feat(cli): migrate e2e tests and fix lint errors by alkalescent · Pull Request #3236 · opentdf/platform

alkalescent · 2026-04-01T15:55:06Z

Summary

Rewrites the otdfctl-test CI job in checks.yaml to use local composite action references (./test/start-up-with-containers, ./otdfctl/e2e) instead of cross-repo checkouts from opentdf/otdfctl
Updates otdfctl/e2e/action.yaml: removes external checkout step, removes otdfctl-ref input, uses otdfctl/v0.26.2 subtree tag for legacy binary build
Updates nightly-checks.yaml to build otdfctl from platform/otdfctl/ instead of checking out opentdf/otdfctl separately
Restores tui/ directory lint exclusion (matching original otdfctl config) and fixes ~60 lint errors (gofumpt, unused nolint directives, perfsprint, sloglint, revive)
Adds .golangci.yaml exclusion rules for deferred refactoring-level fixes (contextcheck, revive unused-parameter/unexported-return/var-naming)

Resolves DSPX-2659

Test plan

otdfctl-test CI job passes (all 19 BATS e2e test files)
Legacy v0.26.2 binary build succeeds via git worktree add ../otdfctl_v0.26.2 otdfctl/v0.26.2
Profile keyring tests pass with legacy binary
golangci-lint run ./... from otdfctl/ passes with 0 issues
go test ./... from otdfctl/ passes
Nightly-checks workflow syntax is valid

coderabbitai · 2026-04-01T15:55:14Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 49f53787-041a-4641-bf15-f0479a962012

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch DSPX-2659-migrate-e2e-tests-composite-action

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-04-01T15:55:23Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on modernizing the CI/CD pipeline for the otdfctl CLI and improving overall code quality. By shifting to local composite actions, the build process is now more self-contained. Additionally, the codebase has undergone a significant cleanup to address technical debt related to linting and logging standards, ensuring better maintainability and adherence to modern Go best practices.

Highlights

CI/CD Optimization: Refactored CI jobs in checks.yaml and nightly-checks.yaml to use local composite actions instead of cross-repo checkouts, improving build reliability and speed.
Linting and Code Quality: Resolved approximately 60 linting errors across the codebase, including updates for gofumpt, sloglint, and revive, while adding necessary exclusions in .golangci.yaml for deferred refactoring.
Logging and Error Handling: Standardized logging practices by converting fmt.Sprintf calls to structured slog fields and replaced fmt.Errorf with errors.New where static error messages were used.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

Ignored by pattern: .github/workflows/** (2)
- .github/workflows/checks.yaml
- .github/workflows/nightly-checks.yaml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

The linter cried out in the night, / To set all the code paths aright. / With local actions now in place, / The build runs at a faster pace, / And all the logs are shining bright.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request performs a comprehensive refactoring of the otdfctl CLI codebase. Key changes include replacing fmt.Errorf with errors.New for static error messages, updating logging to use structured slog calls, and standardizing error messages and string concatenations. Additionally, the pull request updates the .golangci.yaml configuration to exclude specific paths during migration and includes a fix for a typo in an error message within otdfctl/pkg/cli/pipe.go.

otdfctl/pkg/cli/pipe.go

github-actions · 2026-04-01T16:01:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	200.707155ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	104.713323ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	414.657652ms
Throughput	241.16 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.536889289s
Average Latency	444.143756ms
Throughput	112.27 requests/second

github-actions · 2026-04-01T16:07:38Z

X-Test Results

✅ go-pull-3236
✅ go-v0.9.0
✅ java-pull-3236
✅ js-pull-3236
✅ java-v0.9.0
✅ js-v0.9.0
opentdf~~platform~~NK7I7A.dockerbuild

github-actions · 2026-04-03T10:13:53Z

Dependency Review

The following issues were found:

❌ 2 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 48 package(s) with unknown licenses.
⚠️ 6 packages with OpenSSF Scorecard issues.

View full job summary

github-actions · 2026-04-03T10:19:22Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	205.964313ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.994157ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	400.607385ms
Throughput	249.62 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.552739518s
Average Latency	423.733431ms
Throughput	117.50 requests/second

github-actions · 2026-04-03T10:26:14Z

X-Test Results

✅ go-pull-3236
✅ go-v0.9.0
✅ java-pull-3236
✅ js-pull-3236
✅ java-v0.9.0
✅ js-v0.9.0
bats-test-results
cukes-report
opentdf~~platform~~LDVFMF.dockerbuild

