feat: rewrite mattermost-cli in Go

.github/workflows/ci.yml

@@ -9,37 +9,61 @@ permissions:
   contents: read
 
 jobs:
-  verify:
+  go:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          bun-version: 1.3.14
+          go-version-file: go.mod
+          cache: true
+      - run: go test ./...
+      - run: go test -race ./...
+      - run: go vet ./...
+      - run: go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
+      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+      - run: go run ./scripts/licenses
+      - run: go mod verify
+      - run: go build -o "$RUNNER_TEMP/mm" ./cmd/mm
+      - run: git diff --check
+
+  distribution:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
-      - run: bun install --frozen-lockfile
-      - run: bun run verify
-      - run: bun audit
-      - name: Pack and verify contents
-        id: pack
-        shell: bash
+          node-version: 24
+      - name: Build release artifacts reproducibly
         run: |
-          tarball=$(npm pack --json --ignore-scripts | node -e 'let input=""; process.stdin.on("data", c => input += c); process.stdin.on("end", () => process.stdout.write(JSON.parse(input)[0].filename))')
-          printf 'tarball=%s\n' "$tarball" >> "$GITHUB_OUTPUT"
-          actual=$(tar -tzf "$tarball" | LC_ALL=C sort)
-          expected=$(printf '%s\n' package/LICENSE package/README.md package/dist/index.js package/package.json | LC_ALL=C sort)
-          diff -u <(printf '%s\n' "$expected") <(printf '%s\n' "$actual")
-      - name: Smoke packed CLI on Node 22
+          go run ./scripts/release --version 2.0.0-dev --commit "$GITHUB_SHA" --output dist
+          GOCACHE="$RUNNER_TEMP/repro-cache" go run ./scripts/release --version 2.0.0-dev --commit "$GITHUB_SHA" --output repro
+          diff -r dist repro
+          (cd dist && sha256sum --check checksums.txt)
+          ruby -c dist/mattermost-cli.rb
+      - name: Generate and pack exact npm packages
+        shell: bash
         run: |
-          mkdir package-smoke
-          tar -xzf "${{ steps.pack.outputs.tarball }}" -C package-smoke
-          test "$(node package-smoke/package/dist/index.js --version)" = "$(node -p "require('./package.json').version")"
-          node package-smoke/package/dist/index.js --help
-          node package-smoke/package/dist/index.js config --path
-      - name: Smoke global npm install
+          go run ./scripts/npm-package --version 2.0.0-dev --release-dir dist --output npm-dist
+          mkdir npm-packs
+          for package_dir in npm-dist/*; do
+            npm pack --json --ignore-scripts --pack-destination npm-packs "./$package_dir" >/dev/null
+          done
+          test "$(find npm-packs -maxdepth 1 -name '*.tgz' | wc -l)" -eq 5
+      - name: Smoke native archive and npm launcher
         run: |
-          npm install --global --prefix "$RUNNER_TEMP/npm-global" "./${{ steps.pack.outputs.tarball }}"
-          test "$("$RUNNER_TEMP/npm-global/bin/mm" --version)" = "$(node -p "require('./package.json').version")"
-          "$RUNNER_TEMP/npm-global/bin/mm" --help
+          mkdir "$RUNNER_TEMP/native-smoke"
+          tar -xzf dist/mattermost-cli_2.0.0-dev_linux_amd64.tar.gz -C "$RUNNER_TEMP/native-smoke"
+          test "$("$RUNNER_TEMP/native-smoke/mm" --version)" = "mm version 2.0.0-dev ($GITHUB_SHA)"
+          mkdir "$RUNNER_TEMP/npm-smoke"
+          cd "$RUNNER_TEMP/npm-smoke"
+          npm init -y >/dev/null
+          npm install --ignore-scripts \
+            "$GITHUB_WORKSPACE/npm-packs/ardasevinc-mattermost-cli-linux-amd64-2.0.0-dev.tgz" \
+            "$GITHUB_WORKSPACE/npm-packs/mattermost-cli-2.0.0-dev.tgz" >/dev/null
+          test "$(./node_modules/.bin/mm --version)" = "mm version 2.0.0-dev ($GITHUB_SHA)"
+          ./node_modules/.bin/mm --help

