feat: add CLI tool support for Kind, Minikube, Cosign, Syft, and Grype

[thomhurst]

Summary

• Add support for Kind and Minikube for local Kubernetes testing
• Add supply chain security tools: Cosign (container signing), Syft (SBOM generation), Grype (vulnerability scanning)
• Include CLI scrapers, project files, and GitHub workflow installation steps for all 5 tools

Test plan

• Verify solution builds successfully
• Trigger GitHub workflow to generate CLI options for new tools
• Verify generated options classes work correctly

Closes #2063

🤖 Generated with Claude Code

[thomhurst]

Summary

Adds CLI tool integrations for 5 new tools: Kind and Minikube (local Kubernetes), plus Cosign, Syft, and Grype (supply chain security).

Critical Issues

None found ✅

Suggestions

1. Installation Script Security (Syft and Grype)

The Syft and Grype installations pipe curl output directly to shell:

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

While this is a common pattern and matches the official installation instructions, consider adding checksum verification or pinning to specific versions for reproducibility. This is consistent with how Flux is installed, so it's not a blocker—just something to consider for future hardening.

2. Version Pinning

All installation URLs use latest:

• kind.sigs.k8s.io/dl/latest/kind-linux-amd64
• storage.googleapis.com/minikube/releases/latest/...
• github.com/sigstore/cosign/releases/latest/...

This could cause version drift in generated options. Consider pinning to specific versions if CLI stability is important for the options generator. However, this matches the existing pattern for other tools (ArgoCD, Flux), so it's consistent with the codebase.

3. Minor: Missing Directory Structure

The PR creates .csproj files but the actual src/ModularPipelines.{Tool}/ directories may need to be created if they don't exist. Verify the workflow handles empty directories or if you need placeholder files.

Verdict

✅ APPROVE - No critical issues

The implementation is clean, follows existing patterns perfectly, and all 5 scrapers correctly inherit from CobraCliScraper (appropriate for Go-based CLI tools). The workflow integration is comprehensive and consistent with existing tool installations. The suggestions above are minor improvements for consideration, not blockers.