WIP: feat: use compose-go

See #492

.dockerignore

@@ -4,5 +4,4 @@
 Dockerfile
 abra
 dist
-kadabra
 tags

.drone.yml

@@ -3,7 +3,7 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.24
+    image: golang:1.26
     commands:
       - make check
 
@@ -11,13 +11,18 @@ steps:
     image: git.coopcloud.tech/toolshed/drone-xgettext-go:latest
     settings:
       keyword: i18n.G
+      keyword_ctx: i18n.GC
       out: pkg/i18n/locales/abra.pot
       comments_tag: translators
     depends_on:
       - make check
+    when:
+      event:
+        exclude:
+          - tag
 
   - name: xgettext-go status
-    image: golang:1.24-alpine3.22
+    image: golang:1.26-alpine3.22
     commands:
       - apk add patchutils git make
       - cd /drone/src
@@ -27,44 +32,20 @@ steps:
       - git diff-files --exit-code
     depends_on:
       - xgettext-go
+    when:
+      event:
+        exclude:
+          - tag
 
   - name: make test
-    image: golang:1.24
+    image: golang:1.26
     environment:
-      ABRA_DIR: $HOME/.abra
-      CATL_URL: https://git.coopcloud.tech/toolshed/recipes-catalogue-json.git
+      ABRA_DIR: /root/.abra_test
     commands:
-      - mkdir -p $HOME/.abra
-      - git clone $CATL_URL $HOME/.abra/catalogue
       - make test
     depends_on:
       - make check
 
-  - name: fetch
-    image: docker:git
-    commands:
-      - git fetch --tags
-    depends_on:
-      - make check
-      - make test
-    when:
-      event: tag
-
-  - name: release
-    image: goreleaser/goreleaser:v2.5.1
-    environment:
-      GITEA_TOKEN:
-        from_secret: goreleaser_gitea_token
-    volumes:
-      - name: deps
-        path: /go
-    commands:
-      - goreleaser release
-    depends_on:
-      - fetch
-    when:
-      event: tag
-
   - name: publish image
     image: plugins/docker
     settings:

.gitignore

@@ -4,6 +4,6 @@
 .envrc
 .vscode/
 /abra
-/kadabra
+/bin
 dist/
 tests/integration/.bats

.goreleaser.yml

@@ -1,4 +1,6 @@
 ---
+version: 2
+
 gitea_urls:
   api: https://git.coopcloud.tech/api/v1
   download: https://git.coopcloud.tech/
@@ -26,31 +28,9 @@ builds:
       - 5
       - 6
       - 7
-    ldflags:
-      - "-X 'main.Commit={{ .Commit }}'"
-      - "-X 'main.Version={{ .Version }}'"
-      - "-s"
-      - "-w"
-
-  - id: kadabra
-    binary: kadabra
-    dir: cmd/kadabra
-    env:
-      - CGO_ENABLED=0
-    goos:
-      - linux
-      - darwin
-    goarch:
-      - 386
-      - amd64
-      - arm
-      - arm64
-    goarm:
-      - 5
-      - 6
-      - 7
-    gcflags:
-      - "all=-l -B"
+    flags:
+      - -v
+      - -trimpath
     ldflags:
       - "-X 'main.Commit={{ .Commit }}'"
       - "-X 'main.Version={{ .Version }}'"

AUTHORS.md

@@ -10,14 +10,17 @@
 - cassowary
 - chasqui
 - codegod100
+- cyrnel
 - decentral1se
 - fauno
 - frando
 - iexos
+- jade
 - kawaiipunk
 - knoflook
 - mayel
 - moritz
+- namnatulco
 - p4u1
 - rix
 - roxxers

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.24-alpine AS build
+FROM golang:1.26-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 
@@ -15,8 +15,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=0 make build
 
-# Release image ("slim")
-FROM alpine:3.19.1
+FROM alpine:3.22
 
 RUN apk add --no-cache \
   ca-certificates \

Makefile

@@ -1,10 +1,11 @@
 ABRA         := ./cmd/abra
-KADABRA      := ./cmd/kadabra
+XGETTEXT     := ./bin/xgettext-go
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
-GOVERSION    := 1.24
+GOVERSION    := 1.26
 LDFLAGS      := "-X 'main.Commit=$(COMMIT)'"
 DIST_LDFLAGS := $(LDFLAGS)" -s -w"
+BFLAGS       := -v -trimpath
 GCFLAGS      := "all=-l -B"
 DOMAIN       := abra
 POFILES      := $(wildcard pkg/i18n/locales/*.po)
@@ -13,40 +14,23 @@ LINGUAS      := $(basename $(POFILES))
 
 export GOPRIVATE=coopcloud.tech
 
-# NOTE(d1): default `make` optimised for Abra hacking
-all: format check build-abra test
+all: format check build
 
-run-abra:
+run:
 	@go run -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(ABRA)
 
-run-kadabra:
-	@go run -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(KADABRA)
-
-install-abra:
+install:
 	@go install -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(ABRA)
 
-install-kadabra:
-	@go install -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(KADABRA)
+build:
+	@go build $(BFLAGS) -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
 
-install: install-abra install-kadabra
-
-build-abra:
-	@go build -v -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
-
-build-kadabra:
-	@go build -v -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(KADABRA)
-
-build: build-abra build-kadabra
-
-build-docker-abra:
+build-docker:
 	@docker run -it -v $(PWD):/abra golang:$(GOVERSION) \
 		bash -c 'cd /abra; ./scripts/docker/build.sh'
 
-build-docker: build-docker-abra
-
 clean:
 	@rm '$(GOPATH)/bin/abra'
-	@rm '$(GOPATH)/bin/kadabra'
 
 format:
 	@gofmt -s -w $$(find . -type f -name '*.go' | grep -v "/vendor/")
@@ -56,7 +40,7 @@ check:
 	(echo "gofmt: formatting issue - run 'make format' to resolve" && exit 1)
 
 test:
-	@go test ./... -cover -v
+	@go test ./... -cover -v -p 1
 
 find-tests:
 	@find . -name "*_test.go"
@@ -78,14 +62,20 @@ update-po:
 	done
 
 .PHONY: update-pot
-update-pot:
-	@xgettext-go \
+update-pot: $(XGETTEXT)
+	@${XGETTEXT} \
 		-o pkg/i18n/locales/$(DOMAIN).pot \
 		--keyword=i18n.G \
+		--keyword-ctx=i18n.GC \
 		--sort-output \
 		--add-comments-tag="translators" \
 		$$(find . -name "*.go" -not -path "*vendor*" | sort)
 
+${XGETTEXT}:
+	@mkdir -p ./bin && \
+	wget -O ./bin/xgettext-go https://git.coopcloud.tech/toolshed/xgettext-go/raw/branch/main/xgettext-go && \
+	chmod +x ./bin/xgettext-go
+
 .PHONY: update-pot-po-metadata
 update-pot-po-metadata:
 	@sed -i "s/charset=CHARSET/charset=UTF-8/g" pkg/i18n/locales/*.po pkg/i18n/locales/*.pot
@@ -96,3 +86,6 @@ build-mo:
 	for lang in $(POFILES); do \
 		msgfmt $$lang -o $$(echo $$lang | sed 's/.po/.mo/g') --statistics; \
 	done
+
+release:
+	@goreleaser release --clean

cli/app/app.go

@@ -9,7 +9,7 @@ import (
 
 // translators: `abra app` aliases. use a comma separated list of aliases with
 // no spaces in between
-var appAliases = i18n.G("a")
+var appAliases = i18n.GC("a", "abra app")
 
 var AppCommand = &cobra.Command{
 	// translators: `app` command group

cli/app/backup.go

@@ -268,7 +268,7 @@ func init() {
 	AppBackupListCommand.Flags().BoolVarP(
 		&showAllPaths,
 		i18n.G("all"),
-		i18n.G("a"),
+		i18n.GC("a", "app backup list"),
 		false,
 		i18n.G("show all paths"),
 	)

cli/app/deploy.go

@@ -3,12 +3,14 @@ package app
 import (
 	"context"
 	"errors"
+	"fmt"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/secret"
+	"coopcloud.tech/tagcmp"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/client"
@@ -103,18 +105,26 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		toDeployVersion, err = getDeployVersion(args, deployMeta, app)
 		if err != nil {
-			log.Fatal(i18n.G("get deploy version: %s", err))
+			log.Fatal(err)
+		}
+
+		isChaosCommit, err := app.Recipe.IsChaosCommit(toDeployVersion)
+		if err != nil {
+			log.Fatal(i18n.G("unable to determine if %s is a chaos commit: %s", toDeployVersion, err))
+		}
+
+		if !isChaosCommit && !tagcmp.IsParsable(toDeployVersion) {
+			log.Fatal(i18n.G("unable to parse deploy version: %s", toDeployVersion))
 		}
 
-		versionIsChaos := false
 		if !internal.Chaos {
-			var err error
-			versionIsChaos, err = app.Recipe.EnsureVersion(toDeployVersion)
+			isChaosCommit, err := app.Recipe.EnsureVersion(toDeployVersion)
 			if err != nil {
 				log.Fatal(i18n.G("ensure recipe: %s", err))
 			}
-			if versionIsChaos {
+			if isChaosCommit {
 				log.Warnf(i18n.G("version '%s' appears to be a chaos commit, but --chaos/-C was not provided", toDeployVersion))
+				internal.Chaos = true
 			}
 		}
 
@@ -147,19 +157,32 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			ResolveImage: stack.ResolveImageAlways,
 			Detach:       false,
 		}
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		appPkg.ExposeAllEnv(stackName, compose, app.Env)
 		appPkg.SetRecipeLabel(compose, stackName, app.Recipe.Name)
-		appPkg.SetChaosLabel(compose, stackName, internal.Chaos || versionIsChaos)
+		appPkg.SetChaosLabel(compose, stackName, internal.Chaos)
 		if internal.Chaos {
 			appPkg.SetChaosVersionLabel(compose, stackName, toDeployVersion)
 		}
-		appPkg.SetUpdateLabel(compose, stackName, app.Env)
-		appPkg.SetVersionLabel(compose, stackName, toDeployVersion)
+
+		versionLabel := toDeployVersion
+		if internal.Chaos {
+			for _, service := range compose.Services {
+				if service.Name == "app" {
+					labelKey := fmt.Sprintf("coop-cloud.%s.version", stackName)
+					// NOTE(d1): keep non-chaos version labbeling when doing chaos ops
+					versionLabel = service.Deploy.Labels[labelKey]
+				}
+			}
+		}
+		appPkg.SetVersionLabel(compose, stackName, versionLabel)
+
+		newRecipeWithDeployVersion := fmt.Sprintf("%s:%s", app.Recipe.Name, toDeployVersion)
+		appPkg.ExposeAllEnv(stackName, compose, app.Env, newRecipeWithDeployVersion)
 
 		envVars, err := appPkg.CheckEnv(app)
 		if err != nil {
@@ -186,9 +209,12 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Debug(i18n.G("skipping domain checks"))
 		}
 
-		deployedVersion := config.NO_VERSION_DEFAULT
+		deployedVersion := config.MISSING_DEFAULT
 		if deployMeta.IsDeployed {
 			deployedVersion = deployMeta.Version
+			if deployMeta.IsChaos {
+				deployedVersion = deployMeta.ChaosVersion
+			}
 		}
 
 		// Gather secrets
@@ -245,6 +271,7 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			app.Name,
 			app.Server,
 			internal.DontWaitConverge,
+			internal.NoInput,
 			f,
 		); err != nil {
 			log.Fatal(err)
@@ -265,13 +292,21 @@ checkout as-is. Recipe commit hashes are also supported as values for
 }
 
 func getLatestVersionOrCommit(app appPkg.App) (string, error) {
-	versions, err := app.Recipe.Tags()
+	recipeVersions, warnings, err := app.Recipe.GetRecipeVersions()
 	if err != nil {
 		return "", err
 	}
 
-	if len(versions) > 0 && !internal.Chaos {
-		return versions[len(versions)-1], nil
+	for _, warning := range warnings {
+		log.Warn(warning)
+	}
+
+	if len(recipeVersions) > 0 && !internal.Chaos {
+		latest := recipeVersions[len(recipeVersions)-1]
+		for tag := range latest {
+			log.Debug(i18n.G("selected latest recipe version: %s (from %d available versions)", tag, len(recipeVersions)))
+			return tag, nil
+		}
 	}
 
 	head, err := app.Recipe.Head()
@@ -300,6 +335,16 @@ func validateArgsAndFlags(args []string) error {
 }
 
 func validateSecrets(cl *dockerClient.Client, app appPkg.App) error {
+	composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+	if err != nil {
+		return err
+	}
+
+	secretsConfig, err := secret.ReadSecretsConfig(app.Path, composeFiles, app.StackName())
+	if err != nil {
+		return err
+	}
+
 	secStats, err := secret.PollSecretsStatus(cl, app)
 	if err != nil {
 		return err
@@ -307,6 +352,10 @@ func validateSecrets(cl *dockerClient.Client, app appPkg.App) error {
 
 	for _, secStat := range secStats {
 		if !secStat.CreatedOnRemote {
+			secretConfig := secretsConfig[secStat.LocalName]
+			if secretConfig.SkipGenerate {
+				return errors.New(i18n.G("secret not inserted (#generate=false): %s", secStat.LocalName))
+			}
 			return errors.New(i18n.G("secret not generated: %s", secStat.LocalName))
 		}
 	}
@@ -334,7 +383,12 @@ func getDeployVersion(cliArgs []string, deployMeta stack.DeployMeta, app appPkg.
 	// Check if the recipe has a version in the .env file
 	if app.Recipe.EnvVersion != "" && !internal.DeployLatest {
 		if strings.HasSuffix(app.Recipe.EnvVersionRaw, "+U") {
-			return "", errors.New(i18n.G("version: can not redeploy chaos version %s", app.Recipe.EnvVersionRaw))
+			// NOTE(d1): use double-line 5 spaces ("FATA ") trick to make a more
+			// informative error message. it's ugly but that's our logging situation
+			// atm
+			return "", errors.New(i18n.G(`cannot redeploy previous chaos version (%s), did you mean to use "--chaos"?
+     to return to a regular release, specify a release tag, commit SHA or use "--latest"`,
+				formatter.BoldDirtyDefault(app.Recipe.EnvVersionRaw)))
 		}
 		log.Debug(i18n.G("version: taking version from .env file: %s", app.Recipe.EnvVersion))
 		return app.Recipe.EnvVersion, nil

cli/app/env.go

@@ -1,28 +1,50 @@
 package app
 
 import (
+	"context"
 	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
 	"sort"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
+	"coopcloud.tech/abra/pkg/app"
+	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
+	"coopcloud.tech/abra/pkg/client"
+	"coopcloud.tech/abra/pkg/config"
+	containerPkg "coopcloud.tech/abra/pkg/container"
+	contextPkg "coopcloud.tech/abra/pkg/context"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/i18n"
+	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types/filters"
 	"github.com/spf13/cobra"
 )
 
-// translators: `abra app env` aliases. use a comma separated list of aliases with
-// no spaces in between
+// translators: `abra app env` aliases. use a comma separated list of aliases
+// with no spaces in between
 var appEnvAliases = i18n.G("e")
 
-var AppEnvCommand = &cobra.Command{
-	// translators: `app env` command
-	Use:     i18n.G("env <domain> [flags]"),
-	Aliases: strings.Split(appEnvAliases, ","),
-	// translators: Short description for `app env` command
-	Short:   i18n.G("Show app .env values"),
-	Example: i18n.G("  abra app env 1312.net"),
+// translators: `abra app env list` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appEnvListAliases = i18n.G("l,ls")
+
+// translators: `abra app env pull` aliases. use a comma separated list of
+// aliases with no spaces in between
+var appEnvPullAliases = i18n.G("pl,p")
+
+var AppEnvListCommand = &cobra.Command{
+	// translators: `app env list` command
+	Use:     i18n.G("list <domain> [flags]"),
+	Aliases: strings.Split(appEnvListAliases, ","),
+	// translators: Short description for `app env list` command
+	Short:   i18n.G("List all app environment values"),
+	Example: i18n.G("  abra app env list 1312.net"),
 	Args:    cobra.ExactArgs(1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -49,3 +71,274 @@ var AppEnvCommand = &cobra.Command{
 		fmt.Println(overview)
 	},
 }
+
+var AppEnvPullCommand = &cobra.Command{
+	// translators: `app pull` command
+	Use:     i18n.G("pull <domain> [flags]"),
+	Aliases: strings.Split(appEnvPullAliases, ","),
+	// translators: Short description for `app env pull` command
+	Short: i18n.G("Pull app environment values from a deployed app"),
+	Long: i18n.G(`Pull app environment values from a deploymed app.
+
+A convenient command for when you've lost your app environment file or want to
+synchronize your local app environment values with what is deployed live.`),
+	Example: i18n.G(`  # pull existing .env file and overwrite local values
+  abra app env pull 1312.net --force
+
+  # pull lost app .env file
+  abra app env pull my.gitea.net --server 1312.net`),
+	Args: cobra.MaximumNArgs(2),
+	ValidArgsFunction: func(
+		cmd *cobra.Command,
+		args []string,
+		toComplete string) ([]string, cobra.ShellCompDirective) {
+		return autocomplete.AppNameComplete()
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		appName := args[0]
+
+		appEnvPath := path.Join(config.ABRA_DIR, "servers", server, fmt.Sprintf("%s.env", appName))
+		if _, err := os.Stat(appEnvPath); !os.IsNotExist(err) {
+			log.Fatal(i18n.G("%s already exists?", appEnvPath))
+		}
+
+		if server == "" {
+			log.Fatal(i18n.G("unable to determine server of app %s, please pass --server/-s", appName))
+		}
+
+		serverDir := filepath.Join(config.SERVERS_DIR, server)
+		if _, err := os.Stat(serverDir); os.IsNotExist(err) {
+			log.Fatal(i18n.G("unknown server %s, run \"abra server add %s\"?", server, server))
+		}
+
+		store := contextPkg.NewDefaultDockerContextStore()
+		contexts, err := store.Store.List()
+		if err != nil {
+			log.Fatal(i18n.G("unable to look up server context for %s: %s", server, err))
+		}
+
+		var contextCreated bool
+		if server == "default" {
+			contextCreated = true
+		}
+
+		for _, context := range contexts {
+			if context.Name == server {
+				contextCreated = true
+			}
+		}
+
+		if !contextCreated {
+			log.Fatal(i18n.G("%s missing context, run \"abra server add %s\"?", server, server))
+		}
+
+		cl, err := client.New(server)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		deployMeta, err := stack.IsDeployed(context.Background(), cl, appPkg.StackName(appName))
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !deployMeta.IsDeployed {
+			log.Fatal(i18n.G("%s is not deployed?", appName))
+		}
+
+		filters := filters.NewArgs()
+		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(appName), "app"))
+		targetContainer, err := containerPkg.GetContainer(context.Background(), cl, filters, internal.NoInput)
+		if err != nil {
+			log.Fatal(i18n.G("unable to retrieve container for %s: %s", appName, err))
+		}
+
+		inspectResult, err := cl.ContainerInspect(context.Background(), targetContainer.ID)
+		if err != nil {
+			log.Fatal(i18n.G("unable to inspect container for %s: %s", appName, err))
+		}
+
+		deploymentEnv := make(map[string]string)
+		for _, envVar := range inspectResult.Config.Env {
+			split := strings.SplitN(envVar, "=", 2)
+			if len(split) != 2 {
+				log.Debug(i18n.G("no value attached to %s", envVar))
+				continue
+			}
+
+			key, val := split[0], split[1]
+			deploymentEnv[key] = val
+		}
+
+		log.Debug(i18n.G("pulled env values from %s deployment: %s", appName, deploymentEnv))
+
+		var (
+			recipeEnvVar string
+			recipeKey    string
+		)
+
+		if r, ok := deploymentEnv["TYPE"]; ok {
+			recipeKey = "TYPE"
+			recipeEnvVar = r
+		}
+
+		if r, ok := deploymentEnv["RECIPE"]; ok {
+			recipeKey = "RECIPE"
+			recipeEnvVar = r
+		}
+
+		if recipeEnvVar == "" {
+			log.Fatal(i18n.G("unable to determine recipe type from %s, env: %v", appName, inspectResult.Config.Env))
+		}
+
+		var recipeName = recipeEnvVar
+		if strings.Contains(recipeEnvVar, ":") {
+			split := strings.Split(recipeEnvVar, ":")
+			recipeName = split[0]
+		}
+
+		recipe := internal.ValidateRecipe(
+			[]string{recipeName},
+			cmd.Name(),
+		)
+
+		version := deployMeta.Version
+		if deployMeta.IsChaos {
+			version = deployMeta.ChaosVersion
+		}
+
+		if _, err := recipe.EnsureVersion(version); err != nil {
+			log.Fatal(err)
+		}
+
+		mergedEnv, err := recipe.SampleEnv()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Debug(i18n.G("retrieved env values from .env.sample of %s: %s", recipe.Name, mergedEnv))
+
+		for k, v := range deploymentEnv {
+			mergedEnv[k] = v
+		}
+
+		if !strings.Contains(recipeEnvVar, ":") {
+			mergedEnv[recipeKey] = fmt.Sprintf("%s:%s", mergedEnv[recipeKey], version)
+		}
+
+		log.Debug(i18n.G("final merged env values for %s are: %s", appName, mergedEnv))
+
+		envSample, err := os.ReadFile(recipe.SampleEnvPath)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		err = os.WriteFile(appEnvPath, envSample, 0o664)
+		if err != nil {
+			log.Fatal(i18n.G("unable to write new env %s: %s", appEnvPath, err))
+		}
+
+		read, err := os.ReadFile(appEnvPath)
+		if err != nil {
+			log.Fatal(i18n.G("unable to read new env %s: %s", appEnvPath, err))
+		}
+
+		sampleEnv, err := recipe.SampleEnv()
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		var composeFileUpdated bool
+		newContents := string(read)
+		for key, val := range mergedEnv {
+			if sampleEnv[key] == val {
+				continue
+			}
+
+			if key == "COMPOSE_FILE" {
+				composeFileUpdated = true
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`#%s=`, key), newContents); m {
+				log.Debug(i18n.G("uncommenting %s", key))
+				re := regexp.MustCompile(fmt.Sprintf(`#%s=`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=", key))
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`# %s=`, key), newContents); m {
+				log.Debug(i18n.G("uncommenting %s", key))
+				re := regexp.MustCompile(fmt.Sprintf(`# %s=`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=", key))
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`%s=".*"`, key), newContents); m {
+				log.Debug(i18n.G(`inserting %s="%s" (double quotes)`, key, val))
+				re := regexp.MustCompile(fmt.Sprintf(`%s=".*"`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf(`%s="%s"`, key, val))
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf(`%s='.*'`, key), newContents); m {
+				log.Debug(i18n.G(`inserting %s='%s' (single quotes)`, key, val))
+				re := regexp.MustCompile(fmt.Sprintf(`%s='.*'`, key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf(`%s='%s'`, key, val))
+				continue
+			}
+
+			if m, _ := regexp.MatchString(fmt.Sprintf("%s=.*", key), newContents); m {
+				log.Debug(i18n.G("inserting %s=%s (no quotes)", key, val))
+				re := regexp.MustCompile(fmt.Sprintf("%s=.*", key))
+				newContents = re.ReplaceAllString(newContents, fmt.Sprintf("%s=%s", key, val))
+			}
+		}
+
+		err = os.WriteFile(appEnvPath, []byte(newContents), 0)
+		if err != nil {
+			log.Fatal(i18n.G("unable to write new env %s: %s", appEnvPath, err))
+		}
+
+		log.Info(i18n.G("%s successfully created", appEnvPath))
+
+		if composeFileUpdated {
+			log.Warn(i18n.G("manual update required: COMPOSE_FILE=\"%s\"", mergedEnv["COMPOSE_FILE"]))
+		}
+	},
+}
+
+var AppEnvCommand = &cobra.Command{
+	// translators: `app env` command group
+	Use:     i18n.G("env [cmd] [args] [flags]"),
+	Aliases: strings.Split(appEnvAliases, ","),
+	// translators: Short description for `app env` command group
+	Short: i18n.G("Manage app environment values"),
+}
+
+var (
+	server string
+)
+
+func init() {
+	AppEnvPullCommand.Flags().BoolVarP(
+		&internal.Force,
+		i18n.G("force"),
+		i18n.G("f"),
+		false,
+		i18n.G("perform action without further prompt"),
+	)
+
+	AppEnvPullCommand.Flags().StringVarP(
+		&server,
+		i18n.G("server"),
+		i18n.G("s"),
+		"",
+		i18n.G("server associated with deployed app"),
+	)
+
+	AppEnvPullCommand.RegisterFlagCompletionFunc(
+		i18n.G("server"),
+		func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+			return autocomplete.ServerNameComplete()
+		},
+	)
+}

cli/app/labels.go

@@ -13,7 +13,7 @@ import (
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/convert"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	dockerClient "github.com/docker/docker/client"
@@ -80,13 +80,13 @@ var AppLabelsCommand = &cobra.Command{
 
 		rows = append(rows, []string{i18n.G("RECIPE LABELS"), "---"})
 
-		config, err := app.Recipe.GetComposeConfig(app.Env)
+		config, err := app.Recipe.GetComposeConfig()
 		if err != nil {
 			log.Fatal(err)
 		}
 
 		var localLabelKeys []string
-		var appServiceConfig composetypes.ServiceConfig
+		var appServiceConfig composeGoTypes.ServiceConfig
 		for _, service := range config.Services {
 			if service.Name == "app" {
 				appServiceConfig = service

cli/app/list.go

@@ -25,7 +25,6 @@ type appStatus struct {
 	Status       string `json:"status"`
 	Chaos        string `json:"chaos"`
 	ChaosVersion string `json:"chaosVersion"`
-	AutoUpdate   string `json:"autoUpdate"`
 	Version      string `json:"version"`
 	Upgrade      string `json:"upgrade"`
 }
@@ -114,11 +113,14 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 				totalAppsCount++
 
 				if status {
+					if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+						log.Fatal(err)
+					}
+
 					status := i18n.G("unknown")
 					version := i18n.G("unknown")
 					chaos := i18n.G("unknown")
 					chaosVersion := i18n.G("unknown")
-					autoUpdate := i18n.G("unknown")
 					if statusMeta, ok := statuses[app.StackName()]; ok {
 						if currentVersion, exists := statusMeta["version"]; exists {
 							if currentVersion != "" {
@@ -131,9 +133,6 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 						if chaosDeployVersion, exists := statusMeta["chaosVersion"]; exists {
 							chaosVersion = chaosDeployVersion
 						}
-						if autoUpdateState, exists := statusMeta["autoUpdate"]; exists {
-							autoUpdate = autoUpdateState
-						}
 						if statusMeta["status"] != "" {
 							status = statusMeta["status"]
 						}
@@ -146,7 +145,6 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 					appStats.Chaos = chaos
 					appStats.ChaosVersion = chaosVersion
 					appStats.Version = version
-					appStats.AutoUpdate = autoUpdate
 
 					var newUpdates []string
 					if version != "unknown" && chaos == "false" {
@@ -165,6 +163,11 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 						}
 
 						for _, update := range updates {
+							if ok := tagcmp.IsParsable(update); !ok {
+								log.Debug(i18n.G("unable to parse %s, skipping as upgrade option", update))
+								continue
+							}
+
 							parsedUpdate, err := tagcmp.Parse(update)
 							if err != nil {
 								log.Fatal(err)
@@ -226,7 +229,6 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 					i18n.G("CHAOS"),
 					i18n.G("VERSION"),
 					i18n.G("UPGRADE"),
-					i18n.G("AUTOUPDATE"),
 				}...,
 				)
 			}
@@ -257,8 +259,7 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 						appStat.Status,
 						chaosStatus,
 						appStat.Version,
-						appStat.Upgrade,
-						appStat.AutoUpdate}...,
+						appStat.Upgrade}...,
 					)
 				}
 
@@ -328,6 +329,14 @@ func init() {
 		i18n.G("show apps of a specific server"),
 	)
 
+	AppListCommand.Flags().BoolVarP(
+		&internal.Chaos,
+		i18n.G("chaos"),
+		i18n.G("C"),
+		false,
+		i18n.G("ignore uncommitted recipes changes"),
+	)
+
 	AppListCommand.RegisterFlagCompletionFunc(
 		i18n.G("server"),
 		func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {

cli/app/move.go

@@ -128,6 +128,10 @@ Use "--dry-run/-r" to see which secrets and volumes will be moved.`),
 			secretName := strings.Join(sname[:len(sname)-1], "_")
 			data := resources.Secrets[secretName]
 			if err := client.StoreSecret(newServerClient, s.Spec.Name, data); err != nil {
+				if strings.Contains(err.Error(), "already exists") {
+					log.Info(i18n.G("skipping secret (because it already exists) on %s: %s", s.Spec.Name, newServer))
+					continue
+				}
 				log.Fatal(i18n.G("failed to store secret on %s: %s", err, newServer))
 			}
 			log.Info(i18n.G("created secret on %s: %s", s.Spec.Name, newServer))
@@ -258,8 +262,7 @@ func getAppResources(cl *dockerclient.Client, app app.App) (*AppResources, error
 		return nil, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles, Namespace: app.StackName()}
-	compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+	compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		return nil, err
 	}

cli/app/new.go

@@ -72,6 +72,10 @@ var AppNewCommand = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		recipe := internal.ValidateRecipe(args, cmd.Name())
 
+		if err := recipe.Ensure(internal.GetEnsureContext()); err != nil {
+			log.Fatal(err)
+		}
+
 		if len(args) == 2 && internal.Chaos {
 			log.Fatal(i18n.G("cannot use [version] and --chaos together"))
 		}
@@ -98,10 +102,14 @@ var AppNewCommand = &cobra.Command{
 			var recipeVersions recipePkg.RecipeVersions
 			if recipeVersion == "" {
 				var err error
-				recipeVersions, _, err = recipe.GetRecipeVersions()
+				var warnings []string
+				recipeVersions, warnings, err = recipe.GetRecipeVersions()
 				if err != nil {
 					log.Fatal(err)
 				}
+				for _, warning := range warnings {
+					log.Warn(warning)
+				}
 			}
 
 			if len(recipeVersions) > 0 {
@@ -110,6 +118,8 @@ var AppNewCommand = &cobra.Command{
 					recipeVersion = tag
 				}
 
+				log.Debug(i18n.G("selected recipe version: %s (from %d available versions)", recipeVersion, len(recipeVersions)))
+
 				if _, err := recipe.EnsureVersion(recipeVersion); err != nil {
 					log.Fatal(err)
 				}
@@ -192,7 +202,27 @@ var AppNewCommand = &cobra.Command{
 		log.Info(i18n.G("%s created (version: %s)", appDomain, recipeVersion))
 
 		if len(secretsConfig) > 0 {
-			log.Warn(i18n.G("%s requires secret generation before deploying, run \"abra app secret generate %s --all\"", recipe.Name, appDomain))
+			var (
+				hasSecretToGenerate bool
+				hasSecretToSkip     bool
+			)
+
+			for _, secretConfig := range secretsConfig {
+				if secretConfig.SkipGenerate {
+					hasSecretToSkip = true
+					continue
+				}
+
+				hasSecretToGenerate = true
+			}
+
+			if hasSecretToGenerate && !generateSecrets {
+				log.Warn(i18n.G("%s requires secret generation before deploy, run \"abra app secret generate %s --all\"", recipe.Name, appDomain))
+			}
+
+			if hasSecretToSkip {
+				log.Warn(i18n.G("%s requires secret insertion before deploy (#generate=false)", recipe.Name))
+			}
 		}
 
 		if len(appSecrets) > 0 {

cli/app/ps.go

@@ -4,7 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"sort"
+	"maps"
+	"slices"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
@@ -87,26 +88,19 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 		return
 	}
 
-	deployOpts := stack.Deploy{
-		Composefiles: composeFiles,
-		Namespace:    app.StackName(),
-		Prune:        false,
-		ResolveImage: stack.ResolveImageAlways,
-	}
-	compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+	compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		log.Fatal(err)
 		return
 	}
 
 	services := compose.Services
-	sort.Slice(services, func(i, j int) bool {
-		return services[i].Name < services[j].Name
-	})
 
 	var rows [][]string
 	allContainerStats := make(map[string]map[string]string)
-	for _, service := range services {
+	for _, serviceName := range slices.Sorted(maps.Keys(compose.Services)) {
+		service := services[serviceName]
+
 		filters := filters.NewArgs()
 		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service.Name))
 

cli/app/restart.go

@@ -128,6 +128,7 @@ Pass "--all-services/-a" to restart all services.`),
 				AppName:    app.Name,
 				ServerName: app.Server,
 				Filters:    f,
+				NoInput:    internal.NoInput,
 				NoLog:      true,
 				Quiet:      true,
 			}
@@ -166,7 +167,7 @@ func init() {
 	AppRestartCommand.Flags().BoolVarP(
 		&allServices,
 		i18n.G("all-services"),
-		i18n.G("a"),
+		i18n.GC("a", "app restart"),
 		false,
 		i18n.G("restart all services"),
 	)

cli/app/rollback.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"errors"
+	"fmt"
 	"strings"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
@@ -172,18 +173,19 @@ beforehand. See "abra app backup" for more.`),
 			Detach:       false,
 		}
 
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		appPkg.ExposeAllEnv(stackName, compose, app.Env)
+		newRecipeWithDowngradeVersion := fmt.Sprintf("%s:%s", app.Recipe.Name, chosenDowngrade)
+		appPkg.ExposeAllEnv(stackName, compose, app.Env, newRecipeWithDowngradeVersion)
+
 		appPkg.SetRecipeLabel(compose, stackName, app.Recipe.Name)
 		appPkg.SetChaosLabel(compose, stackName, internal.Chaos)
 		if internal.Chaos {
 			appPkg.SetChaosVersionLabel(compose, stackName, chosenDowngrade)
 		}
-		appPkg.SetUpdateLabel(compose, stackName, app.Env)
 
 		// Gather secrets
 		secretInfo, err := deploy.GatherSecretsForDeploy(cl, app, internal.ShowUnchanged)
@@ -203,10 +205,15 @@ beforehand. See "abra app backup" for more.`),
 			log.Fatal(err)
 		}
 
+		deployedVersion := deployMeta.Version
+		if deployMeta.IsChaos {
+			deployedVersion = deployMeta.ChaosVersion
+		}
+
 		// NOTE(d1): no release notes implemeneted for rolling back
 		if err := internal.DeployOverview(
 			app,
-			deployMeta.Version,
+			deployedVersion,
 			chosenDowngrade,
 			"",
 			downgradeWarnMessages,
@@ -239,6 +246,7 @@ beforehand. See "abra app backup" for more.`),
 			stackName,
 			app.Server,
 			internal.DontWaitConverge,
+			internal.NoInput,
 			f,
 		); err != nil {
 			log.Fatal(err)

cli/app/secret.go

@@ -165,7 +165,7 @@ var AppSecretInsertCommand = &cobra.Command{
 Arbitrary secret insertion is not supported. Secrets that are inserted must
 match those configured in the recipe beforehand.
 
