Skip to content

feat: add cross-platform Go CLI for container lifecycle management #395

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Aureliolo wants to merge 5 commits into from
Closed

feat: add cross-platform Go CLI for container lifecycle management #395

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cd9b179
feat: add cross-platform Go CLI for container lifecycle management
Aureliolo Mar 14, 2026
b99e4f3
test: expand Go CLI test coverage and add multi-platform CI
Aureliolo Mar 14, 2026
2a602b6
fix: address 40 review findings from 6 agents
Aureliolo Mar 14, 2026
b5638a5
fix: address 50 review findings + pin install scripts with release au…
Aureliolo Mar 14, 2026
1736f88
chore: remove Homebrew/Scoop distribution (not needed yet)
Aureliolo Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .claude/skills/aurelio-review-pr/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ After identifying the PR, fetch its body and check for issue linkage:
gh pr view NUMBER --json body,title --jq '{title: .title, body: .body}'
```

**Check for closing keywords.** Look for GitHub closing keywords in the PR body: `closes #N`, `fixes #N`, `resolves #N` (case-insensitive, with or without the `#`). Also accept full URL forms like `closes https://github.com/OWNER/REPO/issues/N`.
**Check for closing keywords.** Look for GitHub closing keywords in the PR body: `closes #N`, `fixes #N`, `resolves #N` (case-insensitive, with or without the `#`). Also accept full URL forms like `closes https://github.com/OWNER/REPO/issues/N`. Additionally, **scan the conversation context** — check earlier messages in this conversation for issue references like `#N`, `(#N)`, `issue N`, or GitHub issue URLs that the user may have mentioned before invoking this skill.

**Determine if closing is expected.** Some PRs are intentionally non-closing — they represent partial progress toward an issue (e.g., investigation scripts, step 1 of N, research spikes, diagnostic tools). Scan the PR title and body for signals like:
- "step 1", "step N of M", "part 1", "phase 1"
Expand All @@ -58,8 +58,8 @@ gh pr view NUMBER --json body,title --jq '{title: .title, body: .body}'
|---|---|---|
| Yes | No | Extract issue number, proceed to fetch context |
| Yes | Yes | Warn the user: "PR has `closes #N` but appears to be partial work — confirm the issue should be closed when this merges" |
| No | Yes | OK — no warning needed, this is expected for investigation/partial PRs |
| No | No | **Search for a matching issue** (see below) before warning |
| No | Yes | Still ask the user to confirm: "PR has no closing keyword and looks like partial/investigation work. Link to an issue anyway, or proceed without?" |
| No | No | **Search for a matching issue** (see below), then **always ask the user** to confirm |

### Auto-searching for a matching issue

Expand Down Expand Up @@ -91,7 +91,7 @@ When no closing keyword is found and the PR doesn't look like partial/investigat
3. **Confidence threshold:**
- **High confidence** (single strong match, clear title/scope alignment): present the match to the user and ask for confirmation before editing the PR body. For example: "Found issue #N (*title*) which closely matches this PR. Link it with `closes #N`?" If confirmed, safely update the PR body (see linking procedure below). Inform the user: "Linked closes #N."
- **Ambiguous** (multiple plausible matches or weak alignment): present the top candidates to the user via AskUserQuestion and let them pick, or confirm none apply. If the user selects an issue, persist the link using the same linking procedure below.
- **No matches**: warn the user: "PR does not reference a GitHub issue and no matching issue was found. Consider adding `closes #N` to the PR body if this resolves an issue."
- **No matches**: ask the user via AskUserQuestion: "No linked issue detected and no matching issue found. Options: (A) Link to issue #___ (enter number), (B) This PR has no GitHub issue — proceed without." Never silently proceed — always get explicit confirmation.

**Linking procedure (safe body update):** Never interpolate the existing PR body into a shell argument — it is untrusted input. Instead:

Expand Down Expand Up @@ -145,6 +145,8 @@ git diff main --name-only
- `infra_config`: `.pre-commit-config.yaml`, `.dockerignore`
- `config`: `.toml`, `.yaml`, `.yml`, `.json`, `.cfg` files (not already categorized above)
- `docs`: `.md` files
- `cli_go`: `.go` files in `cli/`
- `cli_config`: non-Go files in `cli/` (`.yml`, `.yaml`, `.tmpl`, `.sh`, `.ps1`)
- `site`: files in `site/`
- `other`: everything else

Expand All @@ -169,6 +171,9 @@ Based on changed files, launch applicable review agents **in parallel** using th
| **persistence-reviewer** | Any file in `src/ai_company/persistence/` | `everything-claude-code:database-reviewer` |
| **test-quality-reviewer** | Any `test_py` or `web_test` | `pr-review-toolkit:pr-test-analyzer` (custom prompt below) |
| **async-concurrency-reviewer** | Diff contains `async def`, `await`, `asyncio`, `TaskGroup`, `create_task`, `aiosqlite` in `src_py` files | `pr-review-toolkit:code-reviewer` (custom prompt below) |
| **go-reviewer** | Any `cli_go` | `everything-claude-code:go-reviewer` |
| **go-security-reviewer** | Any `cli_go` — diff contains `exec.Command`, `os/exec`, `http`, `os.Remove`, `os.WriteFile`, `filepath`, user-supplied paths | `everything-claude-code:security-reviewer` |
| **go-conventions-enforcer** | Any `cli_go` | `pr-review-toolkit:code-reviewer` (go-conventions-enforcer custom prompt — same as in pre-pr-review skill) |
| **issue-resolution-verifier** | Issue is linked (pre-existing or auto-linked in Phase 2) | `pr-review-toolkit:code-reviewer` (custom prompt below) |

The **issue-resolution-verifier** agent checks whether the PR fully resolves the linked issue. It only runs when an issue is linked — either from a pre-existing `closes #N` in the PR body, or auto-linked/user-selected during Phase 2's search.
Expand Down
90 changes: 83 additions & 7 deletions .claude/skills/pre-pr-review/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,15 +87,17 @@ Automated pre-PR pipeline that runs checks, launches review agents, triages find
- `infra_config`: `.pre-commit-config.yaml`, `.dockerignore`
- `config`: `.toml`, `.yaml`, `.yml`, `.json`, `.cfg` files (not already categorized above)
- `docs`: `.md` files
- `cli_go`: `.go` files in `cli/`
- `cli_config`: non-Go files in `cli/` (`.yml`, `.yaml`, `.tmpl`, `.sh`, `.ps1`)
- `site`: files in `site/`
- `other`: everything else

6. **Detect linked issue.** Gather issue context for all agents:
6. **Detect linked issue.** Gather issue context for all agents. Check these sources in priority order — take the first match:

- Check `$ARGUMENTS` for a bare issue number (e.g., `42`, `#42`)
- Parse commit messages for `#N` references: `git log main..HEAD --oneline`
- Parse branch name for issue number patterns (e.g., `feat/123-add-widget`, `fix-456`, `42-some-slug`)
- Take the first match found (arguments > commits > branch name)
1. Check `$ARGUMENTS` for a bare issue number (e.g., `42`, `#42`)
2. Parse commit messages for `#N` references: `git log main..HEAD --oneline`
3. Parse branch name for issue number patterns (e.g., `feat/123-add-widget`, `fix-456`, `42-some-slug`)
4. **Scan conversation context** — check earlier messages in this conversation for issue references like `#N`, `(#N)`, `issue N`, or GitHub issue URLs. The user may have mentioned the issue in a plan, prompt, or discussion before invoking `/pre-pr-review`.

If an issue number is found, strip any leading `#` prefix, then validate the extracted digits are purely numeric (`^[0-9]+$`) before use in shell commands:

Expand All @@ -105,7 +107,24 @@ Automated pre-PR pipeline that runs checks, launches review agents, triages find

Store the issue context for passing to all agents in Phase 4. Wrap in `<untrusted-issue-context>` XML tags.

If no issue is found, proceed without — agents that require issue context (issue-resolution-verifier) simply don't trigger.
**If no issue is found from the above sources**, proactively search for a matching issue:

- Extract 3-5 distinctive keywords from the branch name (split on `/` and `-`) and from any commit messages
- Search open issues:

```bash
gh issue list --state open --limit 15 --search "KEYWORDS" --json number,title --jq '.[] | "\(.number): \(.title)"'
```

- If a strong match exists (clear title/scope alignment), present it to the user and ask for confirmation
- If ambiguous matches exist, present the top candidates and let the user pick

**If still no issue is found (or search returns nothing)**, always ask the user via AskUserQuestion:
- "No linked issue detected. Options:"
- Option A: "Link to issue #___ (enter number)"
- Option B: "This PR has no GitHub issue — proceed without"

Never silently proceed without an issue — always confirm with the user.

7. **Large diff warning.** If 50+ files changed, warn about token cost and ask user whether to proceed with all agents or select a subset.

Expand All @@ -116,7 +135,7 @@ Determine if agent review can be skipped:
- If `$ARGUMENTS` contains `quick` -> skip agents, go to Phase 2 then Phase 8, then Phase 10 and Phase 11
- **Auto-detect**: If ALL changed files are non-substantive (only `.md` docs, config formatting, typo-level edits with no logic changes, `site/` static assets like images/fonts), skip agents automatically
- Auto-skip examples: all changes are `.md` files; only `pyproject.toml` version bump; only `.yaml`/`.json` config with no Python changes; only `site/` image/font/asset changes
- Do NOT auto-skip: any `.py` file changed; any `.vue`/`.ts`/`.css` file changed; any `docker/` or `.github/workflows/` file changed; config changes that affect runtime behavior; new dependencies added
- Do NOT auto-skip: any `.py` file changed; any `.go` file changed; any `.vue`/`.ts`/`.css` file changed; any `docker/` or `.github/workflows/` file changed; config changes that affect runtime behavior; new dependencies added
- If auto-skipping, inform user: "Skipping agent review (no substantive code changes detected). Running automated checks only."

## Phase 2: Automated Checks (always run)
Expand Down Expand Up @@ -181,6 +200,28 @@ Run these sequentially, fixing as we go:
npm --prefix web run test
```

