isolate remote zeitgeist functionality/dependencies to separate command/package

[liggitt]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Isolates remote functionality into a subpackage and separate command, so that downstreams relying on the main zeitgeist command to verify local files only don't take dependencies on large numbers of remote libraries (github, gitlab, aws, etc).

My scans of in-project use looked like we only relied on the local dependencies.yaml with no upstreams specified (xref #543 (comment))

Which issue(s) this PR fixes:

xref #543

Best reviewed commit-by-commit

Does this PR introduce a user-facing change?

Functionality requiring access to remote upstreams has moved to the sigs.k8s.io/zeitgeist/remote/zeitgeist command

[liggitt]

/assign @justaugustus @saschagrunert

[saschagrunert]

/approve

Making the CI work for both binaries would be cool to have.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

/hold

until release questions are resolved

[liggitt]

it makes sense for the artifacts we build/release to contain the remote functionality... I'm not very familiar with the release setup here, so I took a stab at changes in the last commit but those need close review

[cpanato]

will take a look on this tomorrow (06/jun/2023)

[cpanato]

lgtm

just a small nit

[cpanato]

Suggested change

	go build -trimpath -ldflags "$(LDFLAGS)" -o ./output/zeitgeist ./remote/zeitgeist
	go build -trimpath -ldflags "$(LDFLAGS)" -o ./output/zeitgeist-remote ./remote/zeitgeist

otherwise it will overwrite the build that is done above

[cpanato]

@saschagrunert one question to double check, should we build both binaries and images for the local and remote one? or when we release we just build the full one?

cc @kubernetes-sigs/release-engineering

[saschagrunert]

should we build both binaries and images for the local and remote one

I think we can only build the full one since it contains all the features.

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cpanato]

@liggitt i will take this over to rebase and fix the conflicts if you are okay with that

[liggitt]

@liggitt i will take this over to rebase and fix the conflicts if you are okay with that

sgtm, thanks

[k8s-ci-robot]

@liggitt: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-zeitgeist-test	26e614d	link	true	/test pull-zeitgeist-test
pull-zeitgeist-build	26e614d	link	true	/test pull-zeitgeist-build
pull-zeitgeist-verify	26e614d	link	true	/test pull-zeitgeist-verify

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[cpanato]

will close this in favor of #854