feat: parity batch 2 (review follow-ups, CFN in-progress states, OCI LB backend TLS, ...)

.github/actions/lint-setup/action.yml

@@ -0,0 +1,67 @@
+name: lint-setup
+description: Disk, swap, Go and golangci-lint setup shared by the lint jobs
+runs:
+  using: composite
+  steps:
+    # Full-repo lint (go.mod/.golangci.yml changed) exhausts the default runner disk; lint needs no docker images or apt packages.
+    - name: Free Disk Space (Ubuntu)
+      uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
+      with:
+        tool-cache: true
+        android: true
+        dotnet: true
+        haskell: true
+        large-packages: true
+        docker-images: true
+        swap-storage: true
+
+    - name: Keep Go temp files and build cache off the /tmp tmpfs
+      shell: bash
+      run: |
+        # /tmp is a small tmpfs on hosted runners; use /mnt when mounted, else the root disk.
+        if mountpoint -q /mnt; then base=/mnt; else base="$RUNNER_TEMP"; fi
+        sudo mkdir -p "$base/gotmp" "$base/gocache"
+        sudo chown -R "$(id -u):$(id -g)" "$base/gotmp" "$base/gocache"
+        {
+          echo "GOTMPDIR=$base/gotmp"
+          echo "TMPDIR=$base/gotmp"
+          echo "GOCACHE=$base/gocache"
+        } >> "$GITHUB_ENV"
+        df -h / /tmp "$base" || true
+
+    - name: Set up Go
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+      with:
+        go-version-file: go.mod
+        check-latest: true
+        cache: true
+
+    - name: Download Go modules (retry proxy stream errors)
+      shell: bash
+      run: |
+        for i in 1 2 3 4 5; do
+          go mod download && exit 0
+          sleep $((i * 15))
+        done
+        exit 1
+
+    # Full-repo lint (go.mod changed) exceeds runner RAM; the runner is killed without swap.
+    - name: Add swap
+      shell: bash
+      run: |
+        sudo swapoff -a || true
+        sudo fallocate -l 16G /mnt/lint.swap
+        sudo chmod 600 /mnt/lint.swap
+        sudo mkswap /mnt/lint.swap
+        sudo swapon /mnt/lint.swap
+
+    - name: Read golangci-lint version
+      id: golangci-lint-version
+      shell: bash
+      run: |
+        echo "version=$(sed -n 's/^  GOLANGCI_LINT_VERSION: \(.*\)$/\1/p' Taskfile.yml)" >> "$GITHUB_OUTPUT"
+
+    - name: Install golangci-lint
+      shell: bash
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "$(go env GOPATH)/bin" "v${{ steps.golangci-lint-version.outputs.version }}"

.github/workflows/ci.yml

@@ -52,86 +52,81 @@ jobs:
         env:
           NODE_OPTIONS: --max-old-space-size=8192
 
-  lint:
+  # Required status check "lint" is the aggregator at the bottom of this group.
+  # Config change (or no base): sharded full-repo lint. Otherwise: changed
+  # packages plus importers of any go.mod-bumped module (lint-changed.sh).
+  lint-scope:
     runs-on: ubuntu-latest
+    outputs:
+      mode: ${{ steps.mode.outputs.mode }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ env.GH_CI_TOKEN }}
           fetch-depth: 0
 
-      # Full-repo lint (go.mod/.golangci.yml changed) exhausts the default runner disk; lint needs no docker images or apt packages.
-      - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # main
-        with:
-          tool-cache: false
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          docker-images: true
-          swap-storage: true
-
-      - name: Keep Go temp files and build cache off the /tmp tmpfs
+      - name: Decide lint scope
+        id: mode
         run: |
-          # /tmp is a small tmpfs on hosted runners; use /mnt when mounted, else the root disk.
-          if mountpoint -q /mnt; then base=/mnt; else base="$RUNNER_TEMP"; fi
-          sudo mkdir -p "$base/gotmp" "$base/gocache"
-          sudo chown -R "$(id -u):$(id -g)" "$base/gotmp" "$base/gocache"
-          {
-            echo "GOTMPDIR=$base/gotmp"
-            echo "TMPDIR=$base/gotmp"
-            echo "GOCACHE=$base/gocache"
-          } >> "$GITHUB_ENV"
-          df -h / /tmp "$base" || true
+          set -euo pipefail
+          mode=full
+          if git rev-parse --verify -q origin/main >/dev/null 2>&1; then
+            merge_base=$(git merge-base HEAD origin/main)
+            if git diff --quiet "$merge_base" HEAD -- .golangci.yml; then
+              mode=changed
+            fi
+          fi
+          echo "lint: scope=$mode"
+          echo "mode=$mode" >> "$GITHUB_OUTPUT"
 
