feat(cli): migrate otdfctl into platform monorepo

.github/dependabot.yml

@@ -7,7 +7,9 @@
 updates:
   # Dependabot for CI
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - "/"
+      - "/otdfctl/e2e"
     schedule:
       interval: monthly
     commit-message:
@@ -68,6 +70,17 @@
     schedule:
       interval: daily
 
+  - package-ecosystem: gomod
+    directory: "/otdfctl"
+    commit-message:
+      prefix: "fix(deps)"
+    groups:
+      external:
+        exclude-patterns:
+          - "github.com/opentdf/*"
+    schedule:
+      interval: daily
+
   - package-ecosystem: gomod
     directory: "/protocol/go"
     commit-message:

.github/release-please/release-please-config.main.json

@@ -19,6 +19,15 @@
     "lib/identifier": {
       "component": "lib/identifier"
     },
+    "otdfctl": {
+      "component": "otdfctl",
+      "extra-files": [
+        {
+          "type": "generic",
+          "path": "pkg/config/config.go"
+        }
+      ]
+    },
     "protocol/go": {
       "component": "protocol/go"
     },
@@ -41,4 +50,4 @@
       ]
     }
   }
-}
+}

.github/release-please/release-please-config.otdfctl.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "go",
+  "versioning": "always-bump-patch",
+  "separate-pull-requests": true,
+  "include-component-in-tag": true,
+  "pull-request-title-pattern": "chore(release): release ${component} ${version}",
+  "tag-separator": "/",
+  "packages": {
+    "otdfctl": {
+      "component": "otdfctl",
+      "extra-files": [
+        {
+          "type": "generic",
+          "path": "pkg/config/config.go"
+        }
+      ]
+    }
+  }
+}

.github/release-please/release-please-manifest.json

@@ -3,6 +3,7 @@
   "lib/ocrypto": "0.10.0",
   "lib/flattening": "0.1.3",
   "lib/identifier": "0.3.0",
+  "otdfctl": "0.30.0",
   "protocol/go": "0.25.0",
   "sdk": "0.15.0",
   "service": "0.13.0"

.github/workflows/checks.yaml

@@ -33,6 +33,7 @@ jobs:
       matrix:
         directory:
           - examples
+          - otdfctl
           - sdk
           - service
           - lib/ocrypto
@@ -51,6 +52,7 @@ jobs:
           check-latest: false
           cache-dependency-path: |
             examples/go.sum
+            otdfctl/go.sum
             protocol/go/go.sum
             sdk/go.sum
             service/go.sum
@@ -545,23 +547,26 @@ jobs:
             cukes_platform_report.log
           retention-days: 1
 
-  # test latest otdfctl CLI 'main' against platform PR branch
+  # test otdfctl CLI e2e against platform PR branch
   otdfctl-test:
     permissions:
       contents: read
     name: otdfctl e2e tests
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
       - name: Install GNU parallel
         run: |
           sudo apt update
           sudo apt install -y parallel
-      - uses: opentdf/platform/test/start-up-with-containers@main
+      - uses: ./test/start-up-with-containers
         with:
           platform-ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: opentdf/otdfctl/e2e@main
-        with:
-          otdfctl-ref: "main"
+          provision-policy-fixtures: "false"
+      - uses: ./otdfctl/e2e
         env:
           TESTRAIL_USER: ${{ secrets.TESTRAIL_USER }}
           TESTRAIL_PASS: ${{ secrets.TESTRAIL_PASS }}

.github/workflows/nightly-checks.yaml

@@ -27,6 +27,7 @@ jobs:
           check-latest: false
           cache-dependency-path: |
             platform/examples/go.sum
+            platform/otdfctl/go.sum
             platform/protocol/go/go.sum
             platform/sdk/go.sum
             platform/service/go.sum
@@ -60,18 +61,11 @@ jobs:
           wait-for: 90s
           working-directory: platform
 
