feat(#617): remove godo (DigitalOcean SDK) from workflow core

.github/workflows/ci.yml

@@ -376,3 +376,20 @@ jobs:
 
         echo ""
         echo "Results: $total configs, $passed passed, $warned warnings"
+
+  godo-banned:
+    name: Verify godo is not imported (issue #617)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Grep gate — *.go files must not import godo
+        run: |
+          ! grep -rn --include="*.go" \
+              --exclude-dir=_worktrees \
+              --exclude-dir=.worktrees \
+              --exclude-dir=.claude \
+              --exclude="godo_absent_test.go" \
+              "digitalocean/godo" .
+      - name: Grep gate — go.mod files must not list godo
+        run: |
+          ! grep -qH "digitalocean/godo" go.mod example/go.mod

CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.52.0 (2026-05-13) — BREAKING
+
+### Removed (issue #617)
+
+- All legacy DigitalOcean IaC modules (`platform.do_app`, `platform.do_database`, `platform.do_dns`, `platform.do_networking`, `platform.doks`) and the DO credential resolver `cloud_account_do.go`.
+- All legacy DigitalOcean pipeline steps (`step.do_deploy`, `step.do_status`, `step.do_logs`, `step.do_scale`, `step.do_destroy`).
+- The `github.com/digitalocean/godo` dependency from `go.mod` (root and `example/`).
+
+### Migration
+
+DigitalOcean IaC moved to [`workflow-plugin-digitalocean`](https://github.com/GoCodeAlone/workflow-plugin-digitalocean) v0.12.0+. After loading the plugin, replace legacy module types with `infra.*` types and `provider: digitalocean`. Run `wfctl modernize --apply <config.yaml>` to auto-rewrite supported types — **then manually add `provider: digitalocean` to each rewritten module's `config:` block** (the modernize rule does not inject the provider key; see the [migration guide](docs/migrations/v0.52.0-godo-removal.md) for the exact recipe). Two step types (`step.do_logs`, `step.do_scale`) have no 1:1 pipeline successor — workarounds documented in the migration guide.
+
+Configs that still reference the legacy types now fail to load with an actionable error pointing to the plugin and the relevant `infra.*` successor.
+
+---
+
 ## [Unreleased]
 
 ### Added

DOCUMENTATION.md

@@ -322,11 +322,11 @@ flowchart TD
 | `step.argo_logs` | Retrieves logs from an Argo Workflow | platform |
 | `step.argo_delete` | Deletes an Argo Workflow | platform |
 | `step.argo_list` | Lists Argo Workflows for a namespace | platform |
-| `step.do_deploy` | Deploys to DigitalOcean App Platform | platform |
-| `step.do_status` | Retrieves DigitalOcean App Platform deployment status | platform |
-| `step.do_logs` | Fetches DigitalOcean App Platform runtime logs | platform |
-| `step.do_scale` | Scales a DigitalOcean App Platform component | platform |
-| `step.do_destroy` | Destroys a DigitalOcean App Platform deployment | platform |
+
+**DigitalOcean IaC steps** were removed from workflow core in v0.52.0 and moved to the
+[workflow-plugin-digitalocean](https://github.com/GoCodeAlone/workflow-plugin-digitalocean)
+external plugin. After loading the plugin, use the generic `step.iac_*` pipeline steps.
+See [v0.52.0 migration guide](docs/migrations/v0.52.0-godo-removal.md).
 
