ci: adopt the fleet taskfile and lint baseline, and clear the debt it surfaces

.dockerignore

@@ -1,4 +1,56 @@
-# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
-# Ignore build and test binaries.
-bin/
-testbin/
+# --- managed by copier: regenerated on `copier update`; add your own BELOW the end marker ---
+# Goes at the BUILD CONTEXT root, not beside the Dockerfile.
+
+# Version control — biggest context bloat and a real leak risk
+.git
+.gitignore
+.gitattributes
+.github
+
+# Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+
+# Dependencies and build output — rebuilt inside the image
+node_modules
+vendor
+target
+__pycache__
+.venv
+venv
+bin
+dist
+coverage
+
+# Tooling and CI config the image never needs
+.golangci.yml
+.yamllint.yml
+.hadolint.yaml
+ruff.toml
+eslint.config.mjs
+taskfile.yml
+.taskfiles
+Makefile
+renovate.json
+
+# Docs and local junk
+docs
+*.md
+!README.md
+.DS_Store
+Thumbs.db
+*.swp
+.worktrees
+.idea
+.vscode
+
+# Test fixtures.
+# CAUTION: delete these two lines if this repo's Dockerfile runs `go mod tidy` —
+# tidy computes requirements from the whole module INCLUDING tests, so stripping
+# *_test.go changes what it resolves.
+**/testdata
+**/*_test.go
+# --- end managed ---

.github/workflows/build-images.yaml

@@ -40,7 +40,7 @@ permissions:
   contents: read
   packages: write
 
-jobs: 
+jobs:
   build-images:
     strategy:
       matrix:
@@ -50,68 +50,66 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-      with:
-        repository: ${{ inputs.repository }}
-        ref: ${{ inputs.ref }}
-        submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ inputs.repository }}
+          ref: ${{ inputs.ref }}
+          submodules: true
 
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
 
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v4
-      with:
-        install: true
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v4
 
-    - name: Login to GitHub Container Registry
-      uses: docker/login-action@v4
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Generate docker metadata
-      id: image-meta
-      uses: docker/metadata-action@v6
-      with:
-        tags: |
-          type=raw,value=latest, enable=${{ inputs.latest}}
-          type=raw,value=${{ inputs.tag }}
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.image }}
+      - name: Generate docker metadata
+        id: image-meta
+        uses: docker/metadata-action@v6
+        with:
+          tags: |
+            type=raw,value=latest, enable=${{ inputs.latest}}
+            type=raw,value=${{ inputs.tag }}
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/${{ matrix.image }}
 
-    - uses: actions/setup-go@v6
-      with:
-        go-version-file: "go.mod"
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: "go.mod"
 
-    - name: Build and push docker images
-      if: ${{ inputs.push == true }}
-      uses: docker/build-push-action@v7
-      with:
-        context: .
-        file: images/${{ matrix.image }}/Dockerfile
-        platforms: ${{ inputs.platforms }}
-        push: true
-        tags: ${{ steps.image-meta.outputs.tags }}
-        labels: ${{ steps.image-meta.outputs.labels }}
+      - name: Build and push docker images
+        if: ${{ inputs.push == true }}
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: images/${{ matrix.image }}/Dockerfile
+          platforms: ${{ inputs.platforms }}
+          push: true
+          tags: ${{ steps.image-meta.outputs.tags }}
+          labels: ${{ steps.image-meta.outputs.labels }}
 
-    - name: Build and upload docker image to job artifact
-      if: ${{ inputs.upload_images == true }}
-      uses: docker/build-push-action@v7
-      with:
-        context: .
-        file: images/${{ matrix.image }}/Dockerfile
-        platforms: ${{ inputs.platforms }}
-        outputs: type=docker,dest=/tmp/${{matrix.image}}.tar
-        push: false
-        tags: ${{ steps.image-meta.outputs.tags }}
-        labels: ${{ steps.image-meta.outputs.labels }}
+      - name: Build and upload docker image to job artifact
+        if: ${{ inputs.upload_images == true }}
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: images/${{ matrix.image }}/Dockerfile
+          platforms: ${{ inputs.platforms }}
+          outputs: type=docker,dest=/tmp/${{matrix.image}}.tar
+          push: false
+          tags: ${{ steps.image-meta.outputs.tags }}
+          labels: ${{ steps.image-meta.outputs.labels }}
 