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish
+name: Publish npm packages
 
 on:
   release:
@@ -7,49 +7,111 @@ on:
 permissions:
   contents: read
   id-token: write
+  attestations: read
+
+concurrency:
+  group: npm-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     environment: npm
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ github.event.release.tag_name }}
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          bun-version: 1.3.14
+          go-version-file: go.mod
+          cache: true
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
-      - run: bun install --frozen-lockfile
-      - run: bun audit
-      - run: bun run verify
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-      - name: Require an unpublished npm version
+      - name: Validate release identity
+        id: version
         shell: bash
         run: |
-          name=$(node -p "require('./package.json').name")
-          version=$(node -p "require('./package.json').version")
-          versions=$(npm view "$name" versions --json)
-          node -e 'const versions = JSON.parse(process.argv[1]); if (versions.includes(process.argv[2])) { throw new Error("npm version " + process.argv[2] + " is already published") }' "$versions" "$version"
-      - name: Pack and smoke exact tarball
-        id: pack
+          version="${{ github.event.release.tag_name }}"
+          version="${version#v}"
+          test "${{ github.event.release.tag_name }}" = "v$version"
+          source_version="$(awk -F'"' '/^[[:space:]]*Version = / {print $2}' internal/buildinfo/buildinfo.go)"
+          test "$version" = "$source_version"
+          commit="$(git rev-parse HEAD)"
+          test "$commit" = "$(git rev-parse '${{ github.event.release.tag_name }}^{commit}')"
+          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
+          printf 'commit=%s\n' "$commit" >> "$GITHUB_OUTPUT"
+      - name: Download and verify native release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir dist
+          gh release download "${{ github.event.release.tag_name }}" --dir dist
+          (cd dist && sha256sum --check checksums.txt)
+          for artifact in dist/*; do
+            gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
+          done
+      - name: Generate and pack npm packages
         shell: bash
         run: |
-          tarball=$(npm pack --json --ignore-scripts | node -e 'let input=""; process.stdin.on("data", c => input += c); process.stdin.on("end", () => process.stdout.write(JSON.parse(input)[0].filename))')
-          printf 'tarball=%s\n' "$tarball" >> "$GITHUB_OUTPUT"
-          actual=$(tar -tzf "$tarball" | LC_ALL=C sort)
-          expected=$(printf '%s\n' package/LICENSE package/README.md package/dist/index.js package/package.json | LC_ALL=C sort)
+          go run ./scripts/npm-package --version "${{ steps.version.outputs.version }}" --release-dir dist --output npm-dist
+          mkdir npm-packs
+          for package_dir in npm-dist/*; do
+            npm pack --json --ignore-scripts --pack-destination npm-packs "./$package_dir" >/dev/null
+          done
+          test "$(find npm-packs -maxdepth 1 -name '*.tgz' | wc -l)" -eq 5
+          for tarball in npm-packs/ardasevinc-*.tgz; do
+            actual="$(tar -tzf "$tarball" | LC_ALL=C sort)"
+            expected="$(printf '%s\n' package/bin/mm package/package.json | LC_ALL=C sort)"