-This can be useful when you want to manually generate secrets for an app
+This command can be useful when you want to manually generate secrets for an app
 environment. Typically, you can let Abra generate them for you on app creation
 (see "abra app new --secrets/-S" for more).`),
 	Example: i18n.G(`  # insert regular secret
@@ -574,7 +574,7 @@ func init() {
 	AppSecretGenerateCommand.Flags().BoolVarP(
 		&generateAllSecrets,
 		i18n.G("all"),
-		i18n.G("a"),
+		i18n.GC("a", "app secret generate"),
 		false,
 		i18n.G("generate all secrets"),
 	)
@@ -614,7 +614,7 @@ func init() {
 	AppSecretRmCommand.Flags().BoolVarP(
 		&rmAllSecrets,
 		i18n.G("all"),
-		i18n.G("a"),
+		i18n.GC("a", "app secret rm"),
 		false,
 		i18n.G("remove all secrets"),
 	)

cli/app/undeploy.go

@@ -28,6 +28,7 @@ var AppUndeployCommand = &cobra.Command{
 	Use: i18n.G("undeploy <domain> [flags]"),
 	// translators: Short description for `app undeploy` command
 	Aliases: strings.Split(appUndeployAliases, ","),
+	Short:   i18n.G("Undeploy a deployed app"),
 	Long: i18n.G(`This does not destroy any application data.
 
 However, you should remain vigilant, as your swarm installation will consider
@@ -65,10 +66,15 @@ Passing "--prune/-p" does not remove those volumes.`),
 			log.Fatal(i18n.G("%s is not deployed?", app.Name))
 		}
 
+		version := deployMeta.Version
+		if deployMeta.IsChaos {
+			version = deployMeta.ChaosVersion
+		}
+
 		if err := internal.DeployOverview(
 			app,
-			deployMeta.Version,
-			config.NO_DOMAIN_DEFAULT,
+			version,
+			config.MISSING_DEFAULT,
 			"",
 			nil,
 			nil,
@@ -83,8 +89,7 @@ Passing "--prune/-p" does not remove those volumes.`),
 			log.Fatal(err)
 		}
 
-		opts := stack.Deploy{Composefiles: composeFiles, Namespace: stackName}
-		compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -110,7 +115,7 @@ Passing "--prune/-p" does not remove those volumes.`),
 
 		log.Info(i18n.G("undeploy succeeded 🟢"))
 
-		if err := app.WriteRecipeVersion(deployMeta.Version, false); err != nil {
+		if err := app.WriteRecipeVersion(version, false); err != nil {
 			log.Fatal(i18n.G("writing recipe version failed: %s", err))
 		}
 	},

cli/app/upgrade.go

@@ -185,18 +185,19 @@ beforehand. See "abra app backup" for more.`),
 			Detach:       false,
 		}
 
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
 
-		appPkg.ExposeAllEnv(stackName, compose, app.Env)
+		newRecipeWithUpgradeVersion := fmt.Sprintf("%s:%s", app.Recipe.Name, chosenUpgrade)
+		appPkg.ExposeAllEnv(stackName, compose, app.Env, newRecipeWithUpgradeVersion)
+
 		appPkg.SetRecipeLabel(compose, stackName, app.Recipe.Name)
 		appPkg.SetChaosLabel(compose, stackName, internal.Chaos)
 		if internal.Chaos {
 			appPkg.SetChaosVersionLabel(compose, stackName, chosenUpgrade)
 		}
-		appPkg.SetUpdateLabel(compose, stackName, app.Env)
 
 		envVars, err := appPkg.CheckEnv(app)
 		if err != nil {
@@ -241,9 +242,14 @@ beforehand. See "abra app backup" for more.`),
 			)
 		}
 
+		deployedVersion := deployMeta.Version
+		if deployMeta.IsChaos {
+			deployedVersion = deployMeta.ChaosVersion
+		}
+
 		if err := internal.DeployOverview(
 			app,
-			deployMeta.Version,
+			deployedVersion,
 			chosenUpgrade,
 			upgradeReleaseNotes,
 			upgradeWarnMessages,
@@ -276,6 +282,7 @@ beforehand. See "abra app backup" for more.`),
 			stackName,
 			app.Server,
 			internal.DontWaitConverge,
+			internal.NoInput,
 			f,
 		); err != nil {
 			log.Fatal(err)

cli/internal/deploy.go

@@ -64,14 +64,14 @@ func DeployOverview(
 		server = "local"
 	}
 
-	domain := app.Domain
+	domain := fmt.Sprintf("https://%s", app.Domain)
 	if domain == "" {
-		domain = config.NO_DOMAIN_DEFAULT
+		domain = config.MISSING_DEFAULT
 	}
 
 	envVersion := app.Recipe.EnvVersionRaw
 	if envVersion == "" {
-		envVersion = config.NO_VERSION_DEFAULT
+		envVersion = config.MISSING_DEFAULT
 	}
 
 	rows := [][]string{
@@ -127,7 +127,7 @@ func DeployOverview(
 	}
 
 	response := false
-	prompt := &survey.Confirm{Message: "proceed?"}
+	prompt := &survey.Confirm{Message: i18n.G("proceed?")}
 	if err := survey.AskOne(prompt, &response); err != nil {
 		return err
 	}
@@ -140,32 +140,40 @@ func DeployOverview(
 }
 
 func getDeployType(currentVersion, newVersion string) string {
-	if newVersion == config.NO_DOMAIN_DEFAULT {
+	if newVersion == config.MISSING_DEFAULT {
 		return i18n.G("UNDEPLOY")
 	}
+
 	if strings.Contains(newVersion, "+U") {
 		return i18n.G("CHAOS DEPLOY")
 	}
+
 	if strings.Contains(currentVersion, "+U") {
 		return i18n.G("UNCHAOS DEPLOY")
 	}
+
 	if currentVersion == newVersion {
 		return ("REDEPLOY")
 	}
-	if currentVersion == config.NO_VERSION_DEFAULT {
+
+	if currentVersion == config.MISSING_DEFAULT {
 		return i18n.G("NEW DEPLOY")
 	}
+
 	currentParsed, err := tagcmp.Parse(currentVersion)
 	if err != nil {
 		return i18n.G("DEPLOY")
 	}
+
 	newParsed, err := tagcmp.Parse(newVersion)
 	if err != nil {
 		return i18n.G("DEPLOY")
 	}
+
 	if currentParsed.IsLessThan(newParsed) {
 		return i18n.G("UPGRADE")
 	}
+
 	return i18n.G("DOWNGRADE")
 }
 
@@ -183,17 +191,17 @@ func MoveOverview(
 
 	domain := app.Domain
 	if domain == "" {
-		domain = config.NO_DOMAIN_DEFAULT
+		domain = config.MISSING_DEFAULT
 	}
 
 	secretsOverview := strings.Join(secrets, "\n")
 	if len(secrets) == 0 {
-		secretsOverview = config.NO_SECRETS_DEFAULT
+		secretsOverview = config.MISSING_DEFAULT
 	}
 
 	volumesOverview := strings.Join(volumes, "\n")
 	if len(volumes) == 0 {
-		volumesOverview = config.NO_VOLUMES_DEFAULT
+		volumesOverview = config.MISSING_DEFAULT
 	}
 
 	rows := [][]string{

cli/internal/recipe.go

@@ -92,10 +92,11 @@ func SetBumpType(bumpType string) {
 func GetMainAppImage(recipe recipe.Recipe) (string, error) {
 	var path string
 
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return "", err
 	}
+
 	for _, service := range config.Services {
 		if service.Name == "app" {
 			img, err := reference.ParseNormalizedNamed(service.Image)

cli/internal/validate.go

@@ -70,21 +70,6 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 		log.Fatal(err)
 	}
 
-	_, err = chosenRecipe.GetComposeConfig(nil)
-	if err != nil {
-		if cmdName == i18n.G("generate") {
-			if strings.Contains(err.Error(), "missing a compose") {
-				log.Fatal(err)
-			}
-			log.Warn(err)
-		} else {
-			if strings.Contains(err.Error(), "template_driver is not allowed") {
-				log.Warn(i18n.G("ensure %s recipe compose.* files include \"version: '3.8'\"", recipeName))
-			}
-			log.Fatal(i18n.G("unable to validate recipe: %s", err))
-		}
-	}
-
 	log.Debug(i18n.G("validated %s as recipe argument", recipeName))
 
 	return chosenRecipe

cli/recipe/fetch.go

@@ -119,7 +119,7 @@ func init() {
 	RecipeFetchCommand.Flags().BoolVarP(
 		&fetchAllRecipes,
 		i18n.G("all"),
-		i18n.G("a"),
+		i18n.GC("a", "recipe fetch"),
 		false,
 		i18n.G("fetch all recipes"),
 	)

cli/recipe/release.go

@@ -14,7 +14,7 @@ import (
 	gitPkg "coopcloud.tech/abra/pkg/git"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/recipe"
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/distribution/reference"
@@ -23,6 +23,9 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// Errors
+var errEmptyVersionsInCatalogue = errors.New(i18n.G("catalogue versions list is unexpectedly empty"))
+
 // translators: `abra recipe release` aliases. use a comma separated list of
 // aliases with no spaces in between
 var recipeReleaseAliases = i18n.G("rl")
@@ -50,7 +53,7 @@ recipe updates are properly communicated. I.e. developers of an app might
 publish a minor version but that might lead to changes in the recipe which are
 major and therefore require intervention while doing the upgrade work.
 
-Publish your new release to git.coopcloud.tech with "--publish/-p". This
+This command will publish your new release to git.coopcloud.tech. This
 requires that you have permission to git push to these repositories and have
 your SSH keys configured on your account. Enable ssh-agent and make sure to add
 your private key and enter your passphrase beforehand.
@@ -60,12 +63,13 @@ your private key and enter your passphrase beforehand.
 	Example: `  # publish release
   eval ` + "`ssh-agent`" + `
   ssh-add ~/.ssh/id_ed25519
-  abra recipe release gitea -p`,
+  abra recipe release gitea`,
 	Args: cobra.RangeArgs(1, 2),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		switch l := len(args); l {
 		case 0:
 			return autocomplete.RecipeNameComplete()
@@ -93,21 +97,6 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(i18n.G("main app service version for %s is empty?", recipe.Name))
 		}
 
-		var tagString string
-		if len(args) == 2 {
-			tagString = args[1]
-		}
-
-		if tagString != "" {
-			if _, err := tagcmp.Parse(tagString); err != nil {
-				log.Fatal(i18n.G("cannot parse %s, invalid tag specified?", tagString))
-			}
-		}
-
-		if (internal.Major || internal.Minor || internal.Patch) && tagString != "" {
-			log.Fatal(i18n.G("cannot specify tag and bump type at the same time"))
-		}
-
 		repo, err := git.PlainOpen(recipe.Dir)
 		if err != nil {
 			log.Fatal(err)
@@ -118,16 +107,13 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(err)
 		}
 
-		if tagString != "" {
-			if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				log.Fatal(err)
-			}
+		isClean, err := gitPkg.IsClean(recipe.Dir)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !isClean {
+			log.Fatal(i18n.G("working directory not clean in %s, aborting", recipe.Dir))
 		}
 
 		tags, err := recipe.Tags()
@@ -135,64 +121,202 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(err)
 		}
 
+		var tagString string
+		if len(args) == 2 {
+			tagString = args[1]
+		}
+
+		if (internal.Major || internal.Minor || internal.Patch) && tagString != "" {
+			log.Fatal(i18n.G("cannot specify tag and bump type at the same time"))
+		}
+
+		if len(tags) == 0 && tagString == "" {
+			log.Warn(i18n.G("no git tags found for %s", recipe.Name))
+			if internal.NoInput {
+				log.Fatal(i18n.G("unable to continue, input required for initial version"))
+			}
+			fmt.Println(i18n.G(`
+The following options are two types of initial semantic version that you can
+pick for %s that will be published in the recipe catalogue. This follows the
+semver convention (more on https://semver.org), here is a short cheatsheet
+
+    0.1.0: development release, still hacking. when you make a major upgrade
+           you increment the "y" part (i.e. 0.1.0 -> 0.2.0) and only move to
+           using the "x" part when things are stable.
+
+    1.0.0: public release, assumed to be working. you already have a stable
+           and reliable deployment of this app and feel relatively confident
+           about it.
+
+If you want people to be able alpha test your current config for %s but don't
+think it is quite reliable, go with 0.1.0 and people will know that things are
+likely to change.
+
+`, recipe.Name, recipe.Name))
+			var chosenVersion string
+			edPrompt := &survey.Select{
+				Message: i18n.G("which version do you want to begin with?"),
+				Options: []string{"0.1.0", "1.0.0"},
+			}
+
+			if err := survey.AskOne(edPrompt, &chosenVersion); err != nil {
+				log.Fatal(err)
+			}
+
+			tagString = fmt.Sprintf("%s+%s", chosenVersion, mainAppVersion)
+		}
+
 		if tagString == "" && (!internal.Major && !internal.Minor && !internal.Patch) {
-			var err error
-			tagString, err = getLabelVersion(recipe, false)
+
+			catl, err := recipePkg.ReadRecipeCatalogue(false)
 			if err != nil {
 				log.Fatal(err)
 			}
-		}
 
-		isClean, err := gitPkg.IsClean(recipe.Dir)
-		if err != nil {
-			log.Fatal(err)
-		}
+			changesTable, err := formatter.CreateTable()
+			if err != nil {
+				log.Fatal(err)
+			}
 
-		if !isClean {
-			log.Info(i18n.G("%s currently has these unstaged changes 👇", recipe.Name))
-			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
+			latestRelease := tags[len(tags)-1]
+			latestRecipeVersion, err := getLatestVersion(recipe, catl)
+			if err != nil && err != errEmptyVersionsInCatalogue {
+				log.Fatal(err)
+			}
+			changesTable.Headers(i18n.G("SERVICE"), latestRelease, i18n.G("PROPOSED CHANGES"))
+
+			allRecipeVersions := catl[recipe.Name].Versions
+			for _, recipeVersion := range allRecipeVersions {
+				if serviceVersions, ok := recipeVersion[latestRecipeVersion]; ok {
+					for serviceName := range serviceVersions {
+						serviceMeta := serviceVersions[serviceName]
+
+						existingImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, serviceMeta.Tag)
+						newImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, imagesTmp[serviceMeta.Image])
+
+						if existingImageTag == newImageTag {
+							continue
+						}
+
+						changesTable.Row([]string{serviceName, existingImageTag, newImageTag}...)
+					}
+				}
+			}
+
+			changeOverview := changesTable.Render()
+
+			if err := internal.PromptBumpType("", latestRelease, changeOverview); err != nil {
 				log.Fatal(err)
 			}
 		}
 
-		if len(tags) > 0 {
-			log.Warn(i18n.G("previous git tags detected, assuming new semver release"))
-
-			if err := createReleaseFromPreviousTag(tagString, mainAppVersion, recipe, tags); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
+		if tagString == "" {
+			var lastGitTag tagcmp.Tag
+			iter, err := repo.Tags()
+			if err != nil {
 				log.Fatal(err)
 			}
-		} else {
-			log.Warn(i18n.G("no tag specified and no previous tag available for %s, assuming initial release", recipe.Name))
 
-			if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
+			if err := iter.ForEach(func(ref *plumbing.Reference) error {
+				obj, err := repo.TagObject(ref.Hash())
+				if err != nil {
+					log.Fatal(i18n.G("tag at commit %s is unannotated or otherwise broken", ref.Hash()))
+					return err
 				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
+
+				tagcmpTag, err := tagcmp.Parse(obj.Name)
+				if err != nil {
+					return err
 				}
+
+				if (lastGitTag == tagcmp.Tag{}) {
+					lastGitTag = tagcmpTag
+				} else if tagcmpTag.IsGreaterThan(lastGitTag) {
+					lastGitTag = tagcmpTag
+				}
+
+				return nil
+			}); err != nil {
 				log.Fatal(err)
 			}
+
+			// bumpType is used to decide what part of the tag should be incremented
+			bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
+			if bumpType != 0 {
+				// a bitwise check if the number is a power of 2
+				if (bumpType & (bumpType - 1)) != 0 {
+					log.Fatal(i18n.G("you can only use one version flag: --major, --minor or --patch"))
+				}
+			}
+
+			newTag := lastGitTag
+			if bumpType > 0 {
+				if internal.Patch {
+					now, err := strconv.Atoi(newTag.Patch)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = strconv.Itoa(now + 1)
+				} else if internal.Minor {
+					now, err := strconv.Atoi(newTag.Minor)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = "0"
+					newTag.Minor = strconv.Itoa(now + 1)
+				} else if internal.Major {
+					now, err := strconv.Atoi(newTag.Major)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = "0"
+					newTag.Minor = "0"
+					newTag.Major = strconv.Itoa(now + 1)
+				}
+			}
+
+			newTag.Metadata = mainAppVersion
+			log.Debug(i18n.G("choosing %s as new version for %s", newTag.String(), recipe.Name))
+			tagString = newTag.String()
+		}
+
+		if _, err := tagcmp.Parse(tagString); err != nil {
+			log.Fatal(i18n.G("invalid version %s specified", tagString))
+		}
+
+		for _, tag := range tags {
+			previousTagLeftHand := strings.Split(tag, "+")[0]
+			newTagStringLeftHand := strings.Split(tagString, "+")[0]
+			if previousTagLeftHand == newTagStringLeftHand {
+				log.Fatal(i18n.G("%s+... conflicts with a previous release: %s", newTagStringLeftHand, tag))
+			}
 		}
 
-		return
+		if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
+			if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
+				log.Fatal(i18n.G("unable to clean up tag after failed release attempt: %s", cleanErr))
+			}
+			if resetErr := resetCommit(recipe, preCommitHead); resetErr != nil {
+				log.Fatal(i18n.G("unable to reset commit after failed release attempt: %s", resetErr))
+			}
+			log.Error(err)
+			log.Fatal(i18n.G("release failed. any changes made have been reverted"))
+		}
 	},
 }
 
 // GetImageVersions retrieves image versions for a recipe
-func GetImageVersions(recipe recipe.Recipe) (map[string]string, error) {
+func GetImageVersions(recipe recipePkg.Recipe) (map[string]string, error) {
 	services := make(map[string]string)
 
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return nil, err
 	}
+
 	missingTag := false
 	for _, service := range config.Services {
 		if service.Image == "" {
@@ -230,7 +354,7 @@ func GetImageVersions(recipe recipe.Recipe) (map[string]string, error) {
 }
 
 // createReleaseFromTag creates a new release based on a supplied recipe version string
-func createReleaseFromTag(recipe recipe.Recipe, tagString, mainAppVersion string) error {
+func createReleaseFromTag(recipe recipePkg.Recipe, tagString, mainAppVersion string) error {
 	var err error
 
 	repo, err := git.PlainOpen(recipe.Dir)
@@ -238,23 +362,14 @@ func createReleaseFromTag(recipe recipe.Recipe, tagString, mainAppVersion string
 		return err
 	}
 
-	tag, err := tagcmp.Parse(tagString)
-	if err != nil {
-		return err
-	}
-
-	if tag.MissingMinor {
-		tag.Minor = "0"
-		tag.MissingMinor = false
-	}
-
-	if tag.MissingPatch {
-		tag.Patch = "0"
-		tag.MissingPatch = false
-	}
-
-	if tagString == "" {
-		tagString = fmt.Sprintf("%s+%s", tag.String(), mainAppVersion)
+	mainService := "app"
+	label := fmt.Sprintf("coop-cloud.${STACK_NAME}.version=%s", tagString)
+	if !internal.Dry {
+		if err := recipe.UpdateLabel("compose.y*ml", mainService, label); err != nil {
+			log.Fatal(err)
+		}
+	} else {
+		log.Info(i18n.G("dry run: not syncing label %s for recipe %s", tagString, recipe.Name))
 	}
 
 	if err := addReleaseNotes(recipe, tagString); err != nil {
@@ -293,7 +408,7 @@ func getTagCreateOptions(tag string) (git.CreateTagOptions, error) {
 
 // addReleaseNotes checks if the release/next release note exists and moves the
 // file to release/<tag>.
-func addReleaseNotes(recipe recipe.Recipe, tag string) error {
+func addReleaseNotes(recipe recipePkg.Recipe, tag string) error {
 	releaseDir := path.Join(recipe.Dir, "release")
 	if _, err := os.Stat(releaseDir); errors.Is(err, os.ErrNotExist) {
 		if err := os.Mkdir(releaseDir, 0755); err != nil {
@@ -321,7 +436,7 @@ func addReleaseNotes(recipe recipe.Recipe, tag string) error {
 
 		if !internal.NoInput {
 			prompt := &survey.Confirm{
-				Message: i18n.G("Use release note in release/next?"),
+				Message: i18n.G("use release note in release/next?"),
 			}
 
 			if err := survey.AskOne(prompt, &addNextAsReleaseNotes); err != nil {
@@ -378,7 +493,7 @@ func addReleaseNotes(recipe recipe.Recipe, tag string) error {
 	return nil
 }
 
-func commitRelease(recipe recipe.Recipe, tag string) error {
+func commitRelease(recipe recipePkg.Recipe, tag string) error {
 	if internal.Dry {
 		log.Debug(i18n.G("dry run: no changes committed"))
 		return nil
@@ -430,140 +545,30 @@ func tagRelease(tagString string, repo *git.Repository) error {
 	return nil
 }
 
-func pushRelease(recipe recipe.Recipe, tagString string) error {
+func pushRelease(recipe recipePkg.Recipe, tagString string) error {
 	if internal.Dry {
 		log.Info(i18n.G("dry run: no changes published"))
 		return nil
 	}
 
-	if !publish && !internal.NoInput {
-		prompt := &survey.Confirm{
-			Message: i18n.G("publish new release?"),
-		}
-
-		if err := survey.AskOne(prompt, &publish); err != nil {
-			return err
-		}
+	if os.Getenv("SSH_AUTH_SOCK") == "" {
+		return errors.New(i18n.G("ssh-agent not found. see \"abra recipe release --help\" and try again"))
 	}
 
-	if publish {
-		if os.Getenv("SSH_AUTH_SOCK") == "" {
-			return errors.New(i18n.G("ssh-agent not found. see \"abra recipe release --help\" and try again"))
-		}
-
-		if err := recipe.Push(internal.Dry); err != nil {
-			return err
-		}
-
-		url := fmt.Sprintf("%s/src/tag/%s", recipe.GitURL, tagString)
-		log.Info(i18n.G("new release published: %s", url))
-	} else {
-		log.Info(i18n.G("no -p/--publish passed, not publishing"))
-	}
-
-	return nil
-}
-
-func createReleaseFromPreviousTag(tagString, mainAppVersion string, recipe recipe.Recipe, tags []string) error {
-	repo, err := git.PlainOpen(recipe.Dir)
-	if err != nil {
+	if err := recipe.Push(internal.Dry); err != nil {
 		return err
 	}
 
-	bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
-	if bumpType != 0 {
-		if (bumpType & (bumpType - 1)) != 0 {
-			return errors.New(i18n.G("you can only use one of: --major, --minor, --patch"))
-		}
-	}
-
-	var lastGitTag tagcmp.Tag
-	for _, tag := range tags {
-		parsed, err := tagcmp.Parse(tag)
-		if err != nil {
-			return err
-		}
-
-		if (lastGitTag == tagcmp.Tag{}) {
-			lastGitTag = parsed
-		} else if parsed.IsGreaterThan(lastGitTag) {
-			lastGitTag = parsed
-		}
-	}
-
-	newTag := lastGitTag
-	if internal.Patch {
-		now, err := strconv.Atoi(newTag.Patch)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = strconv.Itoa(now + 1)
-	} else if internal.Minor {
-		now, err := strconv.Atoi(newTag.Minor)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = "0"
-		newTag.Minor = strconv.Itoa(now + 1)
-	} else if internal.Major {
-		now, err := strconv.Atoi(newTag.Major)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = "0"
-		newTag.Minor = "0"
-		newTag.Major = strconv.Itoa(now + 1)
-	}
-
-	if internal.Major || internal.Minor || internal.Patch {
-		newTag.Metadata = mainAppVersion
-		tagString = newTag.String()
-	}
-
-	if lastGitTag.String() == tagString {
-		return errors.New(i18n.G("latest git tag (%s) and synced label (%s) are the same?", lastGitTag, tagString))
-	}
-
-	if !internal.NoInput {
-		prompt := &survey.Confirm{
-			Message: i18n.G("current: %s, new: %s, correct?", lastGitTag, tagString),
-		}
-
-		var ok bool
-		if err := survey.AskOne(prompt, &ok); err != nil {
-			return err
-		}
-
-		if !ok {
-			return errors.New(i18n.G("exiting as requested"))
-		}
-	}
-
-	if err := addReleaseNotes(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to add release notes: %s", err.Error()))
-	}
-
-	if err := commitRelease(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to commit changes: %s", err.Error()))
-	}
-
-	if err := tagRelease(tagString, repo); err != nil {
-		return errors.New(i18n.G("failed to tag release: %s", err.Error()))
-	}
-
-	if err := pushRelease(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to publish new release: %s", err.Error()))
-	}
+	url := fmt.Sprintf("%s/src/tag/%s", recipe.GitURL, tagString)
+	log.Info(i18n.G("new release published: %s", url))
 
 	return nil
 }
 
-// cleanCommit soft removes the latest release commit. No change are lost the
-// the commit itself is removed. This is the equivalent of `git reset HEAD~1`.
-func cleanCommit(recipe recipe.Recipe, head *plumbing.Reference) error {
+// resetCommit hard resets to the state before release was started.
+// This will only remove changes made by the release process due to requiring
+// a clean working directory.
+func resetCommit(recipe recipePkg.Recipe, head *plumbing.Reference) error {
 	repo, err := git.PlainOpen(recipe.Dir)
 	if err != nil {
 		return errors.New(i18n.G("unable to open repo in %s: %s", recipe.Dir, err))
@@ -574,18 +579,18 @@ func cleanCommit(recipe recipe.Recipe, head *plumbing.Reference) error {
 		return errors.New(i18n.G("unable to open work tree in %s: %s", recipe.Dir, err))
 	}
 
-	opts := &git.ResetOptions{Commit: head.Hash(), Mode: git.MixedReset}
+	opts := &git.ResetOptions{Commit: head.Hash(), Mode: git.HardReset}
 	if err := worktree.Reset(opts); err != nil {
-		return errors.New(i18n.G("unable to soft reset %s: %s", recipe.Dir, err))
+		return errors.New(i18n.G("unable to hard reset %s: %s", recipe.Dir, err))
 	}
 
-	log.Debug(i18n.G("removed freshly created commit"))
+	log.Debug(i18n.G("reset commit to pre-release state"))
 
 	return nil
 }
 
 // cleanTag removes a freshly created tag
-func cleanTag(recipe recipe.Recipe, tag string) error {
+func cleanTag(recipe recipePkg.Recipe, tag string) error {
 	repo, err := git.PlainOpen(recipe.Dir)
 	if err != nil {
 		return errors.New(i18n.G("unable to open repo in %s: %s", recipe.Dir, err))
@@ -602,37 +607,17 @@ func cleanTag(recipe recipe.Recipe, tag string) error {
 	return nil
 }
 
-func getLabelVersion(recipe recipe.Recipe, prompt bool) (string, error) {
-	initTag, err := recipe.GetVersionLabelLocal()
+func getLatestVersion(recipe recipePkg.Recipe, catl recipePkg.RecipeCatalogue) (string, error) {
+	versions, err := recipePkg.GetRecipeCatalogueVersions(recipe.Name, catl)
 	if err != nil {
 		return "", err
 	}
-
-	if initTag == "" {
-		return "", errors.New(i18n.G("unable to read version for %s from synced label. Did you try running \"abra recipe sync %s\" already?", recipe.Name, recipe.Name))
+	if len(versions) > 0 {
+		return versions[len(versions)-1], nil
 	}
-
-	log.Warn(i18n.G("discovered %s as currently synced recipe label", initTag))
-
-	if prompt && !internal.NoInput {
-		var response bool
-		prompt := &survey.Confirm{Message: i18n.G("use %s as the new version?", initTag)}
-		if err := survey.AskOne(prompt, &response); err != nil {
-			return "", err
-		}
-
-		if !response {
-			return "", errors.New(i18n.G("please fix your synced label for %s and re-run this command", recipe.Name))
-		}
-	}
-
-	return initTag, nil
+	return "", errEmptyVersionsInCatalogue
 }
 
