WIP: feat: use compose-go

See #492

.drone.yml

@@ -3,7 +3,7 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.24
+    image: golang:1.26
     commands:
       - make check
 
@@ -22,7 +22,7 @@ steps:
           - tag
 
   - name: xgettext-go status
-    image: golang:1.24-alpine3.22
+    image: golang:1.26-alpine3.22
     commands:
       - apk add patchutils git make
       - cd /drone/src
@@ -38,42 +38,14 @@ steps:
           - tag
 
   - name: make test
-    image: golang:1.24
+    image: golang:1.26
     environment:
-      ABRA_DIR: $HOME/.abra
-      CATL_URL: https://git.coopcloud.tech/toolshed/recipes-catalogue-json.git
+      ABRA_DIR: /root/.abra_test
     commands:
-      - mkdir -p $HOME/.abra
-      - git clone $CATL_URL $HOME/.abra/catalogue
       - make test
     depends_on:
       - make check
 
-  - name: fetch
-    image: docker:git
-    commands:
-      - git fetch --tags
-    depends_on:
-      - make check
-      - make test
-    when:
-      event: tag
-
-  - name: release
-    image: goreleaser/goreleaser:v2.5.1
-    environment:
-      GITEA_TOKEN:
-        from_secret: goreleaser_gitea_token
-    volumes:
-      - name: deps
-        path: /go
-    commands:
-      - goreleaser release
-    depends_on:
-      - fetch
-    when:
-      event: tag
-
   - name: publish image
     image: plugins/docker
     settings:

.goreleaser.yml

@@ -1,4 +1,6 @@
 ---
+version: 2
+
 gitea_urls:
   api: https://git.coopcloud.tech/api/v1
   download: https://git.coopcloud.tech/
@@ -26,6 +28,9 @@ builds:
       - 5
       - 6
       - 7
+    flags:
+      - -v
+      - -trimpath
     ldflags:
       - "-X 'main.Commit={{ .Commit }}'"
       - "-X 'main.Version={{ .Version }}'"

AUTHORS.md

@@ -10,14 +10,17 @@
 - cassowary
 - chasqui
 - codegod100
+- cyrnel
 - decentral1se
 - fauno
 - frando
 - iexos
+- jade
 - kawaiipunk
 - knoflook
 - mayel
 - moritz
+- namnatulco
 - p4u1
 - rix
 - roxxers

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.24-alpine AS build
+FROM golang:1.26-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 
@@ -15,8 +15,7 @@ WORKDIR /app
 
 RUN CGO_ENABLED=0 make build
 
-# Release image ("slim")
-FROM alpine:3.19.1
+FROM alpine:3.22
 
 RUN apk add --no-cache \
   ca-certificates \

Makefile

@@ -2,9 +2,10 @@ ABRA         := ./cmd/abra
 XGETTEXT     := ./bin/xgettext-go
 COMMIT       := $(shell git rev-list -1 HEAD)
 GOPATH       := $(shell go env GOPATH)
-GOVERSION    := 1.24
+GOVERSION    := 1.26
 LDFLAGS      := "-X 'main.Commit=$(COMMIT)'"
 DIST_LDFLAGS := $(LDFLAGS)" -s -w"
+BFLAGS       := -v -trimpath
 GCFLAGS      := "all=-l -B"
 DOMAIN       := abra
 POFILES      := $(wildcard pkg/i18n/locales/*.po)
@@ -22,7 +23,7 @@ install:
 	@go install -gcflags=$(GCFLAGS) -ldflags=$(LDFLAGS) $(ABRA)
 
 build:
-	@go build -v -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
+	@go build $(BFLAGS) -gcflags=$(GCFLAGS) -ldflags=$(DIST_LDFLAGS) $(ABRA)
 
 build-docker:
 	@docker run -it -v $(PWD):/abra golang:$(GOVERSION) \
@@ -39,7 +40,7 @@ check:
 	(echo "gofmt: formatting issue - run 'make format' to resolve" && exit 1)
 
 test:
-	@go test ./... -cover -v
+	@go test ./... -cover -v -p 1
 
 find-tests:
 	@find . -name "*_test.go"
@@ -85,3 +86,6 @@ build-mo:
 	for lang in $(POFILES); do \
 		msgfmt $$lang -o $$(echo $$lang | sed 's/.po/.mo/g') --statistics; \
 	done
+
+release:
+	@goreleaser release --clean

cli/app/deploy.go

@@ -10,6 +10,7 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/secret"
+	"coopcloud.tech/tagcmp"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/client"
@@ -107,6 +108,15 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			log.Fatal(err)
 		}
 
+		isChaosCommit, err := app.Recipe.IsChaosCommit(toDeployVersion)
+		if err != nil {
+			log.Fatal(i18n.G("unable to determine if %s is a chaos commit: %s", toDeployVersion, err))
+		}
+
+		if !isChaosCommit && !tagcmp.IsParsable(toDeployVersion) {
+			log.Fatal(i18n.G("unable to parse deploy version: %s", toDeployVersion))
+		}
+
 		if !internal.Chaos {
 			isChaosCommit, err := app.Recipe.EnsureVersion(toDeployVersion)
 			if err != nil {
@@ -147,7 +157,8 @@ checkout as-is. Recipe commit hashes are also supported as values for
 			ResolveImage: stack.ResolveImageAlways,
 			Detach:       false,
 		}
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -281,13 +292,21 @@ checkout as-is. Recipe commit hashes are also supported as values for
 }
 
 func getLatestVersionOrCommit(app appPkg.App) (string, error) {
-	versions, err := app.Recipe.Tags()
+	recipeVersions, warnings, err := app.Recipe.GetRecipeVersions()
 	if err != nil {
 		return "", err
 	}
 
-	if len(versions) > 0 && !internal.Chaos {
-		return versions[len(versions)-1], nil
+	for _, warning := range warnings {
+		log.Warn(warning)
+	}
+
+	if len(recipeVersions) > 0 && !internal.Chaos {
+		latest := recipeVersions[len(recipeVersions)-1]
+		for tag := range latest {
+			log.Debug(i18n.G("selected latest recipe version: %s (from %d available versions)", tag, len(recipeVersions)))
+			return tag, nil
+		}
 	}
 
 	head, err := app.Recipe.Head()

cli/app/labels.go

@@ -13,7 +13,7 @@ import (
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/upstream/convert"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
 	dockerClient "github.com/docker/docker/client"
@@ -80,13 +80,13 @@ var AppLabelsCommand = &cobra.Command{
 
 		rows = append(rows, []string{i18n.G("RECIPE LABELS"), "---"})
 
-		config, err := app.Recipe.GetComposeConfig(app.Env)
+		config, err := app.Recipe.GetComposeConfig()
 		if err != nil {
 			log.Fatal(err)
 		}
 
 		var localLabelKeys []string
-		var appServiceConfig composetypes.ServiceConfig
+		var appServiceConfig composeGoTypes.ServiceConfig
 		for _, service := range config.Services {
 			if service.Name == "app" {
 				appServiceConfig = service

cli/app/list.go

@@ -113,6 +113,10 @@ Use "--status/-S" flag to query all servers for the live deployment status.`),
 				totalAppsCount++
 
 				if status {
+					if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+						log.Fatal(err)
+					}
+
 					status := i18n.G("unknown")
 					version := i18n.G("unknown")
 					chaos := i18n.G("unknown")
@@ -325,6 +329,14 @@ func init() {
 		i18n.G("show apps of a specific server"),
 	)
 
+	AppListCommand.Flags().BoolVarP(
+		&internal.Chaos,
+		i18n.G("chaos"),
+		i18n.G("C"),
+		false,
+		i18n.G("ignore uncommitted recipes changes"),
+	)
+
 	AppListCommand.RegisterFlagCompletionFunc(
 		i18n.G("server"),
 		func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {

cli/app/move.go

@@ -262,8 +262,7 @@ func getAppResources(cl *dockerclient.Client, app app.App) (*AppResources, error
 		return nil, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles, Namespace: app.StackName()}
-	compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+	compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		return nil, err
 	}

cli/app/new.go

@@ -72,6 +72,10 @@ var AppNewCommand = &cobra.Command{
 	Run: func(cmd *cobra.Command, args []string) {
 		recipe := internal.ValidateRecipe(args, cmd.Name())
 
+		if err := recipe.Ensure(internal.GetEnsureContext()); err != nil {
+			log.Fatal(err)
+		}
+
 		if len(args) == 2 && internal.Chaos {
 			log.Fatal(i18n.G("cannot use [version] and --chaos together"))
 		}
@@ -98,10 +102,14 @@ var AppNewCommand = &cobra.Command{
 			var recipeVersions recipePkg.RecipeVersions
 			if recipeVersion == "" {
 				var err error
-				recipeVersions, _, err = recipe.GetRecipeVersions()
+				var warnings []string
+				recipeVersions, warnings, err = recipe.GetRecipeVersions()
 				if err != nil {
 					log.Fatal(err)
 				}
+				for _, warning := range warnings {
+					log.Warn(warning)
+				}
 			}
 
 			if len(recipeVersions) > 0 {
@@ -110,6 +118,8 @@ var AppNewCommand = &cobra.Command{
 					recipeVersion = tag
 				}
 
+				log.Debug(i18n.G("selected recipe version: %s (from %d available versions)", recipeVersion, len(recipeVersions)))
+
 				if _, err := recipe.EnsureVersion(recipeVersion); err != nil {
 					log.Fatal(err)
 				}

cli/app/ps.go

@@ -4,7 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"sort"
+	"maps"
+	"slices"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
@@ -87,26 +88,19 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 		return
 	}
 
-	deployOpts := stack.Deploy{
-		Composefiles: composeFiles,
-		Namespace:    app.StackName(),
-		Prune:        false,
-		ResolveImage: stack.ResolveImageAlways,
-	}
-	compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+	compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		log.Fatal(err)
 		return
 	}
 
 	services := compose.Services
-	sort.Slice(services, func(i, j int) bool {
-		return services[i].Name < services[j].Name
-	})
 
 	var rows [][]string
 	allContainerStats := make(map[string]map[string]string)
-	for _, service := range services {
+	for _, serviceName := range slices.Sorted(maps.Keys(compose.Services)) {
+		service := services[serviceName]
+
 		filters := filters.NewArgs()
 		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service.Name))
 

cli/app/rollback.go

@@ -173,7 +173,7 @@ beforehand. See "abra app backup" for more.`),
 			Detach:       false,
 		}
 
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}

cli/app/undeploy.go

@@ -89,8 +89,7 @@ Passing "--prune/-p" does not remove those volumes.`),
 			log.Fatal(err)
 		}
 
-		opts := stack.Deploy{Composefiles: composeFiles, Namespace: stackName}
-		compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}

cli/app/upgrade.go

@@ -185,7 +185,7 @@ beforehand. See "abra app backup" for more.`),
 			Detach:       false,
 		}
 
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			log.Fatal(err)
 		}

cli/internal/deploy.go

@@ -127,7 +127,7 @@ func DeployOverview(
 	}
 
 	response := false
-	prompt := &survey.Confirm{Message: "proceed?"}
+	prompt := &survey.Confirm{Message: i18n.G("proceed?")}
 	if err := survey.AskOne(prompt, &response); err != nil {
 		return err
 	}

cli/internal/recipe.go

@@ -92,10 +92,11 @@ func SetBumpType(bumpType string) {
 func GetMainAppImage(recipe recipe.Recipe) (string, error) {
 	var path string
 
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return "", err
 	}
+
 	for _, service := range config.Services {
 		if service.Name == "app" {
 			img, err := reference.ParseNormalizedNamed(service.Image)

cli/internal/validate.go

@@ -70,21 +70,6 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 		log.Fatal(err)
 	}
 
-	_, err = chosenRecipe.GetComposeConfig(nil)
-	if err != nil {
-		if cmdName == i18n.G("generate") {
-			if strings.Contains(err.Error(), "missing a compose") {
-				log.Fatal(err)
-			}
-			log.Warn(err)
-		} else {
-			if strings.Contains(err.Error(), "template_driver is not allowed") {
-				log.Warn(i18n.G("ensure %s recipe compose.* files include \"version: '3.8'\"", recipeName))
-			}
-			log.Fatal(i18n.G("unable to validate recipe: %s", err))
-		}
-	}
-
 	log.Debug(i18n.G("validated %s as recipe argument", recipeName))
 
 	return chosenRecipe

cli/recipe/release.go

@@ -14,7 +14,7 @@ import (
 	gitPkg "coopcloud.tech/abra/pkg/git"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/recipe"
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/distribution/reference"
@@ -23,6 +23,9 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// Errors
+var errEmptyVersionsInCatalogue = errors.New(i18n.G("catalogue versions list is unexpectedly empty"))
+
 // translators: `abra recipe release` aliases. use a comma separated list of
 // aliases with no spaces in between
 var recipeReleaseAliases = i18n.G("rl")
@@ -50,7 +53,7 @@ recipe updates are properly communicated. I.e. developers of an app might
 publish a minor version but that might lead to changes in the recipe which are
 major and therefore require intervention while doing the upgrade work.
 