…rrors Rewrite the otdfctl e2e test CI to use local composite action references instead of cross-repo checkouts from opentdf/otdfctl, since otdfctl now lives in the platform monorepo. - Update checks.yaml otdfctl-test job to checkout platform repo and reference ./test/start-up-with-containers and ./otdfctl/e2e locally - Update otdfctl/e2e/action.yaml: remove external checkout step, remove otdfctl-ref input, use otdfctl/v0.26.2 subtree tag for legacy binary - Update nightly-checks.yaml to build otdfctl from platform/otdfctl/ instead of checking out opentdf/otdfctl separately - Restore tui/ directory lint exclusion (matching original otdfctl config) - Fix ~60 lint errors: gofumpt formatting, unused nolint directives, perfsprint (fmt.Errorf->errors.New, fmt.Sprintf->string concat), sloglint (lowercase messages, attr-only, snake_case keys, args on separate lines), revive (indent-error-flow, blank import comment) - Add golangci.yaml exclusions for deferred refactoring-level fixes (contextcheck, revive unused-parameter/unexported-return/var-naming) Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

github-actions · 2026-04-06T22:55:48Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	179.761203ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	85.643679ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	414.309894ms
Throughput	241.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.936998605s
Average Latency	406.941581ms
Throughput	122.14 requests/second

github-actions · 2026-04-06T23:01:40Z

X-Test Results

✅ go-pull-3236
✅ go-v0.9.0
✅ java-pull-3236
✅ java-v0.9.0
✅ js-v0.9.0
✅ js-pull-3236
bats-test-results
cukes-report
opentdf~~platform~~VHZ9X9.dockerbuild
govulncheck-failure-8
govulncheck-failure-3

github-actions · 2026-04-07T04:17:55Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	161.35737ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	79.814711ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	388.536581ms
Throughput	257.38 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.320130611s
Average Latency	381.934461ms
Throughput	130.48 requests/second

github-actions · 2026-04-07T04:21:25Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

service
tests-bdd

See the workflow run for details.

github-actions · 2026-04-07T04:25:24Z

X-Test Results

✅ go-pull-3236
✅ go-v0.9.0
✅ java-pull-3236
✅ java-v0.9.0
✅ js-pull-3236
test-cases-mapping-report
bats-test-results
✅ js-v0.9.0
cukes-report
opentdf~~platform~~TTJPMA.dockerbuild
govulncheck-failure-3
govulncheck-failure-8

elizabethhealy · 2026-04-07T15:37:57Z

.github/workflows/checks.yaml

        run: |
          sudo apt update
          sudo apt install -y parallel
-      - uses: opentdf/platform/test/start-up-with-containers@main


nit: why move to local?

Since we now explicitly check out the repo for the local e2e otdfctl step, we can use the local version of the action too. Otherwise, we'd have two checkouts (including the implicit one when you do use: *@main) and we wouldn't be able to test start-up-with-containers action changes (not relevant here). Down to revert this specific change in my next PR to the stacked branch if someone has a strong opinion.

c-r33d · 2026-04-07T15:48:12Z

.github/workflows/checks.yaml

-      - uses: opentdf/otdfctl/e2e@main
-        with:
-          otdfctl-ref: "main"
+      - uses: ./otdfctl/e2e


Will this change to opentdf/platform/otdfctl@main after mergning?

I'm thinking not — to ensure breaking changes are caught before merging to main.

- Rewrites the `otdfctl-test` CI job in `checks.yaml` to use local composite action references (`./test/start-up-with-containers`, `./otdfctl/e2e`) instead of cross-repo checkouts from `opentdf/otdfctl` - Updates `otdfctl/e2e/action.yaml`: removes external checkout step, removes `otdfctl-ref` input, uses `otdfctl/v0.26.2` subtree tag for legacy binary build - Updates `nightly-checks.yaml` to build otdfctl from `platform/otdfctl/` instead of checking out `opentdf/otdfctl` separately - Restores `tui/` directory lint exclusion (matching original otdfctl config) and fixes ~60 lint errors (gofumpt, unused nolint directives, perfsprint, sloglint, revive) - Adds `.golangci.yaml` exclusion rules for deferred refactoring-level fixes (contextcheck, revive unused-parameter/unexported-return/var-naming) Resolves [DSPX-2659](https://virtru.atlassian.net/browse/DSPX-2659) - [ ] `otdfctl-test` CI job passes (all 19 BATS e2e test files) - [ ] Legacy v0.26.2 binary build succeeds via `git worktree add ../otdfctl_v0.26.2 otdfctl/v0.26.2` - [ ] Profile keyring tests pass with legacy binary - [ ] `golangci-lint run ./...` from `otdfctl/` passes with 0 issues - [ ] `go test ./...` from `otdfctl/` passes - [ ] Nightly-checks workflow syntax is valid [DSPX-2659]: https://virtru.atlassian.net/browse/DSPX-2659?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ --------- Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