 ### Expression Syntax
 
@@ -510,11 +510,12 @@ Strict mode applies to **both** direct dot-access (`{{ .steps.auth.field }}`) an
 | `platform.autoscaling` | Auto-scaling policy and target management | platform |
 | `platform.region` | Multi-region deployment configuration | platform |
 | `platform.region_router` | Routes traffic across regions by weight, latency, or failover | platform |
-| `platform.doks` | DigitalOcean Kubernetes Service (DOKS) deployment | platform |
-| `platform.do_app` | DigitalOcean App Platform deployment (deploy, scale, logs, destroy) | platform |
-| `platform.do_networking` | DigitalOcean VPC and firewall management | platform |
-| `platform.do_dns` | DigitalOcean domain and DNS record management | platform |
-| `platform.do_database` | DigitalOcean Managed Database (PostgreSQL, MySQL, Redis) | platform |
+
+**DigitalOcean IaC modules** were removed from workflow core in v0.52.0 and moved to the
+[workflow-plugin-digitalocean](https://github.com/GoCodeAlone/workflow-plugin-digitalocean)
+external plugin. After loading the plugin, use the generic `infra.*` module
+types with `provider: digitalocean` and the generic `step.iac_*` pipeline
+steps. See [v0.52.0 migration guide](docs/migrations/v0.52.0-godo-removal.md).
 | `iac.provider` | Cloud provider configuration (aws, gcp, azure, digitalocean) for IaC operations | platform |
 | `iac.state` | IaC state persistence (memory, filesystem, spaces, gcs, azure_blob, postgres) | platform |
 | `infra.vpc` | Virtual Private Cloud and subnet management | platform |

cmd/wfctl/ci_run_dryrun.go

@@ -177,7 +177,6 @@ func resolveDeployInfoFromConfig(wfCfg *config.WorkflowConfig, envName, provider
 	// references the provider.
 	deployTargetTypes := []string{
 		"infra.container_service",
-		"platform.do_app",
 		"platform.app_platform",
 		"infra.k8s_cluster",
 	}

cmd/wfctl/ci_validate.go

@@ -10,8 +10,10 @@ import (
 	"time"
 
 	"github.com/GoCodeAlone/workflow/config"
+	"github.com/GoCodeAlone/workflow/internal/legacydo"
 	"github.com/GoCodeAlone/workflow/schema"
 	"github.com/GoCodeAlone/workflow/validation"
+	"gopkg.in/yaml.v3"
 )
 
 // ciFileResult holds the outcome of validating a single config file.
@@ -131,10 +133,37 @@ func ciValidateFile(cfgPath string, strict, immutableConfig bool, immutableSecti
 		opts = append(opts, schema.WithAllowEmptyModules())
 	}
 	opts = append(opts, schema.WithSkipWorkflowTypeCheck(), schema.WithSkipTriggerTypeCheck())
+	// Pass legacy DO module types through schema so the migration error fires
+	// below instead of a generic "unknown module type" (issue #617).
+	for t := range legacydo.ModuleTypes {
+		opts = append(opts, schema.WithExtraModuleTypes(t))
+	}
 	if err := schema.ValidateConfig(cfg, opts...); err != nil {
 		errs = append(errs, fmt.Errorf("schema: %w", err))
 	}
 
+	// Post-validate sweep: accumulate legacy DO module/step errors (issue #617).
+	for _, m := range cfg.Modules {
+		if legacydo.IsModuleType(m.Type) {
+			errs = append(errs, legacydo.FormatModuleError(m.Type, m.Name, false))
+		}
+	}
+	for _, rawPipeline := range cfg.Pipelines {
+		yamlBytes, err := yaml.Marshal(rawPipeline)
+		if err != nil {
+			continue
+		}
+		var pipeCfg config.PipelineConfig
+		if err := yaml.Unmarshal(yamlBytes, &pipeCfg); err != nil {
+			continue
+		}
+		for _, s := range pipeCfg.Steps {
+			if legacydo.IsStepType(s.Type) {
+				errs = append(errs, legacydo.FormatStepError(s.Type, false))
+			}
+		}
+	}
+
 	// CI config check.
 	if immutableConfig {
 		if cfg.CI == nil {

cmd/wfctl/deploy.go

@@ -778,7 +778,7 @@ func runDeployCloud(args []string) error {
 		fmt.Fprintf(fs.Output(), `Usage: wfctl deploy cloud [options]
 
 Deploy infrastructure defined in a workflow config to a cloud environment.
-Discovers cloud.account and platform.* modules, validates credentials,
+Discovers cloud.account, platform.*, and infra.* modules, validates credentials,
 shows a deployment plan, and applies changes.
 