-Publish your new release to git.coopcloud.tech with "--publish/-p". This
+This command will publish your new release to git.coopcloud.tech. This
 requires that you have permission to git push to these repositories and have
 your SSH keys configured on your account. Enable ssh-agent and make sure to add
 your private key and enter your passphrase beforehand.
@@ -60,12 +63,13 @@ your private key and enter your passphrase beforehand.
 	Example: `  # publish release
   eval ` + "`ssh-agent`" + `
   ssh-add ~/.ssh/id_ed25519
-  abra recipe release gitea -p`,
+  abra recipe release gitea`,
 	Args: cobra.RangeArgs(1, 2),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		switch l := len(args); l {
 		case 0:
 			return autocomplete.RecipeNameComplete()
@@ -93,21 +97,6 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(i18n.G("main app service version for %s is empty?", recipe.Name))
 		}
 
-		var tagString string
-		if len(args) == 2 {
-			tagString = args[1]
-		}
-
-		if tagString != "" {
-			if _, err := tagcmp.Parse(tagString); err != nil {
-				log.Fatal(i18n.G("cannot parse %s, invalid tag specified?", tagString))
-			}
-		}
-
-		if (internal.Major || internal.Minor || internal.Patch) && tagString != "" {
-			log.Fatal(i18n.G("cannot specify tag and bump type at the same time"))
-		}
-
 		repo, err := git.PlainOpen(recipe.Dir)
 		if err != nil {
 			log.Fatal(err)
@@ -118,16 +107,13 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(err)
 		}
 
-		if tagString != "" {
-			if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				log.Fatal(err)
-			}
+		isClean, err := gitPkg.IsClean(recipe.Dir)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if !isClean {
+			log.Fatal(i18n.G("working directory not clean in %s, aborting", recipe.Dir))
 		}
 
 		tags, err := recipe.Tags()
@@ -135,73 +121,202 @@ your private key and enter your passphrase beforehand.
 			log.Fatal(err)
 		}
 
-		labelVersion, err := getLabelVersion(recipe, false)
-		if err != nil {
-			log.Fatal(err)
+		var tagString string
+		if len(args) == 2 {
+			tagString = args[1]
+		}
+
+		if (internal.Major || internal.Minor || internal.Patch) && tagString != "" {
+			log.Fatal(i18n.G("cannot specify tag and bump type at the same time"))
+		}
+
+		if len(tags) == 0 && tagString == "" {
+			log.Warn(i18n.G("no git tags found for %s", recipe.Name))
+			if internal.NoInput {
+				log.Fatal(i18n.G("unable to continue, input required for initial version"))
+			}
+			fmt.Println(i18n.G(`
+The following options are two types of initial semantic version that you can
+pick for %s that will be published in the recipe catalogue. This follows the
+semver convention (more on https://semver.org), here is a short cheatsheet
+
+    0.1.0: development release, still hacking. when you make a major upgrade
+           you increment the "y" part (i.e. 0.1.0 -> 0.2.0) and only move to
+           using the "x" part when things are stable.
+
+    1.0.0: public release, assumed to be working. you already have a stable
+           and reliable deployment of this app and feel relatively confident
+           about it.
+
+If you want people to be able alpha test your current config for %s but don't
+think it is quite reliable, go with 0.1.0 and people will know that things are
+likely to change.
+
+`, recipe.Name, recipe.Name))
+			var chosenVersion string
+			edPrompt := &survey.Select{
+				Message: i18n.G("which version do you want to begin with?"),
+				Options: []string{"0.1.0", "1.0.0"},
+			}
+
+			if err := survey.AskOne(edPrompt, &chosenVersion); err != nil {
+				log.Fatal(err)
+			}
+
+			tagString = fmt.Sprintf("%s+%s", chosenVersion, mainAppVersion)
+		}
+
+		if tagString == "" && (!internal.Major && !internal.Minor && !internal.Patch) {
+
+			catl, err := recipePkg.ReadRecipeCatalogue(false)
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			changesTable, err := formatter.CreateTable()
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			latestRelease := tags[len(tags)-1]
+			latestRecipeVersion, err := getLatestVersion(recipe, catl)
+			if err != nil && err != errEmptyVersionsInCatalogue {
+				log.Fatal(err)
+			}
+			changesTable.Headers(i18n.G("SERVICE"), latestRelease, i18n.G("PROPOSED CHANGES"))
+
+			allRecipeVersions := catl[recipe.Name].Versions
+			for _, recipeVersion := range allRecipeVersions {
+				if serviceVersions, ok := recipeVersion[latestRecipeVersion]; ok {
+					for serviceName := range serviceVersions {
+						serviceMeta := serviceVersions[serviceName]
+
+						existingImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, serviceMeta.Tag)
+						newImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, imagesTmp[serviceMeta.Image])
+
+						if existingImageTag == newImageTag {
+							continue
+						}
+
+						changesTable.Row([]string{serviceName, existingImageTag, newImageTag}...)
+					}
+				}
+			}
+
+			changeOverview := changesTable.Render()
+
+			if err := internal.PromptBumpType("", latestRelease, changeOverview); err != nil {
+				log.Fatal(err)
+			}
+		}
+
+		if tagString == "" {
+			var lastGitTag tagcmp.Tag
+			iter, err := repo.Tags()
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			if err := iter.ForEach(func(ref *plumbing.Reference) error {
+				obj, err := repo.TagObject(ref.Hash())
+				if err != nil {
+					log.Fatal(i18n.G("tag at commit %s is unannotated or otherwise broken", ref.Hash()))
+					return err
+				}
+
+				tagcmpTag, err := tagcmp.Parse(obj.Name)
+				if err != nil {
+					return err
+				}
+
+				if (lastGitTag == tagcmp.Tag{}) {
+					lastGitTag = tagcmpTag
+				} else if tagcmpTag.IsGreaterThan(lastGitTag) {
+					lastGitTag = tagcmpTag
+				}
+
+				return nil
+			}); err != nil {
+				log.Fatal(err)
+			}
+
+			// bumpType is used to decide what part of the tag should be incremented
+			bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
+			if bumpType != 0 {
+				// a bitwise check if the number is a power of 2
+				if (bumpType & (bumpType - 1)) != 0 {
+					log.Fatal(i18n.G("you can only use one version flag: --major, --minor or --patch"))
+				}
+			}
+
+			newTag := lastGitTag
+			if bumpType > 0 {
+				if internal.Patch {
+					now, err := strconv.Atoi(newTag.Patch)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = strconv.Itoa(now + 1)
+				} else if internal.Minor {
+					now, err := strconv.Atoi(newTag.Minor)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = "0"
+					newTag.Minor = strconv.Itoa(now + 1)
+				} else if internal.Major {
+					now, err := strconv.Atoi(newTag.Major)
+					if err != nil {
+						log.Fatal(err)
+					}
+
+					newTag.Patch = "0"
+					newTag.Minor = "0"
+					newTag.Major = strconv.Itoa(now + 1)
+				}
+			}
+
+			newTag.Metadata = mainAppVersion
+			log.Debug(i18n.G("choosing %s as new version for %s", newTag.String(), recipe.Name))
+			tagString = newTag.String()
+		}
+
+		if _, err := tagcmp.Parse(tagString); err != nil {
+			log.Fatal(i18n.G("invalid version %s specified", tagString))
 		}
 
 		for _, tag := range tags {
 			previousTagLeftHand := strings.Split(tag, "+")[0]
-			newTagStringLeftHand := strings.Split(labelVersion, "+")[0]
+			newTagStringLeftHand := strings.Split(tagString, "+")[0]
 			if previousTagLeftHand == newTagStringLeftHand {
 				log.Fatal(i18n.G("%s+... conflicts with a previous release: %s", newTagStringLeftHand, tag))
 			}
 		}
 
-		if tagString == "" && (!internal.Major && !internal.Minor && !internal.Patch) {
-			tagString = labelVersion
-		}
-
-		isClean, err := gitPkg.IsClean(recipe.Dir)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		if !isClean {
-			log.Info(i18n.G("%s currently has these unstaged changes 👇", recipe.Name))
-			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
-				log.Fatal(err)
+		if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
+			if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
+				log.Fatal(i18n.G("unable to clean up tag after failed release attempt: %s", cleanErr))
 			}
-		}
-
-		if len(tags) > 0 {
-			log.Warn(i18n.G("previous git tags detected, assuming new semver release"))
-
-			if err := createReleaseFromPreviousTag(tagString, mainAppVersion, recipe, tags); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				log.Fatal(err)
-			}
-		} else {
-			log.Warn(i18n.G("no tag specified and no previous tag available for %s, assuming initial release", recipe.Name))
-
-			if err := createReleaseFromTag(recipe, tagString, mainAppVersion); err != nil {
-				if cleanErr := cleanTag(recipe, tagString); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				if cleanErr := cleanCommit(recipe, preCommitHead); cleanErr != nil {
-					log.Fatal(cleanErr)
-				}
-				log.Fatal(err)
+			if resetErr := resetCommit(recipe, preCommitHead); resetErr != nil {
+				log.Fatal(i18n.G("unable to reset commit after failed release attempt: %s", resetErr))
 			}
+			log.Error(err)
+			log.Fatal(i18n.G("release failed. any changes made have been reverted"))
 		}
-
-		return
 	},
 }
 
 // GetImageVersions retrieves image versions for a recipe
-func GetImageVersions(recipe recipe.Recipe) (map[string]string, error) {
+func GetImageVersions(recipe recipePkg.Recipe) (map[string]string, error) {
 	services := make(map[string]string)
 
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return nil, err
 	}
+
 	missingTag := false
 	for _, service := range config.Services {
 		if service.Image == "" {
@@ -239,7 +354,7 @@ func GetImageVersions(recipe recipe.Recipe) (map[string]string, error) {
 }
 
 // createReleaseFromTag creates a new release based on a supplied recipe version string
-func createReleaseFromTag(recipe recipe.Recipe, tagString, mainAppVersion string) error {
+func createReleaseFromTag(recipe recipePkg.Recipe, tagString, mainAppVersion string) error {
 	var err error
 
 	repo, err := git.PlainOpen(recipe.Dir)
@@ -247,23 +362,14 @@ func createReleaseFromTag(recipe recipe.Recipe, tagString, mainAppVersion string
 		return err
 	}
 
-	tag, err := tagcmp.Parse(tagString)
-	if err != nil {
-		return err
-	}
-
-	if tag.MissingMinor {
-		tag.Minor = "0"
-		tag.MissingMinor = false
-	}
-
-	if tag.MissingPatch {
-		tag.Patch = "0"
-		tag.MissingPatch = false
-	}
-
-	if tagString == "" {
-		tagString = fmt.Sprintf("%s+%s", tag.String(), mainAppVersion)
+	mainService := "app"
+	label := fmt.Sprintf("coop-cloud.${STACK_NAME}.version=%s", tagString)
+	if !internal.Dry {
+		if err := recipe.UpdateLabel("compose.y*ml", mainService, label); err != nil {
+			log.Fatal(err)
+		}
+	} else {
+		log.Info(i18n.G("dry run: not syncing label %s for recipe %s", tagString, recipe.Name))
 	}
 
 	if err := addReleaseNotes(recipe, tagString); err != nil {
@@ -302,7 +408,7 @@ func getTagCreateOptions(tag string) (git.CreateTagOptions, error) {
 
 // addReleaseNotes checks if the release/next release note exists and moves the
 // file to release/<tag>.
-func addReleaseNotes(recipe recipe.Recipe, tag string) error {
+func addReleaseNotes(recipe recipePkg.Recipe, tag string) error {
 	releaseDir := path.Join(recipe.Dir, "release")
 	if _, err := os.Stat(releaseDir); errors.Is(err, os.ErrNotExist) {
 		if err := os.Mkdir(releaseDir, 0755); err != nil {
@@ -387,7 +493,7 @@ func addReleaseNotes(recipe recipe.Recipe, tag string) error {
 	return nil
 }
 
-func commitRelease(recipe recipe.Recipe, tag string) error {
+func commitRelease(recipe recipePkg.Recipe, tag string) error {
 	if internal.Dry {
 		log.Debug(i18n.G("dry run: no changes committed"))
 		return nil
@@ -439,140 +545,30 @@ func tagRelease(tagString string, repo *git.Repository) error {
 	return nil
 }
 
-func pushRelease(recipe recipe.Recipe, tagString string) error {
+func pushRelease(recipe recipePkg.Recipe, tagString string) error {
 	if internal.Dry {
 		log.Info(i18n.G("dry run: no changes published"))
 		return nil
 	}
 
-	if !publish && !internal.NoInput {
-		prompt := &survey.Confirm{
-			Message: i18n.G("publish new release?"),
-		}
-
-		if err := survey.AskOne(prompt, &publish); err != nil {
-			return err
-		}
+	if os.Getenv("SSH_AUTH_SOCK") == "" {
+		return errors.New(i18n.G("ssh-agent not found. see \"abra recipe release --help\" and try again"))
 	}
 
-	if publish {
-		if os.Getenv("SSH_AUTH_SOCK") == "" {
-			return errors.New(i18n.G("ssh-agent not found. see \"abra recipe release --help\" and try again"))
-		}
-
-		if err := recipe.Push(internal.Dry); err != nil {
-			return err
-		}
-
-		url := fmt.Sprintf("%s/src/tag/%s", recipe.GitURL, tagString)
-		log.Info(i18n.G("new release published: %s", url))
-	} else {
-		log.Info(i18n.G("no -p/--publish passed, not publishing"))
-	}
-
-	return nil
-}
-
-func createReleaseFromPreviousTag(tagString, mainAppVersion string, recipe recipe.Recipe, tags []string) error {
-	repo, err := git.PlainOpen(recipe.Dir)
-	if err != nil {
+	if err := recipe.Push(internal.Dry); err != nil {
 		return err
 	}
 