-var (
-	publish bool
-)
-
 func init() {
 	RecipeReleaseCommand.Flags().BoolVarP(
 		&internal.Dry,
@@ -665,12 +650,4 @@ func init() {
 		false,
 		i18n.G("increase the patch part of the version"),
 	)
-
-	RecipeReleaseCommand.Flags().BoolVarP(
-		&publish,
-		i18n.G("publish"),
-		i18n.G("p"),
-		false,
-		i18n.G("publish changes to git.coopcloud.tech"),
-	)
 }

cli/recipe/release_test.go

@@ -0,0 +1,33 @@
+package recipe
+
+import (
+	"testing"
+
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetLatestVersionReturnsErrorWhenVersionsIsEmpty(t *testing.T) {
+	recipe := recipePkg.Recipe{}
+	catalogue := recipePkg.RecipeCatalogue{}
+	_, err := getLatestVersion(recipe, catalogue)
+	assert.Equal(t, err, errEmptyVersionsInCatalogue)
+}
+
+func TestGetLatestVersionReturnsLastVersion(t *testing.T) {
+	recipe := recipePkg.Recipe{
+		Name: "test",
+	}
+	versions := []map[string]map[string]recipePkg.ServiceMeta{
+		make(map[string]map[string]recipePkg.ServiceMeta),
+		make(map[string]map[string]recipePkg.ServiceMeta),
+	}
+	versions[0]["0.0.3"] = make(map[string]recipePkg.ServiceMeta)
+	versions[1]["0.0.2"] = make(map[string]recipePkg.ServiceMeta)
+	catalogue := make(recipePkg.RecipeCatalogue)
+	catalogue["test"] = recipePkg.RecipeMeta{
+		Versions: versions,
+	}
+	version, _ := getLatestVersion(recipe, catalogue)
+	assert.Equal(t, version, "0.0.3")
+}

cli/recipe/sync.go

@@ -1,298 +0,0 @@
-package recipe
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/formatter"
-	gitPkg "coopcloud.tech/abra/pkg/git"
-	"coopcloud.tech/abra/pkg/i18n"
-	"coopcloud.tech/abra/pkg/log"
-	recipePkg "coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/tagcmp"
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/spf13/cobra"
-)
-
-// translators: `abra recipe reset` aliases. use a comma separated list of
-// aliases with no spaces in between
-var recipeSyncAliases = i18n.G("s")
-
-var RecipeSyncCommand = &cobra.Command{
-	// translators: `recipe sync` command
-	Use:     i18n.G("sync <recipe> [version] [flags]"),
-	Aliases: strings.Split(recipeSyncAliases, ","),
-	// translators: Short description for `recipe sync` command
-	Short: i18n.G("Sync recipe version label"),
-	Long: i18n.G(`Generate labels for the main recipe service.
-
-By convention, the service named "app" using the following format:
-
-    coop-cloud.${STACK_NAME}.version=<version>
-
-Where [version] can be specifed on the command-line or Abra can attempt to
-auto-generate it for you. The <recipe> configuration will be updated on the
-local file system.`),
-	Args: cobra.RangeArgs(1, 2),
-	ValidArgsFunction: func(
-		cmd *cobra.Command,
-		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
-		switch l := len(args); l {
-		case 0:
-			return autocomplete.RecipeNameComplete()
-		case 1:
-			return autocomplete.RecipeVersionComplete(args[0])
-		default:
-			return nil, cobra.ShellCompDirectiveError
-		}
-	},
-	Run: func(cmd *cobra.Command, args []string) {
-		recipe := internal.ValidateRecipe(args, cmd.Name())
-
-		mainApp, err := internal.GetMainAppImage(recipe)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		imagesTmp, err := GetImageVersions(recipe)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		mainAppVersion := imagesTmp[mainApp]
-
-		tags, err := recipe.Tags()
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		var nextTag string
-		if len(args) == 2 {
-			nextTag = args[1]
-		}
-
-		if len(tags) == 0 && nextTag == "" {
-			log.Warn(i18n.G("no git tags found for %s", recipe.Name))
-			if internal.NoInput {
-				log.Fatal(i18n.G("unable to continue, input required for initial version"))
-			}
-			fmt.Println(i18n.G(`
-The following options are two types of initial semantic version that you can
-pick for %s that will be published in the recipe catalogue. This follows the
-semver convention (more on https://semver.org), here is a short cheatsheet
-
-    0.1.0: development release, still hacking. when you make a major upgrade
-           you increment the "y" part (i.e. 0.1.0 -> 0.2.0) and only move to
-           using the "x" part when things are stable.
-
-    1.0.0: public release, assumed to be working. you already have a stable
-           and reliable deployment of this app and feel relatively confident
-           about it.
-
-If you want people to be able alpha test your current config for %s but don't
-think it is quite reliable, go with 0.1.0 and people will know that things are
-likely to change.
-
-`, recipe.Name, recipe.Name))
-			var chosenVersion string
-			edPrompt := &survey.Select{
-				Message: i18n.G("which version do you want to begin with?"),
-				Options: []string{"0.1.0", "1.0.0"},
-			}
-
-			if err := survey.AskOne(edPrompt, &chosenVersion); err != nil {
-				log.Fatal(err)
-			}
-
-			nextTag = fmt.Sprintf("%s+%s", chosenVersion, mainAppVersion)
-		}
-
-		if nextTag == "" && (!internal.Major && !internal.Minor && !internal.Patch) {
-			var changeOverview string
-
-			catl, err := recipePkg.ReadRecipeCatalogue(false)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			versions, err := recipePkg.GetRecipeCatalogueVersions(recipe.Name, catl)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			changesTable, err := formatter.CreateTable()
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			latestRelease := tags[len(tags)-1]
-			changesTable.Headers(i18n.G("SERVICE"), latestRelease, i18n.G("PROPOSED CHANGES"))
-
-			latestRecipeVersion := versions[len(versions)-1]
-			allRecipeVersions := catl[recipe.Name].Versions
-			for _, recipeVersion := range allRecipeVersions {
-				if serviceVersions, ok := recipeVersion[latestRecipeVersion]; ok {
-					for serviceName := range serviceVersions {
-						serviceMeta := serviceVersions[serviceName]
-						changesTable.Row(
-							[]string{
-								serviceName,
-								fmt.Sprintf("%s:%s", serviceMeta.Image, serviceMeta.Tag),
-								fmt.Sprintf("%s:%s", serviceMeta.Image, imagesTmp[serviceMeta.Image]),
-							}...,
-						)
-					}
-				}
-			}
-
-			changeOverview = changesTable.Render()
-
-			if err := internal.PromptBumpType("", latestRelease, changeOverview); err != nil {
-				log.Fatal(err)
-			}
-		}
-
-		if nextTag == "" {
-			repo, err := git.PlainOpen(recipe.Dir)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			var lastGitTag tagcmp.Tag
-			iter, err := repo.Tags()
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			if err := iter.ForEach(func(ref *plumbing.Reference) error {
-				obj, err := repo.TagObject(ref.Hash())
-				if err != nil {
-					log.Fatal(i18n.G("tag at commit %s is unannotated or otherwise broken", ref.Hash()))
-					return err
-				}
-
-				tagcmpTag, err := tagcmp.Parse(obj.Name)
-				if err != nil {
-					return err
-				}
-
-				if (lastGitTag == tagcmp.Tag{}) {
-					lastGitTag = tagcmpTag
-				} else if tagcmpTag.IsGreaterThan(lastGitTag) {
-					lastGitTag = tagcmpTag
-				}
-
-				return nil
-			}); err != nil {
-				log.Fatal(err)
-			}
-
-			// bumpType is used to decide what part of the tag should be incremented
-			bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
-			if bumpType != 0 {
-				// a bitwise check if the number is a power of 2
-				if (bumpType & (bumpType - 1)) != 0 {
-					log.Fatal(i18n.G("you can only use one version flag: --major, --minor or --patch"))
-				}
-			}
-
-			newTag := lastGitTag
-			if bumpType > 0 {
-				if internal.Patch {
-					now, err := strconv.Atoi(newTag.Patch)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = strconv.Itoa(now + 1)
-				} else if internal.Minor {
-					now, err := strconv.Atoi(newTag.Minor)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = "0"
-					newTag.Minor = strconv.Itoa(now + 1)
-				} else if internal.Major {
-					now, err := strconv.Atoi(newTag.Major)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = "0"
-					newTag.Minor = "0"
-					newTag.Major = strconv.Itoa(now + 1)
-				}
-			}
-
-			newTag.Metadata = mainAppVersion
-			log.Debug(i18n.G("choosing %s as new version for %s", newTag.String(), recipe.Name))
-			nextTag = newTag.String()
-		}
-
-		if _, err := tagcmp.Parse(nextTag); err != nil {
-			log.Fatal(i18n.G("invalid version %s specified", nextTag))
-		}
-
-		mainService := "app"
-		label := i18n.G("coop-cloud.${STACK_NAME}.version=%s", nextTag)
-		if !internal.Dry {
-			if err := recipe.UpdateLabel("compose.y*ml", mainService, label); err != nil {
-				log.Fatal(err)
-			}
-		} else {
-			log.Info(i18n.G("dry run: not syncing label %s for recipe %s", nextTag, recipe.Name))
-		}
-
-		isClean, err := gitPkg.IsClean(recipe.Dir)
-		if err != nil {
-			log.Fatal(err)
-		}
-		if !isClean {
-			log.Info(i18n.G("%s currently has these unstaged changes 👇", recipe.Name))
-			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
-				log.Fatal(err)
-			}
-		}
-	},
-}
-
-func init() {
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Dry,
-		i18n.G("dry-run"),
-		i18n.G("r"),
-		false,
-		i18n.G("report changes that would be made"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Major,
-		i18n.G("major"),
-		i18n.G("x"),
-		false,
-		i18n.G("increase the major part of the version"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Minor,
-		i18n.G("minor"),
-		i18n.G("y"),
-		false,
-		i18n.G("increase the minor part of the version"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Patch,
-		i18n.G("patch"),
-		i18n.G("z"),
-		false,
-		i18n.G("increase the patch part of the version"),
-	)
-}

cli/recipe/upgrade.go

@@ -57,14 +57,13 @@ is up to the end-user to decide.
 
 The command is interactive and will show a select input which allows you to
 make a seclection. Use the "?" key to see more help on navigating this
-interface.
-
-You may invoke this command in "wizard" mode and be prompted for input.`),
+interface.`),
 	Args: cobra.RangeArgs(0, 1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		return autocomplete.RecipeNameComplete()
 	},
 	Run: func(cmd *cobra.Command, args []string) {
@@ -125,7 +124,7 @@ You may invoke this command in "wizard" mode and be prompted for input.`),
 			log.Debug(i18n.G("did not find versions file for %s", recipe.Name))
 		}
 
-		config, err := recipe.GetComposeConfig(nil)
+		config, err := recipe.GetComposeConfig()
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -337,12 +336,37 @@ You may invoke this command in "wizard" mode and be prompted for input.`),
 			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
 				log.Fatal(err)
 			}
+
+			if !internal.NoInput && !createCommit {
+				prompt := &survey.Confirm{
+					Message: i18n.G("commit changes?"),
+					Default: true,
+				}
+
+				if err := survey.AskOne(prompt, &createCommit); err != nil {
+					log.Fatal(err)
+				}
+			}
+
+			if createCommit {
+				msg := i18n.G("chore: update image tags")
+				if err := gitPkg.Commit(recipe.Dir, msg, internal.Dry); err != nil {
+					log.Fatal(err)
+				}
+				log.Info(i18n.G("committed changes as '%s'", msg))
+			}
+
+		} else {
+			if createCommit {
+				log.Warn(i18n.G("no changes, skip creating commit"))
+			}
 		}
 	},
 }
 
 var (
-	allTags bool
+	allTags      bool
+	createCommit bool
 )
 
 func init() {
@@ -381,8 +405,16 @@ func init() {
 	RecipeUpgradeCommand.Flags().BoolVarP(
 		&allTags,
 		i18n.G("all-tags"),
-		i18n.G("a"),
+		i18n.GC("a", "recipe upgrade"),
 		false,
 		i18n.G("list all tags, not just upgrades"),
 	)
+
+	RecipeUpgradeCommand.Flags().BoolVarP(
+		&createCommit,
+		i18n.G("commit"),
+		i18n.GC("c", "recipe upgrade"),
+		false,
+		i18n.G("commit changes"),
+	)
 }

cli/run.go

@@ -187,28 +187,20 @@ Config:
 
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.Debug,
-		"debug",
-		"d",
+		i18n.G("debug"),
+		i18n.G("d"),
 		false,
 		i18n.G("show debug messages"),
 	)
 
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.NoInput,
-		"no-input",
-		"n",
+		i18n.G("no-input"),
+		i18n.G("n"),
 		false,
 		i18n.G("toggle non-interactive mode"),
 	)
 
-	rootCmd.PersistentFlags().BoolVarP(
-		&internal.Offline,
-		"offline",
-		"o",
-		false,
-		i18n.G("prefer offline & filesystem access"),
-	)
-
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.Help,
 		i18n.G("help"),
@@ -217,6 +209,14 @@ Config:
 		i18n.G("help for abra"),
 	)
 
+	rootCmd.PersistentFlags().BoolVarP(
+		&internal.Offline,
+		i18n.G("offline"),
+		i18n.G("o"),
+		false,
+		i18n.G("prefer offline & filesystem access"),
+	)
+
 	rootCmd.Flags().BoolVarP(
 		&internal.Version,
 		i18n.G("version"),
@@ -245,7 +245,6 @@ Config:
 		recipe.RecipeNewCommand,
 		recipe.RecipeReleaseCommand,
 		recipe.RecipeResetCommand,
-		recipe.RecipeSyncCommand,
 		recipe.RecipeUpgradeCommand,
 		recipe.RecipeVersionCommand,
 	)
@@ -283,6 +282,11 @@ Config:
 		app.AppBackupSnapshotsCommand,
 	)
 
+	app.AppEnvCommand.AddCommand(
+		app.AppEnvListCommand,
+		app.AppEnvPullCommand,
+	)
+
 	app.AppCommand.AddCommand(
 		app.AppBackupCommand,
 		app.AppCheckCommand,

cli/server/add.go

@@ -20,7 +20,7 @@ import (
 
 // translators: `abra server add` aliases. use a comma separated list of
 // aliases with no spaces in between
-var serverAddAliases = i18n.G("a")
+var serverAddAliases = i18n.GC("a", "server add")
 
 var ServerAddCommand = &cobra.Command{
 	// translators: `server add` command

cli/server/prune.go

@@ -96,7 +96,7 @@ func init() {
 	ServerPruneCommand.Flags().BoolVarP(
 		&allFilter,
 		i18n.G("all"),
-		i18n.G("a"),
+		i18n.GC("a", "server prune"),
 		false,
 		i18n.G("remove all unused images"),
 	)

cli/updater/updater.go

@@ -1,558 +0,0 @@
-package updater
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"strings"
-
-	"coopcloud.tech/abra/cli/internal"
-	appPkg "coopcloud.tech/abra/pkg/app"
-	"coopcloud.tech/abra/pkg/client"
-	"coopcloud.tech/abra/pkg/deploy"
-	"coopcloud.tech/abra/pkg/envfile"
-	"coopcloud.tech/abra/pkg/i18n"
-	"coopcloud.tech/abra/pkg/lint"
-	"coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/abra/pkg/upstream/convert"
-	"coopcloud.tech/abra/pkg/upstream/stack"
-	"coopcloud.tech/tagcmp"
-	charmLog "github.com/charmbracelet/log"
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/filters"
-	dockerclient "github.com/docker/docker/client"
-	"github.com/spf13/cobra"
-
-	"coopcloud.tech/abra/pkg/log"
-)
-
-const SERVER = "localhost"
-
-// translators: `kadabra notify` aliases. use a comma separated list of aliases
-// with no spaces in between
-var notifyAliases = i18n.G("n")
-
-// NotifyCommand checks for available upgrades.
-var NotifyCommand = &cobra.Command{
-	// translators: `notify` command
-	Use:     i18n.G("notify [flags]"),
-	Aliases: strings.Split(notifyAliases, ","),
-	// translators: Short description for `notify` command
-	Short: i18n.G("Check for available upgrades"),
-	Long: i18n.G(`Notify on new versions for deployed apps.
-
-If a new patch/minor version is available, a notification is printed.
-
-Use "--major/-m" to include new major versions.`),
-	Args: cobra.NoArgs,
-	Run: func(cmd *cobra.Command, args []string) {
-		cl, err := client.New("default")
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		stacks, err := stack.GetStacks(cl)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		for _, stackInfo := range stacks {
-			stackName := stackInfo.Name
-			recipeName, err := getLabel(cl, stackName, "recipe")
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			if recipeName != "" {
-				_, err = getLatestUpgrade(cl, stackName, recipeName)
-				if err != nil {
-					log.Fatal(err)
-				}
-			}
-		}
-	},
-}
-
-// translators: `kadabra upgrade` aliases. use a comma separated list of aliases with
-// no spaces in between
-var upgradeAliases = i18n.G("u")
-
-// UpgradeCommand upgrades apps.
-var UpgradeCommand = &cobra.Command{
-	// translators: `app upgrade` command
-	Use:     i18n.G("upgrade [[stack] [recipe] | --all] [flags]"),
-	Aliases: strings.Split(upgradeAliases, ","),
-	// translators: Short description for `app upgrade` command
-	Short: i18n.G("Upgrade apps"),
-	Long: i18n.G(`Upgrade an app by specifying stack name and recipe. 
-
-Use "--all" to upgrade every deployed app.
-
-For each app with auto updates enabled, the deployed version is compared with
-the current recipe catalogue version. If a new patch/minor version is
-available, the app is upgraded.
-
-To include major versions use the "--major/-m" flag. You probably don't want
-that as it will break things. Only apps that are not deployed with "--chaos/-C"
-are upgraded, to update chaos deployments use the "--chaos/-C" flag. Use it
-with care.`),
-	Args: cobra.RangeArgs(0, 2),
-	// TODO(d1): complete stack/recipe
-	// ValidArgsFunction: func(
-	// 	cmd *cobra.Command,
-	// 	args []string,
-	// 	toComplete string) ([]string, cobra.ShellCompDirective) {
-	// },
-	Run: func(cmd *cobra.Command, args []string) {
-		cl, err := client.New("default")
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		if !updateAll && len(args) != 2 {
-			log.Fatal(i18n.G("missing arguments or --all/-a flag"))
-		}
-
-		if !updateAll {
-			stackName := args[0]
-			recipeName := args[1]
-
-			err = tryUpgrade(cl, stackName, recipeName)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			return
-		}
-
-		stacks, err := stack.GetStacks(cl)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		for _, stackInfo := range stacks {
-			stackName := stackInfo.Name
-			recipeName, err := getLabel(cl, stackName, "recipe")
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			err = tryUpgrade(cl, stackName, recipeName)
-			if err != nil {
-				log.Fatal(err)
-			}
-		}
-	},
-}
-
-// getLabel reads docker labels from running services in the format of "coop-cloud.${STACK_NAME}.${LABEL}".
-func getLabel(cl *dockerclient.Client, stackName string, label string) (string, error) {
-	filter := filters.NewArgs()
-	filter.Add("label", fmt.Sprintf("%s=%s", convert.LabelNamespace, stackName))
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filter})
-	if err != nil {
-		return "", err
-	}
-
-	for _, service := range services {
-		labelKey := fmt.Sprintf("coop-cloud.%s.%s", stackName, label)
-		if labelValue, ok := service.Spec.Labels[labelKey]; ok {
-			return labelValue, nil
-		}
-	}
-
-	log.Debug(i18n.G("no %s label found for %s", label, stackName))
-
-	return "", nil
-}
-
-// getBoolLabel reads a boolean docker label from running services
-func getBoolLabel(cl *dockerclient.Client, stackName string, label string) (bool, error) {
-	lableValue, err := getLabel(cl, stackName, label)
-	if err != nil {
-		return false, err
-	}
-
-	if lableValue != "" {
-		value, err := strconv.ParseBool(lableValue)
-		if err != nil {
-			return false, err
-		}
-
-		return value, nil
-	}
-
-	log.Debug(i18n.G("boolean label %s could not be found for %s, set default to false.", label, stackName))
-
-	return false, nil
-}
-
-// getEnv reads env variables from docker services.
-func getEnv(cl *dockerclient.Client, stackName string) (envfile.AppEnv, error) {
-	envMap := make(map[string]string)
-	filter := filters.NewArgs()
-	filter.Add("label", fmt.Sprintf("%s=%s", convert.LabelNamespace, stackName))
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filter})
-	if err != nil {
-		return nil, err
-	}
-
-	for _, service := range services {
-		envList := service.Spec.TaskTemplate.ContainerSpec.Env
-		for _, envString := range envList {
-			splitString := strings.SplitN(envString, "=", 2)
-			if len(splitString) != 2 {
-				log.Debug(i18n.G("can't separate key from value: %s (this variable is probably unset)", envString))
-				continue
-			}
-			k := splitString[0]
-			v := splitString[1]
-			log.Debugf(i18n.G("for %s read env %s with value: %s from docker service", stackName, k, v))
-			envMap[k] = v
-		}
-	}
-
-	return envMap, nil
-}
-
-// getLatestUpgrade returns the latest available version for an app respecting
-// the "--major" flag if it is newer than the currently deployed version.
-func getLatestUpgrade(cl *dockerclient.Client, stackName string, recipeName string) (string, error) {
-	deployedVersion, err := getDeployedVersion(cl, stackName, recipeName)
-	if err != nil {
-		return "", err
-	}
-
-	availableUpgrades, err := getAvailableUpgrades(cl, stackName, recipeName, deployedVersion)
-	if err != nil {
-		return "", err
-	}
-
-	if len(availableUpgrades) == 0 {
-		log.Debugf(i18n.G("no available upgrades for %s", stackName))
-		return "", nil
-	}
-
-	var chosenUpgrade string
-	if len(availableUpgrades) > 0 {
-		chosenUpgrade = availableUpgrades[len(availableUpgrades)-1]
-		log.Info(i18n.G("%s (%s) can be upgraded from version %s to %s", stackName, recipeName, deployedVersion, chosenUpgrade))
-	}
-
-	return chosenUpgrade, nil
-}
-
-// getDeployedVersion returns the currently deployed version of an app.
-func getDeployedVersion(cl *dockerclient.Client, stackName string, recipeName string) (string, error) {
-	log.Debug(i18n.G("retrieve deployed version whether %s is already deployed", stackName))
-
-	deployMeta, err := stack.IsDeployed(context.Background(), cl, stackName)
-	if err != nil {
-		return "", err
-	}
-
-	if !deployMeta.IsDeployed {
-		return "", errors.New(i18n.G("%s is not deployed?", stackName))
-	}
-
-	if deployMeta.Version == "unknown" {
-		return "", errors.New(i18n.G("failed to determine deployed version of %s", stackName))
-	}
-
-	return deployMeta.Version, nil
-}
-
-// getAvailableUpgrades returns all available versions of an app that are newer
-// than the deployed version. It only includes major upgrades if the "--major"
-// flag is set.
-func getAvailableUpgrades(cl *dockerclient.Client, stackName string, recipeName string,
-	deployedVersion string) ([]string, error) {
-	catl, err := recipe.ReadRecipeCatalogue(internal.Offline)
-	if err != nil {
-		return nil, err
-	}
-
-	versions, err := recipe.GetRecipeCatalogueVersions(recipeName, catl)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(versions) == 0 {
-		log.Warn(i18n.G("no published releases for %s in the recipe catalogue?", recipeName))
-		return nil, nil
-	}
-
-	var availableUpgrades []string
-	for _, version := range versions {
-		parsedDeployedVersion, err := tagcmp.Parse(deployedVersion)
-		if err != nil {
-			return nil, err
-		}
-
-		parsedVersion, err := tagcmp.Parse(version)
-		if err != nil {
-			return nil, err
-		}
-
-		versionDelta, err := parsedDeployedVersion.UpgradeDelta(parsedVersion)
-		if err != nil {
-			return nil, err
-		}
-
-		if 0 < versionDelta.UpgradeType() && (versionDelta.UpgradeType() < 4 || includeMajorUpdates) {
-			availableUpgrades = append(availableUpgrades, version)
-		}
-	}
-
-	log.Debug(i18n.G("available updates for %s: %s", stackName, availableUpgrades))
-
-	return availableUpgrades, nil
-}
-
-// processRecipeRepoVersion clones, pulls, checks out the version and lints the
-// recipe repository.
-func processRecipeRepoVersion(r recipe.Recipe, version string) error {
-	if err := r.EnsureExists(); err != nil {
-		return err
-	}
-
-	if err := r.EnsureUpToDate(); err != nil {
-		return err
-	}
-
-	if _, err := r.EnsureVersion(version); err != nil {
-		return err
-	}
-
-	if err := lint.LintForErrors(r); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// createDeployConfig merges and enriches the compose config for the deployment.
-func createDeployConfig(r recipe.Recipe, stackName string, env envfile.AppEnv) (*composetypes.Config, stack.Deploy, error) {
-	env["STACK_NAME"] = stackName
-
-	deployOpts := stack.Deploy{
-		Namespace:    stackName,
-		Prune:        false,
-		ResolveImage: stack.ResolveImageAlways,
-		Detach:       false,
-	}
-
-	composeFiles, err := r.GetComposeFiles(env)
-	if err != nil {
-		return nil, deployOpts, err
-	}
-
-	deployOpts.Composefiles = composeFiles
-	compose, err := appPkg.GetAppComposeConfig(stackName, deployOpts, env)
-	if err != nil {
-		return nil, deployOpts, err
-	}
-
-	appPkg.ExposeAllEnv(stackName, compose, env)
-
-	// after the upgrade the deployment won't be in chaos state anymore
-	appPkg.SetChaosLabel(compose, stackName, false)
-	appPkg.SetRecipeLabel(compose, stackName, r.Name)
-	appPkg.SetUpdateLabel(compose, stackName, env)
-
-	return compose, deployOpts, nil
-}
-
-// tryUpgrade performs the upgrade if all the requirements are fulfilled.
-func tryUpgrade(cl *dockerclient.Client, stackName, recipeName string) error {
-	if recipeName == "" {
-		log.Debug(i18n.G("don't update %s due to missing recipe name", stackName))
-		return nil
-	}
-
-	chaos, err := getBoolLabel(cl, stackName, "chaos")
-	if err != nil {
-		return err
-	}
-
-	if chaos && !internal.Chaos {
-		log.Debug(i18n.G("don't update %s due to chaos deployment", stackName))
-		return nil
-	}
-
-	updatesEnabled, err := getBoolLabel(cl, stackName, "autoupdate")
-	if err != nil {
-		return err
-	}
-
-	if !updatesEnabled {
-		log.Debug(i18n.G("don't update %s due to disabled auto updates or missing ENABLE_AUTO_UPDATE env", stackName))
-		return nil
-	}
-
-	upgradeVersion, err := getLatestUpgrade(cl, stackName, recipeName)
-	if err != nil {
-		return err
-	}
-
-	if upgradeVersion == "" {
-		log.Debug(i18n.G("don't update %s due to no new version", stackName))
-		return nil
-	}
-
-	err = upgrade(cl, stackName, recipeName, upgradeVersion)
-
-	return err
-}
-
-// upgrade performs all necessary steps to upgrade an app.
-func upgrade(cl *dockerclient.Client, stackName, recipeName, upgradeVersion string) error {
-	env, err := getEnv(cl, stackName)
-	if err != nil {
-		return err
-	}
-
-	app := appPkg.App{
-		Name:   stackName,
-		Recipe: recipe.Get(recipeName),
-		Server: SERVER,
-		Env:    env,
-	}
-
-	r := recipe.Get(recipeName)
-
-	if err = processRecipeRepoVersion(r, upgradeVersion); err != nil {
-		return err
-	}
-
-	if err = deploy.MergeAbraShEnv(app.Recipe, app.Env); err != nil {
-		return err
-	}
-
-	compose, deployOpts, err := createDeployConfig(r, stackName, app.Env)
-	if err != nil {
-		return err
-	}
-
-	log.Info(i18n.G("upgrade %s (%s) to version %s", stackName, recipeName, upgradeVersion))
-
-	serviceNames, err := appPkg.GetAppServiceNames(app.Name)
-	if err != nil {
-		return err
-	}
-
-	f, err := app.Filters(true, false, serviceNames...)
-	if err != nil {
-		return err
-	}
-
-	err = stack.RunDeploy(
-		cl,
-		deployOpts,
-		compose,
-		stackName,
-		app.Server,
-		true,
-		f,
-	)
-
-	return err
-}
-
-func newKadabraApp(version, commit string) *cobra.Command {
-	rootCmd := &cobra.Command{
-		// translators: `kadabra` binary name
-		Use:     i18n.G("kadabra [cmd] [flags]"),
-		Version: fmt.Sprintf("%s-%s", version, commit[:7]),
-		// translators: Short description for `kababra` binary
-		Short: i18n.G("The Co-op Cloud auto-updater 🤖 🚀"),
-		PersistentPreRun: func(cmd *cobra.Command, args []string) {
-			log.Logger.SetStyles(charmLog.DefaultStyles())
-			charmLog.SetDefault(log.Logger)
-
-			if internal.Debug {
-				log.SetLevel(log.DebugLevel)
-				log.SetOutput(os.Stderr)
-				log.SetReportCaller(true)
-			}
-
-			log.Debug(i18n.G("kadabra version %s, commit %s", version, commit))
-		},
-	}
-
-	rootCmd.PersistentFlags().BoolVarP(
-		&internal.Debug,
-		i18n.G("debug"),
-		i18n.G("d"),
-		false,
-		i18n.G("show debug messages"),
-	)
-
-	rootCmd.PersistentFlags().BoolVarP(
-		&internal.NoInput,
-		i18n.G("no-input"),
-		i18n.G("n"),
-		false,
-		i18n.G("toggle non-interactive mode"),
-	)
-
-	rootCmd.AddCommand(
-		NotifyCommand,
-		UpgradeCommand,
-	)
-
-	return rootCmd
-}
-
-// RunApp runs CLI abra app.
-func RunApp(version, commit string) {
-	app := newKadabraApp(version, commit)
-
-	if err := app.Execute(); err != nil {
-		log.Fatal(err)
-	}
-}
-
-var (
-	includeMajorUpdates bool
-	updateAll           bool
-)
-
-func init() {
-	NotifyCommand.Flags().BoolVarP(
-		&includeMajorUpdates,
-		"major",
-		"m",
-		false,
-		"check for major updates",
-	)
-
-	UpgradeCommand.Flags().BoolVarP(
-		&internal.Chaos,
-		i18n.G("chaos"),
-		i18n.G("C"),
-		false,
-		i18n.G("ignore uncommitted recipes changes"),
-	)
-
-	UpgradeCommand.Flags().BoolVarP(
-		&includeMajorUpdates,
-		i18n.G("major"),
-		i18n.G("m"),
-		false,
-		i18n.G("check for major updates"),
-	)
-
-	UpgradeCommand.Flags().BoolVarP(
-		&updateAll,
-		i18n.G("all"),
-		i18n.G("a"),
-		false,
-		i18n.G("update all deployed apps"),
-	)
-}

