feat!: unify CalmsToolkit CLI and delivery pipeline

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Oslo
+    groups:
+      go-minor-and-patch:
+        update-types: [minor, patch]
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:30"
+      timezone: Europe/Oslo
+    groups:
+      actions:
+        patterns: ["*"]
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -5,54 +5,139 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  GO_VERSION: "1.25.12"
+
 jobs:
-  qc-test-build:
-    name: Quality, Test & Build
+  quality:
+    name: Quality
     runs-on: ubuntu-latest
-    timeout-minutes: 10
-
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version: '1.25.0'
+          go-version: ${{ env.GO_VERSION }}
           cache: true
-
-      - name: Run gofmt check
+      - name: Check formatting
+        shell: bash
         run: |
-          if [ -n "$(gofmt -l .)" ]; then
-            echo "Error: Code is not properly formatted. Run 'go fmt ./...' to fix the formatting."
-            gofmt -d .
+          files="$(gofmt -l .)"
+          if [[ -n "$files" ]]; then
+            echo "::error::Run 'gofmt -w .' on these files:"
+            echo "$files"
             exit 1
           fi
-
-      - name: Check go.mod tidiness
+      - name: Check module consistency
         run: |
           go mod tidy
-          if ! git diff --exit-code go.mod go.sum; then
-            echo "Error: go.mod or go.sum is not tidy. Run 'go mod tidy' to fix this."
+          git diff --exit-code -- go.mod go.sum
+          go mod verify
+      - name: Run go vet
+        run: go vet ./...
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          version: v2.12.2
+          args: --timeout=5m
+      - name: Validate workflow syntax
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+      - name: Validate conventional PR title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        shell: bash
+        run: |
+          pattern='^(feat|fix|perf|refactor|docs|test|build|ci|chore|revert)(\([a-z0-9._/-]+\))?!?: .+'
+          if [[ ! "$PR_TITLE" =~ $pattern ]]; then
+            echo "::error::PR title must use Conventional Commits, for example 'feat(cli): add command' or 'feat!: breaking change'."
             exit 1
           fi
+      - name: Enforce architecture boundaries
+        shell: bash
+        run: |
+          mapfile -t mains < <(find cmd -name main.go -type f | sort)
+          [[ ${#mains[@]} -eq 1 && "${mains[0]}" == cmd/calmstoolkit/main.go ]]
+          mapfile -t exits < <(grep -RIl --include='*.go' --exclude-dir=.git 'os\.Exit' . | sed 's#^\./##' | sort)
+          [[ ${#exits[@]} -eq 1 && "${exits[0]}" == cmd/calmstoolkit/main.go ]]
+      - name: Verify command documentation
+        shell: bash
+        run: |
+          help="$(go run ./cmd/calmstoolkit --help)"
+          for command in streams calendar requests airtime feed anime config doctor version; do
+            grep -Eq "^[[:space:]]+${command}[[:space:]]" <<<"$help"
+            grep -Fq "calmstoolkit ${command}" README.md
+          done
 
-      - name: Go vet
-        run: go vet ./...
-
-      - name: Run tests with coverage
-        run: go test -v -race -count=1 -coverprofile=coverage.out ./...
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Run race tests with coverage
+        run: go test -race -count=1 -covermode=atomic -coverprofile=coverage.out ./...
+      - name: Write coverage summary
+        shell: bash
+        run: |
+          {
+            echo '## Go coverage'
+            echo '```text'
+            go tool cover -func=coverage.out
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
 
-      - name: Display coverage summary
-        run: go tool cover -func=coverage.out | tail -10
+  builds:
+    name: Linux builds
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Build supported Linux targets
+        shell: bash
+        run: |
+          version=ci
+          commit="${GITHUB_SHA:0:12}"
+          date="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          ldflags="-s -w -X github.com/calmcacil/CalmsToolkit/internal/buildinfo.Version=$version -X github.com/calmcacil/CalmsToolkit/internal/buildinfo.Commit=$commit -X github.com/calmcacil/CalmsToolkit/internal/buildinfo.Date=$date"
+          for arch in amd64 arm64; do
+            GOOS=linux GOARCH="$arch" CGO_ENABLED=0 go build -trimpath -ldflags "$ldflags" -o "/tmp/calmstoolkit-linux-$arch" ./cmd/calmstoolkit
+          done
 
-      - name: Verify build of all cmd tools
-        run: go build -v ./cmd/...
+  vulnerabilities:
+    name: Vulnerabilities
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Run govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-main
+  cancel-in-progress: false
+
+env:
+  GO_VERSION: "1.25.12"
+
+jobs:
+  release:
+    name: Release Please
+    if: github.ref == 'refs/heads/main' && github.repository == 'calmcacil/CalmsToolkit'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Create release GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.1
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+      - name: Create or update the release pull request
+        id: release
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+      - name: Check out the released tag
+        if: steps.release.outputs.release_created == 'true'
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ steps.release.outputs.tag_name }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Go
+        if: steps.release.outputs.release_created == 'true'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Build and attach release artifacts
+        if: steps.release.outputs.release_created == 'true'
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          distribution: goreleaser
+          version: v2.12.7
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/security.yml

@@ -0,0 +1,53 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          license-check: false
+          comment-summary-in-pr: never
+
+  codeql:
+    name: CodeQL (Go)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: go
+          build-mode: autobuild
+      - name: Analyze
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          category: /language:go

.golangci.yml

@@ -1,52 +1,30 @@
+version: "2"
+
 run:
   timeout: 5m
 
 linters:
-  enable:
-    - errcheck
-    - gosimple
-    - govet
-    - ineffassign
-    - staticcheck
-    - unused
-    - gocritic
-    - prealloc
-    - unconvert
-    - whitespace
-    - nolintlint
-  disable:
-    - exhaustruct
-    - forcetypeassert
-    - gochecknoglobals
-    - gochecknoinits
+  default: standard
+  settings:
+    errcheck:
+      check-type-assertions: true
+      check-blank: false
+  exclusions:
+    rules:
+      # Test fixtures intentionally ignore writes to in-memory/httptest helpers.
+      - path: _test\.go
+        linters: [errcheck]
+      # Terminal views are best-effort until rendering is fully writer-returning.
+      - path: internal/(airtime|anisearch|calendar|feed|requests|streams)/(render|input|menu)\.go
+        linters: [errcheck]
+      - path: internal/anisearch/search\.go
+        linters: [errcheck]
+      - path: internal/(buildinfo|cli)/.*\.go
+        linters: [errcheck]
 
-linters-settings:
-  errcheck:
-    check-type-assertions: true
-    check-blank: false
-  gocritic:
-    enabled-tags:
-      - performance
-      - diagnostic
-      - experimental
-    disabled-checks:
-      - paramTypeCombine
-  staticcheck:
-    checks:
-      - all
-      - -SA1019
-  prealloc:
-    simple: true
-    range-loops: true
-    for-loops: true
+formatters:
+  enable: [gofmt]
 
 issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-        - gocritic
-    - path: internal/colors/colors.go
-      text: "WhyNoLint"
-      linters:
-        - staticcheck
+  max-issues-per-linter: 0
+  max-same-issues: 0