-	bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
-	if bumpType != 0 {
-		if (bumpType & (bumpType - 1)) != 0 {
-			return errors.New(i18n.G("you can only use one of: --major, --minor, --patch"))
-		}
-	}
-
-	var lastGitTag tagcmp.Tag
-	for _, tag := range tags {
-		parsed, err := tagcmp.Parse(tag)
-		if err != nil {
-			return err
-		}
-
-		if (lastGitTag == tagcmp.Tag{}) {
-			lastGitTag = parsed
-		} else if parsed.IsGreaterThan(lastGitTag) {
-			lastGitTag = parsed
-		}
-	}
-
-	newTag := lastGitTag
-	if internal.Patch {
-		now, err := strconv.Atoi(newTag.Patch)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = strconv.Itoa(now + 1)
-	} else if internal.Minor {
-		now, err := strconv.Atoi(newTag.Minor)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = "0"
-		newTag.Minor = strconv.Itoa(now + 1)
-	} else if internal.Major {
-		now, err := strconv.Atoi(newTag.Major)
-		if err != nil {
-			return err
-		}
-
-		newTag.Patch = "0"
-		newTag.Minor = "0"
-		newTag.Major = strconv.Itoa(now + 1)
-	}
-
-	if internal.Major || internal.Minor || internal.Patch {
-		newTag.Metadata = mainAppVersion
-		tagString = newTag.String()
-	}
-
-	if lastGitTag.String() == tagString {
-		return errors.New(i18n.G("latest git tag (%s) and synced label (%s) are the same?", lastGitTag, tagString))
-	}
-
-	if !internal.NoInput {
-		prompt := &survey.Confirm{
-			Message: i18n.G("current: %s, new: %s, correct?", lastGitTag, tagString),
-		}
-
-		var ok bool
-		if err := survey.AskOne(prompt, &ok); err != nil {
-			return err
-		}
-
-		if !ok {
-			return errors.New(i18n.G("exiting as requested"))
-		}
-	}
-
-	if err := addReleaseNotes(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to add release notes: %s", err.Error()))
-	}
-
-	if err := commitRelease(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to commit changes: %s", err.Error()))
-	}
-
-	if err := tagRelease(tagString, repo); err != nil {
-		return errors.New(i18n.G("failed to tag release: %s", err.Error()))
-	}
-
-	if err := pushRelease(recipe, tagString); err != nil {
-		return errors.New(i18n.G("failed to publish new release: %s", err.Error()))
-	}
+	url := fmt.Sprintf("%s/src/tag/%s", recipe.GitURL, tagString)
+	log.Info(i18n.G("new release published: %s", url))
 
 	return nil
 }
 
-// cleanCommit soft removes the latest release commit. No change are lost the
-// the commit itself is removed. This is the equivalent of `git reset HEAD~1`.
-func cleanCommit(recipe recipe.Recipe, head *plumbing.Reference) error {
+// resetCommit hard resets to the state before release was started.
+// This will only remove changes made by the release process due to requiring
+// a clean working directory.
+func resetCommit(recipe recipePkg.Recipe, head *plumbing.Reference) error {
 	repo, err := git.PlainOpen(recipe.Dir)
 	if err != nil {
 		return errors.New(i18n.G("unable to open repo in %s: %s", recipe.Dir, err))
@@ -583,18 +579,18 @@ func cleanCommit(recipe recipe.Recipe, head *plumbing.Reference) error {
 		return errors.New(i18n.G("unable to open work tree in %s: %s", recipe.Dir, err))
 	}
 
-	opts := &git.ResetOptions{Commit: head.Hash(), Mode: git.MixedReset}
+	opts := &git.ResetOptions{Commit: head.Hash(), Mode: git.HardReset}
 	if err := worktree.Reset(opts); err != nil {
-		return errors.New(i18n.G("unable to soft reset %s: %s", recipe.Dir, err))
+		return errors.New(i18n.G("unable to hard reset %s: %s", recipe.Dir, err))
 	}
 
-	log.Debug(i18n.G("removed freshly created commit"))
+	log.Debug(i18n.G("reset commit to pre-release state"))
 
 	return nil
 }
 
 // cleanTag removes a freshly created tag
-func cleanTag(recipe recipe.Recipe, tag string) error {
+func cleanTag(recipe recipePkg.Recipe, tag string) error {
 	repo, err := git.PlainOpen(recipe.Dir)
 	if err != nil {
 		return errors.New(i18n.G("unable to open repo in %s: %s", recipe.Dir, err))
@@ -611,37 +607,17 @@ func cleanTag(recipe recipe.Recipe, tag string) error {
 	return nil
 }
 
-func getLabelVersion(recipe recipe.Recipe, prompt bool) (string, error) {
-	initTag, err := recipe.GetVersionLabelLocal()
+func getLatestVersion(recipe recipePkg.Recipe, catl recipePkg.RecipeCatalogue) (string, error) {
+	versions, err := recipePkg.GetRecipeCatalogueVersions(recipe.Name, catl)
 	if err != nil {
 		return "", err
 	}
-
-	if initTag == "" {
-		return "", errors.New(i18n.G("unable to read version for %s from synced label. Did you try running \"abra recipe sync %s\" already?", recipe.Name, recipe.Name))
+	if len(versions) > 0 {
+		return versions[len(versions)-1], nil
 	}
-
-	log.Warn(i18n.G("discovered %s as currently synced recipe label", initTag))
-
-	if prompt && !internal.NoInput {
-		var response bool
-		prompt := &survey.Confirm{Message: i18n.G("use %s as the new version?", initTag)}
-		if err := survey.AskOne(prompt, &response); err != nil {
-			return "", err
-		}
-
-		if !response {
-			return "", errors.New(i18n.G("please fix your synced label for %s and re-run this command", recipe.Name))
-		}
-	}
-
-	return initTag, nil
+	return "", errEmptyVersionsInCatalogue
 }
 
-var (
-	publish bool
-)
-
 func init() {
 	RecipeReleaseCommand.Flags().BoolVarP(
 		&internal.Dry,
@@ -674,12 +650,4 @@ func init() {
 		false,
 		i18n.G("increase the patch part of the version"),
 	)
-
-	RecipeReleaseCommand.Flags().BoolVarP(
-		&publish,
-		i18n.G("publish"),
-		i18n.G("p"),
-		false,
-		i18n.G("publish changes to git.coopcloud.tech"),
-	)
 }

cli/recipe/release_test.go

@@ -0,0 +1,33 @@
+package recipe
+
+import (
+	"testing"
+
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetLatestVersionReturnsErrorWhenVersionsIsEmpty(t *testing.T) {
+	recipe := recipePkg.Recipe{}
+	catalogue := recipePkg.RecipeCatalogue{}
+	_, err := getLatestVersion(recipe, catalogue)
+	assert.Equal(t, err, errEmptyVersionsInCatalogue)
+}
+
+func TestGetLatestVersionReturnsLastVersion(t *testing.T) {
+	recipe := recipePkg.Recipe{
+		Name: "test",
+	}
+	versions := []map[string]map[string]recipePkg.ServiceMeta{
+		make(map[string]map[string]recipePkg.ServiceMeta),
+		make(map[string]map[string]recipePkg.ServiceMeta),
+	}
+	versions[0]["0.0.3"] = make(map[string]recipePkg.ServiceMeta)
+	versions[1]["0.0.2"] = make(map[string]recipePkg.ServiceMeta)
+	catalogue := make(recipePkg.RecipeCatalogue)
+	catalogue["test"] = recipePkg.RecipeMeta{
+		Versions: versions,
+	}
+	version, _ := getLatestVersion(recipe, catalogue)
+	assert.Equal(t, version, "0.0.3")
+}

cli/recipe/sync.go

@@ -1,300 +0,0 @@
-package recipe
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"coopcloud.tech/abra/cli/internal"
-	"coopcloud.tech/abra/pkg/autocomplete"
-	"coopcloud.tech/abra/pkg/formatter"
-	gitPkg "coopcloud.tech/abra/pkg/git"
-	"coopcloud.tech/abra/pkg/i18n"
-	"coopcloud.tech/abra/pkg/log"
-	recipePkg "coopcloud.tech/abra/pkg/recipe"
-	"coopcloud.tech/tagcmp"
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/spf13/cobra"
-)
-
-// translators: `abra recipe reset` aliases. use a comma separated list of
-// aliases with no spaces in between
-var recipeSyncAliases = i18n.G("s")
-
-var RecipeSyncCommand = &cobra.Command{
-	// translators: `recipe sync` command
-	Use:     i18n.G("sync <recipe> [version] [flags]"),
-	Aliases: strings.Split(recipeSyncAliases, ","),
-	// translators: Short description for `recipe sync` command
-	Short: i18n.G("Sync recipe version label"),
-	Long: i18n.G(`Generate labels for the main recipe service.
-
-By convention, the service named "app" using the following format:
-
-    coop-cloud.${STACK_NAME}.version=<version>
-
-Where [version] can be specifed on the command-line or Abra can attempt to
-auto-generate it for you. The <recipe> configuration will be updated on the
-local file system.`),
-	Args: cobra.RangeArgs(1, 2),
-	ValidArgsFunction: func(
-		cmd *cobra.Command,
-		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
-		switch l := len(args); l {
-		case 0:
-			return autocomplete.RecipeNameComplete()
-		case 1:
-			return autocomplete.RecipeVersionComplete(args[0])
-		default:
-			return nil, cobra.ShellCompDirectiveError
-		}
-	},
-	Run: func(cmd *cobra.Command, args []string) {
-		recipe := internal.ValidateRecipe(args, cmd.Name())
-
-		mainApp, err := internal.GetMainAppImage(recipe)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		imagesTmp, err := GetImageVersions(recipe)
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		mainAppVersion := imagesTmp[mainApp]
-
-		tags, err := recipe.Tags()
-		if err != nil {
-			log.Fatal(err)
-		}
-
-		var nextTag string
-		if len(args) == 2 {
-			nextTag = args[1]
-		}
-
-		if len(tags) == 0 && nextTag == "" {
-			log.Warn(i18n.G("no git tags found for %s", recipe.Name))
-			if internal.NoInput {
-				log.Fatal(i18n.G("unable to continue, input required for initial version"))
-			}
-			fmt.Println(i18n.G(`
-The following options are two types of initial semantic version that you can
-pick for %s that will be published in the recipe catalogue. This follows the
-semver convention (more on https://semver.org), here is a short cheatsheet
-
-    0.1.0: development release, still hacking. when you make a major upgrade
-           you increment the "y" part (i.e. 0.1.0 -> 0.2.0) and only move to
-           using the "x" part when things are stable.
-
-    1.0.0: public release, assumed to be working. you already have a stable
-           and reliable deployment of this app and feel relatively confident
-           about it.
-
-If you want people to be able alpha test your current config for %s but don't
-think it is quite reliable, go with 0.1.0 and people will know that things are
-likely to change.
-
-`, recipe.Name, recipe.Name))
-			var chosenVersion string
-			edPrompt := &survey.Select{
-				Message: i18n.G("which version do you want to begin with?"),
-				Options: []string{"0.1.0", "1.0.0"},
-			}
-
-			if err := survey.AskOne(edPrompt, &chosenVersion); err != nil {
-				log.Fatal(err)
-			}
-
-			nextTag = fmt.Sprintf("%s+%s", chosenVersion, mainAppVersion)
-		}
-
-		if nextTag == "" && (!internal.Major && !internal.Minor && !internal.Patch) {
-			var changeOverview string
-
-			catl, err := recipePkg.ReadRecipeCatalogue(false)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			versions, err := recipePkg.GetRecipeCatalogueVersions(recipe.Name, catl)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			changesTable, err := formatter.CreateTable()
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			latestRelease := tags[len(tags)-1]
-			changesTable.Headers(i18n.G("SERVICE"), latestRelease, i18n.G("PROPOSED CHANGES"))
-
-			latestRecipeVersion := versions[len(versions)-1]
-			allRecipeVersions := catl[recipe.Name].Versions
-			for _, recipeVersion := range allRecipeVersions {
-				if serviceVersions, ok := recipeVersion[latestRecipeVersion]; ok {
-					for serviceName := range serviceVersions {
-						serviceMeta := serviceVersions[serviceName]
-
-						existingImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, serviceMeta.Tag)
-						newImageTag := fmt.Sprintf("%s:%s", serviceMeta.Image, imagesTmp[serviceMeta.Image])
-
-						if existingImageTag == newImageTag {
-							continue
-						}
-
-						changesTable.Row([]string{serviceName, existingImageTag, newImageTag}...)
-					}
-				}
-			}
-
-			changeOverview = changesTable.Render()
-
-			if err := internal.PromptBumpType("", latestRelease, changeOverview); err != nil {
-				log.Fatal(err)
-			}
-		}
-
-		if nextTag == "" {
-			repo, err := git.PlainOpen(recipe.Dir)
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			var lastGitTag tagcmp.Tag
-			iter, err := repo.Tags()
-			if err != nil {
-				log.Fatal(err)
-			}
-
-			if err := iter.ForEach(func(ref *plumbing.Reference) error {
-				obj, err := repo.TagObject(ref.Hash())
-				if err != nil {
-					log.Fatal(i18n.G("tag at commit %s is unannotated or otherwise broken", ref.Hash()))
-					return err
-				}
-
-				tagcmpTag, err := tagcmp.Parse(obj.Name)
-				if err != nil {
-					return err
-				}
-
-				if (lastGitTag == tagcmp.Tag{}) {
-					lastGitTag = tagcmpTag
-				} else if tagcmpTag.IsGreaterThan(lastGitTag) {
-					lastGitTag = tagcmpTag
-				}
-
-				return nil
-			}); err != nil {
-				log.Fatal(err)
-			}
-
-			// bumpType is used to decide what part of the tag should be incremented
-			bumpType := btoi(internal.Major)*4 + btoi(internal.Minor)*2 + btoi(internal.Patch)
-			if bumpType != 0 {
-				// a bitwise check if the number is a power of 2
-				if (bumpType & (bumpType - 1)) != 0 {
-					log.Fatal(i18n.G("you can only use one version flag: --major, --minor or --patch"))
-				}
-			}
-
-			newTag := lastGitTag
-			if bumpType > 0 {
-				if internal.Patch {
-					now, err := strconv.Atoi(newTag.Patch)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = strconv.Itoa(now + 1)
-				} else if internal.Minor {
-					now, err := strconv.Atoi(newTag.Minor)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = "0"
-					newTag.Minor = strconv.Itoa(now + 1)
-				} else if internal.Major {
-					now, err := strconv.Atoi(newTag.Major)
-					if err != nil {
-						log.Fatal(err)
-					}
-
-					newTag.Patch = "0"
-					newTag.Minor = "0"
-					newTag.Major = strconv.Itoa(now + 1)
-				}
-			}
-
-			newTag.Metadata = mainAppVersion
-			log.Debug(i18n.G("choosing %s as new version for %s", newTag.String(), recipe.Name))
-			nextTag = newTag.String()
-		}
-
-		if _, err := tagcmp.Parse(nextTag); err != nil {
-			log.Fatal(i18n.G("invalid version %s specified", nextTag))
-		}
-
-		mainService := "app"
-		label := i18n.G("coop-cloud.${STACK_NAME}.version=%s", nextTag)
-		if !internal.Dry {
-			if err := recipe.UpdateLabel("compose.y*ml", mainService, label); err != nil {
-				log.Fatal(err)
-			}
-		} else {
-			log.Info(i18n.G("dry run: not syncing label %s for recipe %s", nextTag, recipe.Name))
-		}
-
-		isClean, err := gitPkg.IsClean(recipe.Dir)
-		if err != nil {
-			log.Fatal(err)
-		}
-		if !isClean {
-			log.Info(i18n.G("%s currently has these unstaged changes 👇", recipe.Name))
-			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
-				log.Fatal(err)
-			}
-		}
-	},
-}
-
-func init() {
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Dry,
-		i18n.G("dry-run"),
-		i18n.G("r"),
-		false,
-		i18n.G("report changes that would be made"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Major,
-		i18n.G("major"),
-		i18n.G("x"),
-		false,
-		i18n.G("increase the major part of the version"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Minor,
-		i18n.G("minor"),
-		i18n.G("y"),
-		false,
-		i18n.G("increase the minor part of the version"),
-	)
-
-	RecipeSyncCommand.Flags().BoolVarP(
-		&internal.Patch,
-		i18n.G("patch"),
-		i18n.G("z"),
-		false,
-		i18n.G("increase the patch part of the version"),
-	)
-}

cli/recipe/upgrade.go

@@ -57,14 +57,13 @@ is up to the end-user to decide.
 
