ci: add build, lint, test, release jobs

.github/workflows/ci.yml

@@ -3,37 +3,115 @@ name: CI
 on:
   pull_request:
   push:
+    branches:
+      - "**"
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+-*"
 
 permissions:
   contents: read
 
 jobs:
-  verify:
+  lint:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.25
+          cache: true
+
+      - name: ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          scandir: ./scripts
+
+      - name: Lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.2
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.25
+          cache: true
+
+      - name: Test
+        run: go test ./...
+
+  scan:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.ref_type == 'tag'
+    needs: [lint, test]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.25
+          cache: true
+
+      - name: Security (gosec)
+        uses: securego/gosec@master
+        with:
+          args: ./...
+
+      - name: Vulnerability check (govulncheck)
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: 1.25
+          go-package: ./...
+          repo-checkout: "false"
+
+      - name: Filesystem scan (trivy)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          cache: true
+          exit-code: 1
+          ignore-unfixed: true
+          scan-type: fs
+          scan-ref: .
+          scanners: vuln,secret,misconfig
+          severity: HIGH,CRITICAL
+
+  release:
+    runs-on: ubuntu-latest
+    needs: [lint, test, scan]
+    if: github.ref_type == 'tag'
+    permissions:
+      contents: write
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version: "1.25.11"
           cache: true
 
-      - name: Install ShellCheck
-        run: |
-          if command -v sudo >/dev/null 2>&1; then
-            apt_cmd="sudo apt-get"
-          else
-            apt_cmd="apt-get"
-          fi
-          $apt_cmd update
-          $apt_cmd install -y shellcheck
-
-      - name: Bootstrap verification tools
-        run: |
-          ./scripts/bootstrap_tools.sh
-          echo "$PWD/.tools/bin" >> "$GITHUB_PATH"
-
-      - name: Verify
-        run: .tools/bin/task verify
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -0,0 +1,35 @@
+version: 2
+
+project_name: hyperstack-agent
+
+builds:
+  - id: hyperstack-agent
+    main: ./cmd/agent
+    binary: hyperstack-agent
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w -X main.version={{.Version}} -X main.date={{.Date}}
+
+archives:
+  - id: default
+    # format: binary uploads the raw binary directly with no archive wrapper
+    format: binary
+    name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "checksums.txt"
+  algorithm: sha256
+
+release:
+  draft: false
+  prerelease: auto
+
+changelog:
+  disable: true

Dockerfile

@@ -31,7 +31,7 @@ ENV AGENT_VERSION=${VERSION} \
     AGENT_BUILD_DATE=${DATE} \
     HYPERSTACK_HEALTH_ADDR=127.0.0.1:9100
 
-FROM runtime-base AS agent-host
+FROM runtime-base AS dev
 USER root
 RUN apt-get update && apt-get install -y --no-install-recommends \
     busybox \
@@ -40,7 +40,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY scripts /scripts
 RUN chmod 0755 /scripts/*.sh
 USER hyperstack-agent
-CMD ["/scripts/serve.sh"]
+
+CMD ["/usr/local/bin/hyperstack-agent"]
 
 FROM runtime-base AS agent
 USER hyperstack-agent

README.md

@@ -6,62 +6,23 @@ gateway.
 
 ## Install On A VM
 
-Download the public install helper, review it if required by your change-control
-process, then run it with the gateway URL. The helper downloads the agent binary
-from the gateway `/download` endpoint, verifies the `Hyperstack-Agent-Digest`
-SHA-256 header, installs the binary, and creates the systemd service.
-
-```bash
-curl -fsSLO https://raw.githubusercontent.com/NexGenCloud/hyperstack-agent/main/scripts/install_agent.sh
-chmod +x install_agent.sh
-sudo ./install_agent.sh https://gateway.example.com
-```
-
-If the gateway requires a VM key to authorize release metadata or downloads,
-provide `INFRAHUB_KEY` in the environment. The key is only sent as an HTTP
-header and is not written to disk or systemd.
+Installation is handled by the Hyperstack platform.
 