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+  lint-changed:
+    needs: [lint-scope]
+    if: needs.lint-scope.outputs.mode == 'changed'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: true
+          token: ${{ env.GH_CI_TOKEN }}
+          fetch-depth: 0
 
-      - name: Download Go modules (retry proxy stream errors)
-        run: |
-          for i in 1 2 3 4 5; do
-            go mod download && exit 0
-            sleep $((i * 15))
-          done
-          exit 1
+      - uses: ./.github/actions/lint-setup
 
-      # Full-repo lint (go.mod changed) exceeds runner RAM; the runner is killed without swap.
-      - name: Add swap
-        run: |
-          sudo swapoff -a || true
-          sudo fallocate -l 16G /mnt/lint.swap
-          sudo chmod 600 /mnt/lint.swap
-          sudo mkswap /mnt/lint.swap
-          sudo swapon /mnt/lint.swap
+      - name: Run golangci-lint on changed packages
+        run: bash scripts/lint-changed.sh
 
-      - name: Read golangci-lint version
-        id: golangci-lint-version
-        run: |
-          echo "version=$(sed -n 's/^  GOLANGCI_LINT_VERSION: \(.*\)$/\1/p' Taskfile.yml)" >> "$GITHUB_OUTPUT"
+  lint-shard:
+    needs: [lint-scope]
+    if: needs.lint-scope.outputs.mode == 'full'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [svc-a, svc-b-c, svc-d-e, svc-f-h, svc-i-m, svc-n-o, svc-p-r, svc-s, svc-t-z, pkgs, rest]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ env.GH_CI_TOKEN }}
+          fetch-depth: 0
 
-      - name: Install golangci-lint
-        run: |
-          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "$(go env GOPATH)/bin" "v${{ steps.golangci-lint-version.outputs.version }}"
+      - uses: ./.github/actions/lint-setup
+
+      - name: Run golangci-lint shard
+        run: bash scripts/lint-shard.sh "${{ matrix.shard }}"
 
-      - name: Run golangci-lint (changed packages or full repo on config change)
+  lint:
+    needs: [lint-scope, lint-changed, lint-shard]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every lint job to pass or be skipped by scope
+        env:
+          RESULTS: ${{ needs.lint-scope.result }} ${{ needs.lint-changed.result }} ${{ needs.lint-shard.result }}
         run: |
-          set -euo pipefail
-          if git rev-parse --verify -q origin/main >/dev/null 2>&1; then
-            merge_base=$(git merge-base HEAD origin/main)
-            if git diff --name-only "$merge_base" HEAD -- .golangci.yml go.mod | grep -q .; then
-              echo "lint: .golangci.yml or go.mod changed vs origin/main — running full-repo lint"
-              golangci-lint run --timeout 55m ./...
-            else
-              bash scripts/lint-changed.sh
-            fi
-          else
-            golangci-lint run --timeout 55m ./...
-          fi
+          echo "lint: results: $RESULTS"
+          case " $RESULTS " in
+            *" failure "*|*" cancelled "*) exit 1 ;;
+          esac
+          [[ "${{ needs.lint-scope.result }}" == success ]]
 
   # Fails fast on tag-gated compile breaks (e2e, integration) before the slow
   # e2e/integration/terraform jobs run any tests -- see gopherstack-0bpp.
@@ -862,6 +857,34 @@ jobs:
           GOPHERSTACK_TEST_IMAGE: gopherstack:tc-local
         run: go test -count=1 -timeout 10m ./...
 