 The command is interactive and will show a select input which allows you to
 make a seclection. Use the "?" key to see more help on navigating this
-interface.
-
-You may invoke this command in "wizard" mode and be prompted for input.`),
+interface.`),
 	Args: cobra.RangeArgs(0, 1),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
-		toComplete string) ([]string, cobra.ShellCompDirective) {
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
 		return autocomplete.RecipeNameComplete()
 	},
 	Run: func(cmd *cobra.Command, args []string) {
@@ -125,7 +124,7 @@ You may invoke this command in "wizard" mode and be prompted for input.`),
 			log.Debug(i18n.G("did not find versions file for %s", recipe.Name))
 		}
 
-		config, err := recipe.GetComposeConfig(nil)
+		config, err := recipe.GetComposeConfig()
 		if err != nil {
 			log.Fatal(err)
 		}
@@ -337,12 +336,37 @@ You may invoke this command in "wizard" mode and be prompted for input.`),
 			if err := gitPkg.DiffUnstaged(recipe.Dir); err != nil {
 				log.Fatal(err)
 			}
+
+			if !internal.NoInput && !createCommit {
+				prompt := &survey.Confirm{
+					Message: i18n.G("commit changes?"),
+					Default: true,
+				}
+
+				if err := survey.AskOne(prompt, &createCommit); err != nil {
+					log.Fatal(err)
+				}
+			}
+
+			if createCommit {
+				msg := i18n.G("chore: update image tags")
+				if err := gitPkg.Commit(recipe.Dir, msg, internal.Dry); err != nil {
+					log.Fatal(err)
+				}
+				log.Info(i18n.G("committed changes as '%s'", msg))
+			}
+
+		} else {
+			if createCommit {
+				log.Warn(i18n.G("no changes, skip creating commit"))
+			}
 		}
 	},
 }
 
 var (
-	allTags bool
+	allTags      bool
+	createCommit bool
 )
 
 func init() {
@@ -385,4 +409,12 @@ func init() {
 		false,
 		i18n.G("list all tags, not just upgrades"),
 	)
+
+	RecipeUpgradeCommand.Flags().BoolVarP(
+		&createCommit,
+		i18n.G("commit"),
+		i18n.GC("c", "recipe upgrade"),
+		false,
+		i18n.G("commit changes"),
+	)
 }

cli/run.go

@@ -187,28 +187,20 @@ Config:
 
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.Debug,
-		"debug",
-		"d",
+		i18n.G("debug"),
+		i18n.G("d"),
 		false,
 		i18n.G("show debug messages"),
 	)
 
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.NoInput,
-		"no-input",
-		"n",
+		i18n.G("no-input"),
+		i18n.G("n"),
 		false,
 		i18n.G("toggle non-interactive mode"),
 	)
 
-	rootCmd.PersistentFlags().BoolVarP(
-		&internal.Offline,
-		"offline",
-		"o",
-		false,
-		i18n.G("prefer offline & filesystem access"),
-	)
-
 	rootCmd.PersistentFlags().BoolVarP(
 		&internal.Help,
 		i18n.G("help"),
@@ -217,6 +209,14 @@ Config:
 		i18n.G("help for abra"),
 	)
 
+	rootCmd.PersistentFlags().BoolVarP(
+		&internal.Offline,
+		i18n.G("offline"),
+		i18n.G("o"),
+		false,
+		i18n.G("prefer offline & filesystem access"),
+	)
+
 	rootCmd.Flags().BoolVarP(
 		&internal.Version,
 		i18n.G("version"),
@@ -245,7 +245,6 @@ Config:
 		recipe.RecipeNewCommand,
 		recipe.RecipeReleaseCommand,
 		recipe.RecipeResetCommand,
-		recipe.RecipeSyncCommand,
 		recipe.RecipeUpgradeCommand,
 		recipe.RecipeVersionCommand,
 	)

go.mod

@@ -1,8 +1,6 @@
 module coopcloud.tech/abra
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.26.0
 
 require (
 	coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca
@@ -10,19 +8,20 @@ require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/charmbracelet/log v0.4.2
+	github.com/charmbracelet/log v1.0.0
+	github.com/compose-spec/compose-go/v2 v2.10.1
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v28.4.0+incompatible
-	github.com/docker/docker v28.4.0+incompatible
+	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.16.2
+	github.com/go-git/go-git/v5 v5.17.2
 	github.com/google/go-cmp v0.7.0
 	github.com/leonelquinteros/gotext v1.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
-	github.com/schollz/progressbar/v3 v3.18.0
-	golang.org/x/term v0.35.0
+	github.com/schollz/progressbar/v3 v3.19.0
+	golang.org/x/term v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
@@ -30,27 +29,28 @@ require (
 require (
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.3.2 // indirect
-	github.com/charmbracelet/x/ansi v0.10.2 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
+	github.com/charmbracelet/colorprofile v0.4.3 // indirect
+	github.com/charmbracelet/x/ansi v0.11.6 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
 	github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/clipperhouse/displaywidth v0.11.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/cyphar/filepath-securejoin v0.5.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
@@ -61,26 +61,27 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-git/go-billy/v5 v5.8.0 // indirect
+	github.com/go-logfmt/logfmt v0.6.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/kevinburke/ssh_config v1.4.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/kevinburke/ssh_config v1.6.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.19 // indirect
+	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
@@ -89,7 +90,7 @@ require (
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
@@ -100,39 +101,44 @@ require (
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.66.1 // indirect
-	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.20.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
+	go.opentelemetry.io/otel v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
-	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.8.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
-	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
-	golang.org/x/net v0.44.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
-	golang.org/x/time v0.13.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect
-	google.golang.org/grpc v1.75.1 // indirect
-	google.golang.org/protobuf v1.36.9 // indirect
+	go.opentelemetry.io/otel/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
+	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -141,12 +147,12 @@ require (
 	github.com/containers/image v3.0.2+incompatible
 	github.com/containers/storage v1.38.2 // indirect
 	github.com/decentral1se/passgen v1.0.1
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/docker-credential-helpers v0.9.5 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8
-	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
@@ -155,5 +161,9 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.36.0
+	golang.org/x/sys v0.42.0
 )
+
+replace github.com/docker/cli v28.4.0+incompatible => git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible
+
+replace github.com/spf13/cobra => github.com/decentral1se/cobra v1.10.2-i18n

go.sum

@@ -27,6 +27,8 @@ coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca/go.mod h1:ESVm0wQKcbcFi
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible h1:YdW2uK5sHj545lGz/FrozPueINkQ7fUjlsNd8aYcqik=
+git.coopcloud.tech/toolshed/docker-cli v28.5.3-0.20260202112816-30df2d0b3a00+incompatible/go.mod h1:PY19bHY5R4DLmRuCrv4TR7etURn/+tSTFuam4FUTiD8=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c h1:oeKnUB79PKYD8D0/unYuu7MRcWryQQWOns8+JL+acrs=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c/go.mod h1:fQuhwrpg6qb9NlFXKYi/LysWu1wxjraS8sxyW12CUF0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
@@ -49,8 +51,8 @@ github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZ
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -79,8 +81,8 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
-github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -95,7 +97,6 @@ github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:C
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
@@ -135,20 +136,20 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
 github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.3.2 h1:9J27WdztfJQVAQKX2WOlSSRB+5gaKqqITmrvb1uTIiI=
-github.com/charmbracelet/colorprofile v0.3.2/go.mod h1:mTD5XzNeWHj8oqHb+S1bssQb7vIHbepiebQ2kPKVKbI=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/log v0.4.2 h1:hYt8Qj6a8yLnvR+h7MwsJv/XvmBJXiueUcI3cIxsyig=
-github.com/charmbracelet/log v0.4.2/go.mod h1:qifHGX/tc7eluv2R6pWIpyHDDrrb/AG71Pf2ysQu5nw=
-github.com/charmbracelet/x/ansi v0.10.2 h1:ith2ArZS0CJG30cIUfID1LXN7ZFXRCww6RUvAPA+Pzw=
-github.com/charmbracelet/x/ansi v0.10.2/go.mod h1:HbLdJjQH4UH4AqA2HpRWuWNluRE6zxJH/yteYEYCFa8=
-github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
-github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
+github.com/charmbracelet/log v1.0.0 h1:HVVVMmfOorfj3BA9i8X8UL69Hoz9lI0PYwXfJvOdRc4=
+github.com/charmbracelet/log v1.0.0/go.mod h1:uYgY3SmLpwJWxmlrPwXvzVYujxis1vAKRV/0VQB7yWA=
+github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
+github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
+github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
 github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
 github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
+github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
 github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
 github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
@@ -164,15 +165,19 @@ github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJ
 github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
-github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
+github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
+github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
+github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
-github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
+github.com/compose-spec/compose-go/v2 v2.10.1 h1:mFbXobojGRFIVi1UknrvaDAZ+PkJfyjqkA1yseh+vAU=
+github.com/compose-spec/compose-go/v2 v2.10.1/go.mod h1:Ohac1SzhO/4fXXrzWIztIVB6ckmKBv1Nt5Z5mGVESUg=
 github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
 github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
 github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
@@ -271,8 +276,6 @@ github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgU
 github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/containers/storage v1.38.2 h1:8bAIxnVBGKzMw5EWCivVj24bztQT6IkDp4uHiyhnzwE=
 github.com/containers/storage v1.38.2/go.mod h1:INP0RPLHWBxx+pTsO5uiHlDUGHDFvWZPWprAbAlQWPQ=
-github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
-github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
 github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
@@ -298,8 +301,8 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.5.0 h1:hIAhkRBMQ8nIeuVwcAoymp7MY4oherZdAxD+m0u9zaw=
-github.com/cyphar/filepath-securejoin v0.5.0/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
 github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
@@ -307,30 +310,31 @@ github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjI
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decentral1se/cobra v1.10.2-i18n h1:XR+6AHHfnf4k5NM9f09oLMrEVwz3rkQIAIcqgL8R08g=
+github.com/decentral1se/cobra v1.10.2-i18n/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/decentral1se/passgen v1.0.1 h1:j2AxK/kHKxDHWZZfkJj8Wgae9+O+DYEqR5sjKthIYKA=
 github.com/decentral1se/passgen v1.0.1/go.mod h1:530V+lNoPhKtkrX2fIVsIfLhkl47CuiOM7HRgi7C+SU=
 github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
+github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY=
-github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk=
-github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
+github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
-github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
+github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
+github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
@@ -389,12 +393,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
+github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
-github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
+github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104=
+github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -403,8 +407,8 @@ github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
-github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
-github.com/go-logfmt/logfmt v0.6.0/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
+github.com/go-logfmt/logfmt v0.6.1 h1:4hvbpePJKnIzH1B+8OR/JPbTx37NktoI9LE2QZBBkvE=
+github.com/go-logfmt/logfmt v0.6.1/go.mod h1:EV2pOAQoZaT1ZXZbqDl5hrymndi4SY9ED9/z6CO0XAk=
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -425,8 +429,8 @@ github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
 github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
-github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -445,7 +449,6 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -521,17 +524,14 @@ github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2z
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
-github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -546,7 +546,6 @@ github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVU
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -580,8 +579,8 @@ github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVE
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kevinburke/ssh_config v1.4.0 h1:6xxtP5bZ2E4NF5tuQulISpTO2z8XbtH8cg1PWkxoFkQ=
-github.com/kevinburke/ssh_config v1.4.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
+github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
+github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
@@ -589,8 +588,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -614,10 +613,9 @@ github.com/leonelquinteros/gotext v1.7.2 h1:bDPndU8nt+/kRo1m4l/1OXiiy2v7Z7dfPQ9+
 github.com/leonelquinteros/gotext v1.7.2/go.mod h1:9/haCkm5P7Jay1sxKDGJ5WIg4zkz8oZKw4ekNpALob8=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
-github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
-github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -634,10 +632,11 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
-github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
+github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -653,7 +652,6 @@ github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WT
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
@@ -662,8 +660,8 @@ github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6U
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
 github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
-github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
@@ -688,8 +686,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
+github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
@@ -705,7 +704,6 @@ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+
 github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -758,7 +756,6 @@ github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3
 github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
 github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
@@ -774,7 +771,6 @@ github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prY
 github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
-github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
@@ -788,16 +784,13 @@ github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6T
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs=
-github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
-github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
@@ -806,9 +799,8 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
-github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
-github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
@@ -820,9 +812,11 @@ github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
-github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
+github.com/schollz/progressbar/v3 v3.19.0 h1:Ea18xuIRQXLAUidVDox3AbwfUhD0/1IvohyTutOIFoc=
+github.com/schollz/progressbar/v3 v3.19.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
@@ -837,26 +831,17 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
+github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
-github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
 github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
@@ -867,7 +852,6 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
-github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
 github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -892,7 +876,6 @@ github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4D
 github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
@@ -918,10 +901,11 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:
 github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
@@ -929,7 +913,6 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
 github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
 github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
@@ -941,37 +924,41 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 h1:RbKq8BG0FI8OiXhBfcRtqqHcZcka+gU3cskNuf05R18=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0/go.mod h1:h06DGIukJOevXaj/xrNjhi/2098RZzcLTbc0jDAUbsg=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 h1:vl9obrcoWVKp/lwl8tRE33853I8Xru9HFbw/skNeLs8=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0/go.mod h1:GAXRxmLJcVM3u22IjTg74zWBrRCKq8BnOqUVLodpcpw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.8.0 h1:fRAZQDcAFHySxpJ1TwlA1cJ4tvcrw7nXl9xWWC8N5CE=
-go.opentelemetry.io/proto/otlp v1.8.0/go.mod h1:tIeYOeNBU4cvmPqpaji1P+KbB4Oloai8wN4rWzRrFF0=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -990,8 +977,8 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1002,8 +989,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1067,8 +1054,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
-golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1086,6 +1073,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1164,13 +1153,13 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1180,16 +1169,16 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI=
-golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1239,8 +1228,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -1285,10 +1274,10 @@ google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4 h1:8XJ4pajGwOlasW+L13MnEGA8W4115jJySQtVfS2/IBU=
-google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4/go.mod h1:NnuHhy+bxcg30o7FnVAZbXsPHUDQ9qKWAQKCD7VxFtk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
+google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1308,8 +1297,8 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1323,8 +1312,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=

