release: Gordon v3.0.0 - declarative apps

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   changes:
     name: Detect changes
@@ -13,6 +16,7 @@ jobs:
       pull-requests: read
     outputs:
       go: ${{ steps.filter.outputs.go }}
+      installer: ${{ steps.filter.outputs.installer }}
     steps:
       - uses: actions/checkout@v6
       - uses: dorny/paths-filter@v3
@@ -26,6 +30,22 @@ jobs:
               - '.golangci.yml'
               - 'Makefile'
               - '.github/workflows/**'
+            installer:
+              - 'install.sh'
+              - 'tests/install_next_test.sh'
+              - '.github/workflows/ci.yml'
+
+  installer:
+    name: Installer
+    needs: changes
+    if: needs.changes.outputs.installer == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Check installer scripts
+        run: |
+          shellcheck -s sh install.sh tests/install_next_test.sh
+          sh tests/install_next_test.sh
 
   lint:
     name: Lint
@@ -38,14 +58,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: "1.27.x"
-
-      - name: Cache Go modules
-        uses: actions/cache@v5
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-mod-
+          cache: true
 
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
@@ -63,22 +76,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: "1.27.x"
-
-      - name: Cache Go modules
-        uses: actions/cache@v5
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-mod-
-
-      - name: Cache Go build cache
-        uses: actions/cache@v5
-        with:
-          path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-build-
+          cache: true
 
       - name: Run tests
         run: go test -race -v ./...

.goreleaser.yaml

@@ -23,7 +23,7 @@ builds:
     env:
       - CGO_ENABLED=0
     ldflags:
-      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}
+      - -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.dirty={{.IsGitDirty}}
 
 # Docker builds disabled for v2.0.0 release (will add back with proper buildx setup)
 # dockers:

.mockery.yaml

@@ -17,20 +17,28 @@ packages:
       EventSubscriber:
       EventHandler:
       SecretProvider:
-      EnvLoader:
       ContainerLogWriter:
-      AttachmentConfigProvider:
+      Metrics:
+      LogExporter:
+      ContainerLogStreamer:
       TokenStore:
-      DomainSecretStore:
+      AppState:
+      AppStateReader:
+      ImageResolver:
+      SecretWriter:
       RateLimiter:
       BackupStorage:
-      RouteChecker:
       HTTPChallengeSink:
       PublicCertificateIssuer:
       CertificateStore:
       SecretResolver:
       CloudflareZoneResolver:
       CertificateAuthority:
+      AppTrafficRefresher:
+      PruneProtectionStore:
+      PruneRuntime:
+      GCBarrier:
+      GCLease:
   github.com/bnema/gordon/internal/boundaries/in:
     interfaces:
       ContainerService:
@@ -42,12 +50,12 @@ packages:
       AuthService:
       HealthService:
       HTTPProber:
-      SecretService:
       LogService:
       VolumeService:
       PublicTLSService:
       TrafficStatusService:
-      StandaloneServiceService:
+      AppService:
+      AppReconciler:
   # Exception: pushImageOps is a CLI-local interface, not a boundary port.
   # Mocked here because it abstracts Docker SDK calls that require a running
   # daemon, making unit/integration tests impractical without a test double.

AGENTS.md

@@ -111,10 +111,9 @@ CLI commands do NOT use zerowrap — they use `cliWriteLine`/`cliWritef` for out
 
 ### ControlPlane Pattern
 
-`ControlPlane` interface (`controlplane.go`) abstracts local vs remote operations.
-- `controlplane_remote.go` — delegates to `remote.Client` HTTP methods.
-- `controlplane_local.go` — calls service interfaces directly.
-- Test fakes in `push_test.go` — update when adding interface methods.
+`ControlPlane` interface (`controlplane.go`) is the seam CLI commands depend on.
+- `*remote.Client` implements it for both the explicit remote and the local admin socket.
+- Tests use the mockery mock in `cli/mocks/` — run `mockery` after adding interface methods.
 
 ### HTTP Admin Handlers
 

Dockerfile

@@ -5,6 +5,11 @@ ARG BUILDPLATFORM
 ARG VERSION=dev
 ARG COMMIT=unknown
 ARG BUILD_DATE=unknown
+# Whether the source checkout had uncommitted changes. The Makefile and the
+# release tooling pass an explicit true/false value. Because .git is excluded
+# from the build context (see .dockerignore), an ad-hoc build that passes no
+# build-arg reports "unknown" rather than falsely claiming a clean checkout.
+ARG DIRTY=unknown
 
 FROM --platform=$BUILDPLATFORM golang:1.27-alpine3.22 AS builder
 
@@ -13,6 +18,7 @@ ARG TARGETARCH=amd64
 ARG VERSION
 ARG COMMIT
 ARG BUILD_DATE
+ARG DIRTY
 
 RUN apk add --no-cache git ca-certificates tzdata
 
@@ -25,7 +31,7 @@ COPY . .
 
 RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" go build \
     -trimpath \
-    -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${BUILD_DATE}" \
+    -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${BUILD_DATE} -X main.dirty=${DIRTY}" \
     -o /gordon ./main.go
 
 FROM alpine:3.22

Makefile

@@ -10,12 +10,17 @@ ENGINE := podman
 VERSION := $(shell git describe --tags --always --dirty)
 COMMIT := $(shell git rev-parse --short HEAD)
 BUILD_DATE := $(shell date -u '+%Y-%m-%d_%I:%M:%S%p')
+# Probe the working tree directly (tracked edits and untracked files) instead
+# of parsing VERSION, so an overridden VERSION cannot mask a dirty checkout.
+# `git describe --dirty`, which VERSION uses, only reflects tracked edits.
+DIRTY := $(if $(shell git status --porcelain --untracked-files=normal 2>/dev/null),true,false)
 
 # Build flags
 LDFLAGS := -s -w \
 	-X main.version=$(VERSION) \
 	-X main.commit=$(COMMIT) \
-	-X main.date=$(BUILD_DATE)
+	-X main.date=$(BUILD_DATE) \
+	-X main.dirty=$(DIRTY)
 
 # Architectures
 ARCHS := amd64 arm64
@@ -83,7 +88,7 @@ build: ## Build binaries for linux (amd64 and arm64)
 	@echo "Building Go binaries..."
 	@mkdir -p $(DIST_DIR)
 	@rm -f $(DIST_DIR)/*
-	@echo "Building with version $(VERSION), commit $(COMMIT), date $(BUILD_DATE)"
+	@echo "Building with version $(VERSION), commit $(COMMIT), date $(BUILD_DATE), dirty $(DIRTY)"
 	@CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="$(LDFLAGS)" -o $(DIST_DIR)/gordon-linux-amd64 ./main.go
 	@CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags="$(LDFLAGS)" -o $(DIST_DIR)/gordon-linux-arm64 ./main.go
 	@echo "Go binaries built successfully"
@@ -105,6 +110,7 @@ build-push: ## Build and push Docker images
 			--build-arg VERSION="$(VERSION)" \
 			--build-arg COMMIT="$(COMMIT)" \
 			--build-arg BUILD_DATE="$(BUILD_DATE)" \
+			--build-arg DIRTY="$(DIRTY)" \
 			-t $(REPO):$(TAG)-$$arch .; \
 		$(ENGINE) push $(REPO):$(TAG)-$$arch; \
 	done