+  helm-tests:
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ env.GH_CI_TOKEN }}
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+          check-latest: true
+          cache: true
+
+      - name: Download binary
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+        with:
+          name: gopherstack-binary
+          path: bin/
+
+      - name: Lint, render and install the Helm chart on k3s
+        env:
+          GOPHERSTACK_TEST_DOCKER: "1"
+        run: |
+          chmod +x bin/gopherstack-linux
+          go test -count=1 -timeout 15m -v ./test/helm/
+
   integration:
     runs-on: ubuntu-latest
     needs: [integration-tests]

Dockerfile

@@ -32,13 +32,22 @@ RUN CGO_ENABLED=0 go build \
     -ldflags="-w -s -extldflags '-static -fno-PIC'" \
     -o gopherstack
 
-# Final stage
-FROM scratch
+# Writable state dir for the non-root runtime user (65532:65532)
+FROM --platform=$BUILDPLATFORM alpine:3.22@sha256:2e0b81d60597f449baa56dc25d355367869d2dca4cd57e866f1e2b52af3eb55f AS state
+RUN mkdir /data
 
-WORKDIR /root/
+# Final stage: distroless static (nonroot) has a world-searchable / (containerd would unpack a bare
+# scratch / as 0700 root), plus ca-certificates, tzdata and a 1777 /tmp.
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
+
+COPY --from=state --chown=65532:65532 /data /data
+
+WORKDIR /usr/local/bin
+
+COPY --from=builder --chown=0:0 --chmod=755 /app/gopherstack .
+
+USER 65532:65532
 
-# Copy the Pre-built binary from the previous stage
-COPY --from=builder /app/gopherstack .
 
 # Expose port 8000 to the outside world
 EXPOSE 8000

Dockerfile.goreleaser

@@ -1,12 +1,21 @@
 # Dockerfile used by GoReleaser for multi-arch builds
-FROM scratch
+FROM --platform=$BUILDPLATFORM alpine:3.22@sha256:2e0b81d60597f449baa56dc25d355367869d2dca4cd57e866f1e2b52af3eb55f AS state
+RUN mkdir /data
+
+# distroless static (nonroot): world-searchable /, ca-certificates, tzdata, 1777 /tmp, UID 65532.
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
 
 ARG TARGETPLATFORM
 
-WORKDIR /root/
+COPY --from=state --chown=65532:65532 /data /data
+
+WORKDIR /usr/local/bin
 
 # Copy the binary from GoReleaser context
-COPY $TARGETPLATFORM/gopherstack .
+COPY --chown=0:0 --chmod=755 $TARGETPLATFORM/gopherstack .
+
+USER 65532:65532
+
 
 # Expose port 8000
 EXPOSE 8000

Dockerfile.test

@@ -1,8 +1,14 @@
-# Lightweight test image — expects a pre-built static binary at bin/gopherstack-linux
-# (from `task build-linux`; this is a separate path from `task build`'s bin/gopherstack
-# so the two targets can't clobber each other — see gopherstack-gooq).
-FROM scratch
-COPY bin/gopherstack-linux /root/gopherstack
+# Lightweight test image: expects a pre-built static binary at bin/gopherstack-linux
+# (from `task build-linux`; separate from `task build`'s bin/gopherstack — see gopherstack-gooq).
+# Same non-root layout as the release image. Must build with the classic (non-BuildKit)
+# builder testcontainers uses: no $BUILDPLATFORM, no COPY --chmod (the binary is already 0755).
+FROM alpine:3.22@sha256:2e0b81d60597f449baa56dc25d355367869d2dca4cd57e866f1e2b52af3eb55f AS state
+RUN mkdir /data
+
+FROM gcr.io/distroless/static:nonroot@sha256:25ac8f0c3b2334a9eb05452266bd4697864a8c8ef0ef71e5e6480d7f92868329
+COPY --from=state --chown=65532:65532 /data /data
+COPY --chown=0:0 bin/gopherstack-linux /usr/local/bin/gopherstack
+USER 65532:65532
 EXPOSE 8000
 EXPOSE 1883
-CMD ["/root/gopherstack"]
+CMD ["/usr/local/bin/gopherstack"]