+            diff -u <(printf '%s\n' "$expected") <(printf '%s\n' "$actual")
+          done
+          main="npm-packs/mattermost-cli-${{ steps.version.outputs.version }}.tgz"
+          actual="$(tar -tzf "$main" | LC_ALL=C sort)"
+          expected="$(printf '%s\n' package/LICENSE package/README.md package/bin/mm.js package/package.json | LC_ALL=C sort)"
           diff -u <(printf '%s\n' "$expected") <(printf '%s\n' "$actual")
-          mkdir package-smoke
-          tar -xzf "$tarball" -C package-smoke
-          test "$(node package-smoke/package/dist/index.js --version)" = "$(node -p "require('./package.json').version")"
-          node package-smoke/package/dist/index.js --help
-          node package-smoke/package/dist/index.js config --path
-          npm install --global --prefix "$RUNNER_TEMP/npm-global" "./$tarball"
-          test "$("$RUNNER_TEMP/npm-global/bin/mm" --version)" = "$(node -p "require('./package.json').version")"
-          "$RUNNER_TEMP/npm-global/bin/mm" --help
-      - run: npm publish "./${{ steps.pack.outputs.tarball }}" --access public --provenance
+      - name: Smoke exact Linux npm install
+        run: |
+          mkdir "$RUNNER_TEMP/npm-smoke"
+          cd "$RUNNER_TEMP/npm-smoke"
+          npm init -y >/dev/null
+          npm install --ignore-scripts \
+            "$GITHUB_WORKSPACE/npm-packs/ardasevinc-mattermost-cli-linux-amd64-${{ steps.version.outputs.version }}.tgz" \
+            "$GITHUB_WORKSPACE/npm-packs/mattermost-cli-${{ steps.version.outputs.version }}.tgz" >/dev/null
+          test "$(./node_modules/.bin/mm --version)" = "mm version ${{ steps.version.outputs.version }} (${{ steps.version.outputs.commit }})"
+          ./node_modules/.bin/mm --help
+      - name: Preflight immutable npm versions
+        shell: bash
+        run: |
+          for tarball in npm-packs/*.tgz; do
+            name="$(tar -xOzf "$tarball" package/package.json | node -p 'JSON.parse(require("fs").readFileSync(0, "utf8")).name')"
+            version="${{ steps.version.outputs.version }}"
+            remote="$(npm view "$name@$version" dist.integrity --json 2>/dev/null || true)"
+            if [[ -n "$remote" ]]; then
+              remote="$(node -p 'JSON.parse(process.argv[1])' "$remote")"
+              local_integrity="sha512-$(openssl dgst -sha512 -binary "$tarball" | base64 -w 0)"
+              test "$remote" = "$local_integrity"
+            fi
+          done
+      - name: Publish native platform packages
+        shell: bash
+        run: |
+          for tarball in npm-packs/ardasevinc-*.tgz; do
+            name="$(tar -xOzf "$tarball" package/package.json | node -p 'JSON.parse(require("fs").readFileSync(0, "utf8")).name')"
+            if npm view "$name@${{ steps.version.outputs.version }}" version >/dev/null 2>&1; then
+              echo "already published identically: $name@${{ steps.version.outputs.version }}"
+            else
+              npm publish "$tarball" --access public --provenance
+            fi
+          done
+      - name: Publish launcher package last
+        shell: bash
+        run: |
+          tarball="npm-packs/mattermost-cli-${{ steps.version.outputs.version }}.tgz"
+          if npm view "mattermost-cli@${{ steps.version.outputs.version }}" version >/dev/null 2>&1; then
+            echo "already published identically: mattermost-cli@${{ steps.version.outputs.version }}"
+          else
+            npm publish "$tarball" --access public --provenance
+          fi

