feat: add pre-deploy hook for GitOps project syncs

.depot/workflows/build-v2.yml

@@ -0,0 +1,142 @@
+name: Build V2 Beta Images
+
+on:
+  push:
+    branches:
+      - breaking/v2.0.0
+  workflow_dispatch:
+
+concurrency:
+  group: build-v2-beta-images
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-v2-beta-images:
+    runs-on: depot-ubuntu-24.04-32
+
+    env:
+      MANAGER_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/manager
+      AGENT_IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/agent
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install envsubst
+        run: sudo apt-get update && sudo apt-get install -y gettext-base
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
+      - name: Setup depot buildx driver
+        id: setup-buildx-driver
+        run: |
+          depot configure-docker
+
+      # - name: Snapshot Setup Environment
+      #   uses: depot/snapshot-action@v1
+      #   with:
+      #     image: g7r5wqb57k.registry.depot.dev/arcane-env:latest
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ vars.GHCR_USERNAME }}
+          password: ${{ secrets.ARCANE_BOT_TOKEN }}
+
+      - name: Manager image metadata
+        id: manager-meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.MANAGER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=v2-beta
+          labels: |
+            org.opencontainers.image.authors=OFKM Technologies
+            org.opencontainers.image.url=https://github.com/getarcaneapp/arcane
+            org.opencontainers.image.documentation=https://github.com/getarcaneapp/arcane/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/getarcaneapp/arcane
+            org.opencontainers.image.version=v2-beta
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=BSD-3-Clause
+            org.opencontainers.image.ref.name=arcane
+            org.opencontainers.image.title=Arcane
+            org.opencontainers.image.description=Modern Docker Management, Made for Everyone
+            com.getarcaneapp.arcane=true
+
+      - name: Build and push manager image
+        id: manager-build
+        uses: depot/build-push-action@v1
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.manager-meta.outputs.tags }}
+          labels: ${{ steps.manager-meta.outputs.labels }}
+          build-args: |
+            VERSION=v2.0.0-beta
+            REVISION=${{ github.sha }}
+          sbom: false
+          provenance: true
+
+      - name: Sign manager image
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "${MANAGER_IMAGE_NAME}@${{ steps.manager-build.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
+      - name: Agent image metadata
+        id: agent-meta
+        uses: docker/metadata-action@v6
+        with:
+          images: |
+            ${{ env.AGENT_IMAGE_NAME }}
+          tags: |
+            type=raw,value=v2-beta
+          labels: |
+            org.opencontainers.image.authors=OFKM Technologies
+            org.opencontainers.image.url=https://github.com/getarcaneapp/arcane
+            org.opencontainers.image.documentation=https://github.com/getarcaneapp/arcane/blob/main/README.md
+            org.opencontainers.image.source=https://github.com/getarcaneapp/arcane
+            org.opencontainers.image.version=v2-beta
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=BSD-3-Clause
+            org.opencontainers.image.ref.name=arcane-agent
+            org.opencontainers.image.title=Arcane Agent
+            org.opencontainers.image.description=Arcane Agent
+            com.getarcaneapp.arcane=true
+            com.getarcaneapp.arcane.agent=true
+
+      - name: Build and push agent image
+        id: agent-build
+        uses: depot/build-push-action@v1
+        with:
+          context: .
+          file: docker/Dockerfile-agent
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.agent-meta.outputs.tags }}
+          labels: ${{ steps.agent-meta.outputs.labels }}
+          build-args: |
+            VERSION=v2.0.0-beta
+            REVISION=${{ github.sha }}
+          sbom: false
+          provenance: true
+
+      - name: Sign agent image
+        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "${AGENT_IMAGE_NAME}@${{ steps.agent-build.outputs.digest }}"
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

.gitattributes

@@ -0,0 +1,7 @@
+# Files that must be LF on disk regardless of the checkout platform, because
+# they're consumed by tooling that chokes on CRLF (bash shebangs, just,
+# shell scripts copied verbatim into Linux runner containers).
+.husky/* text eol=lf
+.husky/_/* text eol=lf
+Justfile text eol=lf
+*.sh text eol=lf

