feat: bootstrap the meshStack CLI and move the API client in

.dockerignore

@@ -0,0 +1,11 @@
+# The build only needs the Go sources, go.mod and go.sum. Everything below would
+# otherwise be copied into the build context and invalidate its cache.
+.git/
+.github/
+dist/
+.nix-go/
+meshstack
+.env
+.vscode/
+.idea/
+*.md

.github/workflows/build-image.yml

@@ -0,0 +1,84 @@
+# Builds the meshstack container image and pushes it to GHCR only. Modelled on
+# meshcloud/building-block-runner's build-images.yml, minus the Docker Hub push.
+name: Build Image
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAMESPACE: ${{ github.repository_owner }}
+  IMAGE_NAME: meshstack-cli
+
+on:
+  # Called by the release workflow, so a tagged release publishes the matching image.
+  workflow_call:
+    inputs:
+      version:
+        description: "Release version to tag the image with, e.g. v1.2.3"
+        required: true
+        type: string
+  # A push to main refreshes :main, which is what makes the image usable before the
+  # first release exists.
+  push:
+    branches:
+      - main
+  # Pull requests build the image but do not push it, so a broken Dockerfile fails
+  # review rather than main.
+  pull_request:
+    paths:
+      - 'Dockerfile'
+      - '.github/workflows/build-image.yml'
+      - 'go.mod'
+      - 'go.sum'
+      - '**/*.go'
+
+jobs:
+  build:
+    name: Build and push image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # Tags are computed here rather than with docker/metadata-action, to keep the
+      # set of pinned actions small.
+      - name: Determine version and tags
+        id: meta
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            version="${{ inputs.version }}"
+            tags="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:${version}"
+            tags="${tags},${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:latest"
+          elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            version="main-$(git rev-parse --short HEAD)"
+            tags="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:main"
+            tags="${tags},${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:${version}"
+          else
+            version="pr-${{ github.event.number }}"
+            tags="${REGISTRY}/${IMAGE_NAMESPACE}/${IMAGE_NAME}:${version}"
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "tags=${tags}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Login to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+# Releases the meshstack CLI when a tag matching "v*" is pushed.
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    name: GoReleaser
+    runs-on: ubuntu-latest
+    permissions:
+      # Creating a release and uploading its assets counts as writing contents.
+      contents: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Let goreleaser read older tags, which it needs for the changelog.
+          fetch-depth: 0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          args: release --clean
+        env:
+          # GitHub sets GITHUB_TOKEN automatically.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Publishes the image for the same tag. Separate job so a failing image build does
+  # not take the archives down with it.
+  image:
+    name: Image
+    needs: [ goreleaser ]
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/build-image.yml
+    with:
+      version: ${{ github.ref_name }}

.github/workflows/test.yml

@@ -0,0 +1,83 @@
+# meshStack CLI build, lint and test workflow.
+name: Tests
+
+on:
+  pull_request:
+    paths-ignore:
+      - 'README.md'
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'README.md'
+
+# Testing only needs permissions to read the repository contents.
+permissions:
+  contents: read
+
+# Cancel superseded runs on the same ref.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Go Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - run: go mod tidy
+      - run: go build -v ./...
+      - name: git diff
+        run: |
+          git diff --compact-summary --exit-code || \
+            (echo; echo "Unexpected difference in directories after 'go mod tidy'. Run 'go mod tidy' command and commit."; exit 1)
+
+  golangci:
+    needs: [ build ]
+    name: Go Lint and Format Check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          # The repository's pinned Go, because it is what builds the linter below.
+          go-version-file: 'go.mod'
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          # golangci-lint's formatters use the go/format compiled into the binary, so the
+          # formatting they enforce comes from the Go release that BUILT the linter, not
+          # from the toolchain on PATH. The published binaries are built with whatever Go
+          # was current at release time, which made 'version: latest' with install-mode
+          # 'binary' enforce a different gofmt than the pinned Go: 1.27 widens end-of-line
+          # comment alignment groups, and 1.26 rejects the result, so the two disagree with
+          # no formatting that satisfies both. Building the linter here with go.mod's Go
+          # ties formatting to the version the code is written against.
+          install-mode: goinstall
+          version: v2.13.0
+          # Deliberately no only-new-issues: this repository starts clean and CI keeps it
+          # that way, so filtering to changed code cannot help and can only hide a finding.
+          # It hid this one, and still hides it in the provider's identical job.
+      - name: Suggest fix command on failure
+        if: failure()
+        run: |
+          echo "::error::Linting or formatting issues detected. Run 'task lint -- --fix' locally to automatically fix these issues, then commit the changes."
+
+  test:
+    needs: [ build ]
+    name: Go Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: 'go.mod'
+          cache: true
+      - run: go test -v ./...