cmd/kadabra/main.go

@@ -1,23 +0,0 @@
-// Package main provides the command-line entrypoint.
-package main
-
-import (
-	"coopcloud.tech/abra/cli/updater"
-)
-
-// Version is the current version of Kadabra.
-var Version string
-
-// Commit is the current git commit of Kadabra.
-var Commit string
-
-func main() {
-	if Version == "" {
-		Version = "dev"
-	}
-	if Commit == "" {
-		Commit = "       "
-	}
-
-	updater.RunApp(Version, Commit)
-}

go.mod

@@ -1,28 +1,27 @@
 module coopcloud.tech/abra
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.26.0
 
 require (
 	coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
-	github.com/charmbracelet/bubbletea v1.3.6
+	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/charmbracelet/log v0.4.2
+	github.com/charmbracelet/log v1.0.0
+	github.com/compose-spec/compose-go/v2 v2.10.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.3.3+incompatible
-	github.com/docker/docker v28.3.3+incompatible
+	github.com/docker/cli v28.4.0+incompatible
+	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.16.2
+	github.com/go-git/go-git/v5 v5.17.2
 	github.com/google/go-cmp v0.7.0
 	github.com/leonelquinteros/gotext v1.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.18.0
-	golang.org/x/term v0.34.0
+	github.com/schollz/progressbar/v3 v3.19.0
+	golang.org/x/term v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -30,25 +29,28 @@ require (
 require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.3.2 // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
+	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
+	github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
@@ -59,26 +61,27 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/kevinburke/ssh_config v1.6.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
@@ -87,7 +90,7 @@ require (
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
@@ -95,42 +98,47 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
-	github.com/pjbgf/sha1cd v0.4.0 // indirect
+	github.com/pjbgf/sha1cd v0.5.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.65.0 // indirect
-	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/skeema/knownhosts v1.3.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
-	go.opentelemetry.io/otel v1.37.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
-	go.opentelemetry.io/otel/trace v1.37.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
-	golang.org/x/crypto v0.41.0 // indirect
-	golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect
-	golang.org/x/net v0.43.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
-	google.golang.org/grpc v1.74.2 // indirect
-	google.golang.org/protobuf v1.36.7 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -139,19 +147,23 @@ require (
 	github.com/containers/image v3.0.2+incompatible
 	github.com/containers/storage v1.38.2 // indirect
 	github.com/decentral1se/passgen v1.0.1
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8
-	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
+	github.com/spf13/cobra v1.10.1
+	github.com/stretchr/testify v1.11.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.35.0
+	golang.org/x/sys v0.42.0
 )
+
+replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible
+
+replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2-i18n

go.sum

@@ -27,6 +27,8 @@ coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca/go.mod h1:ESVm0wQKcbcFi
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible h1:YdW2uK5sHj545lGz/FrozPueINkQ7fUjlsNd8aYcqik=
+git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible/go.mod h1:PY19bHY5R4DLmRuCrv4TR7etURn/+tSTFuam4FUTiD8=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c h1:oeKnUB79PKYD8D0/unYuu7MRcWryQQWOns8+JL+acrs=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c/go.mod h1:fQuhwrpg6qb9NlFXKYi/LysWu1wxjraS8sxyW12CUF0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -49,8 +51,8 @@ github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZ
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -79,8 +81,8 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
-github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -95,7 +97,6 @@ github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:C
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
@@ -133,22 +134,22 @@ github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghf
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbletea v1.3.6 h1:VkHIxPJQeDt0aFJIsVxw8BQdh/F/L2KKZGsK6et5taU=
-github.com/charmbracelet/bubbletea v1.3.6/go.mod h1:oQD9VCRQFF8KplacJLo28/jofOI2ToOfGYeFgBBxHOc=
-github.com/charmbracelet/colorprofile v0.3.2 h1:9J27WdztfJQVAQKX2WOlSSRB+5gaKqqITmrvb1uTIiI=
-github.com/charmbracelet/colorprofile v0.3.2/go.mod h1:mTD5XzNeWHj8oqHb+S1bssQb7vIHbepiebQ2kPKVKbI=
+github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
+github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/log v0.4.2 h1:hYt8Qj6a8yLnvR+h7MwsJv/XvmBJXiueUcI3cIxsyig=
-github.com/charmbracelet/log v0.4.2/go.mod h1:qifHGX/tc7eluv2R6pWIpyHDDrrb/AG71Pf2ysQu5nw=
-github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
-github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
-github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
-github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/charmbracelet/log v1.0.0 h1:HVVVMmfOorfj3BA9i8X8UL69Hoz9lI0PYwXfJvOdRc4=
+github.com/charmbracelet/log v1.0.0/go.mod h1:uYgY3SmLpwJWxmlrPwXvzVYujxis1vAKRV/0VQB7yWA=
+github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
+github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
+github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
 github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
 github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
@@ -164,13 +165,19 @@ github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJ
 github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
-github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
+github.com/compose-spec/compose-go/v2 v2.10.1 h1:mFbXobojGRFIVi1UknrvaDAZ+PkJfyjqkA1yseh+vAU=
+github.com/compose-spec/compose-go/v2 v2.10.1/go.mod h1:Ohac1SzhO/4fXXrzWIztIVB6ckmKBv1Nt5Z5mGVESUg=
 github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
 github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
 github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
@@ -269,8 +276,6 @@ github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgU
 github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/containers/storage v1.38.2 h1:8bAIxnVBGKzMw5EWCivVj24bztQT6IkDp4uHiyhnzwE=
 github.com/containers/storage v1.38.2/go.mod h1:INP0RPLHWBxx+pTsO5uiHlDUGHDFvWZPWprAbAlQWPQ=
-github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
@@ -296,8 +301,8 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
-github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
 github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
@@ -305,30 +310,31 @@ github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjI
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decentral1se/cobra v1.10.2-i18n h1:XR+6AHHfnf4k5NM9f09oLMrEVwz3rkQIAIcqgL8R08g=
+github.com/decentral1se/cobra v1.10.2-i18n/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/decentral1se/passgen v1.0.1 h1:j2AxK/kHKxDHWZZfkJj8Wgae9+O+DYEqR5sjKthIYKA=
 github.com/decentral1se/passgen v1.0.1/go.mod h1:530V+lNoPhKtkrX2fIVsIfLhkl47CuiOM7HRgi7C+SU=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=
-github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
-github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
-github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
+github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
@@ -387,12 +393,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
+github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
-github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104=
+github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -401,8 +407,8 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
-github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
+github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -423,8 +429,8 @@ github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -439,12 +445,10 @@ github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zV
 github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -520,17 +524,14 @@ github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2z
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -545,7 +546,6 @@ github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVU
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -579,8 +579,8 @@ github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVE
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
-github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
+github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -588,8 +588,10 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -611,10 +613,9 @@ github.com/leonelquinteros/gotext v1.7.2 h1:bDPndU8nt+/kRo1m4l/1OXiiy2v7Z7dfPQ9+
 github.com/leonelquinteros/gotext v1.7.2/go.mod h1:9/haCkm5P7Jay1sxKDGJ5WIg4zkz8oZKw4ekNpALob8=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -631,10 +632,11 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -650,7 +652,6 @@ github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WT
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
@@ -659,8 +660,8 @@ github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6U
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
 github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
-github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
@@ -685,8 +686,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
+github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
@@ -702,7 +704,6 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+
 github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -755,11 +756,10 @@ github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3
 github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.4.0 h1:NXzbL1RvjTUi6kgYZCX3fPwwl27Q1LJndxtUDVfJGRY=
-github.com/pjbgf/sha1cd v0.4.0/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
+github.com/pjbgf/sha1cd v0.5.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -771,12 +771,11 @@ github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prY
 github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
-github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -785,16 +784,13 @@ github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6T
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
-github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
@@ -803,10 +799,8 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
-github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
-github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
@@ -818,9 +812,11 @@ github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
-github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
+github.com/schollz/progressbar/v3 v3.19.0 h1:Ea18xuIRQXLAUidVDox3AbwfUhD0/1IvohyTutOIFoc=
+github.com/schollz/progressbar/v3 v3.19.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -835,37 +831,27 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
+github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
-github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
 github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -878,8 +864,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
@@ -890,7 +876,6 @@ github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4D
 github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
@@ -916,10 +901,11 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:
 github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
@@ -927,7 +913,6 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
 github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
@@ -937,37 +922,43 @@ go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
-go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
-go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 h1:zG8GlgXCJQd5BU98C0hZnBbElszTmUgCNCfYneaDL0A=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0/go.mod h1:hOfBCz8kv/wuq73Mx2H2QnWokh/kHZxkh6SNF2bdKtw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
-go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
-go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
-go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
-go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
-go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
-go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
-go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
-go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -986,8 +977,8 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -998,8 +989,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE=
-golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1063,8 +1054,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1082,8 +1073,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1162,13 +1153,13 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1178,16 +1169,16 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1237,6 +1228,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -1281,10 +1274,10 @@ google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
-google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1304,8 +1297,8 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
-google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1319,8 +1312,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
-google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=

pkg/app/app.go

@@ -18,10 +18,10 @@ import (
 	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	"coopcloud.tech/abra/pkg/upstream/stack"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 
 	"coopcloud.tech/abra/pkg/log"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/schollz/progressbar/v3"
 )
@@ -179,8 +179,7 @@ func (a App) Filters(appendServiceNames, exactMatch bool, services ...string) (f
 		return filters, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	compose, err := GetAppComposeConfig(a.Recipe.Name, opts, a.Env)
+	compose, err := GetAppComposeConfig(composeFiles, a.Env)
 	if err != nil {
 		return filters, err
 	}
@@ -333,8 +332,7 @@ func GetAppServiceNames(appName string) ([]string, error) {
 		return serviceNames, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	compose, err := GetAppComposeConfig(app.Recipe.Name, opts, app.Env)
+	compose, err := GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		return serviceNames, err
 	}
@@ -471,13 +469,6 @@ func GetAppStatuses(apps []App, MachineReadable bool) (map[string]map[string]str
 				result["chaosVersion"] = chaosVersion
 			}
 
-			labelKey = fmt.Sprintf("coop-cloud.%s.autoupdate", name)
-			if autoUpdate, ok := service.Spec.Labels[labelKey]; ok {
-				result["autoUpdate"] = autoUpdate
-			} else {
-				result["autoUpdate"] = "false"
-			}
-
 			labelKey = fmt.Sprintf("coop-cloud.%s.version", name)
 			if version, ok := service.Spec.Labels[labelKey]; ok {
 				result["version"] = version
@@ -497,19 +488,28 @@ func GetAppStatuses(apps []App, MachineReadable bool) (map[string]map[string]str
 // GetAppComposeConfig retrieves a compose specification for a recipe. This
 // specification is the result of a merge of all the compose.**.yml files in
 // the recipe repository.
-func GetAppComposeConfig(recipe string, opts stack.Deploy, appEnv envfile.AppEnv) (*composetypes.Config, error) {
-	compose, err := loader.LoadComposefile(opts, appEnv)
+func GetAppComposeConfig(composeFiles []string, appEnv envfile.AppEnv) (*composeGoTypes.Project, error) {
+	compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles, AppEnv: appEnv})
 	if err != nil {
-		return &composetypes.Config{}, err
+		return &composeGoTypes.Project{}, err
 	}
 
-	log.Debug(i18n.G("retrieved %s for %s", compose.Filename, recipe))
+	recipeName, exists := appEnv["RECIPE"]
+	if !exists {
+		recipeName, _ = appEnv["TYPE"]
+	}
+
+	log.Debug(i18n.G("retrieved %s for %s", compose.Name, recipeName))
 
 	return compose, nil
 }
 
 // ExposeAllEnv exposes all env variables to the app container
-func ExposeAllEnv(stackName string, compose *composetypes.Config, appEnv envfile.AppEnv) {
+func ExposeAllEnv(
+	stackName string,
+	compose *composeGoTypes.Project,
+	appEnv envfile.AppEnv,
+	toDeployVersion string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("adding env vars to %s service config", stackName))
@@ -517,6 +517,11 @@ func ExposeAllEnv(stackName string, compose *composetypes.Config, appEnv envfile
 				_, exists := service.Environment[k]
 				if !exists {
 					value := v
+					if k == "TYPE" || k == "RECIPE" {
+						// NOTE(d1): don't use the wrong version from the app env
+						//           since we are deploying a new version
+						value = toDeployVersion
+					}
 					service.Environment[k] = &value
 					log.Debug(i18n.G("%s: %s: %s", stackName, k, value))
 				}
@@ -631,6 +636,11 @@ func (a App) WipeRecipeVersion() error {
 
 // WriteRecipeVersion writes the recipe version to the app .env file.
 func (a App) WriteRecipeVersion(version string, dryRun bool) error {
+	if version == config.UNKNOWN_DEFAULT {
+		log.Debug(i18n.G("version is unknown, skipping env write"))
+		return nil
+	}
+
 	file, err := os.Open(a.Path)
 	if err != nil {
 		return err

pkg/app/app_test.go

@@ -10,46 +10,83 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/recipe"
-	testPkg "coopcloud.tech/abra/pkg/test"
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
 )
 
+var (
+	expectedAppEnv = envfile.AppEnv{
+		"DOMAIN": test.AppName,
+		"RECIPE": test.RecipeName,
+	}
+
+	expectedApp = appPkg.App{
+		Name:   test.AppName,
+		Recipe: recipePkg.Get(expectedAppEnv["RECIPE"]),
+		Domain: expectedAppEnv["DOMAIN"],
+		Env:    expectedAppEnv,
+		Path:   expectedAppFile.Path,
+		Server: expectedAppFile.Server,
+	}
+
+	expectedAppFile = appPkg.AppFile{
+		Path:   test.AppEnvPath,
+		Server: test.ServerName,
+	}
+
+	expectedAppFiles = map[string]appPkg.AppFile{
+		test.AppName: expectedAppFile,
+	}
+)
+
 func TestNewApp(t *testing.T) {
-	app, err := appPkg.NewApp(testPkg.ExpectedAppEnv, testPkg.AppName, testPkg.ExpectedAppFile)
+	app, err := appPkg.NewApp(expectedAppEnv, test.AppName, expectedAppFile)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestReadAppEnvFile(t *testing.T) {
-	app, err := appPkg.ReadAppEnvFile(testPkg.ExpectedAppFile, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.ReadAppEnvFile(expectedAppFile, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestGetApp(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestGetComposeFiles(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -94,7 +131,10 @@ func TestGetComposeFiles(t *testing.T) {
 }
 
 func TestGetComposeFilesError(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
 	err := r.EnsureExists()
 	if err != nil {
 		t.Fatal(err)
@@ -186,26 +226,32 @@ func TestFilters(t *testing.T) {
 
 func compareFilter(t *testing.T, f1 filters.Args, f2 map[string]map[string]bool) {
 	t.Helper()
+
 	j1, err := f1.MarshalJSON()
 	if err != nil {
 		t.Error(err)
 	}
+
 	j2, err := json.Marshal(f2)
 	if err != nil {
 		t.Error(err)
 	}
+
 	if diff := cmp.Diff(string(j2), string(j1)); diff != "" {
 		t.Errorf("filters mismatch (-want +got):\n%s", diff)
 	}
 }
 
 func TestWriteRecipeVersionOverwrite(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	defer t.Cleanup(func() {
+	t.Cleanup(func() {
 		if err := app.WipeRecipeVersion(); err != nil {
 			t.Fatal(err)
 		}
@@ -217,10 +263,26 @@ func TestWriteRecipeVersionOverwrite(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	app, err = appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	app, err = appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	assert.Equal(t, "foo", app.Recipe.EnvVersion)
 }
+
+func TestWriteRecipeVersionUnknown(t *testing.T) {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := app.WriteRecipeVersion(config.UNKNOWN_DEFAULT, false); err != nil {
+		t.Fatal(err)
+	}
+
+	assert.NotEqual(t, config.UNKNOWN_DEFAULT, app.Recipe.EnvVersion)
+}

pkg/app/compose.go

@@ -5,15 +5,14 @@ import (
 	"fmt"
 	"strconv"
 
-	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 )
 
 // SetRecipeLabel adds the label 'coop-cloud.${STACK_NAME}.recipe=${RECIPE}' to the app container
 // to signal which recipe is connected to the deployed app
-func SetRecipeLabel(compose *composetypes.Config, stackName string, recipe string) {
+func SetRecipeLabel(compose *composeGoTypes.Project, stackName string, recipe string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set recipe label 'coop-cloud.%s.recipe' to %s for %s", stackName, recipe, stackName))
@@ -25,7 +24,7 @@ func SetRecipeLabel(compose *composetypes.Config, stackName string, recipe strin
 
 // SetChaosLabel adds the label 'coop-cloud.${STACK_NAME}.chaos=true/false' to the app container
 // to signal if the app is deployed in chaos mode
-func SetChaosLabel(compose *composetypes.Config, stackName string, chaos bool) {
+func SetChaosLabel(compose *composeGoTypes.Project, stackName string, chaos bool) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.chaos' to %v for %s", stackName, chaos, stackName))
@@ -36,7 +35,7 @@ func SetChaosLabel(compose *composetypes.Config, stackName string, chaos bool) {
 }
 
 // SetChaosVersionLabel adds the label 'coop-cloud.${STACK_NAME}.chaos-version=$(GIT_COMMIT)' to the app container
-func SetChaosVersionLabel(compose *composetypes.Config, stackName string, chaosVersion string) {
+func SetChaosVersionLabel(compose *composeGoTypes.Project, stackName string, chaosVersion string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.chaos-version' to %v for %s", stackName, chaosVersion, stackName))
@@ -46,7 +45,7 @@ func SetChaosVersionLabel(compose *composetypes.Config, stackName string, chaosV
 	}
 }
 
-func SetVersionLabel(compose *composetypes.Config, stackName string, version string) {
+func SetVersionLabel(compose *composeGoTypes.Project, stackName string, version string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.version' to %v for %s", stackName, version, stackName))
@@ -56,25 +55,8 @@ func SetVersionLabel(compose *composetypes.Config, stackName string, version str
 	}
 }
 
-// SetUpdateLabel adds env ENABLE_AUTO_UPDATE as label to enable/disable the
-// auto update process for this app. The default if this variable is not set is to disable
-// the auto update process.
-func SetUpdateLabel(compose *composetypes.Config, stackName string, appEnv envfile.AppEnv) {
-	for _, service := range compose.Services {
-		if service.Name == "app" {
-			enable_auto_update, exists := appEnv["ENABLE_AUTO_UPDATE"]
-			if !exists {
-				enable_auto_update = "false"
-			}
-			log.Debug(i18n.G("set label 'coop-cloud.%s.autoupdate' to %s for %s", stackName, enable_auto_update, stackName))
-			labelKey := fmt.Sprintf("coop-cloud.%s.autoupdate", stackName)
-			service.Deploy.Labels[labelKey] = enable_auto_update
-		}
-	}
-}
-
 // GetLabel reads docker labels in the format of "coop-cloud.${STACK_NAME}.${LABEL}" from the local compose files
-func GetLabel(compose *composetypes.Config, stackName string, label string) string {
+func GetLabel(compose *composeGoTypes.Project, stackName string, label string) string {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			labelKey := fmt.Sprintf("coop-cloud.%s.%s", stackName, label)
@@ -91,7 +73,7 @@ func GetLabel(compose *composetypes.Config, stackName string, label string) stri
 // GetTimeoutFromLabel reads the timeout value from docker label
 // `coop-cloud.${STACK_NAME}.timeout=...` if present. A value is present if the
 // operator uses a `TIMEOUT=...` in their app env.
-func GetTimeoutFromLabel(compose *composetypes.Config, stackName string) (int, error) {
+func GetTimeoutFromLabel(compose *composeGoTypes.Project, stackName string) (int, error) {
 	var timeout int
 
 	if timeoutLabel := GetLabel(compose, stackName, "timeout"); timeoutLabel != "" {

pkg/app/compose_test.go

@@ -4,15 +4,15 @@ import (
 	"testing"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
+	"coopcloud.tech/abra/pkg/test"
 	testPkg "coopcloud.tech/abra/pkg/test"
-	stack "coopcloud.tech/abra/pkg/upstream/stack"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestGetTimeoutFromLabel(t *testing.T) {
-	testPkg.MkServerAppRecipe()
-	defer testPkg.RmServerAppRecipe()
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
 
 	tests := []struct {
 		configuredTimeout string
@@ -25,7 +25,7 @@ func TestGetTimeoutFromLabel(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+		app, err := appPkg.GetApp(expectedAppFiles, testPkg.AppName)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -39,15 +39,8 @@ func TestGetTimeoutFromLabel(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    app.StackName(),
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
-		}
-
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		app.Env["STACK_NAME"] = app.StackName()
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			t.Fatal(err)
 		}

pkg/autocomplete/autocomplete.go

@@ -120,7 +120,7 @@ func CommandNameComplete(appName string) ([]string, cobra.ShellCompDirective) {
 func SecretComplete(recipeName string) ([]string, cobra.ShellCompDirective) {
 	r := recipe.Get(recipeName)
 
-	config, err := r.GetComposeConfig(nil)
+	config, err := r.GetComposeConfig()
 	if err != nil {
 		err := i18n.G("autocomplete failed: %s", err)
 		return []string{err}, cobra.ShellCompDirectiveError

pkg/client/client.go

@@ -6,9 +6,10 @@ import (
 	"errors"
 	"net/http"
 	"os"
+	"path"
 	"strings"
-	"time"
 
+	"coopcloud.tech/abra/pkg/config"
 	contextPkg "coopcloud.tech/abra/pkg/context"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
@@ -35,13 +36,27 @@ func WithTimeout(timeout int) Opt {
 // New initiates a new Docker client. New client connections are validated so
 // that we ensure connections via SSH to the daemon can succeed. It takes into
 // account that you may only want the local client and not communicate via SSH.
-// For this use-case, please pass "default" as the contextName.
+// For this use-case, please pass "default" as the serverName.
 func New(serverName string, opts ...Opt) (*client.Client, error) {
 	var clientOpts []client.Opt
 
 	ctx, err := GetContext(serverName)
 	if err != nil {
-		return nil, errors.New(i18n.G("unknown server, run \"abra server add %s\"?", serverName))
+		serverDir := path.Join(config.SERVERS_DIR, serverName)
+		if _, err := os.Stat(serverDir); err != nil {
+			return nil, errors.New(i18n.G("server missing, run \"abra server add %s\"?", serverName))
+		}
+
+		// NOTE(p4u1): when the docker context does not exist but the server folder
+		//             is there, let's create a new docker context.
+		if err = CreateContext(serverName); err != nil {
+			return nil, errors.New(i18n.G("server missing context, context creation failed: %s", err))
+		}
+
+		ctx, err = GetContext(serverName)
+		if err != nil {
+			return nil, errors.New(i18n.G("server missing context, run \"abra server add %s\"?", serverName))
+		}
 	}
 
 	ctxEndpoint, err := contextPkg.GetContextEndpoint(ctx)
@@ -68,8 +83,7 @@ func New(serverName string, opts ...Opt) (*client.Client, error) {
 
 		httpClient := &http.Client{
 			Transport: &http.Transport{
-				DialContext:     helper.Dialer,
-				IdleConnTimeout: 30 * time.Second,
+				DialContext: helper.Dialer,
 			},
 		}
 

pkg/config/abra.go

@@ -116,10 +116,7 @@ var (
 
 	DIRTY_DEFAULT = "+U"
 
-	NO_DOMAIN_DEFAULT  = "N/A"
-	NO_VERSION_DEFAULT = "N/A"
-	NO_SECRETS_DEFAULT = "N/A"
-	NO_VOLUMES_DEFAULT = "N/A"
+	MISSING_DEFAULT = "-"
 
 	UNKNOWN_DEFAULT = "unknown"
 )

pkg/config/abra_test.go

@@ -10,8 +10,9 @@ import (
 func TestFindAbraConfig(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	tests := []struct {
 		Dir    string
 		Config string
@@ -51,8 +52,9 @@ func TestFindAbraConfig(t *testing.T) {
 func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	t.Setenv("ABRA_DIR", "")
 
 	t.Run("default", func(t *testing.T) {
@@ -67,7 +69,7 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err = os.Chdir(filepath.Join(wd, "testdata/abraconfig1"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()
@@ -81,7 +83,7 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err := os.Chdir(filepath.Join(wd, "testdata/abraconfig2"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()
@@ -104,8 +106,9 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 func TestLoadAbraConfigServersDir(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	t.Setenv("ABRA_DIR", "")
 
 	t.Run("default", func(t *testing.T) {
@@ -120,7 +123,7 @@ func TestLoadAbraConfigServersDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err = os.Chdir(filepath.Join(wd, "testdata/abraconfig1"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()

pkg/deploy/utils.go

@@ -14,8 +14,8 @@ import (
 	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/abra/pkg/secret"
 
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/distribution/reference"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types/swarm"
 	dockerClient "github.com/docker/docker/client"
 )
@@ -165,7 +165,13 @@ func GetImagesForStack(cl *dockerClient.Client, app appPkg.App) (map[string]stri
 			}
 
 			imageBaseName := reference.Path(imageParsed)
-			imageTag := imageParsed.(reference.NamedTagged).Tag()
+			namedTag, ok := imageParsed.(reference.NamedTagged)
+			if !ok {
+				// This is an image without a tag
+				images[imageBaseName] = ""
+				continue
+			}
+			imageTag := namedTag.Tag()
 
 			existingImageVersion, ok := images[imageBaseName]
 			if !ok {
@@ -223,7 +229,7 @@ func GatherSecretsForDeploy(cl *dockerClient.Client, app appPkg.App, showUnchang
 	return secretInfo, nil
 }
 
-func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composetypes.Config, abraShEnv map[string]string, showUnchanged bool) ([]string, error) {
+func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composeGoTypes.Project, abraShEnv map[string]string, showUnchanged bool) ([]string, error) {
 	// Get current configs from existing deployment
 	currentConfigs, err := GetConfigsForStack(cl, app)
 	if err != nil {
@@ -262,7 +268,7 @@ func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *co
 	return configInfo, nil
 }
 
-func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composetypes.Config, showUnchanged bool) ([]string, error) {
+func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composeGoTypes.Project, showUnchanged bool) ([]string, error) {
 	// Get current images from existing deployment
 	currentImages, err := GetImagesForStack(cl, app)
 	if err != nil {
@@ -282,7 +288,13 @@ func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *com
 		}
 
 		imageBaseName := reference.Path(imageParsed)
-		imageTag := imageParsed.(reference.NamedTagged).Tag()
+		namedTag, ok := imageParsed.(reference.NamedTagged)
+		if !ok {
+			// This is an image without a tag
+			newImages[imageBaseName] = ""
+			continue
+		}
+		imageTag := namedTag.Tag()
 
 		existingImageVersion, ok := newImages[imageBaseName]
 		if !ok {

pkg/envfile/envfile_test.go

@@ -10,48 +10,73 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/recipe"
-	testPkg "coopcloud.tech/abra/pkg/test"
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/stretchr/testify/assert"
 )
 
+var (
+	expectedAppEnv = envfile.AppEnv{
+		"DOMAIN": test.AppName,
+		"RECIPE": test.RecipeName,
+	}
+
+	expectedAppFile = appPkg.AppFile{
+		Path:   test.AppEnvPath,
+		Server: test.ServerName,
+	}
+
+	expectedAppFiles = map[string]appPkg.AppFile{
+		test.AppName: expectedAppFile,
+	}
+)
+
 func TestGetAllFoldersInDirectory(t *testing.T) {
-	folders, err := config.GetAllFoldersInDirectory(testPkg.TestDir)
+	folders, err := config.GetAllFoldersInDirectory(test.TestDir)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(folders, testPkg.TFolders) {
-		t.Fatalf("did not get expected folders. Expected: (%s), Got: (%s)", strings.Join(testPkg.TFolders, ","), strings.Join(folders, ","))
+
+	if !reflect.DeepEqual(folders, test.TFolders) {
+		t.Fatalf("did not get expected folders. Expected: (%s), Got: (%s)", strings.Join(test.TFolders, ","), strings.Join(folders, ","))
 	}
 }
 
 func TestGetAllFilesInDirectory(t *testing.T) {
-	files, err := config.GetAllFilesInDirectory(testPkg.TestDir)
+	files, err := config.GetAllFilesInDirectory(test.TestDir)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	var fileNames []string
 	for _, file := range files {
 		fileNames = append(fileNames, file.Name())
 	}
-	if !reflect.DeepEqual(fileNames, testPkg.TFiles) {
-		t.Fatalf("did not get expected files. Expected: (%s), Got: (%s)", strings.Join(testPkg.TFiles, ","), strings.Join(fileNames, ","))
+
+	if !reflect.DeepEqual(fileNames, test.TFiles) {
+		t.Fatalf("did not get expected files. Expected: (%s), Got: (%s)", strings.Join(test.TFiles, ","), strings.Join(fileNames, ","))
 	}
 }
 
 func TestReadEnv(t *testing.T) {
-	env, err := envfile.ReadEnv(testPkg.ExpectedAppFile.Path)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	env, err := envfile.ReadEnv(expectedAppFile.Path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(env, testPkg.ExpectedAppEnv) {
+
+	if !reflect.DeepEqual(env, expectedAppEnv) {
 		t.Fatal("did not get expected application settings")
 	}
 }
 
 func TestReadAbraShEnvVars(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -78,9 +103,11 @@ func TestReadAbraShEnvVars(t *testing.T) {
 }
 
 func TestReadAbraShCmdNames(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -102,9 +129,11 @@ func TestReadAbraShCmdNames(t *testing.T) {
 }
 
 func TestCheckEnv(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -135,9 +164,11 @@ func TestCheckEnv(t *testing.T) {
 }
 
 func TestCheckEnvError(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -170,9 +201,11 @@ func TestCheckEnvError(t *testing.T) {
 }
 
 func TestEnvVarCommentsRemoved(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -201,9 +234,11 @@ func TestEnvVarCommentsRemoved(t *testing.T) {
 }
 
 func TestEnvVarModifiersIncluded(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -225,7 +260,10 @@ func TestEnvVarModifiersIncluded(t *testing.T) {
 }
 
 func TestNoOverwriteNonVersionEnvVars(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -234,7 +272,7 @@ func TestNoOverwriteNonVersionEnvVars(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	app, err = appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	app, err = appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}

pkg/git/clone_test.go

@@ -8,11 +8,44 @@ import (
 	"testing"
 
 	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/log"
 )
 
+func setup() {
+	teardown()
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/recipes"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+}
+
+func teardown() {
+	abraDir := os.ExpandEnv("$ABRA_DIR")
+	if abraDir == fmt.Sprintf("%s/.abra", os.ExpandEnv("$HOME")) {
+		log.Fatal("set $ABRA_DIR before running the test suite")
+	}
+
+	if err := os.RemoveAll(abraDir); err != nil {
+		log.Fatal(err)
+	}
+}
+
 func TestClone(t *testing.T) {
+	setup()
+	t.Cleanup(func() { teardown() })
+
 	dir := path.Join(config.RECIPES_DIR, "gitea")
-	os.RemoveAll(dir)
+	if err := os.RemoveAll(dir); err != nil {
+		t.Fatal(err)
+	}
 