.github/workflows/release.yml

@@ -0,0 +1,122 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  actions: read
+  contents: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Reproducible native release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: true
+      - name: Validate tag and source version
+        id: version
+        shell: bash
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          test "$GITHUB_REF_NAME" = "v$version"
+          source_version="$(awk -F'"' '/^[[:space:]]*Version = / {print $2}' internal/buildinfo/buildinfo.go)"
+          test "$version" = "$source_version"
+          if [[ "$version" == *-* ]]; then prerelease=true; else prerelease=false; fi
+          printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
+          printf 'prerelease=%s\n' "$prerelease" >> "$GITHUB_OUTPUT"
+      - name: Require tagged commit on main
+        run: |
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+      - name: Require successful CI for tagged commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          conclusion="$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$GITHUB_SHA&status=completed" --jq '.workflow_runs | sort_by(.created_at) | last | .conclusion')"
+          test "$conclusion" = success
+      - name: Reject existing release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
+            echo "release $GITHUB_REF_NAME already exists" >&2
+            exit 1
+          fi
+      - name: Test release source
+        run: |
+          go mod download
+          go install honnef.co/go/tools/cmd/staticcheck@2026.1
+          go install golang.org/x/vuln/cmd/govulncheck@v1.6.0
+          GOPROXY=off go test -race -p 1 ./...
+          GOPROXY=off go vet ./...
+          GOPROXY=off staticcheck ./...
+          GOPROXY=off govulncheck ./...
+          GOPROXY=off go run ./scripts/licenses
+      - name: Build deterministic archives twice
+        env:
+          GOPROXY: "off"
+        run: |
+          GOCACHE="$RUNNER_TEMP/gocache-a" go run ./scripts/release --version "${{ steps.version.outputs.version }}" --commit "$GITHUB_SHA" --output dist
+          GOCACHE="$RUNNER_TEMP/gocache-b" go run ./scripts/release --version "${{ steps.version.outputs.version }}" --commit "$GITHUB_SHA" --output repro
+          diff -r dist repro
+      - name: Verify archives, checksums, formula, and Linux binary
+        run: |
+          cd dist
+          sha256sum --check checksums.txt
+          ruby -c mattermost-cli.rb
+          mkdir "$RUNNER_TEMP/mm-smoke"
+          tar -xzf "mattermost-cli_${{ steps.version.outputs.version }}_linux_amd64.tar.gz" -C "$RUNNER_TEMP/mm-smoke"
+          test "$("$RUNNER_TEMP/mm-smoke/mm" --version)" = "mm version ${{ steps.version.outputs.version }} ($GITHUB_SHA)"
+          "$RUNNER_TEMP/mm-smoke/mm" --help
+          "$RUNNER_TEMP/mm-smoke/mm" config --path
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: "dist/*"
+      - name: Verify release attestations
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          for artifact in dist/*; do
+            gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
+          done
+      - name: Create complete draft release
+        id: create_release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        with:
+          files: dist/*
+          fail_on_unmatched_files: true
+          generate_release_notes: true
+          draft: true
+          overwrite_files: false
+          prerelease: ${{ steps.version.outputs.prerelease }}
+      - name: Verify assets and publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_ID: ${{ steps.create_release.outputs.id }}
+        run: |
+          find dist -maxdepth 1 -type f -exec basename {} \; | sort > "$RUNNER_TEMP/expected-assets"
+          test -n "$RELEASE_ID"
+          gh api "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" --jq '.assets[].name' | sort > "$RUNNER_TEMP/actual-assets"
+          diff -u "$RUNNER_TEMP/expected-assets" "$RUNNER_TEMP/actual-assets"
+          if [[ "${{ steps.version.outputs.prerelease }}" == true ]]; then latest=false; else latest=true; fi
+          gh api --method PATCH "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" \
+            -F draft=false \
+            -F prerelease="${{ steps.version.outputs.prerelease }}" \
+            -f make_latest="$latest" >/dev/null

.gitignore

@@ -1,10 +1,12 @@
-# dependencies (bun install)
-node_modules
-
 # output
 out
 dist
+npm-dist
+bin
+!npm/bin/
+!npm/bin/mm.js
 *.tgz
+npm-dist
 
 # code coverage
 coverage
@@ -25,9 +27,7 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 .env.local
 
 # caches
-.eslintcache
 .cache
-*.tsbuildinfo
 
 # IntelliJ based IDEs
 .idea
@@ -43,6 +43,3 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 
 # Claude Code
 .claude/
-
-# Bun build artifacts
-*.bun-build