**Go CLI checks (steps 10-12):** Run only if `cli_go` or `cli_config` files changed.

10. **Vet:**

```bash
cd cli && go vet ./...
```

11. **Test:**

```bash
cd cli && go test ./...
```

12. **Build check:**
Comment on lines +205 to +217
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix ordered-list numbering to satisfy markdownlint MD029.

This list uses 10/11/12; with the configured style, each ordered item should use 1..

Suggested doc patch 
-10. **Vet:**
+1. **Vet:**
@@
-11. **Test:**
+1. **Test:**
@@
-12. **Build check:**
+1. **Build check:**
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
10. **Vet:**
```bash
cd cli && go vet ./...
```
11. **Test:**
```bash
cd cli && go test ./...
```
12. **Build check:**
1. **Vet:**
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)

[warning] 205-205: Ordered list item prefix
Expected: 1; Actual: 10; Style: 1/1/1

(MD029, ol-prefix)

[warning] 211-211: Ordered list item prefix
Expected: 1; Actual: 11; Style: 1/1/1

(MD029, ol-prefix)

[warning] 217-217: Ordered list item prefix
Expected: 1; Actual: 12; Style: 1/1/1

(MD029, ol-prefix)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.claude/skills/pre-pr-review/SKILL.md around lines 205 - 217, The ordered
list in SKILL.md currently uses explicit numbers "10.", "11.", "12." for items
labeled "Vet:", "Test:", and "Build check:" which violates markdownlint MD029;
change those list markers to use "1." (i.e., make each ordered item use "1.") so
the entire ordered list uses the repeated "1." style, updating the list entries
containing "Vet:", "Test:", and "Build check:" accordingly.


```bash
cd cli && go build ./...
```

If steps 10-12 fail, fix the Go code and re-run.

Comment on lines +203 to +224
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add Go re-verification to post-fix phases to prevent regressions.

Go checks were added in Phase 2, but Phase 8/9 re-verification still only covers Python/Web. If Go files change during fixes or simplification, regressions can slip through before push.

Suggested doc patch 
 ## Phase 8: Post-Fix Verification

 Run automated checks again (same conditional gating as Phase 2):

@@
 **Web dashboard checks (steps 5-7):** Run only if `web_src` or `web_test` files were changed or modified during Phase 7.