 	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
 	if err := Clone(dir, gitURL); err != nil {
@@ -25,6 +58,11 @@ func TestClone(t *testing.T) {
 }
 
 func TestCancelGitClone(t *testing.T) {
+	t.Skip("https://git.coopcloud.tech/toolshed/abra/issues/814")
+
+	setup()
+	t.Cleanup(func() { teardown() })
+
 	dir := path.Join(config.RECIPES_DIR, "gitea")
 	os.RemoveAll(dir)
 

pkg/git/commit.go

@@ -35,7 +35,7 @@ func Commit(repoPath, commitMessage string, dryRun bool) error {
 
 	if !dryRun {
 		// NOTE(d1): `All: true` does not include untracked files
-		_, err = commitWorktree.Commit(commitMessage, &git.CommitOptions{All: true})
+		_, err := commitWorktree.Commit(commitMessage, &git.CommitOptions{All: true})
 		if err != nil {
 			return err
 		}

pkg/i18n/i18n.go

@@ -20,8 +20,17 @@ var (
 	Locale        = DefaultLocale
 	_, Mo         = LoadLocale()
 	G             = Mo.Get
+	GC            = Mo.GetC
 )
 
+func GetLocaleStr() string {
+	locale := os.Getenv("LANG")
+	if lastUnderscore := strings.LastIndex(locale, "_"); lastUnderscore != -1 {
+		locale = locale[0:lastUnderscore]
+	}
+	return locale
+}
+
 func LoadLocale() (string, *gotext.Mo) {
 	entries, err := assetFS.ReadDir("locales")
 	if err != nil {
@@ -37,11 +46,7 @@ func LoadLocale() (string, *gotext.Mo) {
 		}
 	}
 
-	locale := os.Getenv("LANG")
-	if lastUnderscore := strings.LastIndex(locale, "_"); lastUnderscore != -1 {
-		locale = locale[0:lastUnderscore]
-	}
-
+	locale := GetLocaleStr()
 	if locale != "" {
 		if slices.Contains(linguas, locale) {
 			Locale = locale

pkg/lint/recipe.go

@@ -62,13 +62,6 @@ func (l LintRule) Skip(recipe recipe.Recipe) bool {
 
 var LintRules = map[string][]LintRule{
 	"warn": {
-		{
-			Ref:          "R001",
-			Level:        i18n.G("warn"),
-			Description:  i18n.G("compose config has expected version"),
-			HowToResolve: i18n.G("ensure 'version: \"3.8\"' in compose configs"),
-			Function:     LintComposeVersion,
-		},
 		{
 			Ref:          "R002",
 			Level:        i18n.G("warn"),
@@ -142,7 +135,7 @@ var LintRules = map[string][]LintRule{
 			Function:     LintAppService,
 		},
 		{
-			Ref:          "R015",
+			Ref:          "R016",
 			Level:        i18n.G("error"),
 			Description:  i18n.G("deploy labels stanza present"),
 			HowToResolve: i18n.G("include \"deploy: labels: ...\" stanza"),
@@ -217,18 +210,6 @@ func LintForErrors(recipe recipe.Recipe) error {
 	return nil
 }
 
-func LintComposeVersion(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
-	if err != nil {
-		return false, err
-	}
-	if config.Version == "3.8" {
-		return true, nil
-	}
-
-	return true, nil
-}
-
 func LintEnvConfigPresent(r recipe.Recipe) (bool, error) {
 	if _, err := os.Stat(r.SampleEnvPath); !os.IsNotExist(err) {
 		return true, nil
@@ -238,7 +219,7 @@ func LintEnvConfigPresent(r recipe.Recipe) (bool, error) {
 }
 
 func LintAppService(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -258,7 +239,7 @@ func LintAppService(recipe recipe.Recipe) (bool, error) {
 func LintTraefikEnabledSkipCondition(r recipe.Recipe) (bool, error) {
 	sampleEnv, err := r.SampleEnv()
 	if err != nil {
-		return false, errors.New(i18n.G("unable to discover .env.sample for %s", r.Name))
+		return false, errors.New(i18n.G(".env.sample for %s couldn't be read: %s", r.Name, err))
 	}
 
 	if _, ok := sampleEnv["DOMAIN"]; !ok {
@@ -269,7 +250,7 @@ func LintTraefikEnabledSkipCondition(r recipe.Recipe) (bool, error) {
 }
 
 func LintTraefikEnabled(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -287,7 +268,7 @@ func LintTraefikEnabled(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintDeployLabelsPresent(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -302,7 +283,7 @@ func LintDeployLabelsPresent(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintHealthchecks(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -316,7 +297,7 @@ func LintHealthchecks(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintAllImagesTagged(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -334,7 +315,7 @@ func LintAllImagesTagged(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintNoUnstableTags(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -361,7 +342,7 @@ func LintNoUnstableTags(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintSemverLikeTags(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -388,7 +369,7 @@ func LintSemverLikeTags(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintImagePresent(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -440,7 +421,7 @@ func LintMetadataFilledIn(r recipe.Recipe) (bool, error) {
 }
 
 func LintAbraShVendors(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -472,7 +453,7 @@ func LintHasRecipeRepo(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintSecretLengths(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}

pkg/recipe/compose.go

@@ -11,10 +11,9 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/upstream/stack"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/distribution/reference"
-	composetypes "github.com/docker/cli/cli/compose/types"
 )
 
 // GetComposeFiles gets the list of compose files for an app (or recipe if you
@@ -61,7 +60,7 @@ func (r Recipe) GetComposeFiles(appEnv map[string]string) ([]string, error) {
 	return composeFiles, nil
 }
 
-func (r Recipe) GetComposeConfig(env map[string]string) (*composetypes.Config, error) {
+func (r Recipe) GetComposeConfig() (*composeGoTypes.Project, error) {
 	pattern := fmt.Sprintf("%s/compose**yml", r.Dir)
 	composeFiles, err := filepath.Glob(pattern)
 	if err != nil {
@@ -72,25 +71,18 @@ func (r Recipe) GetComposeConfig(env map[string]string) (*composetypes.Config, e
 		return nil, errors.New(i18n.G("%s is missing a compose.yml or compose.*.yml file?", r.Name))
 	}
 
-	if env == nil {
-		env, err = r.SampleEnv()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	opts := stack.Deploy{Composefiles: composeFiles}
-	config, err := loader.LoadComposefile(opts, env)
+	config, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles})
 	if err != nil {
 		return nil, err
 	}
+
 	return config, nil
 }
 
 // GetVersionLabelLocal retrieves the version label on the local recipe config
 func (r Recipe) GetVersionLabelLocal() (string, error) {
 	var label string
-	config, err := r.GetComposeConfig(nil)
+	config, err := r.GetComposeConfig()
 	if err != nil {
 		return "", err
 	}
@@ -123,14 +115,7 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 	log.Debug(i18n.G("considering %s config(s) for tag update", strings.Join(composeFiles, ", ")))
 
 	for _, composeFile := range composeFiles {
-		opts := stack.Deploy{Composefiles: []string{composeFile}}
-
-		sampleEnv, err := r.SampleEnv()
-		if err != nil {
-			return false, err
-		}
-
-		compose, err := loader.LoadComposefile(opts, sampleEnv)
+		compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: []string{composeFile}})
 		if err != nil {
 			return false, err
 		}
@@ -168,9 +153,9 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 				new := fmt.Sprintf("%s:%s", composeImage, tag)
 				replacedBytes := strings.Replace(string(bytes), old, new, -1)
 
-				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Filename))
+				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Name))
 
-				if err := os.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+				if err := os.WriteFile(compose.Name, []byte(replacedBytes), 0o764); err != nil {
 					return false, err
 				}
 			}
@@ -191,20 +176,13 @@ func (r Recipe) UpdateLabel(pattern, serviceName, label string) error {
 	log.Debug(i18n.G("considering %s config(s) for label update", strings.Join(composeFiles, ", ")))
 
 	for _, composeFile := range composeFiles {
-		opts := stack.Deploy{Composefiles: []string{composeFile}}
-
-		sampleEnv, err := r.SampleEnv()
-		if err != nil {
-			return err
-		}
-
-		compose, err := loader.LoadComposefile(opts, sampleEnv)
+		compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: []string{composeFile}})
 		if err != nil {
 			return err
 		}
 
 		serviceExists := false
-		var service composetypes.ServiceConfig
+		var service composeGoTypes.ServiceConfig
 		for _, s := range compose.Services {
 			if s.Name == serviceName {
 				service = s
@@ -234,9 +212,9 @@ func (r Recipe) UpdateLabel(pattern, serviceName, label string) error {
 					return nil
 				}
 
-				log.Debug(i18n.G("updating %s to %s in %s", old, label, compose.Filename))
+				log.Debug(i18n.G("updating %s to %s in %s", old, label, compose.Name))
 
-				if err := ioutil.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+				if err := ioutil.WriteFile(compose.Name, []byte(replacedBytes), 0o764); err != nil {
 					return err
 				}
 

pkg/recipe/files.go

@@ -15,7 +15,7 @@ import (
 func (r Recipe) SampleEnv() (map[string]string, error) {
 	sampleEnv, err := envfile.ReadEnv(r.SampleEnvPath)
 	if err != nil {
-		return sampleEnv, errors.New(i18n.G("unable to discover .env.sample for %s", r.Name))
+		return sampleEnv, errors.New(i18n.G(".env.sample for %s couldn't be read: %s", r.Name, err))
 	}
 	return sampleEnv, nil
 }

pkg/recipe/git.go

@@ -32,6 +32,12 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 		return err
 	}
 
+	// NOTE(d1): if we cannot parse the .env.sample then there is a
+	//           fundamental problem which requires solving right now
+	if _, err := r.SampleEnv(); err != nil {
+		return err
+	}
+
 	if ctx.Chaos {
 		return nil
 	}
@@ -49,7 +55,7 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 	if r.EnvVersion != "" && !ctx.IgnoreEnvVersion {
 		log.Debug(i18n.G("ensuring env version %s", r.EnvVersion))
 		if strings.Contains(r.EnvVersion, "+U") {
-			return errors.New(i18n.G("can not redeploy chaos version (%s) without --chaos", r.EnvVersion))
+			return errors.New(i18n.G(`cannot redeploy previous chaos version (%s), did you mean to use "--chaos"?`))
 		}
 
 		if _, err := r.EnsureVersion(r.EnvVersion); err != nil {
@@ -403,15 +409,18 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 			Branch: plumbing.ReferenceName(ref.Name()),
 		}
 		if err := worktree.Checkout(checkOutOpts); err != nil {
-			log.Debug(i18n.G("failed to check out %s in %s", tag, r.Dir))
-			return err
+			log.Debug(i18n.G("failed to check out %s in %s: %s", tag, r.Dir, err))
+			warnMsg = append(warnMsg, i18n.G("skipping tag %s: checkout failed: %s", tag, err))
+			return nil
 		}
 
 		log.Debug(i18n.G("git checkout: %s in %s", ref.Name(), r.Dir))
 
-		config, err := r.GetComposeConfig(nil)
+		config, err := r.GetComposeConfig()
 		if err != nil {
-			return err
+			log.Debug(i18n.G("failed to get compose config for %s: %s", tag, err))
+			warnMsg = append(warnMsg, i18n.G("skipping tag %s: invalid compose config: %s", tag, err))
+			return nil
 		}
 
 		versionMeta := make(map[string]ServiceMeta)
@@ -419,7 +428,9 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 
 			img, err := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
-				return err
+				log.Debug(i18n.G("failed to parse image for %s in %s: %s", service.Name, tag, err))
+				warnMsg = append(warnMsg, i18n.G("skipping tag %s: invalid image reference in service %s: %s", tag, service.Name, err))
+				return nil
 			}
 
 			path := reference.Path(img)
@@ -445,6 +456,7 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 
 		return nil
 	}); err != nil {
+		log.Warn(i18n.G("GetRecipeVersions encountered error for %s: %s (collected %d versions)", r.Name, err, len(versions)))
 		return versions, warnMsg, nil
 	}
 

pkg/recipe/git_test.go

@@ -5,12 +5,15 @@ import (
 	"path/filepath"
 	"testing"
 
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestIsDirty(t *testing.T) {
-	r := Get("abra-test-recipe")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
 
+	r := Get(test.RecipeName)
 	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
@@ -22,10 +25,9 @@ func TestIsDirty(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer f.Close()
-	defer t.Cleanup(func() {
-		os.Remove(fpath)
-	})
+	t.Cleanup(func() { os.Remove(fpath) })
 
 	dirty, err := r.IsDirty()
 	if err != nil {

pkg/recipe/recipe.go

@@ -379,7 +379,7 @@ func ReadRecipeCatalogue(offline bool) (RecipeCatalogue, error) {
 
 	if !offline {
 		if err := catalogue.EnsureUpToDate(); err != nil {
-			return nil, err
+			return nil, fmt.Errorf("unable to update catalogue: %s", err)
 		}
 	}
 

pkg/recipe/recipe_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/test"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
@@ -101,24 +102,24 @@ func TestGet(t *testing.T) {
 }
 
 func TestGetVersionLabelLocalDoesNotUseTimeoutLabel(t *testing.T) {
-	r := Get("traefik")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := Get(test.RecipeName)
 	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
-	for i := 1; i < 50; i++ {
+	timeout := "120"
+	if err := test.AddEnv("TIMEOUT", timeout); err != nil {
+		t.Fatal(err)
+	}
+
+	for i := 1; i < 3; i++ {
 		label, err := r.GetVersionLabelLocal()
 		if err != nil {
 			t.Fatal(err)
 		}
-
-		// NOTE(d1): this is potentially quite a brittle unit test as it needs to
-		// hardcode the default timeout label to ensure that the label parser never
-		// returns it. hopefully this won't fail too often! if you're here because
-		// of a failure, just update the `defaultTimeoutLabel` value & permalink
-		// below
-		// https://git.coopcloud.tech/coop-cloud/traefik/src/commit/ac3a47fe8ca3ef92db84f64cfedfbb348000faee/.env.sample#L2
-		defaultTimeoutLabel := "300"
-		assert.NotEqual(t, label, defaultTimeoutLabel)
+		assert.NotEqual(t, label, timeout)
 	}
 }

pkg/secret/secret.go

@@ -5,6 +5,8 @@ package secret
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"slices"
@@ -18,7 +20,6 @@ import (
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/upstream/stack"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/decentral1se/passgen"
 	"github.com/docker/docker/api/types"
@@ -39,6 +40,14 @@ type Secret struct {
 	// variable. For Example:
 	//   SECRET_FOO=v1 # charset=default,special
 	Charset string
+	// Encoding comes from the encoding modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # encoding=base64
+	Encoding string
+	// Prefix comes from the prefix modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # prefix=base64:
+	Prefix string
 	// Whether or not to skip generation of the secret or not
 	// For example: SECRET_FOO=v1 # generate=false
 	SkipGenerate bool
@@ -50,6 +59,11 @@ type Secret struct {
 	// Will have this remote name:
 	//   test_example_com_test_pass_two_v2
 	RemoteName string
+
+	// LocalName iis the name of the secret in the recipe config. This is also
+	// the name that you pass to `abra app secret insert` and is shown on `abra
+	// app secret list`
+	LocalName string
 }
 
 // GeneratePassword generates passwords.
@@ -82,6 +96,17 @@ func GeneratePassphrase() (string, error) {
 	return passphrases[0], nil
 }
 
+// generateRandomBytes generates random bytes as a string
+func generateRandomBytes(length int) (string, error) {
+	randomBytes := make([]byte, length)
+	if _, err := rand.Read(randomBytes); err != nil {
+		return "", errors.New(i18n.G("failed to generate random bytes: %w", err))
+	}
+
+	// Return as string for consistent handling with other secret types
+	return string(randomBytes), nil
+}
+
 // ReadSecretsConfig reads secret names/versions from the recipe config. The
 // function generalises appEnv/composeFiles because some times you have an app
 // and some times you don't (as the caller). We need to be able to handle the
@@ -96,14 +121,13 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	// Set the STACK_NAME to be able to generate the remote name correctly.
 	appEnv["STACK_NAME"] = stackName
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	composeConfig, err := loader.LoadComposefile(opts, appEnv)
+	composeConfig, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles, AppEnv: appEnv})
 	if err != nil {
 		return nil, err
 	}
 
 	// Read the compose files without injecting environment variables.
-	configWithoutEnv, err := loader.LoadComposefile(opts, map[string]string{}, loader.SkipInterpolation)
+	configWithoutEnv, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles})
 	if err != nil {
 		return nil, err
 	}
@@ -133,7 +157,12 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 
 		lastIdx := strings.LastIndex(secretConfig.Name, "_")
 		secretVersion := secretConfig.Name[lastIdx+1:]
-		value := Secret{Version: secretVersion, RemoteName: secretConfig.Name}
+
+		value := Secret{
+			Version:    secretVersion,
+			RemoteName: secretConfig.Name,
+			LocalName:  secretId,
+		}
 
 		if len(value.RemoteName) > config.MAX_DOCKER_SECRET_LENGTH {
 			return nil, errors.New(i18n.G("secret %s is > %d chars when combined with %s", secretId, config.MAX_DOCKER_SECRET_LENGTH, stackName))
@@ -167,6 +196,8 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 			}
 
 			value.Charset = resolveCharset(modifierValues["charset"])
+			value.Encoding = resolveEncoding(value.Charset, modifierValues["encoding"], secretId)
+			value.Prefix = modifierValues["prefix"]
 			break
 		}
 		secretValues[secretId] = value
@@ -175,9 +206,45 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	return secretValues, nil
 }
 
+// encodeSecret applies encoding to the generated secret value
+func encodeSecret(value, encoding string) string {
+	switch strings.ToLower(encoding) {
+	case "base64":
+		return base64.StdEncoding.EncodeToString([]byte(value))
+	default:
+		return value // No encoding applied
+	}
+}
+
+// applyPrefix adds a prefix to the secret value
+func applyPrefix(value, prefix string) string {
+	if prefix != "" {
+		return prefix + value
+	}
+	return value
+}
+
+// resolveEncoding validates and resolves the encoding for a given charset and secretId
+func resolveEncoding(charset, encoding, secretId string) string {
+	if charset == "bytes" {
+		if encoding == "" {
+			return "base64"
+		} else if encoding != "base64" {
+			log.Warnf(i18n.G("charset=bytes only supports encoding=base64, got encoding=%s for secret %s, defaulting to base64", encoding, secretId))
+			return "base64"
+		}
+	}
+
+	return encoding
+}
+
 // resolveCharset sets the passgen Alphabet required for a secret
 func resolveCharset(input string) string {
 	switch strings.ToLower(input) {
+	case "hex":
+		return passgen.AlphabetNumericAmbiguous + "abcdef"
+	case "bytes":
+		return "bytes"
 	case "special":
 		return passgen.AlphabetSpecial
 	case "safespecial":
@@ -212,12 +279,23 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 			log.Debug(i18n.G("attempting to generate and store %s on %s", secret.RemoteName, server))
 
 			if secret.Length > 0 {
-				password, err := GeneratePassword(uint(secret.Length), secret.Charset)
+				var password string
+				var err error
+
+				if secret.Charset == "bytes" {
+					password, err = generateRandomBytes(secret.Length)
+				} else {
+					password, err = GeneratePassword(uint(secret.Length), secret.Charset)
+				}
+
 				if err != nil {
 					ch <- err
 					return
 				}
 
+				password = encodeSecret(password, secret.Encoding)
+				password = applyPrefix(password, secret.Prefix)
+
 				if err := client.StoreSecret(cl, secret.RemoteName, password); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf(i18n.G("%s already exists", secret.RemoteName))
@@ -238,6 +316,9 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 					return
 				}
 
+				passphrase = encodeSecret(passphrase, secret.Encoding)
+				passphrase = applyPrefix(passphrase, secret.Prefix)
+
 				if err := client.StoreSecret(cl, secret.RemoteName, passphrase); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf(i18n.G("%s already exists", secret.RemoteName))

pkg/secret/secret_test.go

@@ -18,36 +18,80 @@ func TestReadSecretsConfig(t *testing.T) {
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_one"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_one"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_one"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_one"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_one"].Prefix)
 
 	// Has a length modifier
 	assert.Equal(t, "test_example_com_test_pass_two_v1", secretsFromConfig["test_pass_two"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_two"].Version)
 	assert.Equal(t, 10, secretsFromConfig["test_pass_two"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_two"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_two"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_two"].Prefix)
 
 	// Secret name does not include the secret id
 	assert.Equal(t, "test_example_com_pass_three_v2", secretsFromConfig["test_pass_three"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_three"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_three"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_three"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_three"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_three"].Prefix)
 
 	// Has a length modifier and a charset=default,safespecial modifier
 	assert.Equal(t, "test_example_com_test_pass_four_v1", secretsFromConfig["test_pass_four"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_four"].Version)
 	assert.Equal(t, 12, secretsFromConfig["test_pass_four"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=", secretsFromConfig["test_pass_four"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_four"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_four"].Prefix)
 
 	// Has a length modifier and a charset=default,special modifier
 	assert.Equal(t, "test_example_com_test_pass_five_v1", secretsFromConfig["test_pass_five"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_five"].Version)
 	assert.Equal(t, 12, secretsFromConfig["test_pass_five"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_five"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_five"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_five"].Prefix)
 
 	// Has only a charset=default,special modifier, which gets setted but ignored in the generation
 	assert.Equal(t, "test_example_com_test_pass_six_v1", secretsFromConfig["test_pass_six"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_six"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_six"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_six"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_six"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_six"].Prefix)
+
+	// Has a length modifier and a charset=hex modifier
+	assert.Equal(t, "test_example_com_test_pass_seven_v1", secretsFromConfig["test_pass_seven"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_seven"].Version)
+	assert.Equal(t, 32, secretsFromConfig["test_pass_seven"].Length)
+	assert.Equal(t, "0123456789abcdef", secretsFromConfig["test_pass_seven"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_seven"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_seven"].Prefix)
+
+	// Has a length modifier and an encoding=base64 modifier
+	assert.Equal(t, "test_example_com_test_pass_eight_v1", secretsFromConfig["test_pass_eight"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_eight"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_eight"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_eight"].Charset)
+	assert.Equal(t, "base64", secretsFromConfig["test_pass_eight"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_eight"].Prefix)
+
+	// Has a length modifier and a prefix=base64: modifier
+	assert.Equal(t, "test_example_com_test_pass_nine_v1", secretsFromConfig["test_pass_nine"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_nine"].Version)
+	assert.Equal(t, 16, secretsFromConfig["test_pass_nine"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_nine"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_nine"].Encoding)
+	assert.Equal(t, "base64:", secretsFromConfig["test_pass_nine"].Prefix)
+
+	// Has all modifiers: length, charset=bytes, and prefix=base64: (Laravel-style)
+	assert.Equal(t, "test_example_com_test_pass_ten_v1", secretsFromConfig["test_pass_ten"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_ten"].Version)
+	assert.Equal(t, 32, secretsFromConfig["test_pass_ten"].Length)
+	assert.Equal(t, "bytes", secretsFromConfig["test_pass_ten"].Charset)
+	assert.Equal(t, "base64", secretsFromConfig["test_pass_ten"].Encoding) // Defaults to base64 for bytes
+	assert.Equal(t, "base64:", secretsFromConfig["test_pass_ten"].Prefix)
 }
 
 func TestReadSecretsConfigWithLongDomain(t *testing.T) {
@@ -58,3 +102,48 @@ func TestReadSecretsConfigWithLongDomain(t *testing.T) {
 	}
 	assert.Contains(t, err.Error(), "is > 64 chars")
 }
+
+func TestEncodeSecret(t *testing.T) {
+	// base64 encoding
+	input := "testpassword123"
+	encoded := encodeSecret(input, "base64")
+	expected := "dGVzdHBhc3N3b3JkMTIz"
+	assert.Equal(t, expected, encoded)
+
+	// no encoding (default)
+	noEncoding := encodeSecret(input, "")
+	assert.Equal(t, input, noEncoding)
+
+	// unknown encoding (should return original)
+	unknownEncoding := encodeSecret(input, "unknown")
+	assert.Equal(t, input, unknownEncoding)
+}
+
+func TestApplyPrefix(t *testing.T) {
+	input := "testvalue"
+
+	// with prefix
+	prefixed := applyPrefix(input, "base64:")
+	assert.Equal(t, "base64:testvalue", prefixed)
+
+	// with empty prefix
+	noPrefixed := applyPrefix(input, "")
+	assert.Equal(t, input, noPrefixed)
+}
+
+func TestGenerateRandomBytes(t *testing.T) {
+	// random bytes generation with 32 bytes
+	key, err := generateRandomBytes(32)
+	assert.NoError(t, err)
+	assert.Equal(t, 32, len([]byte(key))) // Check raw byte length
+
+	// random bytes generation with 16 bytes
+	key16, err := generateRandomBytes(16)
+	assert.NoError(t, err)
+	assert.Equal(t, 16, len([]byte(key16))) // Check raw byte length
+
+	// that keys are different (randomness)
+	key2, err := generateRandomBytes(32)
+	assert.NoError(t, err)
+	assert.NotEqual(t, key, key2)
+}

pkg/secret/testdir/.env.sample

@@ -4,3 +4,7 @@ SECRET_TEST_PASS_THREE_VERSION=v2
 SECRET_TEST_PASS_FOUR_VERSION=v1 # length=12 charset=default,safespecial
 SECRET_TEST_PASS_FIVE_VERSION=v1 # length=12 charset=default,special
 SECRET_TEST_PASS_SIX_VERSION=v1 # charset=default,special
+SECRET_TEST_PASS_SEVEN_VERSION=v1 # length=32 charset=hex
+SECRET_TEST_PASS_EIGHT_VERSION=v1 # length=12 encoding=base64
+SECRET_TEST_PASS_NINE_VERSION=v1 # length=16 prefix=base64:
+SECRET_TEST_PASS_TEN_VERSION=v1 # length=32 charset=bytes prefix=base64:

pkg/secret/testdir/compose.yaml

@@ -11,6 +11,10 @@ services:
       - test_pass_four
       - test_pass_five
       - test_pass_six
+      - test_pass_seven
+      - test_pass_eight
+      - test_pass_nine
+      - test_pass_ten
 
 secrets:
   test_pass_one:
@@ -31,3 +35,15 @@ secrets:
   test_pass_six:
     external: true
     name: ${STACK_NAME}_test_pass_six_${SECRET_TEST_PASS_SIX_VERSION}
+  test_pass_seven:
+    external: true
+    name: ${STACK_NAME}_test_pass_seven_${SECRET_TEST_PASS_SEVEN_VERSION}
+  test_pass_eight:
+    external: true
+    name: ${STACK_NAME}_test_pass_eight_${SECRET_TEST_PASS_EIGHT_VERSION}
+  test_pass_nine:
+    external: true
+    name: ${STACK_NAME}_test_pass_nine_${SECRET_TEST_PASS_NINE_VERSION}
+  test_pass_ten:
+    external: true
+    name: ${STACK_NAME}_test_pass_ten_${SECRET_TEST_PASS_TEN_VERSION}

pkg/test/test.go

@@ -2,57 +2,53 @@ package test
 
 import (
 	"fmt"
+	"log"
 	"os"
 	"path"
+	"path/filepath"
+	"runtime"
 
-	appPkg "coopcloud.tech/abra/pkg/app"
-	"coopcloud.tech/abra/pkg/envfile"
-	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/recipe"
+	gitPkg "coopcloud.tech/abra/pkg/git"
+	"git.coopcloud.tech/toolshed/godotenv"
 )
 
 var (
 	AppName    = "test_app.example.com"
+	StackName  = "test_app_example_com"
 	ServerName = "test_server"
-	TFiles     = []string{"bar.env", "foo.env"}
-	TFolders   = []string{"dir1", "dir2"}
-	TestServer = os.ExpandEnv("$PWD/../../tests/resources/test_server")
-	TestDir    = os.ExpandEnv("$PWD/../../tests/resources/test_dir")
+	RecipeName = "test_recipe"
 
-	ExpectedAppEnv = envfile.AppEnv{
-		"DOMAIN": "test_app.example.com",
-		"RECIPE": "test_recipe",
-	}
+	TFiles   = []string{"bar.env", "foo.env"}
+	TFolders = []string{"dir1", "dir2"}
 
-	ExpectedApp = appPkg.App{
-		Name:   AppName,
-		Recipe: recipe.Get(ExpectedAppEnv["RECIPE"]),
-		Domain: ExpectedAppEnv["DOMAIN"],
-		Env:    ExpectedAppEnv,
-		Path:   ExpectedAppFile.Path,
-		Server: ExpectedAppFile.Server,
-	}
+	ServerDir = os.ExpandEnv("$ABRA_DIR/servers/test_server")
+	RecipeDir = os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
+	TestDir   = os.ExpandEnv("$PWD/../../tests/resources/test_dir")
 
-	ExpectedAppFile = appPkg.AppFile{
-		Path:   path.Join(TestServer, fmt.Sprintf("%s.env", AppName)),
-		Server: ServerName,
-	}
+	AppEnvPath = path.Join(ServerDir, fmt.Sprintf("%s.env", AppName))
 
-	ExpectedAppFiles = map[string]appPkg.AppFile{
-		AppName: ExpectedAppFile,
-	}
+	AbraTestRecipe = "abra-test-recipe"
 )
 
-func RmServerAppRecipe() {
-	testAppLink := os.ExpandEnv("$ABRA_DIR/servers/test_server")
-	os.Remove(testAppLink)
+func Teardown() {
+	abraDir := os.ExpandEnv("$ABRA_DIR")
+	if abraDir == fmt.Sprintf("%s/.abra", os.ExpandEnv("$HOME")) {
+		log.Fatal("set $ABRA_DIR before running the test suite")
+	}
 
-	testRecipeLink := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
-	os.Remove(testRecipeLink)
+	if err := os.RemoveAll(abraDir); err != nil {
+		log.Fatal(err)
+	}
 }
 
-func MkServerAppRecipe() {
-	RmServerAppRecipe()
+func Setup() {
+	Teardown()
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
 
 	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/servers"), 0700); err != nil {
 		if !os.IsExist(err) {
@@ -66,15 +62,42 @@ func MkServerAppRecipe() {
 		}
 	}
 
-	testAppDir := os.ExpandEnv("$PWD/../../tests/resources/test_server")
-	testAppLink := os.ExpandEnv("$ABRA_DIR/servers/test_server")
-	if err := os.Symlink(testAppDir, testAppLink); err != nil {
+	_, f, _, ok := runtime.Caller(0)
+	if !ok {
+		log.Fatal("Setup: unable to discover current working directory of file")
+	}
+	pwd := filepath.Dir(f)
+
+	serverSrcDir := filepath.Join(pwd, "/../../tests/resources/test_server")
+	serverDestDir := os.ExpandEnv("$ABRA_DIR/servers/test_server")
+	if err := os.CopyFS(serverDestDir, os.DirFS(serverSrcDir)); err != nil {
 		log.Fatal(err)
 	}
 
-	testRecipeDir := os.ExpandEnv("$PWD/../../tests/resources/test_recipe")
-	testRecipeLink := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
-	if err := os.Symlink(testRecipeDir, testRecipeLink); err != nil {
+	recipeSrcDir := filepath.Join(pwd, "/../../tests/resources/test_recipe")
+	recipeDestDir := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
+	if err := os.CopyFS(recipeDestDir, os.DirFS(recipeSrcDir)); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := gitPkg.Init(recipeDestDir, true, "tester", "helo@coopcloud.tech"); err != nil {
 		log.Fatal(err)
 	}
 }
+
+func AddEnv(envKey, envValue string) error {
+	filePath := os.ExpandEnv(fmt.Sprintf("$ABRA_DIR/servers/%s/%s.env", ServerName, AppName))
+
+	envVars, _, err := godotenv.Read(filePath)
+	if err != nil {
+		return err
+	}
+
+	envVars[envKey] = envValue
+
+	if err := godotenv.Write(envVars, filePath); err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/upstream/convert/compose.go