-      ######## CHECKOUT/BUILD 'otdfctl' #############
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: opentdf/otdfctl
-          ref: main
-          fetch-depth: 0
-          path: otdfctl
-          persist-credentials: false
-      - run: go build -o otdfctl
-        working-directory: otdfctl
-      - run: cp otdfctl ../platform
-        working-directory: otdfctl
+      ######## BUILD 'otdfctl' (now part of platform monorepo) #############
+      - run: go build -o otdfctl .
+        working-directory: platform/otdfctl
+      - run: cp otdfctl ../
+        working-directory: platform/otdfctl
 
       ######## RUN TESTS #############
       - run: ./.github/scripts/connectivity-test.sh

.github/workflows/pr-checks.yaml

@@ -46,6 +46,7 @@ jobs:
           #   - main: used for automated releases
           #   - core: related to any core need such as the core service or monorepo
           #   - ci: anything related to ci
+          #   - cli: related to otdfctl
           #   - deps: dependency update
           #   - docs: anything related solely to documentation
           #   - sdk: related to sdk changes in the /sdk directory
@@ -56,6 +57,7 @@ jobs:
             main
             core
             ci
+            cli
             deps
             docs
             sdk

.github/workflows/release-otdfctl.yaml

@@ -0,0 +1,43 @@
+name: "Build otdfctl CLI Binaries"
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  build:
+    if: ${{ startsWith(github.event.release.tag_name, 'otdfctl/') }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
+        with:
+          go-version-file: otdfctl/go.mod
+
+      - name: Extract version from tag
+        id: version
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION="${TAG#otdfctl/v}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Build cross-platform binaries
+        working-directory: otdfctl
+        env:
+          SEM_VER: ${{ steps.version.outputs.version }}
+          COMMIT_SHA: ${{ github.sha }}
+        run: make build
+
+      - name: Upload release artifacts
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: gh release upload "$RELEASE_TAG" ./otdfctl/output/*

.gitignore

@@ -54,4 +54,40 @@ traces/
 .cache/*
 
 # Claude AI files
-.claude/
+.claude/
+
+# otdfctl specific ignores
+# =========================
+otdfctl/bin/.DS_Store
+otdfctl/.DS_Store
+otdfctl/target/
+otdfctl/.vscode/launch.json
+otdfctl/otdfctl.yaml
+
+# Ignore the binaries
+otdfctl/otdfctl
+otdfctl/otdfctl.*
+otdfctl/otdfctl_testbuild
+otdfctl/otdfctl_testbuild.*
+
+# Test artifacts
+otdfctl/creds.json
+otdfctl/**/creds.json
+
+# TestRail-related files
+otdfctl/testrail.config.json
+otdfctl/testname-to-testrail-id.json
+otdfctl/mapping-report.txt
+otdfctl/bats-results.tap
+
+# Hugo
+otdfctl/public/
+otdfctl/.hugo_build.lock
+otdfctl/output/
+
+# Ignore any TDF files created by the CLI
+otdfctl/*.tdf
+
+# Ignore go.cache
+otdfctl/.gocache
+# =========================

.golangci.yaml

@@ -186,9 +186,31 @@ linters:
       - linters:
           - goimport
         text: http://www.apache.org/licenses/LICENSE-2.0
+      # otdfctl: defer refactoring-level lint fixes to follow-up
+      - path: otdfctl/
+        linters:
+          - contextcheck
+        text: should pass the context parameter
+      - path: otdfctl/
+        linters:
+          - revive
+        text: unused-parameter
+      - path: otdfctl/
+        linters:
+          - revive
+        text: unexported-return
+      - path: otdfctl/
+        linters:
+          - revive
+        text: var-naming
+      - path: otdfctl/
+        linters:
+          - nolintlint
+        text: "exhaustive"
     paths:
       - .*\.pb\.go
       - .*\.pb\.gw.go
+      - otdfctl/tui/  # excluded during migration, matching original otdfctl lint config
       - third_party$
       - builtin$
       - examples$
@@ -204,6 +226,7 @@ formatters:
     paths:
       - .*\.pb\.go
       - .*\.pb\.gw.go
+      - otdfctl/tui/
       - third_party$
       - builtin$
       - examples$