pkg/app/app.go

@@ -18,10 +18,10 @@ import (
 	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	"coopcloud.tech/abra/pkg/upstream/stack"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 
 	"coopcloud.tech/abra/pkg/log"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/schollz/progressbar/v3"
 )
@@ -179,8 +179,7 @@ func (a App) Filters(appendServiceNames, exactMatch bool, services ...string) (f
 		return filters, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	compose, err := GetAppComposeConfig(a.Recipe.Name, opts, a.Env)
+	compose, err := GetAppComposeConfig(composeFiles, a.Env)
 	if err != nil {
 		return filters, err
 	}
@@ -333,8 +332,7 @@ func GetAppServiceNames(appName string) ([]string, error) {
 		return serviceNames, err
 	}
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	compose, err := GetAppComposeConfig(app.Recipe.Name, opts, app.Env)
+	compose, err := GetAppComposeConfig(composeFiles, app.Env)
 	if err != nil {
 		return serviceNames, err
 	}
@@ -490,13 +488,18 @@ func GetAppStatuses(apps []App, MachineReadable bool) (map[string]map[string]str
 // GetAppComposeConfig retrieves a compose specification for a recipe. This
 // specification is the result of a merge of all the compose.**.yml files in
 // the recipe repository.
-func GetAppComposeConfig(recipe string, opts stack.Deploy, appEnv envfile.AppEnv) (*composetypes.Config, error) {
-	compose, err := loader.LoadComposefile(opts, appEnv)
+func GetAppComposeConfig(composeFiles []string, appEnv envfile.AppEnv) (*composeGoTypes.Project, error) {
+	compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles, AppEnv: appEnv})
 	if err != nil {
-		return &composetypes.Config{}, err
+		return &composeGoTypes.Project{}, err
 	}
 
-	log.Debug(i18n.G("retrieved %s for %s", compose.Filename, recipe))
+	recipeName, exists := appEnv["RECIPE"]
+	if !exists {
+		recipeName, _ = appEnv["TYPE"]
+	}
+
+	log.Debug(i18n.G("retrieved %s for %s", compose.Name, recipeName))
 
 	return compose, nil
 }
@@ -504,7 +507,7 @@ func GetAppComposeConfig(recipe string, opts stack.Deploy, appEnv envfile.AppEnv
 // ExposeAllEnv exposes all env variables to the app container
 func ExposeAllEnv(
 	stackName string,
-	compose *composetypes.Config,
+	compose *composeGoTypes.Project,
 	appEnv envfile.AppEnv,
 	toDeployVersion string) {
 	for _, service := range compose.Services {

pkg/app/app_test.go

@@ -10,46 +10,83 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/recipe"
-	testPkg "coopcloud.tech/abra/pkg/test"
+	recipePkg "coopcloud.tech/abra/pkg/recipe"
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
 )
 
+var (
+	expectedAppEnv = envfile.AppEnv{
+		"DOMAIN": test.AppName,
+		"RECIPE": test.RecipeName,
+	}
+
+	expectedApp = appPkg.App{
+		Name:   test.AppName,
+		Recipe: recipePkg.Get(expectedAppEnv["RECIPE"]),
+		Domain: expectedAppEnv["DOMAIN"],
+		Env:    expectedAppEnv,
+		Path:   expectedAppFile.Path,
+		Server: expectedAppFile.Server,
+	}
+
+	expectedAppFile = appPkg.AppFile{
+		Path:   test.AppEnvPath,
+		Server: test.ServerName,
+	}
+
+	expectedAppFiles = map[string]appPkg.AppFile{
+		test.AppName: expectedAppFile,
+	}
+)
+
 func TestNewApp(t *testing.T) {
-	app, err := appPkg.NewApp(testPkg.ExpectedAppEnv, testPkg.AppName, testPkg.ExpectedAppFile)
+	app, err := appPkg.NewApp(expectedAppEnv, test.AppName, expectedAppFile)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestReadAppEnvFile(t *testing.T) {
-	app, err := appPkg.ReadAppEnvFile(testPkg.ExpectedAppFile, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.ReadAppEnvFile(expectedAppFile, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestGetApp(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(app, testPkg.ExpectedApp) {
-		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, testPkg.ExpectedApp)
+
+	if !reflect.DeepEqual(app, expectedApp) {
+		t.Fatalf("did not get expected app type. Expected: %s; Got: %s", app, expectedApp)
 	}
 }
 
 func TestGetComposeFiles(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -94,7 +131,10 @@ func TestGetComposeFiles(t *testing.T) {
 }
 
 func TestGetComposeFilesError(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
 	err := r.EnsureExists()
 	if err != nil {
 		t.Fatal(err)
@@ -186,26 +226,32 @@ func TestFilters(t *testing.T) {
 
 func compareFilter(t *testing.T, f1 filters.Args, f2 map[string]map[string]bool) {
 	t.Helper()
+
 	j1, err := f1.MarshalJSON()
 	if err != nil {
 		t.Error(err)
 	}
+
 	j2, err := json.Marshal(f2)
 	if err != nil {
 		t.Error(err)
 	}
+
 	if diff := cmp.Diff(string(j2), string(j1)); diff != "" {
 		t.Errorf("filters mismatch (-want +got):\n%s", diff)
 	}
 }
 
 func TestWriteRecipeVersionOverwrite(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	defer t.Cleanup(func() {
+	t.Cleanup(func() {
 		if err := app.WipeRecipeVersion(); err != nil {
 			t.Fatal(err)
 		}
@@ -217,7 +263,7 @@ func TestWriteRecipeVersionOverwrite(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	app, err = appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	app, err = appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -226,7 +272,10 @@ func TestWriteRecipeVersionOverwrite(t *testing.T) {
 }
 
 func TestWriteRecipeVersionUnknown(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}

pkg/app/compose.go

@@ -7,12 +7,12 @@ import (
 
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 )
 
 // SetRecipeLabel adds the label 'coop-cloud.${STACK_NAME}.recipe=${RECIPE}' to the app container
 // to signal which recipe is connected to the deployed app
-func SetRecipeLabel(compose *composetypes.Config, stackName string, recipe string) {
+func SetRecipeLabel(compose *composeGoTypes.Project, stackName string, recipe string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set recipe label 'coop-cloud.%s.recipe' to %s for %s", stackName, recipe, stackName))
@@ -24,7 +24,7 @@ func SetRecipeLabel(compose *composetypes.Config, stackName string, recipe strin
 
 // SetChaosLabel adds the label 'coop-cloud.${STACK_NAME}.chaos=true/false' to the app container
 // to signal if the app is deployed in chaos mode
-func SetChaosLabel(compose *composetypes.Config, stackName string, chaos bool) {
+func SetChaosLabel(compose *composeGoTypes.Project, stackName string, chaos bool) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.chaos' to %v for %s", stackName, chaos, stackName))
@@ -35,7 +35,7 @@ func SetChaosLabel(compose *composetypes.Config, stackName string, chaos bool) {
 }
 
 // SetChaosVersionLabel adds the label 'coop-cloud.${STACK_NAME}.chaos-version=$(GIT_COMMIT)' to the app container
-func SetChaosVersionLabel(compose *composetypes.Config, stackName string, chaosVersion string) {
+func SetChaosVersionLabel(compose *composeGoTypes.Project, stackName string, chaosVersion string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.chaos-version' to %v for %s", stackName, chaosVersion, stackName))
@@ -45,7 +45,7 @@ func SetChaosVersionLabel(compose *composetypes.Config, stackName string, chaosV
 	}
 }
 
-func SetVersionLabel(compose *composetypes.Config, stackName string, version string) {
+func SetVersionLabel(compose *composeGoTypes.Project, stackName string, version string) {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			log.Debug(i18n.G("set label 'coop-cloud.%s.version' to %v for %s", stackName, version, stackName))
@@ -56,7 +56,7 @@ func SetVersionLabel(compose *composetypes.Config, stackName string, version str
 }
 
 // GetLabel reads docker labels in the format of "coop-cloud.${STACK_NAME}.${LABEL}" from the local compose files
-func GetLabel(compose *composetypes.Config, stackName string, label string) string {
+func GetLabel(compose *composeGoTypes.Project, stackName string, label string) string {
 	for _, service := range compose.Services {
 		if service.Name == "app" {
 			labelKey := fmt.Sprintf("coop-cloud.%s.%s", stackName, label)
@@ -73,7 +73,7 @@ func GetLabel(compose *composetypes.Config, stackName string, label string) stri
 // GetTimeoutFromLabel reads the timeout value from docker label
 // `coop-cloud.${STACK_NAME}.timeout=...` if present. A value is present if the
 // operator uses a `TIMEOUT=...` in their app env.
-func GetTimeoutFromLabel(compose *composetypes.Config, stackName string) (int, error) {
+func GetTimeoutFromLabel(compose *composeGoTypes.Project, stackName string) (int, error) {
 	var timeout int
 
 	if timeoutLabel := GetLabel(compose, stackName, "timeout"); timeoutLabel != "" {

pkg/app/compose_test.go

@@ -4,15 +4,15 @@ import (
 	"testing"
 
 	appPkg "coopcloud.tech/abra/pkg/app"
+	"coopcloud.tech/abra/pkg/test"
 	testPkg "coopcloud.tech/abra/pkg/test"
-	stack "coopcloud.tech/abra/pkg/upstream/stack"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestGetTimeoutFromLabel(t *testing.T) {
-	testPkg.MkServerAppRecipe()
-	defer testPkg.RmServerAppRecipe()
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
 
 	tests := []struct {
 		configuredTimeout string
@@ -25,7 +25,7 @@ func TestGetTimeoutFromLabel(t *testing.T) {
 	}
 
 	for _, test := range tests {
-		app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+		app, err := appPkg.GetApp(expectedAppFiles, testPkg.AppName)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -39,15 +39,8 @@ func TestGetTimeoutFromLabel(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		deployOpts := stack.Deploy{
-			Composefiles: composeFiles,
-			Namespace:    app.StackName(),
-			Prune:        false,
-			ResolveImage: stack.ResolveImageAlways,
-			Detach:       false,
-		}
-
-		compose, err := appPkg.GetAppComposeConfig(app.Name, deployOpts, app.Env)
+		app.Env["STACK_NAME"] = app.StackName()
+		compose, err := appPkg.GetAppComposeConfig(composeFiles, app.Env)
 		if err != nil {
 			t.Fatal(err)
 		}

pkg/autocomplete/autocomplete.go

@@ -120,7 +120,7 @@ func CommandNameComplete(appName string) ([]string, cobra.ShellCompDirective) {
 func SecretComplete(recipeName string) ([]string, cobra.ShellCompDirective) {
 	r := recipe.Get(recipeName)
 
-	config, err := r.GetComposeConfig(nil)
+	config, err := r.GetComposeConfig()
 	if err != nil {
 		err := i18n.G("autocomplete failed: %s", err)
 		return []string{err}, cobra.ShellCompDirectiveError

pkg/client/client.go

@@ -8,7 +8,6 @@ import (
 	"os"
 	"path"
 	"strings"
-	"time"
 
 	"coopcloud.tech/abra/pkg/config"
 	contextPkg "coopcloud.tech/abra/pkg/context"
@@ -84,8 +83,7 @@ func New(serverName string, opts ...Opt) (*client.Client, error) {
 
 		httpClient := &http.Client{
 			Transport: &http.Transport{
-				DialContext:     helper.Dialer,
-				IdleConnTimeout: 30 * time.Second,
+				DialContext: helper.Dialer,
 			},
 		}
 

pkg/config/abra_test.go

@@ -10,8 +10,9 @@ import (
 func TestFindAbraConfig(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	tests := []struct {
 		Dir    string
 		Config string
@@ -51,8 +52,9 @@ func TestFindAbraConfig(t *testing.T) {
 func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	t.Setenv("ABRA_DIR", "")
 
 	t.Run("default", func(t *testing.T) {
@@ -67,7 +69,7 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err = os.Chdir(filepath.Join(wd, "testdata/abraconfig1"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()
@@ -81,7 +83,7 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err := os.Chdir(filepath.Join(wd, "testdata/abraconfig2"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()
@@ -104,8 +106,9 @@ func TestLoadAbraConfigGetAbraDir(t *testing.T) {
 func TestLoadAbraConfigServersDir(t *testing.T) {
 	wd, err := os.Getwd()
 	if err != nil {
-		log.Fatal(err)
+		t.Fatal(err)
 	}
+
 	t.Setenv("ABRA_DIR", "")
 
 	t.Run("default", func(t *testing.T) {
@@ -120,7 +123,7 @@ func TestLoadAbraConfigServersDir(t *testing.T) {
 		t.Cleanup(func() { os.Chdir(wd) })
 		err = os.Chdir(filepath.Join(wd, "testdata/abraconfig1"))
 		if err != nil {
-			log.Fatal(err)
+			t.Fatal(err)
 		}
 
 		cfg := LoadAbraConfig()

pkg/deploy/utils.go

@@ -14,8 +14,8 @@ import (
 	"coopcloud.tech/abra/pkg/recipe"
 	"coopcloud.tech/abra/pkg/secret"
 
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/distribution/reference"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types/swarm"
 	dockerClient "github.com/docker/docker/client"
 )
@@ -165,7 +165,13 @@ func GetImagesForStack(cl *dockerClient.Client, app appPkg.App) (map[string]stri
 			}
 
 			imageBaseName := reference.Path(imageParsed)
-			imageTag := imageParsed.(reference.NamedTagged).Tag()
+			namedTag, ok := imageParsed.(reference.NamedTagged)
+			if !ok {
+				// This is an image without a tag
+				images[imageBaseName] = ""
+				continue
+			}
+			imageTag := namedTag.Tag()
 
 			existingImageVersion, ok := images[imageBaseName]
 			if !ok {
@@ -223,7 +229,7 @@ func GatherSecretsForDeploy(cl *dockerClient.Client, app appPkg.App, showUnchang
 	return secretInfo, nil
 }
 