-    - name: Upload artifact
-      if: ${{ inputs.upload_images == true }}
-      uses: actions/upload-artifact@v7
-      with:
-        name: image-${{ matrix.image }}
-        path: /tmp/${{matrix.image}}.tar
+      - name: Upload artifact
+        if: ${{ inputs.upload_images == true }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: image-${{ matrix.image }}
+          path: /tmp/${{matrix.image}}.tar

.github/workflows/manual-dev-release-workflow.yaml

@@ -38,7 +38,7 @@ jobs:
       push: true
       latest: false
       ref: ${{ inputs.branch }}
-      repository:  ${{ inputs.repository }}
+      repository: ${{ inputs.repository }}
       tag: dev-${{ inputs.tag }}
 
   save-release:
@@ -61,7 +61,7 @@ jobs:
         env:
           MANAGER_IMAGE: ghcr.io/${{ inputs.repository }}/manager:dev-${{ inputs.tag }}
           AGENT_IMAGE: ghcr.io/${{ inputs.repository }}/agent:dev-${{ inputs.tag }}
-        run : |
+        run: |
           make generate-release-file AGENT_IMAGE="$AGENT_IMAGE" MANAGER_IMAGE="$MANAGER_IMAGE"
       - name: upload release
         uses: actions/upload-artifact@v7

.github/workflows/pull-request-workflow.yaml

@@ -19,6 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          # REQUIRED BY THE RATCHET, and its absence fails OPEN rather than loud.
+          # .golangci.yml sets `new-from-merge-base: origin/main`, which needs the
+          # merge base to exist locally. At the default depth of 1 it does not,
+          # and golangci-lint downgrades that to a warning —
+          #   "Can't process results by diff processor: ... could not read git repo"
+          # — then reports the FULL tree: 113 pre-existing findings, and a red
+          # gate that says nothing about the change under review.
+          fetch-depth: 0
 
       - uses: actions/setup-go@v6
         with:

.gitignore

@@ -1,30 +1,101 @@
+# --- managed by copier: regenerated on `copier update`; add your own BELOW the end marker ---
+# Base fragment; language fragments are appended.
 
-# Binaries for programs and plugins
+# OS junk
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+Thumbs.db
+desktop.ini
+
+# Editor
+*.swp
+*.swo
+*~
+.idea/
+*.iml
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
+
+# Merge/patch leftovers
+*.orig
+*.rej
+
+# Secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+!**/testdata/**/*.pem
+!**/testdata/**/*.key
+
+# Local tooling
+.worktrees/
+bin/
+dist/
+coverage/
+*.out
+!.gitkeep
+
+# Go
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
-bin
-testbin/*
-
-# Test binary, build with `go test -c`
 *.test
+vendor/
+go.work
+go.work.sum
 
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+# kubebuilder / operator-sdk local state
+*.kubeconfig
+config/**/*.local.yaml
 
-# Kubernetes Generated files - skip generated files, except for vendored files
+# Node / JS / TS — lockfiles ARE committed (npm ci depends on them)
+node_modules/
+.npm
+.eslintcache
+*.tsbuildinfo
+.vite/
+.next/
+.nuxt/
+.turbo/
+npm-debug.log*
+yarn-error.log*
 
-!vendor/**/zz_generated.*
+# Python — uv.lock IS committed (it is what makes the env reproducible)
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.ty_cache/
 
-# editor and IDE paraphernalia
-.idea
-*.swp
-*.swo
-*~
-.DS_Store
+# Helm — built subchart tarballs. Chart.lock is the source of truth and
+# `helm dependency build` regenerates these, so committing them creates a second
+# representation that Renovate CANNOT update: it bumps the version in Chart.yaml
+# and the stale .tgz silently stays. All five chart repos in this fleet currently
+# commit one.
+# Chart.lock itself IS committed — do not add it here.
+charts/*.tgz
+**/charts/*.tgz
+# --- end managed ---
+# Repo-specific entries below this line are preserved across regeneration.
+
+# kubebuilder test assets (predates the managed block)
+testbin/*
 
-#
-release.yaml
-release_it.yaml
+# Generated release manifest and release-it config. ANCHORED with a leading
+# slash: an unanchored `release.yaml` matches at any depth and silently
+# swallowed .github/workflows/release.yaml, which must stay tracked.
+/release.yaml
+/release_it.yaml