@@ -4,7 +4,7 @@ import (
 	"io/ioutil"
 	"strings"
 
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 )
@@ -48,19 +48,17 @@ func AddStackLabel(namespace Namespace, labels map[string]string) map[string]str
 	return labels
 }
 
-type networkMap map[string]composetypes.NetworkConfig
-
 // Networks from the compose-file type to the engine API type
-func Networks(namespace Namespace, networks networkMap, servicesNetworks map[string]struct{}) (map[string]networktypes.CreateOptions, []string) {
+func Networks(namespace Namespace, networks map[string]composeGoTypes.NetworkConfig, servicesNetworks map[string]struct{}) (map[string]networktypes.CreateOptions, []string) {
 	if networks == nil {
-		networks = make(map[string]composetypes.NetworkConfig)
+		networks = make(map[string]composeGoTypes.NetworkConfig)
 	}
 
 	externalNetworks := []string{}
 	result := make(map[string]networktypes.CreateOptions)
 	for internalName := range servicesNetworks {
 		network := networks[internalName]
-		if network.External.External {
+		if network.External {
 			externalNetworks = append(externalNetworks, network.Name)
 			continue
 		}
@@ -98,19 +96,19 @@ func Networks(namespace Namespace, networks networkMap, servicesNetworks map[str
 }
 
 // Secrets converts secrets from the Compose type to the engine API type
-func Secrets(namespace Namespace, secrets map[string]composetypes.SecretConfig) ([]swarm.SecretSpec, error) {
+func Secrets(namespace Namespace, secrets map[string]composeGoTypes.SecretConfig) ([]swarm.SecretSpec, error) {
 	result := []swarm.SecretSpec{}
 	for name, secret := range secrets {
-		if secret.External.External {
+		if secret.External {
 			continue
 		}
 
 		var obj swarmFileObject
 		var err error
 		if secret.Driver != "" {
-			obj = driverObjectConfig(namespace, name, composetypes.FileObjectConfig(secret))
+			obj = driverObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(secret))
 		} else {
-			obj, err = fileObjectConfig(namespace, name, composetypes.FileObjectConfig(secret))
+			obj, err = fileObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(secret))
 		}
 		if err != nil {
 			return nil, err
@@ -133,14 +131,14 @@ func Secrets(namespace Namespace, secrets map[string]composetypes.SecretConfig)
 }
 
 // Configs converts config objects from the Compose type to the engine API type
-func Configs(namespace Namespace, configs map[string]composetypes.ConfigObjConfig) ([]swarm.ConfigSpec, error) {
+func Configs(namespace Namespace, configs map[string]composeGoTypes.ConfigObjConfig) ([]swarm.ConfigSpec, error) {
 	result := []swarm.ConfigSpec{}
 	for name, config := range configs {
-		if config.External.External {
+		if config.External {
 			continue
 		}
 
-		obj, err := fileObjectConfig(namespace, name, composetypes.FileObjectConfig(config))
+		obj, err := fileObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(config))
 		if err != nil {
 			return nil, err
 		}
@@ -160,7 +158,7 @@ type swarmFileObject struct {
 	Data        []byte
 }
 
-func driverObjectConfig(namespace Namespace, name string, obj composetypes.FileObjectConfig) swarmFileObject {
+func driverObjectConfig(namespace Namespace, name string, obj composeGoTypes.FileObjectConfig) swarmFileObject {
 	if obj.Name != "" {
 		name = obj.Name
 	} else {
@@ -176,7 +174,7 @@ func driverObjectConfig(namespace Namespace, name string, obj composetypes.FileO
 	}
 }
 
-func fileObjectConfig(namespace Namespace, name string, obj composetypes.FileObjectConfig) (swarmFileObject, error) {
+func fileObjectConfig(namespace Namespace, name string, obj composeGoTypes.FileObjectConfig) (swarmFileObject, error) {
 	data, err := ioutil.ReadFile(obj.File)
 	if err != nil {
 		return swarmFileObject{}, err

pkg/upstream/convert/compose_test.go

@@ -1,170 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/compose_test.go
-
-import (
-	"testing"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types/network"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-	"gotest.tools/v3/fs"
-)
-
-func TestNamespaceScope(t *testing.T) {
-	scoped := Namespace{name: "foo"}.Scope("bar")
-	assert.Check(t, is.Equal("foo_bar", scoped))
-}
-
-func TestAddStackLabel(t *testing.T) {
-	labels := map[string]string{
-		"something": "labeled",
-	}
-	actual := AddStackLabel(Namespace{name: "foo"}, labels)
-	expected := map[string]string{
-		"something":    "labeled",
-		LabelNamespace: "foo",
-	}
-	assert.Check(t, is.DeepEqual(expected, actual))
-}
-
-func TestNetworks(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	serviceNetworks := map[string]struct{}{
-		"normal":        {},
-		"outside":       {},
-		"default":       {},
-		"attachablenet": {},
-		"named":         {},
-	}
-	source := networkMap{
-		"normal": composetypes.NetworkConfig{
-			Driver: "overlay",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Ipam: composetypes.IPAMConfig{
-				Driver: "driver",
-				Config: []*composetypes.IPAMPool{
-					{
-						Subnet: "10.0.0.0",
-					},
-				},
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-		"outside": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "special",
-		},
-		"attachablenet": composetypes.NetworkConfig{
-			Driver:     "overlay",
-			Attachable: true,
-		},
-		"named": composetypes.NetworkConfig{
-			Name: "othername",
-		},
-	}
-	expected := map[string]network.CreateOptions{
-		"foo_default": {
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-			},
-		},
-		"foo_normal": {
-			Driver: "overlay",
-			IPAM: &network.IPAM{
-				Driver: "driver",
-				Config: []network.IPAMConfig{
-					{
-						Subnet: "10.0.0.0",
-					},
-				},
-			},
-			Options: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-		},
-		"foo_attachablenet": {
-			Driver:     "overlay",
-			Attachable: true,
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-			},
-		},
-		"othername": {
-			Labels: map[string]string{LabelNamespace: "foo"},
-		},
-	}
-
-	networks, externals := Networks(namespace, source, serviceNetworks)
-	assert.DeepEqual(t, expected, networks)
-	assert.DeepEqual(t, []string{"special"}, externals)
-}
-
-func TestSecrets(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-
-	secretText := "this is the first secret"
-	secretFile := fs.NewFile(t, "convert-secrets", fs.WithContent(secretText))
-	defer secretFile.Remove()
-
-	source := map[string]composetypes.SecretConfig{
-		"one": {
-			File:   secretFile.Path(),
-			Labels: map[string]string{"monster": "mash"},
-		},
-		"ext": {
-			External: composetypes.External{
-				External: true,
-			},
-		},
-	}
-
-	specs, err := Secrets(namespace, source)
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(specs, 1))
-	secret := specs[0]
-	assert.Check(t, is.Equal("foo_one", secret.Name))
-	assert.Check(t, is.DeepEqual(map[string]string{
-		"monster":      "mash",
-		LabelNamespace: "foo",
-	}, secret.Labels))
-	assert.Check(t, is.DeepEqual([]byte(secretText), secret.Data))
-}
-
-func TestConfigs(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-
-	configText := "this is the first config"
-	configFile := fs.NewFile(t, "convert-configs", fs.WithContent(configText))
-	defer configFile.Remove()
-
-	source := map[string]composetypes.ConfigObjConfig{
-		"one": {
-			File:   configFile.Path(),
-			Labels: map[string]string{"monster": "mash"},
-		},
-		"ext": {
-			External: composetypes.External{
-				External: true,
-			},
-		},
-	}
-
-	specs, err := Configs(namespace, source)
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(specs, 1))
-	config := specs[0]
-	assert.Check(t, is.Equal("foo_one", config.Name))
-	assert.Check(t, is.DeepEqual(map[string]string{
-		"monster":      "mash",
-		LabelNamespace: "foo",
-	}, config.Labels))
-	assert.Check(t, is.DeepEqual([]byte(configText), config.Data))
-}

pkg/upstream/convert/service.go

@@ -5,11 +5,13 @@ import (
 	"fmt"
 	"os"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
+	"unsafe"
 
 	"coopcloud.tech/abra/pkg/i18n"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/cli/opts"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
@@ -178,7 +180,7 @@ func ParseConfigs(client client.ConfigAPIClient, requestedConfigs []*swarmtypes.
 // Services from compose-file types to engine API types
 func Services(
 	namespace Namespace,
-	config *composetypes.Config,
+	config *composeGoTypes.Project,
 	client client.CommonAPIClient,
 ) (map[string]swarm.ServiceSpec, error) {
 	result := make(map[string]swarm.ServiceSpec)
@@ -211,14 +213,17 @@ func Services(
 func Service(
 	apiVersion string,
 	namespace Namespace,
-	service composetypes.ServiceConfig,
-	networkConfigs map[string]composetypes.NetworkConfig,
-	volumes map[string]composetypes.VolumeConfig,
+	service composeGoTypes.ServiceConfig,
+	networkConfigs map[string]composeGoTypes.NetworkConfig,
+	volumes map[string]composeGoTypes.VolumeConfig,
 	secrets []*swarm.SecretReference,
 	configs []*swarm.ConfigReference,
 ) (swarm.ServiceSpec, error) {
 	name := namespace.Scope(service.Name)
-	endpoint := convertEndpointSpec(service.Deploy.EndpointMode, service.Ports)
+	endpoint, err := convertEndpointSpec(service.Deploy.EndpointMode, service.Ports)
+	if err != nil {
+		return swarm.ServiceSpec{}, err
+	}
 
 	mode, err := convertDeployMode(service.Deploy.Mode, service.Deploy.Replicas)
 	if err != nil {
@@ -254,9 +259,16 @@ func Service(
 	dnsConfig := convertDNSConfig(service.DNS, service.DNSSearch)
 
 	var privileges swarm.Privileges
+
+	credSpec := service.CredentialSpec
+	if credSpec == nil {
+		credSpec = &composeGoTypes.CredentialSpecConfig{}
+	}
+
 	privileges.CredentialSpec, err = convertCredentialSpec(
-		namespace, service.CredentialSpec, configs,
+		namespace, *credSpec, configs,
 	)
+
 	if err != nil {
 		return swarm.ServiceSpec{}, err
 	}
@@ -271,6 +283,11 @@ func Service(
 
 	capAdd, capDrop := opts.EffectiveCapAddCapDrop(service.CapAdd, service.CapDrop)
 
+	var stopGracePtr time.Duration
+	if service.StopGracePeriod != nil {
+		stopGracePtr = time.Duration(*service.StopGracePeriod)
+	}
+
 	serviceSpec := swarm.ServiceSpec{
 		Annotations: swarm.Annotations{
 			Name:   name,
@@ -290,7 +307,7 @@ func Service(
 				Dir:             service.WorkingDir,
 				User:            service.User,
 				Mounts:          mounts,
-				StopGracePeriod: composetypes.ConvertDurationPtr(service.StopGracePeriod),
+				StopGracePeriod: &stopGracePtr,
 				StopSignal:      service.StopSignal,
 				TTY:             service.Tty,
 				OpenStdin:       service.StdinOpen,
@@ -338,7 +355,7 @@ func Service(
 	return serviceSpec, nil
 }
 
-func getPlacementPreference(preferences []composetypes.PlacementPreferences) []swarm.PlacementPreference {
+func getPlacementPreference(preferences []composeGoTypes.PlacementPreferences) []swarm.PlacementPreference {
 	result := []swarm.PlacementPreference{}
 	for _, preference := range preferences {
 		spreadDescriptor := preference.Spread
@@ -357,13 +374,13 @@ func sortStrings(strs []string) []string {
 }
 
 func convertServiceNetworks(
-	networks map[string]*composetypes.ServiceNetworkConfig,
-	networkConfigs networkMap,
+	networks map[string]*composeGoTypes.ServiceNetworkConfig,
+	networkConfigs map[string]composeGoTypes.NetworkConfig,
 	namespace Namespace,
 	name string,
 ) ([]swarm.NetworkAttachmentConfig, error) {
 	if len(networks) == 0 {
-		networks = map[string]*composetypes.ServiceNetworkConfig{
+		networks = map[string]*composeGoTypes.ServiceNetworkConfig{
 			defaultNetwork: {},
 		}
 	}
@@ -403,20 +420,20 @@ func convertServiceNetworks(
 func convertServiceSecrets(
 	client client.SecretAPIClient,
 	namespace Namespace,
-	secrets []composetypes.ServiceSecretConfig,
-	secretSpecs map[string]composetypes.SecretConfig,
+	secrets []composeGoTypes.ServiceSecretConfig,
+	secretSpecs map[string]composeGoTypes.SecretConfig,
 ) ([]*swarm.SecretReference, error) {
 	refs := []*swarm.SecretReference{}
 
-	lookup := func(key string) (composetypes.FileObjectConfig, error) {
+	lookup := func(key string) (composeGoTypes.FileObjectConfig, error) {
 		secretSpec, exists := secretSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.New(i18n.G("undefined secret %q", key))
+			return composeGoTypes.FileObjectConfig{}, errors.New(i18n.G("undefined secret %q", key))
 		}
-		return composetypes.FileObjectConfig(secretSpec), nil
+		return composeGoTypes.FileObjectConfig(secretSpec), nil
 	}
 	for _, secret := range secrets {
-		obj, err := convertFileObject(namespace, composetypes.FileReferenceConfig(secret), lookup)
+		obj, err := convertFileObject(namespace, composeGoTypes.FileReferenceConfig(secret), lookup)
 		if err != nil {
 			return nil, err
 		}
@@ -451,20 +468,20 @@ func convertServiceSecrets(
 func convertServiceConfigObjs(
 	client client.ConfigAPIClient,
 	namespace Namespace,
-	service composetypes.ServiceConfig,
-	configSpecs map[string]composetypes.ConfigObjConfig,
+	service composeGoTypes.ServiceConfig,
+	configSpecs map[string]composeGoTypes.ConfigObjConfig,
 ) ([]*swarm.ConfigReference, error) {
 	refs := []*swarm.ConfigReference{}
 
-	lookup := func(key string) (composetypes.FileObjectConfig, error) {
+	lookup := func(key string) (composeGoTypes.FileObjectConfig, error) {
 		configSpec, exists := configSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.New(i18n.G("undefined config %q", key))
+			return composeGoTypes.FileObjectConfig{}, errors.New(i18n.G("undefined config %q", key))
 		}
-		return composetypes.FileObjectConfig(configSpec), nil
+		return composeGoTypes.FileObjectConfig(configSpec), nil
 	}
 	for _, config := range service.Configs {
-		obj, err := convertFileObject(namespace, composetypes.FileReferenceConfig(config), lookup)
+		obj, err := convertFileObject(namespace, composeGoTypes.FileReferenceConfig(config), lookup)
 		if err != nil {
 			return nil, err
 		}
@@ -487,7 +504,7 @@ func convertServiceConfigObjs(
 	// if the credSpec uses a config, then we should grab the config name, and
 	// create a config reference for it. A File or Registry-type CredentialSpec
 	// does not need this operation.
-	if credSpec.Config != "" {
+	if credSpec != nil && credSpec.Config != "" {
 		// look up the config in the configSpecs.
 		obj, err := lookup(credSpec.Config)
 		if err != nil {
@@ -532,8 +549,8 @@ type swarmReferenceObject struct {
 
 func convertFileObject(
 	namespace Namespace,
-	config composetypes.FileReferenceConfig,
-	lookup func(key string) (composetypes.FileObjectConfig, error),
+	config composeGoTypes.FileReferenceConfig,
+	lookup func(key string) (composeGoTypes.FileObjectConfig, error),
 ) (swarmReferenceObject, error) {
 	obj, err := lookup(config.Source)
 	if err != nil {
@@ -558,40 +575,37 @@ func convertFileObject(
 	if gid == "" {
 		gid = "0"
 	}
-	mode := config.Mode
-	if mode == nil {
-		mode = uint32Ptr(0444)
-	}
 
-	return swarmReferenceObject{
+	ref := swarmReferenceObject{
 		File: swarmReferenceTarget{
 			Name: target,
 			UID:  uid,
 			GID:  gid,
-			Mode: os.FileMode(*mode),
 		},
 		Name: source,
-	}, nil
-}
+	}
 
-func uint32Ptr(value uint32) *uint32 {
-	return &value
+	if config.Mode == nil {
+		defaultMode := 0444
+		ref.File.Mode = os.FileMode(defaultMode)
+	} else {
+		ref.File.Mode = os.FileMode(*config.Mode)
+	}
+
+	return ref, nil
 }
 
 // convertExtraHosts converts <host>:<ip> mappings to SwarmKit notation:
 // "IP-address hostname(s)". The original order of mappings is preserved.
-func convertExtraHosts(extraHosts composetypes.HostsList) []string {
+func convertExtraHosts(extraHosts composeGoTypes.HostsList) []string {
 	hosts := []string{}
-	for _, hostIP := range extraHosts {
-		if v := strings.SplitN(hostIP, ":", 2); len(v) == 2 {
-			// Convert to SwarmKit notation: IP-address hostname(s)
-			hosts = append(hosts, fmt.Sprintf("%s %s", v[1], v[0]))
-		}
+	for hostName, hostIP := range extraHosts {
+		hosts = append(hosts, fmt.Sprintf("%s %s", hostIP, hostName))
 	}
 	return hosts
 }
 
-func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container.HealthConfig, error) {
+func convertHealthcheck(healthcheck *composeGoTypes.HealthCheckConfig) (*container.HealthConfig, error) {
 	if healthcheck == nil {
 		return nil, nil
 	}
@@ -629,7 +643,7 @@ func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container
 	}, nil
 }
 
-func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (*swarm.RestartPolicy, error) {
+func convertRestartPolicy(restart string, source *composeGoTypes.RestartPolicy) (*swarm.RestartPolicy, error) {
 	if source == nil {
 		policy, err := opts.ParseRestartPolicy(restart)
 		if err != nil {
@@ -653,15 +667,25 @@ func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (*
 		}
 	}
 
+	var windowPtr time.Duration
+	if source.Window != nil {
+		windowPtr = time.Duration(*source.Window)
+	}
+
+	var delayPtr time.Duration
+	if source.Delay != nil {
+		delayPtr = time.Duration(*source.Delay)
+	}
+
 	return &swarm.RestartPolicy{
 		Condition:   swarm.RestartPolicyCondition(source.Condition),
-		Delay:       composetypes.ConvertDurationPtr(source.Delay),
+		Delay:       &delayPtr,
 		MaxAttempts: source.MaxAttempts,
-		Window:      composetypes.ConvertDurationPtr(source.Window),
+		Window:      &windowPtr,
 	}, nil
 }
 
-func convertUpdateConfig(source *composetypes.UpdateConfig) *swarm.UpdateConfig {
+func convertUpdateConfig(source *composeGoTypes.UpdateConfig) *swarm.UpdateConfig {
 	if source == nil {
 		return nil
 	}
@@ -679,13 +703,13 @@ func convertUpdateConfig(source *composetypes.UpdateConfig) *swarm.UpdateConfig
 	}
 }
 
-func convertResources(source composetypes.Resources) (*swarm.ResourceRequirements, error) {
+func convertResources(source composeGoTypes.Resources) (*swarm.ResourceRequirements, error) {
 	resources := &swarm.ResourceRequirements{}
 	var err error
 	if source.Limits != nil {
 		var cpus int64
-		if source.Limits.NanoCPUs != "" {
-			cpus, err = opts.ParseCPUs(source.Limits.NanoCPUs)
+		if source.Limits.NanoCPUs > 0 {
+			cpus, err = opts.ParseCPUs(fmt.Sprintf("%f", source.Limits.NanoCPUs))
 			if err != nil {
 				return nil, err
 			}
@@ -698,8 +722,8 @@ func convertResources(source composetypes.Resources) (*swarm.ResourceRequirement
 	}
 	if source.Reservations != nil {
 		var cpus int64
-		if source.Reservations.NanoCPUs != "" {
-			cpus, err = opts.ParseCPUs(source.Reservations.NanoCPUs)
+		if source.Reservations.NanoCPUs > 0 {
+			cpus, err = opts.ParseCPUs(fmt.Sprintf("%f", source.Reservations.NanoCPUs))
 			if err != nil {
 				return nil, err
 			}
@@ -728,13 +752,29 @@ func convertResources(source composetypes.Resources) (*swarm.ResourceRequirement
 	return resources, nil
 }
 
-func convertEndpointSpec(endpointMode string, source []composetypes.ServicePortConfig) *swarm.EndpointSpec {
+func str2uint32(s string) (uint32, error) {
+	var u32 uint32
+
+	u64, err := strconv.ParseUint(s, 10, 32)
+	if err != nil {
+		return u32, err
+	}
+
+	return uint32(u64), nil
+}
+
+func convertEndpointSpec(endpointMode string, source []composeGoTypes.ServicePortConfig) (*swarm.EndpointSpec, error) {
 	portConfigs := []swarm.PortConfig{}
 	for _, port := range source {
+		published, err := str2uint32(port.Published)
+		if err != nil {
+			return &swarm.EndpointSpec{}, err
+		}
+
 		portConfig := swarm.PortConfig{
 			Protocol:      swarm.PortConfigProtocol(port.Protocol),
 			TargetPort:    port.Target,
-			PublishedPort: port.Published,
+			PublishedPort: published,
 			PublishMode:   swarm.PortConfigPublishMode(port.Mode),
 		}
 		portConfigs = append(portConfigs, portConfig)
@@ -747,7 +787,7 @@ func convertEndpointSpec(endpointMode string, source []composetypes.ServicePortC
 	return &swarm.EndpointSpec{
 		Mode:  swarm.ResolutionMode(strings.ToLower(endpointMode)),
 		Ports: portConfigs,
-	}
+	}, nil
 }
 
 func convertEnvironment(source map[string]*string) []string {
@@ -765,7 +805,7 @@ func convertEnvironment(source map[string]*string) []string {
 	return output
 }
 
-func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error) {
+func convertDeployMode(mode string, replicas *int) (swarm.ServiceMode, error) {
 	serviceMode := swarm.ServiceMode{}
 
 	switch mode {
@@ -775,7 +815,8 @@ func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error)
 		}
 		serviceMode.Global = &swarm.GlobalService{}
 	case "replicated", "":
-		serviceMode.Replicated = &swarm.ReplicatedService{Replicas: replicas}
+		convReplicas := (*uint64)(unsafe.Pointer(replicas))
+		serviceMode.Replicated = &swarm.ReplicatedService{Replicas: convReplicas}
 	default:
 		return serviceMode, errors.New(i18n.G("unknown mode: %s", mode))
 	}
@@ -792,7 +833,7 @@ func convertDNSConfig(DNS []string, DNSSearch []string) *swarm.DNSConfig {
 	return nil
 }
 
-func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpecConfig, refs []*swarm.ConfigReference) (*swarm.CredentialSpec, error) {
+func convertCredentialSpec(namespace Namespace, spec composeGoTypes.CredentialSpecConfig, refs []*swarm.ConfigReference) (*swarm.CredentialSpec, error) {
 	var o []string
 
 	// Config was added in API v1.40
@@ -814,7 +855,13 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	case l > 2:
 		return nil, errors.New(i18n.G("invalid credential spec: cannot specify both %s, and %s", strings.Join(o[:l-1], ", "), o[l-1]))
 	}
-	swarmCredSpec := swarm.CredentialSpec(spec)
+
+	swarmCredSpec := swarm.CredentialSpec{
+		Config:   spec.Config,
+		File:     spec.File,
+		Registry: spec.Registry,
+	}
+
 	// if we're using a swarm Config for the credential spec, over-write it
 	// here with the config ID
 	if swarmCredSpec.Config != "" {
@@ -836,7 +883,7 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	return &swarmCredSpec, nil
 }
 
-func convertUlimits(origUlimits map[string]*composetypes.UlimitsConfig) []*units.Ulimit {
+func convertUlimits(origUlimits map[string]*composeGoTypes.UlimitsConfig) []*units.Ulimit {
 	newUlimits := make(map[string]*units.Ulimit)
 	for name, u := range origUlimits {
 		if u.Single != 0 {