 Options:
@@ -829,15 +829,15 @@ Options:
 		return fmt.Errorf("parse config %s: %w", cfg, yamlErr)
 	}
 
-	// Discover cloud accounts and platform modules
+	// Discover cloud accounts and deploy-target modules (platform.* or infra.*)
 	var cloudAccounts []moduleEntry
-	var platformModules []moduleEntry
+	var deployTargetModules []moduleEntry
 	for _, m := range parsed.Modules {
 		if m.Type == "cloud.account" {
 			cloudAccounts = append(cloudAccounts, m)
 		}
-		if strings.HasPrefix(m.Type, "platform.") {
-			platformModules = append(platformModules, m)
+		if strings.HasPrefix(m.Type, "platform.") || strings.HasPrefix(m.Type, "infra.") {
+			deployTargetModules = append(deployTargetModules, m)
 		}
 	}
 
@@ -896,13 +896,13 @@ Options:
 		fmt.Println()
 	}
 
-	// Report platform modules (deployment plan)
-	if len(platformModules) == 0 {
-		return fmt.Errorf("no platform.* modules found in config — nothing to deploy")
+	// Report deploy-target modules (deployment plan)
+	if len(deployTargetModules) == 0 {
+		return fmt.Errorf("no platform.* or infra.* modules found in config — nothing to deploy")
 	}
 
-	fmt.Printf("Infrastructure Modules (%d):\n", len(platformModules))
-	for _, pm := range platformModules {
+	fmt.Printf("Infrastructure Modules (%d):\n", len(deployTargetModules))
+	for _, pm := range deployTargetModules {
 		account, _ := pm.Config["account"].(string)
 		detail := pm.Type
 		if account != "" {

cmd/wfctl/deploy_providers.go

@@ -86,8 +86,8 @@ var resolveIaCProvider = discoverAndLoadIaCProvider
 // double parse — and either may be empty without affecting the
 // other.
 type iacPluginManifest struct {
-	Name    string `json:"name"`
-	Version string `json:"version"`
+	Name         string `json:"name"`
+	Version      string `json:"version"`
 	Capabilities struct {
 		IaCProvider struct {
 			Name string `json:"name"`
@@ -418,7 +418,6 @@ func newPluginDeployProvider(providerName string, wfCfg *config.WorkflowConfig,
 	// behaviour is predictable rather than silently wrong.
 	deployTargetTypes := []string{
 		"infra.container_service",
-		"platform.do_app",
 		"platform.app_platform",
 		"infra.k8s_cluster",
 	}

cmd/wfctl/deploy_test.go

@@ -92,7 +92,7 @@ func TestRunDeployCloudValidTarget(t *testing.T) {
 	if err == nil {
 		t.Fatal("expected error when no platform modules found")
 	}
-	if !strings.Contains(err.Error(), "no platform.* modules found") {
+	if !strings.Contains(err.Error(), "no platform.* or infra.* modules found") {
 		t.Errorf("expected no platform modules error, got: %v", err)
 	}
 }

cmd/wfctl/infra.go

@@ -457,7 +457,7 @@ func secretGenKeys(cfg *config.WorkflowConfig) []string {
 }
 
 // parseInfraResourceSpecs reads an infra config (resolving imports:) and
-// returns ResourceSpecs for all infra.* and platform.* modules.
+// returns ResourceSpecs for all infra.* and platform.* (e.g., platform.kubernetes, platform.ecs) modules.
 func parseInfraResourceSpecs(cfgFile string) ([]interfaces.ResourceSpec, error) {
 	cfg, err := config.LoadFromFile(cfgFile)
 	if err != nil {
@@ -574,7 +574,7 @@ func planResourcesForEnv(path, envName string) ([]*config.ResolvedModule, error)
 }
 
 func isContainerType(t string) bool {
-	return t == "infra.container_service" || t == "platform.do_app"
+	return t == "infra.container_service"
 }
 
 // loadCurrentState loads ResourceStates from the configured iac.state backend.

cmd/wfctl/infra_apply.go

@@ -127,8 +127,8 @@ func hasInfraModules(cfgFile string) bool {
 	return false
 }
 
