v2.0.0 — Role-based restructure, /v2 module, and five new SDK-compat services

Release Notes — v2.0.0

A major release. cloudemu is now organized by role so the repository stays legible as it grows — service packages live under services/, the cross-cutting wrappers under features/, and shared plumbing under internal/. Because that moves public import paths, the module is now github.com/stackshy/cloudemu/v2. On top of the restructure this release adds five new SDK-compat surfaces — AWS STS, AWS SSM Parameter Store, S3 multipart / tagging / versioning, Azure Queue & Table Storage, and Azure AI — and ships a full CI/CD + security pipeline.

⚠️ Breaking Changes

• Module path is now /v2. Update the dependency and your imports:

  go get github.com/stackshy/cloudemu/v2@v2.0.0

  // before
  import "github.com/stackshy/cloudemu/storage"
  // after
  import "github.com/stackshy/cloudemu/v2/services/storage"

• Public packages moved by role (import path == directory, so these are the source-visible changes):
  • Every emulated service → services/<name> (e.g. storage → services/storage, compute → services/compute, kubernetes → services/kubernetes, resourcediscovery → services/resourcediscovery, cost → services/cost).
  • Cross-cutting wrappers → features/<name>: chaos, recorder, metrics, ratelimit, inject, topology.
  • Shared helpers → internal/: statemachine → internal/statemachine, pagination → internal/pagination.
  • providers/{aws,azure,gcp} and server/{aws,azure,gcp} are unchanged — only their import prefixes gain /v2.
• No behavior changed in the move: the entrypoints (cloudemu.NewAWS(), NewAzure(), NewGCP()) and every driver, wire protocol, and error type are identical. The upgrade is a find-and-replace of the import prefix.

✨ Features

AWS STS — SDK-compat (query protocol)

The real aws-sdk-go-v2 STS client now works against cloudemu: GetCallerIdentity, AssumeRole, and GetSessionToken return well-formed credentials/identity envelopes so code that resolves an identity or assumes a role before calling other services runs end-to-end.

AWS SSM Parameter Store — SDK-compat (#239)

AWS Systems Manager Parameter Store drives a new parameterstore service: PutParameter (with overwrite + version bump), GetParameter / GetParameters / GetParametersByPath (recursive), DeleteParameter(s), and parameter labels — including String, StringList, and SecureString types and typed ParameterNotFound / ParameterAlreadyExists errors.

S3 — multipart upload, tagging, and versioning

The S3 handler gains the advanced object surface the SDK exercises for large and mutable objects: multipart (CreateMultipartUpload → UploadPart → CompleteMultipartUpload / AbortMultipartUpload, parts assembled in PartNumber order), object tagging (PutObjectTagging / GetObjectTagging / DeleteObjectTagging), and versioning (PutBucketVersioning plus version-aware GetObject / DeleteObject).

Azure Queue Storage + Table Storage — SDK-compat (#243)

Two Azure data-plane services land: Queue Storage (queue create/delete, put / get / peek / update / delete message with visibility-timeout and dequeue-count semantics) and Table Storage (table CRUD; insert / upsert / merge / replace / delete entity and OData-style query). Both speak the real azure-sdk-for-go wire format.

Azure AI — CognitiveServices + Machine Learning (#232)

Azure AI emulation across ARM and data plane: CognitiveServices accounts (ARM lifecycle) plus an assistants data plane, and Azure Machine Learning workspaces and their child resources. Unmodified azure-sdk-for-go clients drive both control-plane provisioning and data-plane calls.

🔧 Enhancements

CI/CD + security pipeline

A complete GitHub Actions setup lands with this release:

• ci.yml — build-vet (build then vet, sharing one cache), test, tidy, and advisory format / lint (golangci-lint v2) jobs, running in parallel with Go build + module caching (actions/cache@v4 with restore-keys) so repeat runs finish in well under a minute. Triggers on PRs and pushes to master, with concurrency cancel-in-progress.
• security.yml — govulncheck, gosec, CodeQL, and dependency-review (PR-only, fail-on high) as a separate parallel workflow.