pkg/upstream/convert/service_test.go

@@ -1,678 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/service_test.go
-
-import (
-	"context"
-	"os"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/client"
-	"github.com/pkg/errors"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-)
-
-func TestConvertRestartPolicyFromNone(t *testing.T) {
-	policy, err := convertRestartPolicy("no", nil)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual((*swarm.RestartPolicy)(nil), policy))
-}
-
-func TestConvertRestartPolicyFromUnknown(t *testing.T) {
-	_, err := convertRestartPolicy("unknown", nil)
-	assert.Error(t, err, "unknown restart policy: unknown")
-}
-
-func TestConvertRestartPolicyFromAlways(t *testing.T) {
-	policy, err := convertRestartPolicy("always", nil)
-	expected := &swarm.RestartPolicy{
-		Condition: swarm.RestartPolicyConditionAny,
-	}
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, policy))
-}
-
-func TestConvertRestartPolicyFromFailure(t *testing.T) {
-	policy, err := convertRestartPolicy("on-failure:4", nil)
-	attempts := uint64(4)
-	expected := &swarm.RestartPolicy{
-		Condition:   swarm.RestartPolicyConditionOnFailure,
-		MaxAttempts: &attempts,
-	}
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, policy))
-}
-
-func strPtr(val string) *string {
-	return &val
-}
-
-func TestConvertEnvironment(t *testing.T) {
-	source := map[string]*string{
-		"foo": strPtr("bar"),
-		"key": strPtr("value"),
-	}
-	env := convertEnvironment(source)
-	sort.Strings(env)
-	assert.Check(t, is.DeepEqual([]string{"foo=bar", "key=value"}, env))
-}
-
-func TestConvertExtraHosts(t *testing.T) {
-	source := composetypes.HostsList{
-		"zulu:127.0.0.2",
-		"alpha:127.0.0.1",
-		"zulu:ff02::1",
-	}
-	assert.Check(t, is.DeepEqual([]string{"127.0.0.2 zulu", "127.0.0.1 alpha", "ff02::1 zulu"}, convertExtraHosts(source)))
-}
-
-func TestConvertResourcesFull(t *testing.T) {
-	source := composetypes.Resources{
-		Limits: &composetypes.ResourceLimit{
-			NanoCPUs:    "0.003",
-			MemoryBytes: composetypes.UnitBytes(300000000),
-		},
-		Reservations: &composetypes.Resource{
-			NanoCPUs:    "0.002",
-			MemoryBytes: composetypes.UnitBytes(200000000),
-		},
-	}
-	resources, err := convertResources(source)
-	assert.NilError(t, err)
-
-	expected := &swarm.ResourceRequirements{
-		Limits: &swarm.Limit{
-			NanoCPUs:    3000000,
-			MemoryBytes: 300000000,
-		},
-		Reservations: &swarm.Resources{
-			NanoCPUs:    2000000,
-			MemoryBytes: 200000000,
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, resources))
-}
-
-func TestConvertResourcesOnlyMemory(t *testing.T) {
-	source := composetypes.Resources{
-		Limits: &composetypes.ResourceLimit{
-			MemoryBytes: composetypes.UnitBytes(300000000),
-		},
-		Reservations: &composetypes.Resource{
-			MemoryBytes: composetypes.UnitBytes(200000000),
-		},
-	}
-	resources, err := convertResources(source)
-	assert.NilError(t, err)
-
-	expected := &swarm.ResourceRequirements{
-		Limits: &swarm.Limit{
-			MemoryBytes: 300000000,
-		},
-		Reservations: &swarm.Resources{
-			MemoryBytes: 200000000,
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, resources))
-}
-
-func TestConvertHealthcheck(t *testing.T) {
-	retries := uint64(10)
-	timeout := composetypes.Duration(30 * time.Second)
-	interval := composetypes.Duration(2 * time.Millisecond)
-	source := &composetypes.HealthCheckConfig{
-		Test:     []string{"EXEC", "touch", "/foo"},
-		Timeout:  &timeout,
-		Interval: &interval,
-		Retries:  &retries,
-	}
-	expected := &container.HealthConfig{
-		Test:     source.Test,
-		Timeout:  time.Duration(timeout),
-		Interval: time.Duration(interval),
-		Retries:  10,
-	}
-
-	healthcheck, err := convertHealthcheck(source)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, healthcheck))
-}
-
-func TestConvertHealthcheckDisable(t *testing.T) {
-	source := &composetypes.HealthCheckConfig{Disable: true}
-	expected := &container.HealthConfig{
-		Test: []string{"NONE"},
-	}
-
-	healthcheck, err := convertHealthcheck(source)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, healthcheck))
-}
-
-func TestConvertHealthcheckDisableWithTest(t *testing.T) {
-	source := &composetypes.HealthCheckConfig{
-		Disable: true,
-		Test:    []string{"EXEC", "touch"},
-	}
-	_, err := convertHealthcheck(source)
-	assert.Error(t, err, "test and disable can't be set at the same time")
-}
-
-func TestConvertEndpointSpec(t *testing.T) {
-	source := []composetypes.ServicePortConfig{
-		{
-			Protocol:  "udp",
-			Target:    53,
-			Published: 1053,
-			Mode:      "host",
-		},
-		{
-			Target:    8080,
-			Published: 80,
-		},
-	}
-	endpoint := convertEndpointSpec("vip", source)
-
-	expected := swarm.EndpointSpec{
-		Mode: swarm.ResolutionMode(strings.ToLower("vip")),
-		Ports: []swarm.PortConfig{
-			{
-				TargetPort:    8080,
-				PublishedPort: 80,
-			},
-			{
-				Protocol:      "udp",
-				TargetPort:    53,
-				PublishedPort: 1053,
-				PublishMode:   "host",
-			},
-		},
-	}
-
-	assert.Check(t, is.DeepEqual(expected, *endpoint))
-}
-
-func TestConvertServiceNetworksOnlyDefault(t *testing.T) {
-	networkConfigs := networkMap{}
-
-	configs, err := convertServiceNetworks(
-		nil, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "foo_default",
-			Aliases: []string{"service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertServiceNetworks(t *testing.T) {
-	networkConfigs := networkMap{
-		"front": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "fronttier",
-		},
-		"back": composetypes.NetworkConfig{},
-	}
-	networks := map[string]*composetypes.ServiceNetworkConfig{
-		"front": {
-			Aliases: []string{"something"},
-		},
-		"back": {
-			Aliases: []string{"other"},
-		},
-	}
-
-	configs, err := convertServiceNetworks(
-		networks, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "foo_back",
-			Aliases: []string{"other", "service"},
-		},
-		{
-			Target:  "fronttier",
-			Aliases: []string{"something", "service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertServiceNetworksCustomDefault(t *testing.T) {
-	networkConfigs := networkMap{
-		"default": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "custom",
-		},
-	}
-	networks := map[string]*composetypes.ServiceNetworkConfig{}
-
-	configs, err := convertServiceNetworks(
-		networks, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "custom",
-			Aliases: []string{"service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertDNSConfigEmpty(t *testing.T) {
-	dnsConfig := convertDNSConfig(nil, nil)
-	assert.Check(t, is.DeepEqual((*swarm.DNSConfig)(nil), dnsConfig))
-}
-
-var (
-	nameservers = []string{"8.8.8.8", "9.9.9.9"}
-	search      = []string{"dc1.example.com", "dc2.example.com"}
-)
-
-func TestConvertDNSConfigAll(t *testing.T) {
-	dnsConfig := convertDNSConfig(nameservers, search)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nameservers,
-		Search:      search,
-	}, dnsConfig))
-}
-
-func TestConvertDNSConfigNameservers(t *testing.T) {
-	dnsConfig := convertDNSConfig(nameservers, nil)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nameservers,
-		Search:      nil,
-	}, dnsConfig))
-}
-
-func TestConvertDNSConfigSearch(t *testing.T) {
-	dnsConfig := convertDNSConfig(nil, search)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nil,
-		Search:      search,
-	}, dnsConfig))
-}
-
-func TestConvertCredentialSpec(t *testing.T) {
-	tests := []struct {
-		name        string
-		in          composetypes.CredentialSpecConfig
-		out         *swarm.CredentialSpec
-		configs     []*swarm.ConfigReference
-		expectedErr string
-	}{
-		{
-			name: "empty",
-		},
-		{
-			name:        "config-and-file",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", File: "somefile.json"},
-			expectedErr: `invalid credential spec: cannot specify both "Config" and "File"`,
-		},
-		{
-			name:        "config-and-registry",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "Config" and "Registry"`,
-		},
-		{
-			name:        "file-and-registry",
-			in:          composetypes.CredentialSpecConfig{File: "somefile.json", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "File" and "Registry"`,
-		},
-		{
-			name:        "config-and-file-and-registry",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", File: "somefile.json", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "Config", "File", and "Registry"`,
-		},
-		{
-			name:        "missing-config-reference",
-			in:          composetypes.CredentialSpecConfig{Config: "missing"},
-			expectedErr: "invalid credential spec: spec specifies config missing, but no such config can be found",
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "someName",
-					ConfigID:   "missing",
-				},
-			},
-		},
-		{
-			name: "namespaced-config",
-			in:   composetypes.CredentialSpecConfig{Config: "name"},
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "namespaced-config_name",
-					ConfigID:   "someID",
-				},
-			},
-			out: &swarm.CredentialSpec{Config: "someID"},
-		},
-		{
-			name: "config",
-			in:   composetypes.CredentialSpecConfig{Config: "someName"},
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "someOtherName",
-					ConfigID:   "someOtherID",
-				}, {
-					ConfigName: "someName",
-					ConfigID:   "someID",
-				},
-			},
-			out: &swarm.CredentialSpec{Config: "someID"},
-		},
-		{
-			name: "file",
-			in:   composetypes.CredentialSpecConfig{File: "somefile.json"},
-			out:  &swarm.CredentialSpec{File: "somefile.json"},
-		},
-		{
-			name: "registry",
-			in:   composetypes.CredentialSpecConfig{Registry: "testing"},
-			out:  &swarm.CredentialSpec{Registry: "testing"},
-		},
-	}
-
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			namespace := NewNamespace(tc.name)
-			swarmSpec, err := convertCredentialSpec(namespace, tc.in, tc.configs)
-
-			if tc.expectedErr != "" {
-				assert.Error(t, err, tc.expectedErr)
-			} else {
-				assert.NilError(t, err)
-			}
-			assert.DeepEqual(t, swarmSpec, tc.out)
-		})
-	}
-}
-
-func TestConvertUpdateConfigOrder(t *testing.T) {
-	// test default behavior
-	updateConfig := convertUpdateConfig(&composetypes.UpdateConfig{})
-	assert.Check(t, is.Equal("", updateConfig.Order))
-
-	// test start-first
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Order: "start-first",
-	})
-	assert.Check(t, is.Equal(updateConfig.Order, "start-first"))
-
-	// test stop-first
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Order: "stop-first",
-	})
-	assert.Check(t, is.Equal(updateConfig.Order, "stop-first"))
-}
-
-func TestConvertFileObject(t *testing.T) {
-	namespace := NewNamespace("testing")
-	config := composetypes.FileReferenceConfig{
-		Source: "source",
-		Target: "target",
-		UID:    "user",
-		GID:    "group",
-		Mode:   uint32Ptr(0644),
-	}
-	swarmRef, err := convertFileObject(namespace, config, lookupConfig)
-	assert.NilError(t, err)
-
-	expected := swarmReferenceObject{
-		Name: "testing_source",
-		File: swarmReferenceTarget{
-			Name: config.Target,
-			UID:  config.UID,
-			GID:  config.GID,
-			Mode: os.FileMode(0644),
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, swarmRef))
-}
-
-func lookupConfig(key string) (composetypes.FileObjectConfig, error) {
-	if key != "source" {
-		return composetypes.FileObjectConfig{}, errors.New("bad key")
-	}
-	return composetypes.FileObjectConfig{}, nil
-}
-
-func TestConvertFileObjectDefaults(t *testing.T) {
-	namespace := NewNamespace("testing")
-	config := composetypes.FileReferenceConfig{Source: "source"}
-	swarmRef, err := convertFileObject(namespace, config, lookupConfig)
-	assert.NilError(t, err)
-
-	expected := swarmReferenceObject{
-		Name: "testing_source",
-		File: swarmReferenceTarget{
-			Name: config.Source,
-			UID:  "0",
-			GID:  "0",
-			Mode: os.FileMode(0444),
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, swarmRef))
-}
-
-func TestServiceConvertsIsolation(t *testing.T) {
-	src := composetypes.ServiceConfig{
-		Isolation: "hyperv",
-	}
-	result, err := Service("1.35", Namespace{name: "foo"}, src, nil, nil, nil, nil)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(container.IsolationHyperV, result.TaskTemplate.ContainerSpec.Isolation))
-}
-
-func TestConvertServiceSecrets(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	secrets := []composetypes.ServiceSecretConfig{
-		{Source: "foo_secret"},
-		{Source: "bar_secret"},
-	}
-	secretSpecs := map[string]composetypes.SecretConfig{
-		"foo_secret": {
-			Name: "foo_secret",
-		},
-		"bar_secret": {
-			Name: "bar_secret",
-		},
-	}
-	client := &fakeClient{
-		secretListFunc: func(opts types.SecretListOptions) ([]swarm.Secret, error) {
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "foo_secret"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "bar_secret"))
-			return []swarm.Secret{
-				{Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "foo_secret"}}},
-				{Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "bar_secret"}}},
-			}, nil
-		},
-	}
-	refs, err := convertServiceSecrets(client, namespace, secrets, secretSpecs)
-	assert.NilError(t, err)
-	expected := []*swarm.SecretReference{
-		{
-			SecretName: "bar_secret",
-			File: &swarm.SecretReferenceFileTarget{
-				Name: "bar_secret",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-		{
-			SecretName: "foo_secret",
-			File: &swarm.SecretReferenceFileTarget{
-				Name: "foo_secret",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-	}
-	assert.DeepEqual(t, expected, refs)
-}
-
-func TestConvertServiceConfigs(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	service := composetypes.ServiceConfig{
-		Configs: []composetypes.ServiceConfigObjConfig{
-			{Source: "foo_config"},
-			{Source: "bar_config"},
-		},
-		CredentialSpec: composetypes.CredentialSpecConfig{
-			Config: "baz_config",
-		},
-	}
-	configSpecs := map[string]composetypes.ConfigObjConfig{
-		"foo_config": {
-			Name: "foo_config",
-		},
-		"bar_config": {
-			Name: "bar_config",
-		},
-		"baz_config": {
-			Name: "baz_config",
-		},
-	}
-	client := &fakeClient{
-		configListFunc: func(opts types.ConfigListOptions) ([]swarm.Config, error) {
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "foo_config"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "bar_config"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "baz_config"))
-			return []swarm.Config{
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "foo_config"}}},
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "bar_config"}}},
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "baz_config"}}},
-			}, nil
-		},
-	}
-	refs, err := convertServiceConfigObjs(client, namespace, service, configSpecs)
-	assert.NilError(t, err)
-	expected := []*swarm.ConfigReference{
-		{
-			ConfigName: "bar_config",
-			File: &swarm.ConfigReferenceFileTarget{
-				Name: "bar_config",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-		{
-			ConfigName: "baz_config",
-			Runtime:    &swarm.ConfigReferenceRuntimeTarget{},
-		},
-		{
-			ConfigName: "foo_config",
-			File: &swarm.ConfigReferenceFileTarget{
-				Name: "foo_config",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-	}
-	assert.DeepEqual(t, expected, refs)
-}
-
-type fakeClient struct {
-	client.Client
-	secretListFunc func(types.SecretListOptions) ([]swarm.Secret, error)
-	configListFunc func(types.ConfigListOptions) ([]swarm.Config, error)
-}
-
-func (c *fakeClient) SecretList(ctx context.Context, options types.SecretListOptions) ([]swarm.Secret, error) {
-	if c.secretListFunc != nil {
-		return c.secretListFunc(options)
-	}
-	return []swarm.Secret{}, nil
-}
-
-func (c *fakeClient) ConfigList(ctx context.Context, options types.ConfigListOptions) ([]swarm.Config, error) {
-	if c.configListFunc != nil {
-		return c.configListFunc(options)
-	}
-	return []swarm.Config{}, nil
-}
-
-func TestConvertUpdateConfigParallelism(t *testing.T) {
-	parallel := uint64(4)
-
-	// test default behavior
-	updateConfig := convertUpdateConfig(&composetypes.UpdateConfig{})
-	assert.Check(t, is.Equal(uint64(1), updateConfig.Parallelism))
-
-	// Non default value
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Parallelism: &parallel,
-	})
-	assert.Check(t, is.Equal(parallel, updateConfig.Parallelism))
-}
-
-func TestConvertServiceCapAddAndCapDrop(t *testing.T) {
-	tests := []struct {
-		title   string
-		in, out composetypes.ServiceConfig
-	}{
-		{
-			title: "default behavior",
-		},
-		{
-			title: "some values",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"SYS_NICE", "CAP_NET_ADMIN"},
-				CapDrop: []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"CAP_NET_ADMIN", "CAP_SYS_NICE"},
-				CapDrop: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID"},
-			},
-		},
-		{
-			title: "adding ALL capabilities",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"ALL", "CAP_NET_ADMIN"},
-				CapDrop: []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"ALL"},
-				CapDrop: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID", "CAP_NET_ADMIN"},
-			},
-		},
-		{
-			title: "dropping ALL capabilities",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-				CapDrop: []string{"ALL", "CAP_NET_ADMIN", "CAP_FOO"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID", "CAP_NET_ADMIN"},
-				CapDrop: []string{"ALL"},
-			},
-		},
-	}
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.title, func(t *testing.T) {
-			result, err := Service("1.41", Namespace{name: "foo"}, tc.in, nil, nil, nil, nil)
-			assert.NilError(t, err)
-			assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.CapabilityAdd, tc.out.CapAdd))
-			assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.CapabilityDrop, tc.out.CapDrop))
-		})
-	}
-}

pkg/upstream/convert/volume.go

@@ -2,15 +2,15 @@ package convert // https://github.com/docker/cli/blob/master/cli/compose/convert
 
 import (
 	"coopcloud.tech/abra/pkg/i18n"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/pkg/errors"
 )
 
-type volumes map[string]composetypes.VolumeConfig
+type volumes map[string]composeGoTypes.VolumeConfig
 
 // Volumes from compose-file types to engine api types
-func Volumes(serviceVolumes []composetypes.ServiceVolumeConfig, stackVolumes volumes, namespace Namespace) ([]mount.Mount, error) {
+func Volumes(serviceVolumes []composeGoTypes.ServiceVolumeConfig, stackVolumes volumes, namespace Namespace) ([]mount.Mount, error) {
 	var mounts []mount.Mount
 
 	for _, volumeConfig := range serviceVolumes {
@@ -23,7 +23,7 @@ func Volumes(serviceVolumes []composetypes.ServiceVolumeConfig, stackVolumes vol
 	return mounts, nil
 }
 
-func createMountFromVolume(volume composetypes.ServiceVolumeConfig) mount.Mount {
+func createMountFromVolume(volume composeGoTypes.ServiceVolumeConfig) mount.Mount {
 	return mount.Mount{
 		Type:        mount.Type(volume.Type),
 		Target:      volume.Target,
@@ -34,7 +34,7 @@ func createMountFromVolume(volume composetypes.ServiceVolumeConfig) mount.Mount
 }
 
 func handleVolumeToMount(
-	volume composetypes.ServiceVolumeConfig,
+	volume composeGoTypes.ServiceVolumeConfig,
 	stackVolumes volumes,
 	namespace Namespace,
 ) (mount.Mount, error) {
@@ -68,7 +68,7 @@ func handleVolumeToMount(
 	}
 
 	// External named volumes
-	if stackVolume.External.External {
+	if stackVolume.External {
 		return result, nil
 	}
 
@@ -83,7 +83,7 @@ func handleVolumeToMount(
 	return result, nil
 }
 
-func handleBindToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleBindToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source == "" {
@@ -103,7 +103,7 @@ func handleBindToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, er
 	return result, nil
 }
 
-func handleTmpfsToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleTmpfsToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source != "" {
@@ -117,13 +117,13 @@ func handleTmpfsToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, e
 	}
 	if volume.Tmpfs != nil {
 		result.TmpfsOptions = &mount.TmpfsOptions{
-			SizeBytes: volume.Tmpfs.Size,
+			SizeBytes: int64(volume.Tmpfs.Size),
 		}
 	}
 	return result, nil
 }
 
-func handleNpipeToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleNpipeToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source == "" {
@@ -144,7 +144,7 @@ func handleNpipeToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, e
 }
 
 func convertVolumeToMount(
-	volume composetypes.ServiceVolumeConfig,
+	volume composeGoTypes.ServiceVolumeConfig,
 	stackVolumes volumes,
 	namespace Namespace,
 ) (mount.Mount, error) {

pkg/upstream/convert/volume_test.go

@@ -1,361 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/volume_test.go
-
-import (
-	"testing"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types/mount"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-)
-
-func TestConvertVolumeToMountAnonymousVolume(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Target: "/foo/bar",
-	}
-	expected := mount.Mount{
-		Type:   mount.TypeVolume,
-		Target: "/foo/bar",
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountAnonymousBind(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Target: "/foo/bar",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "invalid bind source, source cannot be empty")
-}
-
-func TestConvertVolumeToMountUnapprovedType(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "foo",
-		Target: "/foo/bar",
-	}
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "volume type must be volume, bind, tmpfs or npipe")
-}
-
-func TestConvertVolumeToMountConflictingOptionsBindInVolume(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "foo",
-		Target: "/target",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "bind options are incompatible with type volume")
-}
-
-func TestConvertVolumeToMountConflictingOptionsTmpfsInVolume(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "foo",
-		Target: "/target",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "tmpfs options are incompatible with type volume")
-}
-
-func TestConvertVolumeToMountConflictingOptionsVolumeInBind(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Source: "/foo",
-		Target: "/target",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "volume options are incompatible with type bind")
-}
-
-func TestConvertVolumeToMountConflictingOptionsTmpfsInBind(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Source: "/foo",
-		Target: "/target",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "tmpfs options are incompatible with type bind")
-}
-
-func TestConvertVolumeToMountConflictingOptionsBindInTmpfs(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/target",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "bind options are incompatible with type tmpfs")
-}
-
-func TestConvertVolumeToMountConflictingOptionsVolumeInTmpfs(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/target",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "volume options are incompatible with type tmpfs")
-}
-
-func TestConvertVolumeToMountNamedVolume(t *testing.T) {
-	stackVolumes := volumes{
-		"normal": composetypes.VolumeConfig{
-			Driver: "glusterfs",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:     mount.TypeVolume,
-		Source:   "foo_normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		VolumeOptions: &mount.VolumeOptions{
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-			DriverConfig: &mount.Driver{
-				Name: "glusterfs",
-				Options: map[string]string{
-					"opt": "value",
-				},
-			},
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeWithNameCustomizd(t *testing.T) {
-	stackVolumes := volumes{
-		"normal": composetypes.VolumeConfig{
-			Name:   "user_specified_name",
-			Driver: "vsphere",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:     mount.TypeVolume,
-		Source:   "user_specified_name",
-		Target:   "/foo",
-		ReadOnly: true,
-		VolumeOptions: &mount.VolumeOptions{
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-			DriverConfig: &mount.Driver{
-				Name: "vsphere",
-				Options: map[string]string{
-					"opt": "value",
-				},
-			},
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeExternal(t *testing.T) {
-	stackVolumes := volumes{
-		"outside": composetypes.VolumeConfig{
-			Name:     "special",
-			External: composetypes.External{External: true},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:          mount.TypeVolume,
-		Source:        "special",
-		Target:        "/foo",
-		VolumeOptions: &mount.VolumeOptions{NoCopy: false},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "outside",
-		Target: "/foo",
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeExternalNoCopy(t *testing.T) {
-	stackVolumes := volumes{
-		"outside": composetypes.VolumeConfig{
-			Name:     "special",
-			External: composetypes.External{External: true},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:   mount.TypeVolume,
-		Source: "special",
-		Target: "/foo",
-		VolumeOptions: &mount.VolumeOptions{
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "outside",
-		Target: "/foo",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountBind(t *testing.T) {
-	stackVolumes := volumes{}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:        mount.TypeBind,
-		Source:      "/bar",
-		Target:      "/foo",
-		ReadOnly:    true,
-		BindOptions: &mount.BindOptions{Propagation: mount.PropagationShared},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "bind",
-		Source:   "/bar",
-		Target:   "/foo",
-		ReadOnly: true,
-		Bind:     &composetypes.ServiceVolumeBind{Propagation: "shared"},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountVolumeDoesNotExist(t *testing.T) {
-	namespace := NewNamespace("foo")
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "unknown",
-		Target:   "/foo",
-		ReadOnly: true,
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "undefined volume \"unknown\"")
-}
-
-func TestConvertTmpfsToMountVolume(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/foo/bar",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	expected := mount.Mount{
-		Type:         mount.TypeTmpfs,
-		Target:       "/foo/bar",
-		TmpfsOptions: &mount.TmpfsOptions{SizeBytes: 1000},
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertTmpfsToMountVolumeWithSource(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Source: "/bar",
-		Target: "/foo/bar",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "invalid tmpfs source, source must be empty")
-}
-
-func TestConvertVolumeToMountAnonymousNpipe(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "npipe",
-		Source: `\\.\pipe\foo`,
-		Target: `\\.\pipe\foo`,
-	}
-	expected := mount.Mount{
-		Type:   mount.TypeNamedPipe,
-		Source: `\\.\pipe\foo`,
-		Target: `\\.\pipe\foo`,
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}

pkg/upstream/stack/loader.go

@@ -1,6 +1,7 @@
 package stack // https://github.com/docker/cli/blob/master/cli/command/stack/loader/loader.go
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
@@ -8,58 +9,62 @@ import (
 	"strings"
 
 	"coopcloud.tech/abra/pkg/i18n"
-	"coopcloud.tech/abra/pkg/log"
+	composeGoCli "github.com/compose-spec/compose-go/v2/cli"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/cli/cli/compose/schema"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
-// DontSkipValidation ensures validation is done for compose file loading
-func DontSkipValidation(opts *loader.Options) {
-	opts.SkipValidation = false
+type LoadConf struct {
+	ComposeFiles []string
+	AppEnv       map[string]string
 }
 
-// SkipInterpolation skip interpolating environment variables.
-func SkipInterpolation(opts *loader.Options) {
-	opts.SkipInterpolation = true
-}
+func LoadCompose(conf LoadConf) (*composeGoTypes.Project, error) {
+	var project *composeGoTypes.Project
 
-// LoadComposefile parse the composefile specified in the cli and returns its Config and version.
-func LoadComposefile(opts Deploy, appEnv map[string]string, options ...func(*loader.Options)) (*composetypes.Config, error) {
-	configDetails, err := getConfigDetails(opts.Composefiles, appEnv)
-	if err != nil {
-		return nil, err
+	// NOTE(d1): silence compose-go internal logger
+	logrus.SetOutput(ioutil.Discard)
+
+	var projectOptions *composeGoCli.ProjectOptions
+	if len(conf.ComposeFiles) == 0 {
+		return project, errors.New(i18n.G("LoadCompose: provide compose files"))
 	}
 
-	if options == nil {
-		options = []func(*loader.Options){DontSkipValidation}
-	}
-
-	dicts := getDictsFrom(configDetails.ConfigFiles)
-	config, err := loader.Load(configDetails, options...)
-	if err != nil {
-		if fpe, ok := err.(*loader.ForbiddenPropertiesError); ok {
-			return nil, errors.New(i18n.G("compose file contains unsupported options: %s", propertyWarnings(fpe.Properties)))
+	if len(conf.AppEnv) == 0 {
+		var err error
+		projectOptions, err = composeGoCli.NewProjectOptions(
+			conf.ComposeFiles,
+			composeGoCli.WithInterpolation(false),
+		)
+		if err != nil {
+			return project, err
+		}
+	} else {
+		var env []string
+		for k, v := range conf.AppEnv {
+			env = append(env, fmt.Sprintf("%s=%s", k, v))
+		}
+
+		var err error
+		projectOptions, err = composeGoCli.NewProjectOptions(
+			conf.ComposeFiles,
+			composeGoCli.WithEnv(env),
+		)
+		if err != nil {
+			return project, err
 		}
-		return nil, err
 	}
 
-	recipeName, exists := appEnv["RECIPE"]
-	if !exists {
-		recipeName, _ = appEnv["TYPE"]
+	project, err := projectOptions.LoadProject(context.Background())
+	if err != nil {
+		return project, err
 	}
 
-	unsupportedProperties := loader.GetUnsupportedProperties(dicts...)
-	if len(unsupportedProperties) > 0 {
-		log.Warn(i18n.G("%s: ignoring unsupported options: %s", recipeName, strings.Join(unsupportedProperties, ", ")))
-	}
-
-	deprecatedProperties := loader.GetDeprecatedProperties(dicts...)
-	if len(deprecatedProperties) > 0 {
-		log.Warn(i18n.G("%s: ignoring deprecated options: %s", recipeName, propertyWarnings(deprecatedProperties)))
-	}
-	return config, nil
+	return project, nil
 }
 
 func getDictsFrom(configFiles []composetypes.ConfigFile) []map[string]interface{} {
@@ -138,7 +143,7 @@ func loadConfigFile(filename string) (*composetypes.ConfigFile, error) {
 
 	config, err := loader.ParseYAML(bytes)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("%s: %s", filename, err)
 	}
 
 	return &composetypes.ConfigFile{

pkg/upstream/stack/loader_test.go

@@ -0,0 +1,26 @@
+package stack_test // https://github.com/docker/cli/blob/master/cli/command/stack/loader/loader.go
+
+import (
+	"testing"
+
+	"coopcloud.tech/abra/pkg/app"
+	"coopcloud.tech/abra/pkg/test"
+)
+
+func TestSkipInterpolation(t *testing.T) {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	a, err := app.Get(test.AppName)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = a.Recipe.GetComposeConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// TODO: ensure compose has a port with no interpolated value
+	// TODO: ensure compose has port with interpolated value
+}

pkg/upstream/stack/remove.go

@@ -247,7 +247,7 @@ func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace stri
 			}
 		}
 
-		if terminalStatesReached == len(tasks) {
+		if terminalStatesReached >= len(tasks) {
 			log.Debug(i18n.G("all tasks reached terminal state"))
 			break
 		}

pkg/upstream/stack/stack.go

@@ -12,6 +12,7 @@ import (
 	stdlibErr "errors"
 
 	tea "github.com/charmbracelet/bubbletea"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/i18n"
@@ -20,7 +21,6 @@ import (
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/stack/formatter"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
@@ -197,10 +197,11 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 func RunDeploy(
 	cl *dockerClient.Client,
 	opts Deploy,
-	cfg *composetypes.Config,
+	cfg *composeGoTypes.Project,
 	appName string,
 	serverName string,
 	dontWait bool,
+	noInput bool,
 	filters filters.Args,
 ) error {
 	log.Info(i18n.G("initialising deployment"))
@@ -226,6 +227,7 @@ func RunDeploy(
 		appName,
 		serverName,
 		dontWait,
+		noInput,
 		filters,
 	)
 }
@@ -244,10 +246,11 @@ func deployCompose(
 	ctx context.Context,
 	cl *dockerClient.Client,
 	opts Deploy,
-	config *composetypes.Config,
+	config *composeGoTypes.Project,
 	appName string,
 	serverName string,
 	dontWait bool,
+	noInput bool,
 	filters filters.Args,
 ) error {
 	namespace := convert.NewNamespace(opts.Namespace)
@@ -311,6 +314,7 @@ func deployCompose(
 		Services:   serviceIDs,
 		AppName:    appName,
 		ServerName: serverName,
+		NoInput:    noInput,
 		Filters:    filters,
 	}
 
@@ -321,7 +325,7 @@ func deployCompose(
 	return nil
 }
 
-func getServicesDeclaredNetworks(serviceConfigs []composetypes.ServiceConfig) map[string]struct{} {
+func getServicesDeclaredNetworks(serviceConfigs map[string]composeGoTypes.ServiceConfig) map[string]struct{} {
 	serviceNetworks := map[string]struct{}{}
 	for _, serviceConfig := range serviceConfigs {
 		if len(serviceConfig.Networks) == 0 {
@@ -561,6 +565,7 @@ func timestamp() string {
 type WaitOpts struct {
 	AppName    string
 	Filters    filters.Args
+	NoInput    bool
 	NoLog      bool
 	Quiet      bool
 	ServerName string
@@ -570,7 +575,13 @@ type WaitOpts struct {
 func WaitOnServices(ctx context.Context, cl *dockerClient.Client, opts WaitOpts) error {
 	timeout := time.Duration(WaitTimeout) * time.Second
 	model := ui.DeployInitialModel(ctx, cl, opts.Services, opts.AppName, timeout, opts.Filters)
-	tui := tea.NewProgram(model)
+
+	var tui *tea.Program
+	if opts.NoInput {
+		tui = tea.NewProgram(model, tea.WithoutRenderer(), tea.WithInput(nil))
+	} else {
+		tui = tea.NewProgram(model)
+	}
 
 	if !opts.Quiet {
 		log.Info(i18n.G("polling deployment status"))

renovate.json

@@ -8,7 +8,7 @@
     "gomodTidy"
   ],
   "ignoreDeps": [
-    "github.com/urfave/cli",
-    "goreleaser/goreleaser"
+    "github.com/docker/cli",
+    "github.com/spf13/cobra"
   ]
 }

scripts/cloud-init/README.md

@@ -0,0 +1,5 @@
+# cloud-init
+
+This folder contains cloud-init files for installing Abra and its dependencies.
+
+For more information, see <https://cloudinit.readthedocs.io/en/latest/index.html>

scripts/cloud-init/cloud-init.yaml

@@ -0,0 +1,49 @@
+#cloud-config
+
+package_update: true
+package_upgrade: true
+package_reboot_if_required: true
+
+# https://packages.debian.org/bookworm/docker.io
+packages:
+  - ca-certificates
+  - curl
+  - docker.io
+  - docker-compose
+  # https://stackoverflow.com/a/74084180
+  - apparmor
+
+# https://docs.coopcloud.tech/operators/tutorial/#server-setup
+runcmd:
+  - curl -fsSL https://install.abra.coopcloud.tech | env HOME=/root bash
+  - docker swarm init
+  - docker network create -d overlay proxy
+
+write_files:
+  # Add abra to PATH and set EDITOR
+  - path: /etc/profile.d/custom_path.sh
+    content: |
+      export PATH=$PATH:$HOME/.local/bin
+      export EDITOR=vim
+    owner: root:root
+    permissions: '0755'
+  # Send container log to journald: https://docs.coopcloud.tech/operators/handbook/#how-do-i-persist-container-logs-after-they-go-away
+  - path: /etc/docker/daemon.json
+    content: |
+      {
+          "log-driver": "journald",
+          "log-opts": {
+            "labels":"com.docker.swarm.service.name"
+          }
+      }
+    owner: root:root
+    permissions: '0644'
+  # Rotate logs
+  - path: /etc/systemd/journald.conf
+    content: |
+      [Journal]
+      Storage=persistent
+      SystemMaxUse=5G
+      MaxFileSec=1month
+    owner: root:root
+    permissions: '0644'

scripts/installer/installer

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-ABRA_VERSION="0.11.0-beta"
+ABRA_VERSION="0.13.0-beta"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.11.0-beta"
+RC_VERSION="0.13.0-beta"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$RC_VERSION"
 
 for arg in "$@"; do
@@ -14,15 +14,15 @@ done
 
 function show_banner {
   echo ""
-  echo "   ____                           ____ _                 _ "
-  echo "  / ___|___         ___  _ __    / ___| | ___  _   _  __| |"
-  echo " | |   / _ \ _____ / _ \| '_ \  | |   | |/ _ \| | | |/ _' |"
-  echo " | |__| (_) |_____| (_) | |_) | | |___| | (_) | |_| | (_| |"
-  echo "  \____\___/       \___/| .__/   \____|_|\___/ \__,_|\__,_|"
-  echo "                        |_|"
+  echo "   ____                         ____ _                 _ "
+  echo "  / ___|___       ___  _ __    / ___| | ___  _   _  __| |"
+  echo " | |   / _ \ ___ / _ \| '_ \  | |   | |/ _ \| | | |/ _' |"
+  echo " | |__| (_) |___| (_) | |_) | | |___| | (_) | |_| | (_| |"
+  echo "  \____\___/     \___/| .__/   \____|_|\___/ \__,_|\__,_|"
+  echo "                      |_|"
   echo ""
   echo ""
-  echo "          === Public interest infrastructure ===           "
+  echo "        === Public interest infrastructure ===           "
   echo ""
   echo ""
 }
@@ -89,7 +89,7 @@ function install_abra_release {
   if [ $? -ne 0 ]; then
       echo "$(tput setaf 3)WARNING: $HOME/.local/bin/ is not in \$PATH! If you want to run abra by just typing "abra" you should add it to your \$PATH! To do that run this once and restart your terminal:$(tput sgr0)"
       p=$HOME/.local/bin
-      com="echo PATH=\$PATH:$p"
+      com='echo PATH="$PATH:'"$p"'"'
       if [[ $SHELL =~ "bash" ]]; then
           echo "$com >> $HOME/.bashrc"
       elif [[ $SHELL =~ "fizsh" ]]; then

scripts/tests/run-ci-int

@@ -50,8 +50,8 @@ echo "========================================================================"
 echo "========================================================================"
 echo "BUILDING ABRA"
 echo "========================================================================"
-export PATH="/usr/lib/go-1.21/bin:$PATH"
-make build-abra
+export PATH="$PATH:/usr/local/go/bin"
+make build
 echo "========================================================================"
 
 echo "========================================================================"

tests/integration/app_check.bats

@@ -106,7 +106,7 @@ teardown(){
 
   run $ABRA app check "$TEST_APP_DOMAIN" --chaos
   assert_failure
-  assert_output --partial 'unable to discover .env.sample'
+  assert_output --partial 'no such file or directory'
 }
 
 @test "error if missing env var" {

tests/integration/app_deploy.bats

@@ -23,12 +23,24 @@ teardown(){
   _reset_recipe
   _undeploy_app
   _undeploy_app2 "gitea.$TEST_SERVER"
+  _undeploy_app2 "zammad.$TEST_SERVER"
 
