Migrate to gha only

.github/workflows/build.yml

@@ -0,0 +1,63 @@
+# Build and test workflow for Launchpad
+# Triggered on PRs and pushes to main.
+
+name: Build and Test
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+    name: Build Binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Build binaries
+        run: |
+          mkdir -p dist
+          platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
+          for platform in "${platforms[@]}"; do
+            GOOS=${platform%/*}
+            GOARCH=${platform#*/}
+            output_name="dist/launchpad_${GOOS}_${GOARCH}"
+            if [ "$GOOS" = "windows" ]; then
+              output_name+=".exe"
+            fi
+            echo "Building $output_name"
+            GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: launchpad-binaries
+          path: dist/
+
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Run unit tests
+        run: go test -v ./...
+
+      - name: Run integration tests
+        run: go test -v -tags=integration ./test/integration

.github/workflows/pr.yml

@@ -0,0 +1,99 @@
+# PR validation workflow for Launchpad
+# Triggered on PRs to main branch.
+
+name: PR Validation
+
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  lint:
+    name: Lint Code
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Run golangci-lint
+        run: make lint
+
+  unit-test:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Run unit tests
+        run: make unit-test
+
+  integration-test:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Run integration tests
+        run: make integration-test
+
+  build-verification:
+    name: Build Verification
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Build binaries
+        run: |
+          mkdir -p dist
+          platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
+          for platform in "${platforms[@]}"; do
+            GOOS=${platform%/*}
+            GOARCH=${platform#*/}
+            output_name="dist/launchpad_${GOOS}_${GOARCH}"
+            if [ "$GOOS" = "windows" ]; then
+              output_name+=".exe"
+            fi
+            echo "Building $output_name"
+            GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
+          done
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run security scan
+        run: govulncheck ./...

.github/workflows/release.yml

@@ -0,0 +1,66 @@
+# Release workflow for Launchpad
+# Triggered on tags (e.g., v1.5.16).
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    name: Build Release Binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Build binaries
+        run: |
+          mkdir -p dist
+          platforms=("linux/amd64" "linux/arm64" "windows/amd64" "windows/arm64" "darwin/amd64" "darwin/arm64")
+          for platform in "${platforms[@]}"; do
+            GOOS=${platform%/*}
+            GOARCH=${platform#*/}
+            output_name="dist/launchpad_${GOOS}_${GOARCH}"
+            if [ "$GOOS" = "windows" ]; then
+              output_name+=".exe"
+            fi
+            echo "Building $output_name"
+            GOOS=$GOOS GOARCH=$GOARCH go build -o "$output_name" ./main.go
+          done
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: launchpad-release-binaries
+          path: dist/
+
+  release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Download binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: launchpad-release-binaries
+          path: dist/
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: dist/*
+          generate_release_notes: true
+          draft: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # TODO: Add Digicert signing here.
+      # TODO: Push signed artifacts to S3 here.

Makefile

@@ -1,12 +1,7 @@
 
 GO=$(shell which go)
 
-RELEASE_FOLDER=dist/release
-
-CHECKSUM=$(shell which sha256sum)
-
 VOLUME_MOUNTS=-v "$(CURDIR):/v"
-SIGN?=docker run --rm -i $(VOLUME_MOUNTS) -e SM_API_KEY -e SM_CLIENT_CERT_PASSWORD -e SM_CLIENT_CERT_FILE -v "$(SM_CLIENT_CERT_FILE):$(SM_CLIENT_CERT_FILE)" -w "/v" registry.mirantis.com/prodeng/digicert-keytools-jsign:latest sign
 
 GOLANGCI_LINT?=docker run -t --rm -v "$(CURDIR):/data" -w "/data" golangci/golangci-lint:latest golangci-lint
 
@@ -16,53 +11,20 @@ SEGMENT_TOKEN?=""
 clean:
 	rm -fr dist
 
-# Sign release binaries (Windows)
-# (build may need to be run in a separate make run)
-.PHONY: sign-release
-sign-release: $(RELEASE_FOLDER)
-	for f in `find $(RELEASE_FOLDER)/*.exe`; do echo $(SIGN) "$$f"; done
-
-# Force a clean build of the artifacts by first cleaning
-# and then building
-.PHONY: build-release
-build-release: clean $(RELEASE_FOLDER)
-# build all the binaries for release, using goreleaser, but
-# don't use any of the other features of goreleaser - because
-# we need to use digicert to sign the binaries first, and
-# goreleaser doesn't allow for that (some pro features may
-# allow it in a round about way.)
-#
-# If you are using more than one tag for a commit, then use
-# the GORELEASER_CURRENT_TAG env var to clarify the version to
-# avoid having the wrong tag version applied
-$(RELEASE_FOLDER):
-	SEGMENT_TOKEN=${SEGMENT_TOKEN} goreleaser build --clean --config=.goreleaser.release.yml
-
-.PHONY: create-checksum
-create-checksum:
-	cd $(RELEASE_FOLDER) && \
-	for f in *; do \
-		$(CHECKSUM) $$f > $$f.sha256; \
-	done
-
-.PHONY: verify-checksum
-verify-checksum:
-	for f in $(RELEASE_FOLDER)/*.sha256; do \
-		$(CHECKSUM) -c $$f; \
-		echo "Verified checksum for $$f"; \
-	done
-
-# clean out any existing release build
-.PHONY: clean-release
-clean-release:
-	rm -fr $(RELEASE_FOLDER)
+# TODO: Digicert signing will be reimplemented in GitHub Actions.
 
-# Local build of the plugin. This saves time building platforms that you
-# won't test locally. To use it, find the path to your build binary path
-# and alias it.
+# Local build of the plugin. This saves time building only the host platform.
+# Uses native Go commands to avoid Goreleaser dependency.
 .PHONY: local
 local:
-	SEGMENT_TOKEN=${SEGMENT_TOKEN} goreleaser build --clean --single-target --skip=validate --snapshot --config .goreleaser.local.yml
+	mkdir -p dist
+	GOOS=$(shell go env GOOS) GOARCH=$(shell go env GOARCH) \
+	output_name="dist/launchpad_$${GOOS}_$${GOARCH}"; \
+	if [ "$${GOOS}" = "windows" ]; then \
+		output_name="$${output_name}.exe"; \
+	fi; \
+	$(GO) build -o "$${output_name}" ./main.go && \
+	./$${output_name} --help
 
 # run linting
 .PHONY: lint

go.mod

@@ -1,6 +1,7 @@
 module github.com/Mirantis/launchpad
+go 1.25
+
 
-go 1.25.0
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0