feat: standardize build system and CI/CD automation

.github/actionlint.yaml

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+self-hosted-runner:
+  labels:
+    - ubuntu-slim

.github/workflows/Release.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 name: Release with goreleaser
 
 on:
@@ -6,26 +10,47 @@ on:
     tags:
       - v*
 
-permissions: write-all # Necessary for the generate-build-provenance action with containers
+permissions:
+  contents: write
+  packages: write
+  attestations: write
+  id-token: write
 
 jobs:
+  go-version:
+    runs-on: ubuntu-slim
+    outputs:
+      version: ${{ steps.go-mod.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+      - id: go-mod
+        run: echo "version=$(awk '/^go / {print $2; exit}' go.mod)" >> "$GITHUB_OUTPUT"
+
   stress-tests:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@v6.4.0
         with:
-          go-version: stable
+          go-version-file: go.mod
       - name: Run release stress tests
-        run: go test -tags=stress -count=1 ./cmd/cloud-init-server ./pkg/wgtunnel ./internal/memstore ./internal/smdclient
+        run: make test-stress
 
   release:
-    needs: stress-tests
+    needs:
+      - go-version
+      - stress-tests
     uses: OpenCHAMI/github-actions/.github/workflows/go-build-release.yml@v3.2
     with:
       cgo-enabled: "1"
+      go-version: ${{ needs.go-version.outputs.version }}
+      goreleaser-version: "v2.11.2"
       pre-build-commands: |
-        go install github.com/swaggo/swag/cmd/swag@latest
+        go install github.com/swaggo/swag/cmd/swag@v1.16.6
         sudo apt update && sudo apt install -y git gcc g++ make ca-certificates curl gnupg gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libc6-dev-arm64-cross software-properties-common clang-tools libstdc++-13-dev-arm64-cross
       attestation-binary-path: "dist/cloud-init*"
       registry-name: ghcr.io/openchami/cloud-init

.github/workflows/lint.yaml

@@ -1,25 +1,57 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 name: Run golangci-lint
+
 on:
   push:
-    branches:
-      - main
+    branches: [main]
   pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: lint-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
-  # Optional: allow read access to pull requests. Use with `only-new-issues` option.
-  # pull-requests: read
 
 jobs:
   golangci:
-    name: lint
-    runs-on: ubuntu-latest
+    name: Run golangci-lint
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9.2.0
+        with:
+          version: v2.13.2
+
+  modules:
+    name: Check Go modules
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.3
         with:
-          go-version: stable
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
         with:
-          version: v2.11
+          go-version-file: go.mod
+
+      - name: Check go.mod and go.sum
+        run: make tidy-check

.github/workflows/security.yaml

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v3.2
+    with:
+      go-package: ./...
+
+  dependency-review:
+    name: dependency-review
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@v3.2
+    with:
+      fail-on-severity: high
+      comment-summary-in-pr: never
+
+  workflow-lint:
+    name: workflow lint
+    permissions:
+      contents: read
+      security-events: write
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-workflows.yml@v3.2

.github/workflows/test.yaml

@@ -0,0 +1,73 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  unit:
+    name: Unit tests
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: make test
+
+  race:
+    name: Race tests
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run race tests
+        run: make test-race
+
+  build:
+    name: Build binary
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: make build

.gitignore

@@ -1,6 +1,13 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 dist
+bin/
+graphify-out/
+pr_*_diff.txt
+pr_*_view.txt
 # Our compiled binary
 /cloud-init-server
 
 .omo/
-graphify-out/cache/

.golangci.yml

@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+version: "2"
+run:
+  timeout: 5m
+  allow-parallel-runners: true
+linters:
+  enable:
+    - govet
+  disable:
+    - staticcheck
+    - unused
+    - errcheck
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/openchami/cloud-init
+  exclusions:
+    generated: lax

.goreleaser-darwin.yaml

@@ -1,11 +1,13 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 version: 2
 project_name: cloud-init
 before:
   hooks:
-    # You may remove this if you don't use go modules.
-    - go mod tidy
-    - go install github.com/swaggo/swag/cmd/swag@latest
-    - swag init -g cmd/cloud-init-server/main.go  
+    - go install github.com/swaggo/swag/cmd/swag@v1.16.6
+    - swag init -g cmd/cloud-init-server/main.go
 
 builds:
   - id: darwin
@@ -39,4 +41,4 @@ builds:
 # The lines beneath this are called `modelines`. See `:help modeline`
 # Feel free to remove those if you don't want/use them.
 # yaml-language-server: $schema=https://raw.githubusercontent.com/goreleaser/goreleaser/v2.11.2/www/docs/static/schema.json
-# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj

.goreleaser.yaml

@@ -1,10 +1,12 @@
+# SPDX-FileCopyrightText: Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 version: 2
 project_name: cloud-init
 before:
   hooks:
-    # You may remove this if you don't use go modules.
-    - go mod tidy
-    - go install github.com/swaggo/swag/cmd/swag@latest
+    - go install github.com/swaggo/swag/cmd/swag@v1.16.6
     - swag init -g cmd/cloud-init-server/main.go
 
 builds:
@@ -56,7 +58,7 @@ dockers:
     goamd64: v3
 
     extra_files:
-      - LICENSE
+      - LICENSES/MIT.txt
       - CHANGELOG.md
       - README.md
   - image_templates:
@@ -72,7 +74,7 @@ dockers:
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Version}}"
     extra_files:
-      - LICENSE
+      - LICENSES/MIT.txt
       - CHANGELOG.md
       - README.md
     goarch: arm64
@@ -99,7 +101,8 @@ docker_manifests:
       - *arm64v8_linux_image
 
 archives:
-  - format: tar.gz
+  - formats:
+      - tar.gz
     # this name template makes the OS and Arch compatible with the results of uname.
     name_template: >-
       {{ .ProjectName }}_
@@ -110,7 +113,7 @@ archives:
       {{- if .Arm }}v{{ .Arm }}{{ end }}
       {{- if .Amd64 }}{{ .Amd64 }}{{ end }}
     files:
-      - LICENSE
+      - LICENSES/MIT.txt
       - CHANGELOG.md
       - README.md