.github/.golangci.yml

@@ -5,52 +5,118 @@ run:
 linters:
   default: none
   enable:
+    - arangolint
     - asasalint
     - asciicheck
     - bidichk
     - bodyclose
+    - canonicalheader
+    - clickhouselint
     - contextcheck
     - copyloopvar
+    - decorder
+    - dupl
+    - dupword
     - durationcheck
+    - embeddedstructfieldcheck
     - errcheck
     - errchkjson
+    - errname
     - errorlint
     - exhaustive
+    - exptostd
+    - fatcontext
+    - forbidigo
+    - forcetypeassert
+    - ginkgolinter
     - gocheckcompilerdirectives
     - gochecksumtype
     - gocognit
     - gocritic
+    - gocyclo
+    - godoclint
+    - goheader
+    - gomoddirectives
+    - gomodguard_v2
+    - goprintffuncname
     - gosec
     - gosmopolitan
     - govet
+    - grouper
+    - iface
+    - importas
+    - inamedparam
     - ineffassign
+    - interfacebloat
+    - intrange
+    - iotamixing
     - loggercheck
+    - maintidx
     - makezero
-    - misspell
     - mirror
+    - misspell
+    - modernize
     - musttag
     - nakedret
     - nilerr
     - nilnesserr
     - noctx
+    - nolintlint
+    - nosprintfhostport
+    - perfsprint
+    - prealloc
+    - predeclared
+    - promlinter
     - protogetter
     - reassign
     - recvcheck
+    - revive
     - rowserrcheck
+    - sloglint
     - spancheck
     - sqlclosecheck
     - staticcheck
+    - testableexamples
     - testifylint
+    - unconvert
+    - unparam
+    - unqueryvet
     - unused
     - usestdlibvars
+    - usetesting
+    - wastedassign
+    - whitespace
     - zerologlint
+  settings:
+    gomoddirectives:
+      # replace directives (=> ../cli, => ../types). Allow them.
+      replace-local: true
   exclusions:
     generated: lax
     presets:
       - comments
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      # Initialism naming (ApiKey -> APIKey, AppUrl -> AppURL, etc.) is intentional,
+      # widespread, and API-surface; track separately rather than churn it here.
+      - linters:
+          - revive
+        text: "var-naming:"
+      # Unused params are required by interface/callback/gorm-hook signatures.
+      - linters:
+          - revive
+        text: "unused-parameter:"
+      # Package-prefixed exported names (swarm.SwarmInfo, port.PortMapping, etc.) are
+      # an intentional, monorepo-wide convention; renaming is a large public-API change.
+      - linters:
+          - revive
+        text: "exported:"
+      # The cli command package is a CLI entrypoint; printing to stdout is correct.
+      - linters:
+          - forbidigo
+        path: cli/
     paths:
       - '.*\.pb\.go$'
       - third_party$

.github/workflows/ci.yml

@@ -223,7 +223,7 @@ jobs:
   e2e-tests:
     name: E2E Tests (${{ matrix.database.name }})
     if: ${{ github.head_ref != 'l10n_crowdin' }}
-    runs-on: depot-ubuntu-latest
+    runs-on: depot-ubuntu-24.04-4
     permissions:
       contents: read
       actions: write
@@ -301,7 +301,7 @@ jobs:
   cli-e2e-tests:
     name: CLI E2E Tests (proxy)
     if: ${{ github.head_ref != 'l10n_crowdin' }}
-    runs-on: depot-ubuntu-latest
+    runs-on: depot-ubuntu-24.04-4
     permissions:
       contents: read
       actions: write

.github/workflows/hadolint.yml

@@ -10,12 +10,12 @@ name: Hadolint
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ "main" ]
+    branches: ["main"]
   schedule:
-    - cron: '24 19 * * 2'
+    - cron: "24 19 * * 2"
 
 permissions:
   contents: read
@@ -28,20 +28,31 @@ jobs:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: manager
+            dockerfile: ./docker/Dockerfile
+            output: hadolint-results-manager.sarif
+          - name: agent
+            dockerfile: ./docker/Dockerfile-agent
+            output: hadolint-results-agent.sarif
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
 
       - name: Run hadolint
         uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5
         with:
-          dockerfile: ./docker/Dockerfile
+          dockerfile: ${{ matrix.dockerfile }}
           format: sarif
-          output-file: hadolint-results.sarif
+          output-file: ${{ matrix.output }}
           no-fail: true
 
       - name: Upload analysis results to GitHub
         uses: github/codeql-action/upload-sarif@v4.36.0
         with:
-          sarif_file: hadolint-results.sarif
+          sarif_file: ${{ matrix.output }}
+          category: hadolint-${{ matrix.name }}
           wait-for-processing: true

.vscode/settings.json

@@ -6,11 +6,11 @@
     "scminput": false,
     "typescript": true
   },
-  "typescript.tsdk": "frontend/node_modules/typescript/lib",
   "go.buildTags": "playwright,buildables",
   "prettier.documentSelectors": ["**/*.svelte"],
   "tasks.statusbar.default.hide": true,
   "tasks.statusbar.limit": 8,
   "github.copilot.chat.summarizeAgentConversationHistory.enabled": false,
-  "snyk.advanced.autoSelectOrganization": false
+  "snyk.advanced.autoSelectOrganization": false,
+  "js/ts.tsdk.path": "frontend/node_modules/typescript/lib"
 }