 5. `npm --prefix web run lint`
 6. `npm --prefix web run type-check`
 7. `npm --prefix web run test`
+
+**Go CLI checks (steps 8-10):** Run only if `cli_go` or `cli_config` files were changed or modified during Phase 7.
+
+8. `cd cli && go vet ./...`
+9. `cd cli && go test ./...`
+10. `cd cli && go build ./...`

@@
 3. Re-run verification (same conditional gating as Phase 8):
    - If `src_py` or `test_py` changed: `uv run ruff check src/ tests/` + `uv run ruff format src/ tests/` + `uv run mypy src/ tests/` + `uv run pytest tests/ -n auto --cov=ai_company --cov-fail-under=80`
    - If `web_src` or `web_test` changed: `npm --prefix web run lint` + `npm --prefix web run type-check` + `npm --prefix web run test`
+   - If `cli_go` or `cli_config` changed: `cd cli && go vet ./...` + `cd cli && go test ./...` + `cd cli && go build ./...`
🧰 Tools
🪛 markdownlint-cli2 (0.21.0)

[warning] 205-205: Ordered list item prefix
Expected: 1; Actual: 10; Style: 1/1/1

(MD029, ol-prefix)

[warning] 211-211: Ordered list item prefix
Expected: 1; Actual: 11; Style: 1/1/1

(MD029, ol-prefix)

[warning] 217-217: Ordered list item prefix
Expected: 1; Actual: 12; Style: 1/1/1

(MD029, ol-prefix)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.claude/skills/pre-pr-review/SKILL.md around lines 203 - 224, Update the
post-fix re-verification phases to include the existing "Go CLI checks (steps
10-12)" so Go vet, go test, and go build run after fixes; modify the Phase
8/Phase 9 re-verification sections in SKILL.md to conditionally re-run steps
10–12 whenever cli_go or cli_config files changed (the same condition used in
the Phase 2 gating), ensuring the docs state "cd cli && go vet ./...", "cd cli
&& go test ./...", and "cd cli && go build ./..." are executed as part of the
post-fix checks to prevent regressions.

**Failure handling:**
- If mypy fails: fix the type errors, re-run mypy
- If pytest fails: fix failing tests, re-run pytest
Expand Down Expand Up @@ -222,8 +263,43 @@ This captures committed-but-unpushed changes AND any uncommitted/untracked work
| **persistence-reviewer** | Any file in `src/ai_company/persistence/` | `everything-claude-code:database-reviewer` |
| **test-quality-reviewer** | Any `test_py` or `web_test` | `pr-review-toolkit:pr-test-analyzer` (custom prompt below) |
| **async-concurrency-reviewer** | Diff contains `async def`, `await`, `asyncio`, `TaskGroup`, `create_task`, `aiosqlite` in `src_py` files | `pr-review-toolkit:code-reviewer` (custom prompt below) |
| **go-reviewer** | Any `cli_go` | `everything-claude-code:go-reviewer` |
| **go-security-reviewer** | Any `cli_go` — diff contains `exec.Command`, `os/exec`, `http`, `os.Remove`, `os.WriteFile`, `filepath`, user-supplied paths | `everything-claude-code:security-reviewer` |
| **go-conventions-enforcer** | Any `cli_go` | `pr-review-toolkit:code-reviewer` (custom prompt below) |
| **issue-resolution-verifier** | Issue context was found in Phase 0 step 6 | `pr-review-toolkit:code-reviewer` (custom prompt below) |

### Go-conventions-enforcer custom prompt

The go-conventions-enforcer agent checks Go CLI code for idiomatic patterns and project conventions.

**Error handling (CRITICAL):**
1. Errors returned but not checked (`_ = someFunc()` for non-trivial operations) (CRITICAL)
2. `panic()` in library/CLI code instead of returning errors (CRITICAL)
3. Error messages starting with uppercase or ending with punctuation (Go convention: lowercase, no period) (MAJOR)
4. Wrapping errors without `fmt.Errorf("context: %w", err)` — losing the error chain (MAJOR)

**Code structure (MAJOR):**
5. Functions exceeding 50 lines (MAJOR)
6. Files exceeding 800 lines (MAJOR)
7. Exported functions/types missing doc comments (MAJOR)
8. Package-level vars that should be constants (MEDIUM)