   _reset_app
   _reset_tags
 
   run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  if [[ -d "$ABRA_DIR/recipes/foo" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/foo"
+    assert_not_exists "$ABRA_DIR/recipes/foo"
+  fi
+
+  # NOTE(d1): give some extra space for the pure chaos that we are unleashing
+  #           on the CI machine with these deploy tests. the hope is to prevent
+  #           lock-ups and network failures which are common in flaky swarm
+  #           mode
+  sleep 1
 }
 
 @test "validate app argument" {
@@ -75,8 +87,10 @@ teardown(){
   assert_success
 }
 
-# bats test_tags=slow
 @test "bail if recipe lint errors and no --chaos" {
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout main
+  assert_success
+
   # Break the recipe
   run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
   assert_success
@@ -88,8 +102,8 @@ teardown(){
   assert_success
 
   # Make a broken release
-  run $ABRA recipe sync --patch "$TEST_RECIPE"
   run $ABRA recipe release --patch -n "$TEST_RECIPE"
+  assert_success
 
   # Make sure we deploy latest
   _wipe_env_version
@@ -175,7 +189,7 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "bail if env has a hash but no --chaos" {
+@test "do not bail if env version is a hash but no --chaos" {
   wantHash=$(_get_n_hash 3)
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" reset --hard HEAD~3
@@ -250,6 +264,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
     --no-input --no-converge-checks --chaos
   assert_success
+  assert_output --regexp "NEW DEPLOYMENT.*${_get_head_hash:0:8}"
 }
 
 # bats test_tags=slow
@@ -367,6 +382,21 @@ teardown(){
 
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks
   assert_failure
+  assert_output --partial "secret not generated"
+}
+
+@test "error if secret not inserted" {
+  run sed -i 's/COMPOSE_FILE="compose.yml"/COMPOSE_FILE="compose.yml:compose.skip_pass.yml"/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run sed -i 's/#SECRET_TEST_SKIP_PASS_VERSION=v1/SECRET_TEST_SKIP_PASS_VERSION=v1/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks
+  assert_failure
+  assert_output --partial "secret not inserted"
 }
 
 # bats test_tags=slow
@@ -527,7 +557,7 @@ teardown(){
 
 # bats test_tags=slow
 @test "ignore timeout when not present in env" {
-  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks --debug
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks
   assert_success
   refute_output --partial "timeout: set to"
 }
@@ -538,6 +568,7 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 
+  # NOTE(d1}: --debug  required
   run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks --debug
   assert_success
   assert_output --partial "timeout: set to 120"
@@ -561,3 +592,113 @@ teardown(){
   assert_success
   refute_output --partial "IMAGES"
 }
+
+# bats test_tags=slow
+@test "re-deploy updates existing env vars" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
+    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+  assert_success
+  assert_output --partial "WITH_COMMENT=foo"
+
+  run sed -i 's/WITH_COMMENT=foo/WITH_COMMENT=bar/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --force
+  assert_success
+
+  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
+    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+  assert_success
+  refute_output --partial "WITH_COMMENT=foo"
+  assert_output --partial "WITH_COMMENT=bar"
+}
+
+# bats test_tags=slow
+@test "deploy with udp and tcp on same port" {
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/p4u1\/abra-test-recipe:030e8a1cb1a0f17281847b3e55d829220ad32c50/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run bash -c "printf '\nCOMPOSE_FILE=\"\$COMPOSE_FILE:compose.udp-and-tcp.yml\"' >> $ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  run docker service inspect  --format '{{ range .Endpoint.Ports }}{{ .Protocol }}={{ .PublishedPort }}{{ end }}' \
+    "${TEST_APP_DOMAIN//./_}_app"
+  assert_success
+  assert_output --partial "tcp=1312"
+  assert_output --partial "udp=1312"
+}
+
+# bats test_tags=slow
+@test "does not crash when docker image has no tag" {
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/p4u1\/abra-test-recipe:b29422d5a344ea45df271443182f775ea82b4da8/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run bash -c "printf '\nCOMPOSE_FILE=\"\$COMPOSE_FILE:compose.no-image-tag.yml\"' >> $ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+}
+
+
+@test "does not use old recipe version when recipe is broken" {
+  run $ABRA app new zammad \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "zammad.$TEST_SERVER" \
+    --secrets
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/zammad.$TEST_SERVER.env"
+
+  # NOTE(d1): --no-converge-checks because the zammad recipe is a beast and we
+  #           mostly only care about the correct version being used
+  run $ABRA app deploy "zammad.$TEST_SERVER" \
+    --no-input --no-converge-checks
+  assert_success
+  refute_output --partial "1.0.0+6.3.1-95"
+}
+
+# bats test_tags=slow
+@test "unable to deploy borked tag" {
+  _remove_tags
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
+    -a "2.4.8_1" -m "feat: completely borked tag"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "2.4.8_1" \
+    --no-input --no-converge-checks --debug
+  assert_failure
+  assert_output --partial "unable to parse"
+}
+
+# bats test_tags=slow
+@test "app deploy with borked sample env gives useful error" {
+  run $ABRA recipe new foo --no-input
+  assert_success
+
+  run $ABRA app new foo \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "foo.$TEST_SERVER" \
+    --chaos
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/foo.$TEST_SERVER.env"
+
+  run bash -c "printf '\nEVIL-VAR=EVIL' >> $ABRA_DIR/recipes/foo/.env.sample"
+  assert_success
+
+  run $ABRA app deploy "foo.$TEST_SERVER" \
+    --no-input --no-converge-checks --chaos
+  assert_failure
+  assert_output --partial "unexpected character"
+}

tests/integration/app_deploy_env_version.bats

@@ -127,3 +127,14 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+# bats test_tags=slow
+@test "new env version written to container env" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input
+  assert_success
+
+  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
+    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+  assert_success
+  assert_output --partial "$TEST_RECIIPE:0.1.0+1.20.0"
+}

tests/integration/app_deploy_overview.bats

@@ -38,8 +38,8 @@ teardown(){
   assert_success
 
   assert_output --partial 'NEW DEPLOY OVERVIEW'
-  assert_output --partial 'CURRENT DEPLOYMENT    N/A'
-  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial 'CURRENT DEPLOYMENT    -'
+  assert_output --partial 'ENV VERSION           -'
   assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
   assert_output --partial "IMAGES                nginx: ${latestRelease##*+} (new)"
   assert_output --partial "CONFIGS               test_conf: v1 (new)"
@@ -57,7 +57,7 @@ teardown(){
   assert_success
 
   assert_output --partial 'NEW DEPLOY OVERVIEW'
-  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "CURRENT DEPLOYMENT    -"
   assert_output --partial "ENV VERSION           ${latestRelease}"
   assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
   assert_output --partial "IMAGES                nginx: ${latestRelease##*+} (new)"
@@ -68,6 +68,13 @@ teardown(){
   assert_success
 }
 
+@test "domain shown with https" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks
+  assert_success
+  assert_output --partial "https://$TEST_DOMAIN"
+}
+
 # bats test_tags=slow
 @test "show changed config version on re-deploy" {
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
@@ -102,7 +109,7 @@ teardown(){
   assert_success
 
   assert_output --partial 'NEW DEPLOY OVERVIEW'
-  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "CURRENT DEPLOYMENT    -"
   assert_output --partial "ENV VERSION           0.1.1+1.20.2"
   assert_output --partial "NEW DEPLOYMENT        0.1.1+1.20.2"
 
@@ -125,7 +132,7 @@ teardown(){
   assert_success
 
   assert_output --partial 'NEW DEPLOY OVERVIEW'
-  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "CURRENT DEPLOYMENT    -"
   assert_output --partial "ENV VERSION           0.1.1+1.20.2"
   assert_output --partial "NEW DEPLOYMENT        ${latestRelease}"
 
@@ -163,7 +170,7 @@ teardown(){
   assert_success
 }
 
-@test "can not redeploy chaos version without --chaos" {
+@test "cannot redeploy chaos version without --chaos" {
   headHash=$(_get_head_hash)
   latestRelease=$(_latest_release)
 
@@ -181,7 +188,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
     --no-input --no-converge-checks --force --debug
   assert_failure
-  assert_output --regexp 'can not redeploy chaos version .*' + "${headHash:0:8}+U"
+  assert_output --regexp 'cannot redeploy previous chaos version .*' + "${headHash:0:8}+U"
 }
 
 @test "deploy then force commit deploy" {
@@ -219,7 +226,7 @@ teardown(){
   assert_success
 
   assert_output --partial 'NEW DEPLOY OVERVIEW'
-  assert_output --partial "CURRENT DEPLOYMENT    N/A"
+  assert_output --partial "CURRENT DEPLOYMENT    -"
   assert_output --partial "ENV VERSION           ${latestRelease}"
   assert_output --partial "NEW DEPLOYMENT        ${headHash:0:8}"
 

tests/integration/app_env.bats

@@ -28,17 +28,17 @@ teardown(){
 }
 
 @test "validate app argument" {
-  run $ABRA app env
+  run $ABRA app env list
   assert_failure
 
-  run $ABRA app env DOESNTEXIST
+  run $ABRA app env list DOESNTEXIST
   assert_failure
 }
 
 @test "show env version" {
   latestRelease=$(_latest_release)
 
-  run $ABRA app env "$TEST_APP_DOMAIN"
+  run $ABRA app env list "$TEST_APP_DOMAIN"
   assert_success
   assert_output --partial "$latestRelease"
 }
@@ -48,7 +48,7 @@ teardown(){
   assert_success
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
 
-  run $ABRA app env "$TEST_APP_DOMAIN"
+  run $ABRA app env list "$TEST_APP_DOMAIN"
   assert_success
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
@@ -57,3 +57,44 @@ teardown(){
   run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
 }
+
+@test "app env pull explodes when no deployed app" { 
+  run $ABRA app env pull "$TEST_APP_DOMAIN" -s "$TEST_SERVER"
+  assert_failure
+}
+
+# bats test_tags=slow
+@test "app env pull recreates app env when missing" { 
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  run rm -rf "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run $ABRA app env pull "$TEST_APP_DOMAIN" -s "$TEST_SERVER"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+}
+
+# bats test_tags=slow
+@test "app env pull recreates correct version" { 
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input
+  assert_success
+
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run rm -rf "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run $ABRA app env pull "$TEST_APP_DOMAIN" -s "$TEST_SERVER"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+}

tests/integration/app_list.bats

@@ -15,6 +15,7 @@ teardown_file(){
   _undeploy_app
   _rm_app
   _rm_server
+  _reset_recipe
 
   if [[ -d "$ABRA_DIR/servers/foo" ]]; then
     run rm -rf "$ABRA_DIR/servers/foo"
@@ -66,6 +67,16 @@ teardown(){
   assert_output --partial "$TEST_SERVER"
   assert_output --partial "$TEST_APP_DOMAIN"
   assert_output --partial "deployed"
+  assert_output --partial "latest"
+
+  _remove_tags
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "$TEST_SERVER"
+  assert_output --partial "$TEST_APP_DOMAIN"
+  assert_output --partial "deployed"
+  assert_output --partial "latest"
 }
 
 @test "filter by server" {
@@ -150,7 +161,7 @@ teardown(){
     --no-input --no-converge-checks --chaos
   assert_success
 
-  run $ABRA app ls --status
+  run $ABRA app ls --status --chaos
   assert_success
   assert_output --partial "+U"
 
@@ -159,23 +170,6 @@ teardown(){
   assert_not_exists "$ABRA_DIR/servers/foo.com"
 }
 
-@test "list with status skips unknown servers" {
-  if [[ ! -d "$ABRA_DIR/servers/foo" ]]; then
-    run mkdir -p "$ABRA_DIR/servers/foo"
-    assert_success
-    assert_exists "$ABRA_DIR/servers/foo"
-
-    run cp "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env" \
-           "$ABRA_DIR/servers/foo/$TEST_APP_DOMAIN.env"
-    assert_success
-    assert_exists "$ABRA_DIR/servers/foo/$TEST_APP_DOMAIN.env"
-  fi
-
-  run $ABRA app ls --status
-  assert_success
-  assert_output --partial "unknown server"
-}
-
 # bats test_tags=slow
 @test "list does not fail if missing .env" {
   _deploy_app
@@ -193,3 +187,19 @@ teardown(){
     <(jq -S "." <(echo '{}'))
   assert_success
 }
+
+# bats test_tags=slow
+@test "list ignores borked tags" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks
+  assert_success
+
+  # NOTE(d1): always upgradable tag which is also borked
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
+    -a "100.100.100_1_2_3" -m "feat: completely borked tag"
+  assert_success
+
+  run $ABRA app ls --status --debug
+  assert_success
+  assert_output --partial "unable to parse"
+}

tests/integration/app_new.bats

@@ -22,8 +22,15 @@ teardown(){
   _reset_recipe
   _reset_tags
 
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  if [[ -f "$ABRA_DIR/recipes/$TEST_RECIPE/foo" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+    assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  fi
+
+  if [[ -f "$ABRA_DIR/servers/$TEST_SERVER/rauthy.$TEST_APP_DOMAIN.env" ]]; then
+    run rm -rf "$ABRA_DIR/servers/$TEST_SERVER/rauthy.$TEST_APP_DOMAIN.env"
+    assert_not_exists "$ABRA_DIR/servers/$TEST_SERVER/rauthy.$TEST_APP_DOMAIN.env"
+  fi
 }
 
 @test "create new app" {
@@ -56,6 +63,30 @@ teardown(){
   assert_success
 }
 
+@test "ensure recipe is up-to-date" {
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l'
+  assert_success
+  assert_output --partial '0.3.5+1.21.0'
+
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -d 0.3.5+1.21.0'
+  assert_success
+
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l'
+  assert_success
+  refute_output --partial '0.3.5+1.21.0'
+
+  run $ABRA app new "$TEST_RECIPE" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run grep -q "TYPE=$TEST_RECIPE:0.3.5+1.21.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+}
+
 @test "create new app with version commit" {
   tagHash=$(_get_tag_hash "0.3.0+1.21.0")
 
@@ -270,3 +301,32 @@ teardown(){
   assert_success
   refute_output --partial "requires secret generation"
 }
+
+@test "do not warn about generation when generate=false" {
+  run $ABRA app new --domain "$TEST_APP_DOMAIN" renovate "1.0.1+41-full"
+  assert_success
+  refute_output --partial "requires secret generation"
+}
+
+@test "warn about insertion when generate=false" {
+  run $ABRA app new --domain "$TEST_APP_DOMAIN" renovate "1.0.1+41-full"
+  assert_success
+  assert_output --partial "requires secret insertion"
+}
+
+@test "warn about both insert/generate when generate=false/true" {
+  run $ABRA app new rauthy "1.0.0+0.32.3" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "rauthy.$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/rauthy.$TEST_APP_DOMAIN.env"
+  assert_output --partial "requires secret generation"
+  assert_output --partial "requires secret insertion"
+}
+
+@test "no warn about generation if already generated" {
+  run $ABRA app new "$TEST_RECIPE" --domain "$TEST_APP_DOMAIN" --secrets
+  assert_success
+  refute_output --partial "requires secret generation"
+}

tests/integration/app_rollback.bats

@@ -181,7 +181,7 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "rollback chaos deployment is not possible" {
+@test "rollback chaos deployment is possible" {
   tagHash=$(_get_tag_hash "0.2.0+1.21.0")
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
   assert_success
@@ -191,12 +191,13 @@ teardown(){
   assert_output --partial "${tagHash:0:8}"
 
   run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.1+1.20.2" --no-input --no-converge-checks
-  assert_failure
-  assert_output --partial 'current deployment' + "${tagHash:0:8}" + 'is not a known version'
+  assert_success
+  assert_output --regexp "CURRENT DEPLOYMENT.*${tagHash:0:8}"
+  assert_output --regexp "ENV VERSION.*${tagHash:0:8}"
 }
 
 # bats test_tags=slow
-@test "chaos commit rollback not possible" {
+@test "specific chaos commit rollback not possible" {
   _deploy_app
 
   tagHash=$(_get_tag_hash "0.2.0+1.21.0")

tests/integration/app_rollback_env_version.bats

@@ -33,10 +33,29 @@ teardown(){
   assert_success
 
   run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
-    --no-input --no-converge-checks --debug
+    --no-input --no-converge-checks
   assert_success
 
   run grep -q "TYPE=abra-test-recipe:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+# bats test_tags=slow
+@test "new env version written to container env" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input
+  assert_success
+
+  run grep -q "TYPE=abra-test-recipe:0.2.0+1.21.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app rollback "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
+    --no-input
+  assert_success
+
+  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
+    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+  assert_success
+  assert_output --partial "$TEST_RECIIPE:0.1.0+1.20.0"
+}

tests/integration/app_rollback_overview.bats

@@ -75,7 +75,7 @@ teardown(){
 
   assert_output --partial 'DOWNGRADE OVERVIEW'
   assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
-  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial 'ENV VERSION           -'
   assert_output --partial 'NEW DEPLOYMENT        0.1.0+1.20.0'
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \

tests/integration/app_undeploy.bats

@@ -106,6 +106,7 @@ teardown(){
 
   run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
   assert_success
+  assert_output --regexp "CURRENT DEPLOYMENT.*${_get_head_hash:0:8}"
 }
 
 # bats test_tags=slow

tests/integration/app_undeploy_overview.bats

@@ -36,7 +36,7 @@ teardown(){
   assert_output --partial 'UNDEPLOY OVERVIEW'
   assert_output --partial 'CURRENT DEPLOYMENT    0.1.0+1.20.0'
   assert_output --partial 'ENV VERSION           0.1.0+1.20.0'
-  assert_output --partial 'NEW DEPLOYMENT        N/A'
+  assert_output --partial 'NEW DEPLOYMENT        -'
 
   run grep -q "TYPE=$TEST_RECIPE:0.1.0+1.20.0" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -57,7 +57,7 @@ teardown(){
   assert_output --partial 'UNDEPLOY OVERVIEW'
   assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}"
   assert_output --partial "ENV VERSION           ${headHash:0:8}"
-  assert_output --partial 'NEW DEPLOYMENT        N/A'
+  assert_output --partial 'NEW DEPLOYMENT        -'
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
@@ -81,7 +81,7 @@ teardown(){
   assert_output --partial 'UNDEPLOY OVERVIEW'
   assert_output --partial "CURRENT DEPLOYMENT    ${headHash:0:8}+U"
   assert_output --partial "ENV VERSION           ${headHash:0:8}+U"
-  assert_output --partial 'NEW DEPLOYMENT        N/A'
+  assert_output --partial 'NEW DEPLOYMENT        -'
 
   run grep -q "TYPE=$TEST_RECIPE:${headHash:0:8}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"

tests/integration/app_upgrade.bats

@@ -256,7 +256,7 @@ teardown(){
 }
 
 # bats test_tags=slow
-@test "upgrade commit deployment not possible" {
+@test "specific version upgrade after chaos deploy" {
   tagHash=$(_get_tag_hash "0.1.0+1.20.0")
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
   assert_success
@@ -266,20 +266,29 @@ teardown(){
   assert_output --partial "${tagHash:0:8}"
 
   run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.1.1+1.20.2" --no-input --no-converge-checks
-  assert_failure
-  assert_output --partial "not a known version"
+  assert_success
+  assert_output --regexp "CURRENT DEPLOYMENT.*${tagHash:0:8}"
+  assert_output --regexp "ENV VERSION.*${tagHash:0:8}"
+  assert_output --regexp "NEW DEPLOYMENT.*0\.1\.1\+1\.20\.2"
 }
 
-@test "chaos commit upgrade not possible" {
-  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input --no-converge-checks
+# bats test_tags=slow
+@test "upgrade to latest after chaos deploy" {
+  latestRelease=$(_latest_release)
+
+  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
   assert_success
-  assert_output --partial '0.1.0+1.20.0'
 
-  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks --chaos
+  assert_success
+  assert_output --partial "${tagHash:0:8}"
 
-  run $ABRA app upgrade "$TEST_APP_DOMAIN" "$tagHash" --no-input --no-converge-checks
-  assert_failure
-  assert_output --partial "not a known version"
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" --no-input --no-converge-checks
+  assert_success
+  assert_output --regexp "CURRENT DEPLOYMENT.*${tagHash:0:8}"
+  assert_output --regexp "ENV VERSION.*${tagHash:0:8}"
+  assert_output --partial "${latestRelease}"
 }
 
 # bats test_tags=slow

tests/integration/app_upgrade_env_version.bats

@@ -40,3 +40,21 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+# bats test_tags=slow
+@test "new env version written to container env" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" --no-input
+  assert_success
+
+  run grep -q "TYPE=abra-test-recipe:0.1.0+1.20.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input
+  assert_success
+
+  run docker inspect --format='{{range .Config.Env}}{{println .}}{{end}}' \
+    $(docker ps -f name="$TEST_APP_DOMAIN_$TEST_SERVER" -q)
+  assert_success
+  assert_output --partial "$TEST_RECIIPE:0.2.0+1.21.0"
+}

tests/integration/app_upgrade_overview.bats

@@ -75,7 +75,7 @@ teardown(){
 
   assert_output --partial 'UPGRADE OVERVIEW'
   assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
-  assert_output --partial 'ENV VERSION           N/A'
+  assert_output --partial 'ENV VERSION           -'
   assert_output --partial "NEW DEPLOYMENT        $latestRelease"
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \

tests/integration/helpers/common.bash

@@ -13,7 +13,6 @@ _common_setup() {
   load "$PWD/tests/integration/helpers/docker"
 
   export ABRA="$PWD/abra"
-  export KADABRA="$PWD/kadabra"
 
   export TEST_APP_NAME="$(basename "${BATS_TEST_FILENAME//./_}")"
   export TEST_APP_DOMAIN="$TEST_APP_NAME.$TEST_SERVER"
@@ -21,4 +20,20 @@ _common_setup() {
   export TEST_RECIPE="abra-test-recipe"
 
   _ensure_swarm
+  _ensure_ssh_agent
+}
+
+
+_ensure_ssh_agent() {
+  if ! command -v ssh-agent >/dev/null 2>&1
+  then
+    echo "ssh-agent is missing, please install it"
+    exit 1
+  fi
+
+  export SSH_AUTH_SOCK="$HOME/.ssh/ssh_auth_sock"
+  if [ ! -S ~/.ssh/ssh_auth_sock ]; then
+    eval `ssh-agent`
+    ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
+  fi
 }

tests/integration/helpers/git.bash

@@ -17,7 +17,12 @@ _remove_tags(){
 
   run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l | wc -l'
   assert_success
-  assert_output '0'
+  # If this was done without the --regexp I get this error:
+  # -- output differs --
+  # expected : 0
+  # actual   :        0
+  # --
+  assert_output --regexp '[[:space:]]*0'
 }
 
 _reset_tags() {

tests/integration/helpers/recipe.bash

@@ -5,11 +5,22 @@ _latest_release(){
 }
 
 _fetch_recipe() {
+  # clone first to a bare repo which will serve as origin-ssh
+  # this enables simulating git push in recipe release
   if [[ ! -d "$ABRA_DIR/recipes/$TEST_RECIPE" ]]; then
+    run mkdir -p "$ABRA_DIR/origin-recipes"
+    assert_success
+
+    run git clone "https://git.coopcloud.tech/toolshed/$TEST_RECIPE" "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" --bare
+    assert_success
+
     run mkdir -p "$ABRA_DIR/recipes"
     assert_success
 
-    run git clone "https://git.coopcloud.tech/toolshed/$TEST_RECIPE" "$ABRA_DIR/recipes/$TEST_RECIPE"
+    run git clone "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" "$ABRA_DIR/recipes/$TEST_RECIPE"
+    assert_success
+
+    run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote add origin-ssh "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
     assert_success
   fi
 }
@@ -19,6 +30,10 @@ _reset_recipe(){
   assert_success
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
 
+  run rm -rf "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+  assert_success
+  assert_not_exists "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+
   _fetch_recipe
 }
 

tests/integration/recipe_new.bats

@@ -53,7 +53,8 @@ teardown(){
     --domain "foobar.$TEST_SERVER"
   assert_success
 
-  run $ABRA app deploy "foobar.$TEST_SERVER" --no-input
+  run $ABRA app deploy "foobar.$TEST_SERVER" \
+    --no-input --no-converge-checks
   assert_success
 }
 

tests/integration/recipe_release.bats

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
 
-setup_file(){
+setup_file() {
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _add_server
   _new_app
 }
 
-teardown_file(){
+teardown_file() {
   _rm_server
   _reset_recipe
 }
 
-setup(){
+setup() {
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _set_git_author
@@ -21,6 +21,14 @@ setup(){
 teardown() {
   _reset_recipe
   _reset_tags
+  if [[ -d "$ABRA_DIR/recipes/foobar" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/foobar"
+    assert_success
+  fi
+  if [[ -d "$ABRA_DIR/origin-recipes/foobar.git" ]]; then
+    run rm -rf "$ABRA_DIR/origin-recipes/foobar.git"
+    assert_success
+  fi
 }
 
 @test "validate recipe argument" {
@@ -32,10 +40,10 @@ teardown() {
 }
 
 @test "release patch bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
   assert_success
 
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
   assert_success
   assert_output --partial 'image: nginx:1.21.6'
 
@@ -45,17 +53,9 @@ teardown() {
     -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
   assert_success
 
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-  assert_output --partial 'synced label'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --partial 'coop-cloud.${STACK_NAME}.version=0.3.1+1.21.6'
-
   run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
   assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'INFO new release published:'
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag --list
   assert_success
@@ -63,10 +63,10 @@ teardown() {
 }
 
 @test "release minor bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor --commit
   assert_success
 
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
   assert_success
   assert_output --regexp 'image: nginx:1.2.*'
 
@@ -76,54 +76,194 @@ teardown() {
     -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
   assert_success
 
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-  assert_output --partial 'synced label'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.4\.0\+1\.2.*'
-
   run $ABRA recipe release "$TEST_RECIPE" --no-input --minor
   assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'INFO new release published:'
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag --list
   assert_success
   assert_output --regexp '0\.4\.0\+1\.2.*'
 }
 
-@test "unknown files not committed" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
+@test "release with unstaged changes" {
+  run bash -c 'echo "# unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
   assert_success
 
-  run bash -c 'echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"'
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet
+  assert_failure
 
   run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
-  assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rm foo
   assert_failure
-  assert_output --partial "fatal: pathspec 'foo' did not match any files"
+  assert_output --partial "working directory not clean"
+}
+
+@test "release with staged changes" {
+  run bash -c 'echo "# staged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add compose.yml
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet --cached
+  assert_failure
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial "working directory not clean"
 }
 
 @test "release with next release note" {
   _mkfile "$ABRA_DIR/recipes/$TEST_RECIPE/release/next" "those are some release notes for the next release"
 
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout main
+  assert_success
+
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add release/next
   assert_success
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -m "added some release notes"
   assert_success
 
-  run $ABRA recipe release  "$TEST_RECIPE" --no-input  --minor
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --minor
   assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'new release published:'
 
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/release/next"
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/release/0.4.0+1.21.0"
   assert_file_contains "$ABRA_DIR/recipes/$TEST_RECIPE/release/0.4.0+1.21.0" "those are some release notes for the next release"
 }
+
+@test "recipe release conflict fails" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
+  assert_success
+
+  run sed -i "s/nginx:1.21.0/nginx:1.29.1/g" "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
+  assert_success
+  assert_output --regexp 'nginx:1.29.1'
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -am "updated nginx"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input "0.2.0+1.29.1"
+  assert_failure
+  assert_output --partial '0.2.0+... conflicts with a previous release: 0.2.0+1.21.0'
+}
+
+@test "error if recipe release --no-input and no initial version" {
+  _remove_tags
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial 'unable to continue'
+  assert_output --partial 'initial version'
+}
+
+@test "recipe release without input fails with prompt" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run $ABRA recipe release foobar --no-input --patch
+  assert_failure
+  assert_output --partial "input required for initial version"
+}
+
+@test "release new recipe: fail without input" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run bash -c "$ABRA recipe release foobar --no-input"
+  assert_failure
+  assert_output --partial 'unable to continue, input required for initial version'
+}
+
+# note: piping 0.1.0 from stdin is not testable right now because release notes also wants input
+# survey lib used for prompts breaks multi-line stdin for multi-prompt
+@test "release new recipe: development release" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  # fake origin
+  git clone "$ABRA_DIR/recipes/foobar" "$ABRA_DIR/origin-recipes/foobar.git" --bare
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/foobar" remote add origin-ssh "$ABRA_DIR/origin-recipes/foobar.git"
+  assert_success
+
+  run bash -c "$ABRA recipe release foobar 0.1.0+1.2.0 --no-input"
+  assert_success
+  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.1\.0\+1\.2.*'
+}
+
+@test "release newly created recipe with no version label" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run sed -i 's/- "coop-cloud.${STACK_NAME}.version="/#- "coop-cloud.${STACK_NAME}.version="/g' \
+    "$ABRA_DIR/recipes/foobar/compose.yml"
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/foobar" commit -am "updated nginx"
+  assert_success
+
+  run bash -c "echo 0.1.0 | $ABRA recipe release foobar --patch"
+  assert_failure
+  assert_output --partial "automagic insertion not supported yet"
+}
+
+@test "push during release fails" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
+  assert_success
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
+  assert_success
+  assert_output --partial 'image: nginx:1.21.6'
+
+  wantHash="$(_get_current_hash)"
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/does/not/exist"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial 'failed to publish new release:'
+  assert_output --partial 'any changes made have been reverted'
+
+  assert_equal "$wantHash" "$(_get_current_hash)"
+
+  assert_equal "$(_git_status)" ""
+}
+
+@test "release, fail, release: works" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
+  assert_success
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
+  assert_success
+
+  # NOTE(d1): fake broken remote so the release fails
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/does/not/exist"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+
+  # NOTE(d1): correct remote so release can proceed
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_success
+}

tests/integration/recipe_sync.bats

@@ -1,128 +0,0 @@
-#!/usr/bin/env bash
-
-setup_file(){
-  load "$PWD/tests/integration/helpers/common"
-  _common_setup
-  _add_server
-  _new_app
-}
-
-teardown_file(){
-  _rm_server
-}
-
-setup(){
-  load "$PWD/tests/integration/helpers/common"
-  _common_setup
-}
-
-teardown(){
-  _reset_recipe
-  _reset_tags
-}
-
-@test "validate recipe argument" {
-  run $ABRA recipe sync --no-input
-  assert_failure
-
-  run $ABRA recipe sync DOESNTEXIST --no-input
-  assert_failure
-}
-
-@test "allow unstaged changes" {
-  run echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" status
-  assert_success
-  assert_output --partial 'foo'
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_equal "$(_git_status)" "M compose.yml ?? foo"
-
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_success
-  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-}
-
-@test "detect unstaged label changes" {
-  run $ABRA recipe fetch "$TEST_RECIPE"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --patch
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --patch
-  assert_success
-  assert_output --partial 'is already set, nothing to do?'
-}
-
-@test "sync patch label bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --partial 'image: nginx:1.21.6'
-
-  # NOTE(d1): ensure the latest tag is the one we expect
-  _remove_tags
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.3\.1\+1\.2.*'
-}
-
-@test "sync minor label bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'image: nginx:1.2.*'
-
-  # NOTE(d1): ensure the latest tag is the one we expect
-  _remove_tags
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.4\.0\+1\.2.*'
-}
-
-@test "error if --no-input and no initial version" {
-  _remove_tags
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_failure
-  assert_output --partial 'unable to continue'
-  assert_output --partial 'initial version'
-}
-
-@test "output label sync only once" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'image: nginx:1.2.*'
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-  assert_line --index 0 --partial 'synced label'
-  refute_line --index 1 --partial 'synced label'
-}