-func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composetypes.Config, abraShEnv map[string]string, showUnchanged bool) ([]string, error) {
+func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composeGoTypes.Project, abraShEnv map[string]string, showUnchanged bool) ([]string, error) {
 	// Get current configs from existing deployment
 	currentConfigs, err := GetConfigsForStack(cl, app)
 	if err != nil {
@@ -262,7 +268,7 @@ func GatherConfigsForDeploy(cl *dockerClient.Client, app appPkg.App, compose *co
 	return configInfo, nil
 }
 
-func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composetypes.Config, showUnchanged bool) ([]string, error) {
+func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *composeGoTypes.Project, showUnchanged bool) ([]string, error) {
 	// Get current images from existing deployment
 	currentImages, err := GetImagesForStack(cl, app)
 	if err != nil {
@@ -282,7 +288,13 @@ func GatherImagesForDeploy(cl *dockerClient.Client, app appPkg.App, compose *com
 		}
 
 		imageBaseName := reference.Path(imageParsed)
-		imageTag := imageParsed.(reference.NamedTagged).Tag()
+		namedTag, ok := imageParsed.(reference.NamedTagged)
+		if !ok {
+			// This is an image without a tag
+			newImages[imageBaseName] = ""
+			continue
+		}
+		imageTag := namedTag.Tag()
 
 		existingImageVersion, ok := newImages[imageBaseName]
 		if !ok {

pkg/envfile/envfile_test.go

@@ -10,48 +10,73 @@ import (
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/recipe"
-	testPkg "coopcloud.tech/abra/pkg/test"
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/stretchr/testify/assert"
 )
 
+var (
+	expectedAppEnv = envfile.AppEnv{
+		"DOMAIN": test.AppName,
+		"RECIPE": test.RecipeName,
+	}
+
+	expectedAppFile = appPkg.AppFile{
+		Path:   test.AppEnvPath,
+		Server: test.ServerName,
+	}
+
+	expectedAppFiles = map[string]appPkg.AppFile{
+		test.AppName: expectedAppFile,
+	}
+)
+
 func TestGetAllFoldersInDirectory(t *testing.T) {
-	folders, err := config.GetAllFoldersInDirectory(testPkg.TestDir)
+	folders, err := config.GetAllFoldersInDirectory(test.TestDir)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(folders, testPkg.TFolders) {
-		t.Fatalf("did not get expected folders. Expected: (%s), Got: (%s)", strings.Join(testPkg.TFolders, ","), strings.Join(folders, ","))
+
+	if !reflect.DeepEqual(folders, test.TFolders) {
+		t.Fatalf("did not get expected folders. Expected: (%s), Got: (%s)", strings.Join(test.TFolders, ","), strings.Join(folders, ","))
 	}
 }
 
 func TestGetAllFilesInDirectory(t *testing.T) {
-	files, err := config.GetAllFilesInDirectory(testPkg.TestDir)
+	files, err := config.GetAllFilesInDirectory(test.TestDir)
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	var fileNames []string
 	for _, file := range files {
 		fileNames = append(fileNames, file.Name())
 	}
-	if !reflect.DeepEqual(fileNames, testPkg.TFiles) {
-		t.Fatalf("did not get expected files. Expected: (%s), Got: (%s)", strings.Join(testPkg.TFiles, ","), strings.Join(fileNames, ","))
+
+	if !reflect.DeepEqual(fileNames, test.TFiles) {
+		t.Fatalf("did not get expected files. Expected: (%s), Got: (%s)", strings.Join(test.TFiles, ","), strings.Join(fileNames, ","))
 	}
 }
 
 func TestReadEnv(t *testing.T) {
-	env, err := envfile.ReadEnv(testPkg.ExpectedAppFile.Path)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	env, err := envfile.ReadEnv(expectedAppFile.Path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !reflect.DeepEqual(env, testPkg.ExpectedAppEnv) {
+
+	if !reflect.DeepEqual(env, expectedAppEnv) {
 		t.Fatal("did not get expected application settings")
 	}
 }
 
 func TestReadAbraShEnvVars(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -78,9 +103,11 @@ func TestReadAbraShEnvVars(t *testing.T) {
 }
 
 func TestReadAbraShCmdNames(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -102,9 +129,11 @@ func TestReadAbraShCmdNames(t *testing.T) {
 }
 
 func TestCheckEnv(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -135,9 +164,11 @@ func TestCheckEnv(t *testing.T) {
 }
 
 func TestCheckEnvError(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -170,9 +201,11 @@ func TestCheckEnvError(t *testing.T) {
 }
 
 func TestEnvVarCommentsRemoved(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -201,9 +234,11 @@ func TestEnvVarCommentsRemoved(t *testing.T) {
 }
 
 func TestEnvVarModifiersIncluded(t *testing.T) {
-	r := recipe.Get("abra-test-recipe")
-	err := r.EnsureExists()
-	if err != nil {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := recipe.Get(test.AbraTestRecipe)
+	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
@@ -225,7 +260,10 @@ func TestEnvVarModifiersIncluded(t *testing.T) {
 }
 
 func TestNoOverwriteNonVersionEnvVars(t *testing.T) {
-	app, err := appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	app, err := appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -234,7 +272,7 @@ func TestNoOverwriteNonVersionEnvVars(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	app, err = appPkg.GetApp(testPkg.ExpectedAppFiles, testPkg.AppName)
+	app, err = appPkg.GetApp(expectedAppFiles, test.AppName)
 	if err != nil {
 		t.Fatal(err)
 	}

pkg/git/clone_test.go

@@ -8,11 +8,44 @@ import (
 	"testing"
 
 	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/log"
 )
 
+func setup() {
+	teardown()
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/recipes"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+}
+
+func teardown() {
+	abraDir := os.ExpandEnv("$ABRA_DIR")
+	if abraDir == fmt.Sprintf("%s/.abra", os.ExpandEnv("$HOME")) {
+		log.Fatal("set $ABRA_DIR before running the test suite")
+	}
+
+	if err := os.RemoveAll(abraDir); err != nil {
+		log.Fatal(err)
+	}
+}
+
 func TestClone(t *testing.T) {
+	setup()
+	t.Cleanup(func() { teardown() })
+
 	dir := path.Join(config.RECIPES_DIR, "gitea")
-	os.RemoveAll(dir)
+	if err := os.RemoveAll(dir); err != nil {
+		t.Fatal(err)
+	}
 
 	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
 	if err := Clone(dir, gitURL); err != nil {
@@ -25,6 +58,11 @@ func TestClone(t *testing.T) {
 }
 
 func TestCancelGitClone(t *testing.T) {
+	t.Skip("https://git.coopcloud.tech/toolshed/abra/issues/814")
+
+	setup()
+	t.Cleanup(func() { teardown() })
+
 	dir := path.Join(config.RECIPES_DIR, "gitea")
 	os.RemoveAll(dir)
 

pkg/git/commit.go

@@ -35,7 +35,7 @@ func Commit(repoPath, commitMessage string, dryRun bool) error {
 
 	if !dryRun {
 		// NOTE(d1): `All: true` does not include untracked files
-		_, err = commitWorktree.Commit(commitMessage, &git.CommitOptions{All: true})
+		_, err := commitWorktree.Commit(commitMessage, &git.CommitOptions{All: true})
 		if err != nil {
 			return err
 		}

pkg/i18n/i18n.go

@@ -23,6 +23,14 @@ var (
 	GC            = Mo.GetC
 )
 
+func GetLocaleStr() string {
+	locale := os.Getenv("LANG")
+	if lastUnderscore := strings.LastIndex(locale, "_"); lastUnderscore != -1 {
+		locale = locale[0:lastUnderscore]
+	}
+	return locale
+}
+
 func LoadLocale() (string, *gotext.Mo) {
 	entries, err := assetFS.ReadDir("locales")
 	if err != nil {
@@ -38,11 +46,7 @@ func LoadLocale() (string, *gotext.Mo) {
 		}
 	}
 
-	locale := os.Getenv("LANG")
-	if lastUnderscore := strings.LastIndex(locale, "_"); lastUnderscore != -1 {
-		locale = locale[0:lastUnderscore]
-	}
-
+	locale := GetLocaleStr()
 	if locale != "" {
 		if slices.Contains(linguas, locale) {
 			Locale = locale

pkg/lint/recipe.go

@@ -62,13 +62,6 @@ func (l LintRule) Skip(recipe recipe.Recipe) bool {
 
 var LintRules = map[string][]LintRule{
 	"warn": {
-		{
-			Ref:          "R001",
-			Level:        i18n.G("warn"),
-			Description:  i18n.G("compose config has expected version"),
-			HowToResolve: i18n.G("ensure 'version: \"3.8\"' in compose configs"),
-			Function:     LintComposeVersion,
-		},
 		{
 			Ref:          "R002",
 			Level:        i18n.G("warn"),
@@ -142,7 +135,7 @@ var LintRules = map[string][]LintRule{
 			Function:     LintAppService,
 		},
 		{
-			Ref:          "R015",
+			Ref:          "R016",
 			Level:        i18n.G("error"),
 			Description:  i18n.G("deploy labels stanza present"),
 			HowToResolve: i18n.G("include \"deploy: labels: ...\" stanza"),
@@ -217,18 +210,6 @@ func LintForErrors(recipe recipe.Recipe) error {
 	return nil
 }
 
-func LintComposeVersion(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
-	if err != nil {
-		return false, err
-	}
-	if config.Version == "3.8" {
-		return true, nil
-	}
-
-	return true, nil
-}
-
 func LintEnvConfigPresent(r recipe.Recipe) (bool, error) {
 	if _, err := os.Stat(r.SampleEnvPath); !os.IsNotExist(err) {
 		return true, nil
@@ -238,7 +219,7 @@ func LintEnvConfigPresent(r recipe.Recipe) (bool, error) {
 }
 
 func LintAppService(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -258,7 +239,7 @@ func LintAppService(recipe recipe.Recipe) (bool, error) {
 func LintTraefikEnabledSkipCondition(r recipe.Recipe) (bool, error) {
 	sampleEnv, err := r.SampleEnv()
 	if err != nil {
-		return false, errors.New(i18n.G("unable to discover .env.sample for %s", r.Name))
+		return false, errors.New(i18n.G(".env.sample for %s couldn't be read: %s", r.Name, err))
 	}
 
 	if _, ok := sampleEnv["DOMAIN"]; !ok {
@@ -269,7 +250,7 @@ func LintTraefikEnabledSkipCondition(r recipe.Recipe) (bool, error) {
 }
 
 func LintTraefikEnabled(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -287,7 +268,7 @@ func LintTraefikEnabled(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintDeployLabelsPresent(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -302,7 +283,7 @@ func LintDeployLabelsPresent(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintHealthchecks(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -316,7 +297,7 @@ func LintHealthchecks(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintAllImagesTagged(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -334,7 +315,7 @@ func LintAllImagesTagged(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintNoUnstableTags(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -361,7 +342,7 @@ func LintNoUnstableTags(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintSemverLikeTags(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -388,7 +369,7 @@ func LintSemverLikeTags(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintImagePresent(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -440,7 +421,7 @@ func LintMetadataFilledIn(r recipe.Recipe) (bool, error) {
 }
 
 func LintAbraShVendors(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}
@@ -472,7 +453,7 @@ func LintHasRecipeRepo(recipe recipe.Recipe) (bool, error) {
 }
 
 func LintSecretLengths(recipe recipe.Recipe) (bool, error) {
-	config, err := recipe.GetComposeConfig(nil)
+	config, err := recipe.GetComposeConfig()
 	if err != nil {
 		return false, err
 	}

pkg/recipe/compose.go

@@ -11,10 +11,9 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/upstream/stack"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/distribution/reference"
-	composetypes "github.com/docker/cli/cli/compose/types"
 )
 
 // GetComposeFiles gets the list of compose files for an app (or recipe if you
@@ -61,7 +60,7 @@ func (r Recipe) GetComposeFiles(appEnv map[string]string) ([]string, error) {
 	return composeFiles, nil
 }
 
-func (r Recipe) GetComposeConfig(env map[string]string) (*composetypes.Config, error) {
+func (r Recipe) GetComposeConfig() (*composeGoTypes.Project, error) {
 	pattern := fmt.Sprintf("%s/compose**yml", r.Dir)
 	composeFiles, err := filepath.Glob(pattern)
 	if err != nil {
@@ -72,25 +71,18 @@ func (r Recipe) GetComposeConfig(env map[string]string) (*composetypes.Config, e
 		return nil, errors.New(i18n.G("%s is missing a compose.yml or compose.*.yml file?", r.Name))
 	}
 
-	if env == nil {
-		env, err = r.SampleEnv()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	opts := stack.Deploy{Composefiles: composeFiles}
-	config, err := loader.LoadComposefile(opts, env)
+	config, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles})
 	if err != nil {
 		return nil, err
 	}
+
 	return config, nil
 }
 
 // GetVersionLabelLocal retrieves the version label on the local recipe config
 func (r Recipe) GetVersionLabelLocal() (string, error) {
 	var label string
-	config, err := r.GetComposeConfig(nil)
+	config, err := r.GetComposeConfig()
 	if err != nil {
 		return "", err
 	}
@@ -123,14 +115,7 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 	log.Debug(i18n.G("considering %s config(s) for tag update", strings.Join(composeFiles, ", ")))
 
 	for _, composeFile := range composeFiles {
-		opts := stack.Deploy{Composefiles: []string{composeFile}}
-
-		sampleEnv, err := r.SampleEnv()
-		if err != nil {
-			return false, err
-		}
-
-		compose, err := loader.LoadComposefile(opts, sampleEnv)
+		compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: []string{composeFile}})
 		if err != nil {
 			return false, err
 		}
@@ -168,9 +153,9 @@ func (r Recipe) UpdateTag(image, tag string) (bool, error) {
 				new := fmt.Sprintf("%s:%s", composeImage, tag)
 				replacedBytes := strings.Replace(string(bytes), old, new, -1)
 
-				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Filename))
+				log.Debug(i18n.G("updating %s to %s in %s", old, new, compose.Name))
 
