.sh
 
       - name: Commit and push auto-generated changes
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9
+        uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11
         with:
           # Use the PR author's identity for the commit
           author_name: ${{ github.event.pull_request.user.login }}

.gitignore

@@ -28,6 +28,7 @@ vendor
 .envrc
 .env
 .installer
+tmp
 
 # bin file
 bin/

Makefile

@@ -10,7 +10,7 @@ test:
 	# -count=1 to disable caching test results
 	go test -count=1 -v ./...
 
-test-integration:
+test-integration: build-cli
 	# Run integration tests with build tag
 	go test -count=1 -v -tags=integration ./cli/...