 ## Build
 
-Install [Task](https://taskfile.dev/) before running project commands, or run
-`make tools` to install pinned project tools into `.tools/bin`. Equivalent
-`make` targets are also kept for environments that already standardize on Make.
-
 ```bash
-make tools
-.tools/bin/task build-linux-amd64
-.tools/bin/task build-linux-arm64
+task build-linux-amd64
+task build-linux-arm64
 ```
 
 Build artifacts are written to `bin/`.
 
 ## Run Locally
 
 ```bash
-HYPERSTACK_URL="http://localhost:8000" .tools/bin/task run
+HYPERSTACK_URL="http://localhost:8000" task run
 ```
 
-## Scripts
-
-The `scripts/` directory is part of the public release because it shows how the
-agent is built, installed, tested, and removed.
-
-- `scripts/install_agent.sh`: VM install helper. Requires a gateway URL argument
-  or `GATEWAY_URL`; optionally sends `INFRAHUB_KEY` as a download authorization
-  header without persisting it.
-- `scripts/install.sh`: advanced systemd installer for a local agent binary.
-  Requires `BINARY_SOURCE` and does not embed credentials.
-- `scripts/uninstall_agent.sh`: removes the systemd service and agent runtime
-  files.
-- `scripts/build.sh`: builds linux release artifacts and SHA-256 checksums.
-- `scripts/serve.sh`: local Docker helper that serves `/download` and
-  `/version` for install/update tests.
-- `scripts/e2e.sh`: local Docker end-to-end test helper.
-
-Do not commit `.env` files, real gateway URLs, private IPs, credentials, tokens,
-or customer-specific metadata into this repository. Use placeholders such as
-`gateway.example.com` in docs and test fixtures.
-
 ## Configuration
 
 The agent is configured through environment variables:
@@ -77,36 +38,32 @@ The agent is configured through environment variables:
 ## Task Targets
 
 ```bash
-task tools               # install pinned verification tools into .tools/bin
 task build-linux-amd64   # build linux/amd64 binary
 task build-linux-arm64   # build linux/arm64 binary
 task run                 # run agent locally
 task test                # run Go tests
-task lint                # run Go lint checks
-task security            # run gosec checks
-task govulncheck         # run Go vulnerability checks
-task trivy-fs            # run filesystem vulnerability/misconfiguration scan
-task sbom                # generate a local CycloneDX SBOM
-task secrets             # run gitleaks secret scan
-task verify              # run tests, shellcheck, lint, gosec, govulncheck, Trivy, and gitleaks
-task release-agent       # build amd64 binary and checksum
-task release-agent-full  # build amd64, arm64, static amd64, and checksums
+task static              # build a static linux/amd64 binary
+task clean               # remove build artifacts
 ```
 
-The same target names are available through `make`, for example `make tools` and
-`make verify`. The verification targets install and use pinned local tools from
-`.tools/bin` instead of relying on globally installed binaries. If you already
-have `task` on your PATH, `task verify` works as well.
+## Publishing a Release
 
-## Release Artifacts
+Releases are created automatically by CI when a semver tag is pushed. The
+`release` job runs after `test`, `lint`, and `scan` all pass, then uses
+GoReleaser to build the binary and create the GitHub Release.
+
+```bash
+git tag v1.2.3
+git push origin v1.2.3
+```
 
-`task release-agent` creates:
+Tags must match `v[0-9]+.[0-9]+.[0-9]+` (e.g. `v1.2.3`). Tags with a
+pre-release segment (e.g. `v1.2.3-alpha`) are published as pre-releases.
 
-- `bin/hyperstack-agent-linux-amd64`
-- `bin/hyperstack-agent-linux-amd64.sha256`
+Each release contains:
 
-`task release-agent-full` creates linux amd64, linux arm64, static linux amd64,
-and matching `.sha256` files.
+- `hyperstack-agent_linux_amd64` — raw binary, no archive wrapper
+- `checksums.txt` — SHA-256 checksum
 
 ## License