-				if err := os.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+				if err := os.WriteFile(compose.Name, []byte(replacedBytes), 0o764); err != nil {
 					return false, err
 				}
 			}
@@ -191,20 +176,13 @@ func (r Recipe) UpdateLabel(pattern, serviceName, label string) error {
 	log.Debug(i18n.G("considering %s config(s) for label update", strings.Join(composeFiles, ", ")))
 
 	for _, composeFile := range composeFiles {
-		opts := stack.Deploy{Composefiles: []string{composeFile}}
-
-		sampleEnv, err := r.SampleEnv()
-		if err != nil {
-			return err
-		}
-
-		compose, err := loader.LoadComposefile(opts, sampleEnv)
+		compose, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: []string{composeFile}})
 		if err != nil {
 			return err
 		}
 
 		serviceExists := false
-		var service composetypes.ServiceConfig
+		var service composeGoTypes.ServiceConfig
 		for _, s := range compose.Services {
 			if s.Name == serviceName {
 				service = s
@@ -234,9 +212,9 @@ func (r Recipe) UpdateLabel(pattern, serviceName, label string) error {
 					return nil
 				}
 
-				log.Debug(i18n.G("updating %s to %s in %s", old, label, compose.Filename))
+				log.Debug(i18n.G("updating %s to %s in %s", old, label, compose.Name))
 
-				if err := ioutil.WriteFile(compose.Filename, []byte(replacedBytes), 0o764); err != nil {
+				if err := ioutil.WriteFile(compose.Name, []byte(replacedBytes), 0o764); err != nil {
 					return err
 				}
 

pkg/recipe/files.go

@@ -15,7 +15,7 @@ import (
 func (r Recipe) SampleEnv() (map[string]string, error) {
 	sampleEnv, err := envfile.ReadEnv(r.SampleEnvPath)
 	if err != nil {
-		return sampleEnv, errors.New(i18n.G("unable to discover .env.sample for %s", r.Name))
+		return sampleEnv, errors.New(i18n.G(".env.sample for %s couldn't be read: %s", r.Name, err))
 	}
 	return sampleEnv, nil
 }

pkg/recipe/git.go

@@ -32,6 +32,12 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 		return err
 	}
 
+	// NOTE(d1): if we cannot parse the .env.sample then there is a
+	//           fundamental problem which requires solving right now
+	if _, err := r.SampleEnv(); err != nil {
+		return err
+	}
+
 	if ctx.Chaos {
 		return nil
 	}
@@ -403,15 +409,18 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 			Branch: plumbing.ReferenceName(ref.Name()),
 		}
 		if err := worktree.Checkout(checkOutOpts); err != nil {
-			log.Debug(i18n.G("failed to check out %s in %s", tag, r.Dir))
-			return err
+			log.Debug(i18n.G("failed to check out %s in %s: %s", tag, r.Dir, err))
+			warnMsg = append(warnMsg, i18n.G("skipping tag %s: checkout failed: %s", tag, err))
+			return nil
 		}
 
 		log.Debug(i18n.G("git checkout: %s in %s", ref.Name(), r.Dir))
 
-		config, err := r.GetComposeConfig(nil)
+		config, err := r.GetComposeConfig()
 		if err != nil {
-			return err
+			log.Debug(i18n.G("failed to get compose config for %s: %s", tag, err))
+			warnMsg = append(warnMsg, i18n.G("skipping tag %s: invalid compose config: %s", tag, err))
+			return nil
 		}
 
 		versionMeta := make(map[string]ServiceMeta)
@@ -419,7 +428,9 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 
 			img, err := reference.ParseNormalizedNamed(service.Image)
 			if err != nil {
-				return err
+				log.Debug(i18n.G("failed to parse image for %s in %s: %s", service.Name, tag, err))
+				warnMsg = append(warnMsg, i18n.G("skipping tag %s: invalid image reference in service %s: %s", tag, service.Name, err))
+				return nil
 			}
 
 			path := reference.Path(img)
@@ -445,6 +456,7 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 
 		return nil
 	}); err != nil {
+		log.Warn(i18n.G("GetRecipeVersions encountered error for %s: %s (collected %d versions)", r.Name, err, len(versions)))
 		return versions, warnMsg, nil
 	}
 

pkg/recipe/git_test.go

@@ -5,12 +5,15 @@ import (
 	"path/filepath"
 	"testing"
 
+	"coopcloud.tech/abra/pkg/test"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestIsDirty(t *testing.T) {
-	r := Get("abra-test-recipe")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
 
+	r := Get(test.RecipeName)
 	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
@@ -22,10 +25,9 @@ func TestIsDirty(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
 	defer f.Close()
-	defer t.Cleanup(func() {
-		os.Remove(fpath)
-	})
+	t.Cleanup(func() { os.Remove(fpath) })
 
 	dirty, err := r.IsDirty()
 	if err != nil {

pkg/recipe/recipe_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"coopcloud.tech/abra/pkg/config"
+	"coopcloud.tech/abra/pkg/test"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/assert"
@@ -101,24 +102,24 @@ func TestGet(t *testing.T) {
 }
 
 func TestGetVersionLabelLocalDoesNotUseTimeoutLabel(t *testing.T) {
-	r := Get("traefik")
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := Get(test.RecipeName)
 	if err := r.EnsureExists(); err != nil {
 		t.Fatal(err)
 	}
 
-	for i := 1; i < 50; i++ {
+	timeout := "120"
+	if err := test.AddEnv("TIMEOUT", timeout); err != nil {
+		t.Fatal(err)
+	}
+
+	for i := 1; i < 3; i++ {
 		label, err := r.GetVersionLabelLocal()
 		if err != nil {
 			t.Fatal(err)
 		}
-
-		// NOTE(d1): this is potentially quite a brittle unit test as it needs to
-		// hardcode the default timeout label to ensure that the label parser never
-		// returns it. hopefully this won't fail too often! if you're here because
-		// of a failure, just update the `defaultTimeoutLabel` value & permalink
-		// below
-		// https://git.coopcloud.tech/coop-cloud/traefik/src/commit/ac3a47fe8ca3ef92db84f64cfedfbb348000faee/.env.sample#L2
-		defaultTimeoutLabel := "300"
-		assert.NotEqual(t, label, defaultTimeoutLabel)
+		assert.NotEqual(t, label, timeout)
 	}
 }

pkg/secret/secret.go

@@ -5,6 +5,8 @@ package secret
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"slices"
@@ -18,7 +20,6 @@ import (
 	"coopcloud.tech/abra/pkg/envfile"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/upstream/stack"
 	loader "coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/decentral1se/passgen"
 	"github.com/docker/docker/api/types"
@@ -39,6 +40,14 @@ type Secret struct {
 	// variable. For Example:
 	//   SECRET_FOO=v1 # charset=default,special
 	Charset string
+	// Encoding comes from the encoding modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # encoding=base64
+	Encoding string
+	// Prefix comes from the prefix modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # prefix=base64:
+	Prefix string
 	// Whether or not to skip generation of the secret or not
 	// For example: SECRET_FOO=v1 # generate=false
 	SkipGenerate bool
@@ -87,6 +96,17 @@ func GeneratePassphrase() (string, error) {
 	return passphrases[0], nil
 }
 
+// generateRandomBytes generates random bytes as a string
+func generateRandomBytes(length int) (string, error) {
+	randomBytes := make([]byte, length)
+	if _, err := rand.Read(randomBytes); err != nil {
+		return "", errors.New(i18n.G("failed to generate random bytes: %w", err))
+	}
+
+	// Return as string for consistent handling with other secret types
+	return string(randomBytes), nil
+}
+
 // ReadSecretsConfig reads secret names/versions from the recipe config. The
 // function generalises appEnv/composeFiles because some times you have an app
 // and some times you don't (as the caller). We need to be able to handle the
@@ -101,14 +121,13 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	// Set the STACK_NAME to be able to generate the remote name correctly.
 	appEnv["STACK_NAME"] = stackName
 
-	opts := stack.Deploy{Composefiles: composeFiles}
-	composeConfig, err := loader.LoadComposefile(opts, appEnv)
+	composeConfig, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles, AppEnv: appEnv})
 	if err != nil {
 		return nil, err
 	}
 
 	// Read the compose files without injecting environment variables.
-	configWithoutEnv, err := loader.LoadComposefile(opts, map[string]string{}, loader.SkipInterpolation)
+	configWithoutEnv, err := loader.LoadCompose(loader.LoadConf{ComposeFiles: composeFiles})
 	if err != nil {
 		return nil, err
 	}
@@ -177,6 +196,8 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 			}
 
 			value.Charset = resolveCharset(modifierValues["charset"])
+			value.Encoding = resolveEncoding(value.Charset, modifierValues["encoding"], secretId)
+			value.Prefix = modifierValues["prefix"]
 			break
 		}
 		secretValues[secretId] = value
@@ -185,11 +206,45 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	return secretValues, nil
 }
 
+// encodeSecret applies encoding to the generated secret value
+func encodeSecret(value, encoding string) string {
+	switch strings.ToLower(encoding) {
+	case "base64":
+		return base64.StdEncoding.EncodeToString([]byte(value))
+	default:
+		return value // No encoding applied
+	}
+}
+
+// applyPrefix adds a prefix to the secret value
+func applyPrefix(value, prefix string) string {
+	if prefix != "" {
+		return prefix + value
+	}
+	return value
+}
+
+// resolveEncoding validates and resolves the encoding for a given charset and secretId
+func resolveEncoding(charset, encoding, secretId string) string {
+	if charset == "bytes" {
+		if encoding == "" {
+			return "base64"
+		} else if encoding != "base64" {
+			log.Warnf(i18n.G("charset=bytes only supports encoding=base64, got encoding=%s for secret %s, defaulting to base64", encoding, secretId))
+			return "base64"
+		}
+	}
+
+	return encoding
+}
+
 // resolveCharset sets the passgen Alphabet required for a secret
 func resolveCharset(input string) string {
 	switch strings.ToLower(input) {
 	case "hex":
 		return passgen.AlphabetNumericAmbiguous + "abcdef"
+	case "bytes":
+		return "bytes"
 	case "special":
 		return passgen.AlphabetSpecial
 	case "safespecial":
@@ -224,12 +279,23 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 			log.Debug(i18n.G("attempting to generate and store %s on %s", secret.RemoteName, server))
 
 			if secret.Length > 0 {
-				password, err := GeneratePassword(uint(secret.Length), secret.Charset)
+				var password string
+				var err error
+
+				if secret.Charset == "bytes" {
+					password, err = generateRandomBytes(secret.Length)
+				} else {
+					password, err = GeneratePassword(uint(secret.Length), secret.Charset)
+				}
+
 				if err != nil {
 					ch <- err
 					return
 				}
 
+				password = encodeSecret(password, secret.Encoding)
+				password = applyPrefix(password, secret.Prefix)
+
 				if err := client.StoreSecret(cl, secret.RemoteName, password); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf(i18n.G("%s already exists", secret.RemoteName))
@@ -250,6 +316,9 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 					return
 				}
 
+				passphrase = encodeSecret(passphrase, secret.Encoding)
+				passphrase = applyPrefix(passphrase, secret.Prefix)
+
 				if err := client.StoreSecret(cl, secret.RemoteName, passphrase); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf(i18n.G("%s already exists", secret.RemoteName))

pkg/secret/secret_test.go

@@ -18,42 +18,80 @@ func TestReadSecretsConfig(t *testing.T) {
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_one"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_one"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_one"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_one"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_one"].Prefix)
 
 	// Has a length modifier
 	assert.Equal(t, "test_example_com_test_pass_two_v1", secretsFromConfig["test_pass_two"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_two"].Version)
 	assert.Equal(t, 10, secretsFromConfig["test_pass_two"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_two"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_two"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_two"].Prefix)
 
 	// Secret name does not include the secret id
 	assert.Equal(t, "test_example_com_pass_three_v2", secretsFromConfig["test_pass_three"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_three"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_three"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_three"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_three"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_three"].Prefix)
 
 	// Has a length modifier and a charset=default,safespecial modifier
 	assert.Equal(t, "test_example_com_test_pass_four_v1", secretsFromConfig["test_pass_four"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_four"].Version)
 	assert.Equal(t, 12, secretsFromConfig["test_pass_four"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=", secretsFromConfig["test_pass_four"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_four"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_four"].Prefix)
 
 	// Has a length modifier and a charset=default,special modifier
 	assert.Equal(t, "test_example_com_test_pass_five_v1", secretsFromConfig["test_pass_five"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_five"].Version)
 	assert.Equal(t, 12, secretsFromConfig["test_pass_five"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_five"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_five"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_five"].Prefix)
 
 	// Has only a charset=default,special modifier, which gets setted but ignored in the generation
 	assert.Equal(t, "test_example_com_test_pass_six_v1", secretsFromConfig["test_pass_six"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_six"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_six"].Length)
 	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_six"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_six"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_six"].Prefix)
 