CODEOWNERS

@@ -41,6 +41,10 @@
 /sdk/     @opentdf/go-sdk @opentdf/architecture
 /sdk/go.* @opentdf/go-sdk @opentdf/architecture @opentdf/security
 
+## CLI
+
+/otdfctl/ @opentdf/cli
+
 ## High Security Area
 
 CODEOWNERS     @opentdf/architecture @opentdf/security

Dockerfile

@@ -7,6 +7,7 @@ COPY protocol/ protocol/
 COPY sdk/ sdk/
 COPY lib/ lib/
 COPY service/ service/
+COPY otdfctl/ otdfctl/
 COPY examples/ examples/
 COPY tests-bdd/ tests-bdd/
 COPY go.work ./

Makefile

@@ -1,10 +1,10 @@
 # make
 # To run all lint checks: `LINT_OPTIONS= make lint`
 
-.PHONY: all build clean connect-wrapper-generate docker-build fix fmt go-lint license lint proto-generate proto-helper-generate proto-lint sdk/sdk test tidy toolcheck
+.PHONY: all build clean connect-wrapper-generate docker-build fix fmt go-lint license lint otdfctl/otdfctl proto-generate proto-helper-generate proto-lint sdk/sdk test tidy toolcheck
 
-MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
-HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
+MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
+HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples otdfctl
 REQUIRED_BUF_VERSION=1.56.0
 
 ROOT_DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
@@ -115,9 +115,9 @@ bench:
 
 clean:
 	for m in $(MODS); do (cd $$m && go clean) || exit 1; done
-	rm -f opentdf examples/examples
+	rm -f opentdf examples/examples otdfctl/otdfctl
 
-build: proto-generate connect-wrapper-generate opentdf sdk/sdk examples/examples
+build: proto-generate connect-wrapper-generate opentdf sdk/sdk examples/examples otdfctl/otdfctl
 
 opentdf: $(shell find service)
 	go build -o opentdf -v service/main.go
@@ -128,5 +128,8 @@ sdk/sdk: $(shell find sdk)
 examples/examples: $(shell find examples)
 	(cd examples && go build -o examples .)
 
+otdfctl/otdfctl: $(shell find otdfctl)
+	(cd otdfctl && go build -o otdfctl .)
+
 docker-build: build
 	docker build -t opentdf .

adr/decisions/2026-03-24-otdfctl-migration.md

@@ -0,0 +1,26 @@
+## Summary
+
+We are planning to migrate the `otdfctl` CLI from this standalone repository into the [`opentdf/platform`](https://github.com/opentdf/platform) monorepo. After migration, this repository will be archived and marked read-only.
+
+## Why
+
+- otdfctl already depends heavily on platform (SDK, protocol, libs) and uses platform's reusable CI workflows
+- Both repos run each other's e2e tests in CI — consolidating eliminates cross-repo coordination overhead
+- The platform monorepo already supports per-component releases (service, sdk, libs), so otdfctl can maintain independent release cadence
+
+## What changes for users
+
+- **Go module path** will change from `github.com/opentdf/otdfctl` to `github.com/opentdf/platform/otdfctl`
+- **Release tags** will change from `v0.X.Y` to `otdfctl/v0.X.Y`
+- **This repository** will be archived (read-only) — all existing releases and tags will remain accessible
+- A notice will be added to this README pointing to the new location
+
+## What stays the same
+
+- The `otdfctl` binary name and CLI interface
+- Separate release cadence (not coupled to platform service releases)
+- All existing CI tests continue to run
+
+## Feedback
+
+If you have concerns or questions about this migration, please comment on this issue.

go.work

@@ -8,6 +8,7 @@ use (
 	./lib/flattening
 	./lib/identifier
 	./lib/ocrypto
+	./otdfctl
 	./protocol/go
 	./sdk
 	./service