**Security (CRITICAL):**
9. Command injection via unsanitized input to `exec.Command` (CRITICAL)
10. Path traversal via user input in file operations without cleaning (CRITICAL)
11. Secrets logged or printed to stdout (CRITICAL)
12. HTTP responses not closed (`defer resp.Body.Close()` missing) (MAJOR)

**Testing (MAJOR):**
13. Missing table-driven tests for functions with multiple cases (MAJOR)
14. Test names not following `TestFunctionName_scenario` convention (MEDIUM)
15. Missing `t.Helper()` in test helper functions (MEDIUM)

**Go idioms (MEDIUM):**
16. Using `interface{}` instead of `any` (Go 1.18+) (MEDIUM)
17. Unnecessary else after return/continue/break (MEDIUM)
18. Using `new(T)` instead of `&T{}` for struct initialization (MINOR)

### Docs-consistency custom prompt

The docs-consistency agent ensures project documentation never drifts from the codebase. It runs on **every PR** — code changes, config changes, docs-only changes, all of them.
Expand Down
3 changes: 3 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,9 @@ coverage.xml
.idea/
.vscode/

# CLI (Go binary, not needed in Docker builds)
cli/

# Claude Code config
.claude/

Expand Down
78 changes: 78 additions & 0 deletions .github/ISSUE_TEMPLATE/installer-failure.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
name: CLI Installation Failure
description: Report a problem installing the SynthOrg CLI
title: "[CLI Install] "
labels:
- type:bug
- scope:cli
body:
- type: markdown
attributes:
value: |
Thanks for reporting an installation issue. Please fill in the details below.

Comment on lines +8 to +12
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add a redaction warning before asking for full logs.

This form is public, but it explicitly asks for full terminal output and proxy context. Without an upfront warning, reporters will paste tokens, proxy credentials, or internal hostnames into a public issue.

💡 Suggested change 
       value: |
         Thanks for reporting an installation issue. Please fill in the details below.
+        
+        Before submitting, redact tokens, passwords, proxy credentials, internal hostnames, and any other sensitive data from terminal output.
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/ISSUE_TEMPLATE/installer-failure.yml around lines 8 - 12, Insert a
clear redaction warning block immediately before any prompt that requests full
terminal output or proxy details: update the markdown "value" section (the type:
markdown block containing "Thanks for reporting an installation issue...") to
prepend a short warning that the form is public and requesters must redact
secrets (API tokens, SSH keys, proxy credentials, internal hostnames), give
one-line examples of what to redact, and link to a redaction guide or suggest
replacing secrets with "<REDACTED>" so reporters don't accidentally publish
sensitive data.

- type: dropdown
id: install-method
attributes:
label: Installation method
options:
- Homebrew (brew install)
- Scoop (scoop install)
- curl | sh (Linux/macOS)
- PowerShell installer (Windows)
- Manual download from GitHub Releases
- Built from source (go build)
validations:
required: true

- type: dropdown
id: os
attributes:
label: Operating system
options:
- macOS (Apple Silicon / arm64)
- macOS (Intel / amd64)
- Linux (amd64)
- Linux (arm64)
- Windows (amd64)
validations:
required: true

- type: textarea
id: version
attributes:
label: Version info
description: "Output of `synthorg version` (if installed) or the version you tried to install"
placeholder: |
synthorg dev
commit: none
built: unknown
validations:
required: false

- type: textarea
id: error
attributes:
label: Error output
description: "Full error message or terminal output"
render: shell
validations:
required: true

- type: textarea
id: steps
attributes:
label: Steps to reproduce
description: "Exact commands you ran"
placeholder: |
1. curl -sSfL https://... | sh
2. ...
validations:
required: true

- type: textarea
id: context
attributes:
label: Additional context
description: "Anything else that might help (Docker version, shell, proxy, etc.)"
validations:
required: false
19 changes: 19 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,25 @@ updates:
labels:
- type:ci

- package-ecosystem: gomod
directory: /cli
schedule:
interval: daily
time: "06:00"
timezone: Etc/UTC
commit-message:
prefix: "chore"
groups:
minor-and-patch:
update-types: [minor, patch]
major:
update-types: [major]
open-pull-requests-limit: 10
reviewers:
- Aureliolo
labels:
- type:chore

- package-ecosystem: docker
directory: /docker/backend
schedule:
Expand Down
Loading
Loading