.gitignore

@@ -0,0 +1,15 @@
+# Binary produced by 'task build'
+/meshstack
+
+# Release artifacts produced by goreleaser
+/dist/
+
+# Go environment created by the Nix dev shell (flake.nix shellHook)
+/.nix-go/
+
+# Local meshStack credentials, read by the Taskfile's dotenv
+.env
+
+# Editor and IDE directories
+.vscode/
+.idea/

.golangci.yml

@@ -0,0 +1,106 @@
+# Visit https://golangci-lint.run/ for usage documentation
+# and information on other useful linters.
+#
+# Kept deliberately close to the meshStack Terraform provider's configuration, so
+# that code moving between the two repositories does not trip a different linter set.
+version: "2"
+issues:
+  max-same-issues: 0
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+  settings:
+    gci:
+      sections:
+        - standard     # Go standard library
+        - default      # All other external dependencies
+        - localmodule  # This repository's modules
+
+linters:
+  default: none
+  enable:
+    - depguard
+    - durationcheck
+    - errcheck
+    - copyloopvar
+    - forcetypeassert
+    - godot
+    - ineffassign
+    - makezero
+    - misspell
+    - nilerr
+    - predeclared
+    - staticcheck
+    - usetesting
+    - unconvert
+    - unparam
+    - unused
+    - govet
+    - testifylint
+    - thelper
+  settings:
+    # This repository is allowed exactly one external dependency, cobra, and only the
+    # cmd/ tree may use it. Everything else stays on the standard library, with testify
+    # permitted in tests. The rules below are what enforces that; read them as the
+    # dependency policy rather than as lint configuration.
+    depguard:
+      rules:
+        # client/ must stay free of external dependencies. The meshStack Terraform
+        # provider consumes this package, so anything added here lands in the
+        # provider's dependency tree as well.
+        client:
+          files:
+            # Both patterns are needed: '**/dir/**/*.go' only matches files in
+            # subdirectories of dir, never files directly inside it.
+            - "**/client/*.go"
+            - "**/client/**/*.go"
+            - "!$test"
+          list-mode: strict
+          allow:
+            - $gostd
+            - github.com/meshcloud/meshstack-cli/client
+
+        # pkg/ holds logic reusable outside a CLI process — the Terraform provider
+        # imports pkg/login — so cobra must not reach it.
+        pkg:
+          files:
+            - "**/pkg/*.go"
+            - "**/pkg/**/*.go"
+            - "!$test"
+          list-mode: strict
+          deny:
+            - pkg: github.com/spf13/cobra
+              desc: cobra belongs in cmd/; pkg/ is also consumed by the Terraform provider
+          allow:
+            - $gostd
+            - github.com/meshcloud/meshstack-cli/client
+            - github.com/meshcloud/meshstack-cli/pkg
+
+        # cmd/ builds the command tree, and is the only place cobra is used.
+        cmd:
+          files:
+            - "**/cmd/*.go"
+            - "**/cmd/**/*.go"
+            - "!$test"
+          list-mode: strict
+          deny:
+            - pkg: log # as $gostd is allowed
+              desc: Write user-facing output through the command's own streams
+          allow:
+            - $gostd
+            - github.com/meshcloud/meshstack-cli
+            - github.com/spf13/cobra
+
+        # Tests may additionally use testify, which is what the client's moved tests
+        # are written against.
+        tests:
+          files:
+            - "$test"
+          list-mode: strict
+          allow:
+            - $gostd
+            - github.com/meshcloud/meshstack-cli
+            - github.com/spf13/cobra
+            - github.com/stretchr/testify