### Proposed Changes * Add otdfctl component to platform release-please configuration for independent versioned releases * Tags follow the monorepo per-component pattern: `otdfctl/v0.30.0` * Register `otdfctl/pkg/config/config.go` as extra-file so release-please bumps the `Version` constant (already has `// x-release-please-version` marker) * Create release workflow that triggers on `otdfctl/v*` tags, builds 8 cross-platform binaries (darwin amd64/arm64, linux amd64/arm/arm64, windows amd64/arm/arm64), and uploads artifacts to the GitHub release #### Files added/modified | File | Change | |------|--------| | `release-please-config.main.json` | Add `otdfctl` package entry with `extra-files` | | `release-please-manifest.json` | Add `"otdfctl": "0.30.0"` version tracking | | `release-please-config.otdfctl.json` | **New** — component config for `release/otdfctl/vX.Y` branches | | `release-otdfctl.yaml` | **New** — build and upload workflow on release publish | #### PR Stack (DSPX-2654) 1. #3205 — Subtree merge + module path rewrite (DSPX-2655, DSPX-2656) 2. #3208 — Makefile and build scripts (DSPX-2657) 3. #3221 — CI workflows (DSPX-2658) 4. #3236 — e2e tests and lint fixes (DSPX-2659) 5. **This PR** — Release pipeline (DSPX-2660) ### Checklist - [ ] I have added or updated unit tests - [x] I have added or updated integration tests (if appropriate) - [x] I have added or updated documentation ### Testing Instructions - Verify JSON configs are valid: `cat .github/release-please/release-please-config.main.json | jq .packages.otdfctl` - Verify manifest version: `cat .github/release-please/release-please-manifest.json | jq .otdfctl` - Verify `reusable_release-please.yaml` config lookup: branch `release/otdfctl/v0.30` → sanitized name `otdfctl` → resolves to `release-please-config.otdfctl.json` - Full release flow testable after merge by creating a manual release with tag `otdfctl/v0.30.0` --------- Signed-off-by: Krish Suchak <suchak.krish@gmail.com>

alkalescent requested review from a team as code owners April 1, 2026 15:55

github-actions bot added the comp:ci Github Actions Work label Apr 1, 2026

github-actions bot added the size/m label Apr 1, 2026

gemini-code-assist bot reviewed Apr 1, 2026

View reviewed changes

otdfctl/pkg/cli/pipe.go Show resolved Hide resolved

alkalescent force-pushed the DSPX-2655-migrate-otdfctl branch from 07bc639 to 5e4def8 Compare April 6, 2026 22:45

alkalescent requested a review from a team as a code owner April 6, 2026 22:45

alkalescent added 2 commits April 6, 2026 18:49

ignore workspace

02d6a18

alkalescent force-pushed the DSPX-2659-migrate-e2e-tests-composite-action branch from 3aa54bb to 02d6a18 Compare April 6, 2026 22:50

alkalescent added 2 commits April 7, 2026 00:09

log fix

6c985ad

change test back and revert log instead

57b3d1d

elizabethhealy approved these changes Apr 7, 2026

View reviewed changes

c-r33d reviewed Apr 7, 2026

View reviewed changes

c-r33d approved these changes Apr 7, 2026

View reviewed changes

alkalescent merged commit 2e28f2e into DSPX-2655-migrate-otdfctl Apr 7, 2026
35 checks passed

alkalescent deleted the DSPX-2659-migrate-e2e-tests-composite-action branch April 7, 2026 16:55

This was referenced Apr 7, 2026

feat(cli): independent otdfctl releases #3268

Merged

chore(ci): add otdfctl to dependabot configuration #3291

Open

Conversation

alkalescent commented Apr 1, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

coderabbitai bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

gemini-code-assist bot commented Apr 1, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Apr 1, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 1, 2026

X-Test Results

Uh oh!

github-actions bot commented Apr 3, 2026

Dependency Review

Uh oh!

github-actions bot commented Apr 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 3, 2026

X-Test Results

Uh oh!

github-actions bot commented Apr 6, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 6, 2026

X-Test Results

Uh oh!

github-actions bot commented Apr 7, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 7, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions bot commented Apr 7, 2026

X-Test Results

Uh oh!

elizabethhealy Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

alkalescent Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

c-r33d Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

alkalescent Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

alkalescent commented Apr 1, 2026 •

edited by atlassian bot

Loading

coderabbitai bot commented Apr 1, 2026 •

edited

Loading