Security hardening (CodeQL)

• Bounded RunInstances count across AWS EC2, Azure Virtual Machines, and GCP GCE — a request over the per-call maximum (1000) now returns InvalidArgument instead of attempting an uncontrolled allocation.
• Dropped a request-sized pre-allocation in Vertex AI FindNeighbors.

Correctness fixes

• S3 multipart now sorts parts by PartNumber before assembly, maps unknown upload IDs to NoSuchUpload, and rejects an empty CompleteMultipartUpload.
• SSM validates parameter labels and threads context through the PutParameter retry path.
• Azure Table supports UpsertEntity; Queue/Blob/Table shared-hostname collisions are documented.

Documentation

Every in-repo doc (architecture.md, services.md, features.md, getting-started.md) and the package overview were rewritten for the services/ / features/ / internal/ layout, and all import paths and badges updated to the /v2 module.

Technical Details

Repository restructure & /v2 module

• chore(v2)!: bump module path to github.com/stackshy/cloudemu/v2 — go.mod module path gains the required /v2 suffix; every internal import rewritten in lockstep across providers, servers, examples, and helpers.
• Service packages moved under services/ (28 services), cross-cutting wrappers under features/ (chaos, recorder, metrics, ratelimit, inject, topology), and generic helpers under internal/ (statemachine, pagination).
• providers/ and server/ trees kept their internal shape; only import prefixes changed. Build, go vet, and the full test suite are green on the new layout.

AWS STS & SSM Parameter Store

• STS (server/aws/sts, query protocol) — GetCallerIdentity, AssumeRole, GetSessionToken; typed error envelopes; registered with a disjoint action set.
• SSM (server/aws/ssm, query protocol → providers/aws/ssm) — PutParameter / GetParameter / GetParameters / GetParametersByPath (recursive) / DeleteParameter(s); label + version handling; String / StringList / SecureString; typed ParameterNotFound / ParameterAlreadyExists. fix(ssm) adds label validation and context threading in the Put retry path.

S3 — multipart, tagging, versioning

• feat(s3): add multipart, tagging, and versioning wire operations — CreateMultipartUpload / UploadPart / CompleteMultipartUpload / AbortMultipartUpload; PutObjectTagging / GetObjectTagging / DeleteObjectTagging; PutBucketVersioning with version-aware read/delete.
• fix(s3): sort multipart parts, map NoSuchUpload, reject empty Complete + test(s3) — out-of-order parts now assemble by PartNumber (regression test asserts AAAA…BBBB ordering), unknown upload IDs map to NoSuchUpload, and an empty Complete is rejected.

Azure Queue & Table Storage

• Queue (server/azure/queue) — queue create/delete; put / get / peek / update / delete message with visibility-timeout and dequeue-count semantics.
• Table (server/azure/table) — table CRUD; insert / upsert / merge / replace / delete entity; OData-style query. fix(azure-table) adds UpsertEntity support and documents Queue/Blob/Table shared-hostname collisions.

Azure AI (CognitiveServices + Machine Learning)

• CognitiveServices (server/azure/azureai) — ARM accounts lifecycle plus an assistants data plane.
• Machine Learning — workspaces and child resources (machinelearning*.go) over ARM, with data-plane round-trip coverage.

CI/CD & security workflows

• ci.yml — build-vet shares a single Go build+module cache (actions/cache@v4, restore-keys: go-${{ runner.os }}-); test, tidy, advisory format (gofmt, report-only) and lint (golangci-lint v2 via the official install script, report-only) run in parallel. Triggers: pull_request + push to master; concurrency with cancel-in-progress.
• security.yml — govulncheck (report-only), gosec (report-only), CodeQL (init/autobuild/analyze@v3, security-events: write), and dependency-review (fail-on-severity: high, PR-only), run as an independent parallel workflow.
• fix(security) — const maxRunInstances = 1000 guard in EC2/VM/GCE RunInstances; drop sized alloc in Vertex AI FindNeighbors. Resolves the CodeQL go/uncontrolled-allocation-size findings.