-// hasPlatformModules reports whether cfgFile contains any modules with the legacy
-// platform.* type prefix.
+// hasPlatformModules reports whether cfgFile contains any modules with the
+// platform.* type prefix (e.g., platform.kubernetes, platform.ecs).
 func hasPlatformModules(cfgFile string) bool {
 	cfg, err := config.LoadFromFile(cfgFile)
 	if err != nil {

cmd/wfctl/infra_apply_test.go

@@ -1987,7 +1987,7 @@ modules:
 	if err := os.WriteFile(legacyOnly, []byte(`
 modules:
   - name: app
-    type: platform.do_app
+    type: example.legacy_unknown
     config: {}
 `), 0o600); err != nil {
 		t.Fatal(err)

cmd/wfctl/legacy_do_types_removed_test.go

@@ -0,0 +1,87 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestLegacyDOTypesAbsent_FromTypeRegistry locks the post-cutover state of
+// cmd/wfctl/type_registry.go for issue #617. If any legacy type leaks back in,
+// this test fires and the CI gate fires.
+func TestLegacyDOTypesAbsent_FromTypeRegistry(t *testing.T) {
+	modules := KnownModuleTypes()
+	steps := KnownStepTypes()
+	legacyModules := []string{
+		"platform.do_app", "platform.do_database", "platform.do_dns",
+		"platform.do_networking", "platform.doks",
+	}
+	legacySteps := []string{
+		"step.do_deploy", "step.do_status", "step.do_logs",
+		"step.do_scale", "step.do_destroy",
+	}
+	for _, tname := range legacyModules {
+		if _, ok := modules[tname]; ok {
+			t.Errorf("module type registry still contains legacy DO type %q (issue #617)", tname)
+		}
+	}
+	for _, tname := range legacySteps {
+		if _, ok := steps[tname]; ok {
+			t.Errorf("step type registry still contains legacy DO type %q (issue #617)", tname)
+		}
+	}
+}
+
+// TestValidateFile_LegacyDOModule_ReturnsActionableError verifies that
+// wfctl validate emits the actionable migration error when the config
+// references a removed legacy DO module type (issue #617). Covers AC3
+// on the validate path (the engine path is covered by
+// TestLegacyDOModuleError_PluginNotLoaded in the workflow package).
+func TestValidateFile_LegacyDOModule_ReturnsActionableError(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "legacy.yaml")
+	yamlContent := []byte("modules:\n  - name: api\n    type: platform.do_app\n    config: {}\n")
+	if err := os.WriteFile(cfgPath, yamlContent, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := validateFile(cfgPath, false, false, false)
+	if err == nil {
+		t.Fatal("expected error for legacy DO module type")
+	}
+	msg := err.Error()
+	for _, want := range []string{
+		"removed from workflow core",
+		"workflow-plugin-digitalocean",
+		"infra.container_service",
+	} {
+		if !strings.Contains(msg, want) {
+			t.Errorf("error missing %q; got: %s", want, msg)
+		}
+	}
+}
+
+// TestCIValidateFile_LegacyDOStep_ReturnsActionableError covers ciValidateFile's
+// accumulating return for legacy DO step types.
+func TestCIValidateFile_LegacyDOStep_ReturnsActionableError(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "legacy.yaml")
+	yamlContent := []byte("pipelines:\n  deploy:\n    steps:\n      - type: step.do_deploy\n")
+	if err := os.WriteFile(cfgPath, yamlContent, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	errs := ciValidateFile(cfgPath, false, false, "")
+	if len(errs) == 0 {
+		t.Fatal("expected error for legacy DO step type")
+	}
+	found := false
+	for _, e := range errs {
+		if strings.Contains(e.Error(), "step.iac_apply") && strings.Contains(e.Error(), "removed from workflow core") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("expected actionable migration error in errs; got: %v", errs)
+	}
+}

cmd/wfctl/modernize_test.go

@@ -552,6 +552,7 @@ func TestModernizeAllRulesRegistered(t *testing.T) {
 		"empty-routes",
 		"camelcase-config",
 		"request-parse-config",
+		"legacy-do-types",
 	}
 	if len(rules) != len(expectedIDs) {
 		t.Errorf("expected %d rules, got %d", len(expectedIDs), len(rules))