 	// Has a length modifier and a charset=hex modifier
 	assert.Equal(t, "test_example_com_test_pass_seven_v1", secretsFromConfig["test_pass_seven"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_seven"].Version)
 	assert.Equal(t, 32, secretsFromConfig["test_pass_seven"].Length)
 	assert.Equal(t, "0123456789abcdef", secretsFromConfig["test_pass_seven"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_seven"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_seven"].Prefix)
+
+	// Has a length modifier and an encoding=base64 modifier
+	assert.Equal(t, "test_example_com_test_pass_eight_v1", secretsFromConfig["test_pass_eight"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_eight"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_eight"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_eight"].Charset)
+	assert.Equal(t, "base64", secretsFromConfig["test_pass_eight"].Encoding)
+	assert.Equal(t, "", secretsFromConfig["test_pass_eight"].Prefix)
+
+	// Has a length modifier and a prefix=base64: modifier
+	assert.Equal(t, "test_example_com_test_pass_nine_v1", secretsFromConfig["test_pass_nine"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_nine"].Version)
+	assert.Equal(t, 16, secretsFromConfig["test_pass_nine"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_nine"].Charset)
+	assert.Equal(t, "", secretsFromConfig["test_pass_nine"].Encoding)
+	assert.Equal(t, "base64:", secretsFromConfig["test_pass_nine"].Prefix)
+
+	// Has all modifiers: length, charset=bytes, and prefix=base64: (Laravel-style)
+	assert.Equal(t, "test_example_com_test_pass_ten_v1", secretsFromConfig["test_pass_ten"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_ten"].Version)
+	assert.Equal(t, 32, secretsFromConfig["test_pass_ten"].Length)
+	assert.Equal(t, "bytes", secretsFromConfig["test_pass_ten"].Charset)
+	assert.Equal(t, "base64", secretsFromConfig["test_pass_ten"].Encoding) // Defaults to base64 for bytes
+	assert.Equal(t, "base64:", secretsFromConfig["test_pass_ten"].Prefix)
 }
 
 func TestReadSecretsConfigWithLongDomain(t *testing.T) {
@@ -64,3 +102,48 @@ func TestReadSecretsConfigWithLongDomain(t *testing.T) {
 	}
 	assert.Contains(t, err.Error(), "is > 64 chars")
 }
+
+func TestEncodeSecret(t *testing.T) {
+	// base64 encoding
+	input := "testpassword123"
+	encoded := encodeSecret(input, "base64")
+	expected := "dGVzdHBhc3N3b3JkMTIz"
+	assert.Equal(t, expected, encoded)
+
+	// no encoding (default)
+	noEncoding := encodeSecret(input, "")
+	assert.Equal(t, input, noEncoding)
+
+	// unknown encoding (should return original)
+	unknownEncoding := encodeSecret(input, "unknown")
+	assert.Equal(t, input, unknownEncoding)
+}
+
+func TestApplyPrefix(t *testing.T) {
+	input := "testvalue"
+
+	// with prefix
+	prefixed := applyPrefix(input, "base64:")
+	assert.Equal(t, "base64:testvalue", prefixed)
+
+	// with empty prefix
+	noPrefixed := applyPrefix(input, "")
+	assert.Equal(t, input, noPrefixed)
+}
+
+func TestGenerateRandomBytes(t *testing.T) {
+	// random bytes generation with 32 bytes
+	key, err := generateRandomBytes(32)
+	assert.NoError(t, err)
+	assert.Equal(t, 32, len([]byte(key))) // Check raw byte length
+
+	// random bytes generation with 16 bytes
+	key16, err := generateRandomBytes(16)
+	assert.NoError(t, err)
+	assert.Equal(t, 16, len([]byte(key16))) // Check raw byte length
+
+	// that keys are different (randomness)
+	key2, err := generateRandomBytes(32)
+	assert.NoError(t, err)
+	assert.NotEqual(t, key, key2)
+}

pkg/secret/testdir/.env.sample

@@ -5,3 +5,6 @@ SECRET_TEST_PASS_FOUR_VERSION=v1 # length=12 charset=default,safespecial
 SECRET_TEST_PASS_FIVE_VERSION=v1 # length=12 charset=default,special
 SECRET_TEST_PASS_SIX_VERSION=v1 # charset=default,special
 SECRET_TEST_PASS_SEVEN_VERSION=v1 # length=32 charset=hex
+SECRET_TEST_PASS_EIGHT_VERSION=v1 # length=12 encoding=base64
+SECRET_TEST_PASS_NINE_VERSION=v1 # length=16 prefix=base64:
+SECRET_TEST_PASS_TEN_VERSION=v1 # length=32 charset=bytes prefix=base64:

pkg/secret/testdir/compose.yaml

@@ -12,6 +12,9 @@ services:
       - test_pass_five
       - test_pass_six
       - test_pass_seven
+      - test_pass_eight
+      - test_pass_nine
+      - test_pass_ten
 
 secrets:
   test_pass_one:
@@ -35,3 +38,12 @@ secrets:
   test_pass_seven:
     external: true
     name: ${STACK_NAME}_test_pass_seven_${SECRET_TEST_PASS_SEVEN_VERSION}
+  test_pass_eight:
+    external: true
+    name: ${STACK_NAME}_test_pass_eight_${SECRET_TEST_PASS_EIGHT_VERSION}
+  test_pass_nine:
+    external: true
+    name: ${STACK_NAME}_test_pass_nine_${SECRET_TEST_PASS_NINE_VERSION}
+  test_pass_ten:
+    external: true
+    name: ${STACK_NAME}_test_pass_ten_${SECRET_TEST_PASS_TEN_VERSION}

pkg/test/test.go

@@ -2,57 +2,53 @@ package test
 
 import (
 	"fmt"
+	"log"
 	"os"
 	"path"
+	"path/filepath"
+	"runtime"
 
-	appPkg "coopcloud.tech/abra/pkg/app"
-	"coopcloud.tech/abra/pkg/envfile"
-	"coopcloud.tech/abra/pkg/log"
-	"coopcloud.tech/abra/pkg/recipe"
+	gitPkg "coopcloud.tech/abra/pkg/git"
+	"git.coopcloud.tech/toolshed/godotenv"
 )
 
 var (
 	AppName    = "test_app.example.com"
+	StackName  = "test_app_example_com"
 	ServerName = "test_server"
-	TFiles     = []string{"bar.env", "foo.env"}
-	TFolders   = []string{"dir1", "dir2"}
-	TestServer = os.ExpandEnv("$PWD/../../tests/resources/test_server")
-	TestDir    = os.ExpandEnv("$PWD/../../tests/resources/test_dir")
+	RecipeName = "test_recipe"
 
-	ExpectedAppEnv = envfile.AppEnv{
-		"DOMAIN": "test_app.example.com",
-		"RECIPE": "test_recipe",
-	}
+	TFiles   = []string{"bar.env", "foo.env"}
+	TFolders = []string{"dir1", "dir2"}
 
-	ExpectedApp = appPkg.App{
-		Name:   AppName,
-		Recipe: recipe.Get(ExpectedAppEnv["RECIPE"]),
-		Domain: ExpectedAppEnv["DOMAIN"],
-		Env:    ExpectedAppEnv,
-		Path:   ExpectedAppFile.Path,
-		Server: ExpectedAppFile.Server,
-	}
+	ServerDir = os.ExpandEnv("$ABRA_DIR/servers/test_server")
+	RecipeDir = os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
+	TestDir   = os.ExpandEnv("$PWD/../../tests/resources/test_dir")
 
-	ExpectedAppFile = appPkg.AppFile{
-		Path:   path.Join(TestServer, fmt.Sprintf("%s.env", AppName)),
-		Server: ServerName,
-	}
+	AppEnvPath = path.Join(ServerDir, fmt.Sprintf("%s.env", AppName))
 
-	ExpectedAppFiles = map[string]appPkg.AppFile{
-		AppName: ExpectedAppFile,
-	}
+	AbraTestRecipe = "abra-test-recipe"
 )
 
-func RmServerAppRecipe() {
-	testAppLink := os.ExpandEnv("$ABRA_DIR/servers/test_server")
-	os.Remove(testAppLink)
+func Teardown() {
+	abraDir := os.ExpandEnv("$ABRA_DIR")
+	if abraDir == fmt.Sprintf("%s/.abra", os.ExpandEnv("$HOME")) {
+		log.Fatal("set $ABRA_DIR before running the test suite")
+	}
 
-	testRecipeLink := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
-	os.Remove(testRecipeLink)
+	if err := os.RemoveAll(abraDir); err != nil {
+		log.Fatal(err)
+	}
 }
 
-func MkServerAppRecipe() {
-	RmServerAppRecipe()
+func Setup() {
+	Teardown()
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
 
 	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/servers"), 0700); err != nil {
 		if !os.IsExist(err) {
@@ -66,15 +62,42 @@ func MkServerAppRecipe() {
 		}
 	}
 
-	testAppDir := os.ExpandEnv("$PWD/../../tests/resources/test_server")
-	testAppLink := os.ExpandEnv("$ABRA_DIR/servers/test_server")
-	if err := os.Symlink(testAppDir, testAppLink); err != nil {
+	_, f, _, ok := runtime.Caller(0)
+	if !ok {
+		log.Fatal("Setup: unable to discover current working directory of file")
+	}
+	pwd := filepath.Dir(f)
+
+	serverSrcDir := filepath.Join(pwd, "/../../tests/resources/test_server")
+	serverDestDir := os.ExpandEnv("$ABRA_DIR/servers/test_server")
+	if err := os.CopyFS(serverDestDir, os.DirFS(serverSrcDir)); err != nil {
 		log.Fatal(err)
 	}
 
-	testRecipeDir := os.ExpandEnv("$PWD/../../tests/resources/test_recipe")
-	testRecipeLink := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
-	if err := os.Symlink(testRecipeDir, testRecipeLink); err != nil {
+	recipeSrcDir := filepath.Join(pwd, "/../../tests/resources/test_recipe")
+	recipeDestDir := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
+	if err := os.CopyFS(recipeDestDir, os.DirFS(recipeSrcDir)); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := gitPkg.Init(recipeDestDir, true, "tester", "helo@coopcloud.tech"); err != nil {
 		log.Fatal(err)
 	}
 }
+
+func AddEnv(envKey, envValue string) error {
+	filePath := os.ExpandEnv(fmt.Sprintf("$ABRA_DIR/servers/%s/%s.env", ServerName, AppName))
+
+	envVars, _, err := godotenv.Read(filePath)
+	if err != nil {
+		return err
+	}
+
+	envVars[envKey] = envValue
+
+	if err := godotenv.Write(envVars, filePath); err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/upstream/convert/compose.go

@@ -4,7 +4,7 @@ import (
 	"io/ioutil"
 	"strings"
 
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
 )
@@ -48,19 +48,17 @@ func AddStackLabel(namespace Namespace, labels map[string]string) map[string]str
 	return labels
 }
 
-type networkMap map[string]composetypes.NetworkConfig
-
 // Networks from the compose-file type to the engine API type
-func Networks(namespace Namespace, networks networkMap, servicesNetworks map[string]struct{}) (map[string]networktypes.CreateOptions, []string) {
+func Networks(namespace Namespace, networks map[string]composeGoTypes.NetworkConfig, servicesNetworks map[string]struct{}) (map[string]networktypes.CreateOptions, []string) {
 	if networks == nil {
-		networks = make(map[string]composetypes.NetworkConfig)
+		networks = make(map[string]composeGoTypes.NetworkConfig)
 	}
 
 	externalNetworks := []string{}
 	result := make(map[string]networktypes.CreateOptions)
 	for internalName := range servicesNetworks {
 		network := networks[internalName]
-		if network.External.External {
+		if network.External {
 			externalNetworks = append(externalNetworks, network.Name)
 			continue
 		}
@@ -98,19 +96,19 @@ func Networks(namespace Namespace, networks networkMap, servicesNetworks map[str
 }
 
 // Secrets converts secrets from the Compose type to the engine API type
-func Secrets(namespace Namespace, secrets map[string]composetypes.SecretConfig) ([]swarm.SecretSpec, error) {
+func Secrets(namespace Namespace, secrets map[string]composeGoTypes.SecretConfig) ([]swarm.SecretSpec, error) {
 	result := []swarm.SecretSpec{}
 	for name, secret := range secrets {
-		if secret.External.External {
+		if secret.External {
 			continue
 		}
 
 		var obj swarmFileObject
 		var err error
 		if secret.Driver != "" {
-			obj = driverObjectConfig(namespace, name, composetypes.FileObjectConfig(secret))
+			obj = driverObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(secret))
 		} else {
-			obj, err = fileObjectConfig(namespace, name, composetypes.FileObjectConfig(secret))
+			obj, err = fileObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(secret))
 		}
 		if err != nil {
 			return nil, err
@@ -133,14 +131,14 @@ func Secrets(namespace Namespace, secrets map[string]composetypes.SecretConfig)
 }
 
 // Configs converts config objects from the Compose type to the engine API type
-func Configs(namespace Namespace, configs map[string]composetypes.ConfigObjConfig) ([]swarm.ConfigSpec, error) {
+func Configs(namespace Namespace, configs map[string]composeGoTypes.ConfigObjConfig) ([]swarm.ConfigSpec, error) {
 	result := []swarm.ConfigSpec{}
 	for name, config := range configs {
-		if config.External.External {
+		if config.External {
 			continue
 		}
 
-		obj, err := fileObjectConfig(namespace, name, composetypes.FileObjectConfig(config))
+		obj, err := fileObjectConfig(namespace, name, composeGoTypes.FileObjectConfig(config))
 		if err != nil {
 			return nil, err
 		}
@@ -160,7 +158,7 @@ type swarmFileObject struct {
 	Data        []byte
 }
 
-func driverObjectConfig(namespace Namespace, name string, obj composetypes.FileObjectConfig) swarmFileObject {
+func driverObjectConfig(namespace Namespace, name string, obj composeGoTypes.FileObjectConfig) swarmFileObject {
 	if obj.Name != "" {
 		name = obj.Name
 	} else {
@@ -176,7 +174,7 @@ func driverObjectConfig(namespace Namespace, name string, obj composetypes.FileO
 	}
 }
 
-func fileObjectConfig(namespace Namespace, name string, obj composetypes.FileObjectConfig) (swarmFileObject, error) {
+func fileObjectConfig(namespace Namespace, name string, obj composeGoTypes.FileObjectConfig) (swarmFileObject, error) {
 	data, err := ioutil.ReadFile(obj.File)
 	if err != nil {
 		return swarmFileObject{}, err

pkg/upstream/convert/compose_test.go

@@ -1,170 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/compose_test.go
-
-import (
-	"testing"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types/network"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-	"gotest.tools/v3/fs"
-)
-
-func TestNamespaceScope(t *testing.T) {
-	scoped := Namespace{name: "foo"}.Scope("bar")
-	assert.Check(t, is.Equal("foo_bar", scoped))
-}
-
-func TestAddStackLabel(t *testing.T) {
-	labels := map[string]string{
-		"something": "labeled",
-	}
-	actual := AddStackLabel(Namespace{name: "foo"}, labels)
-	expected := map[string]string{
-		"something":    "labeled",
-		LabelNamespace: "foo",
-	}
-	assert.Check(t, is.DeepEqual(expected, actual))
-}
-
-func TestNetworks(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	serviceNetworks := map[string]struct{}{
-		"normal":        {},
-		"outside":       {},
-		"default":       {},
-		"attachablenet": {},
-		"named":         {},
-	}
-	source := networkMap{
-		"normal": composetypes.NetworkConfig{
-			Driver: "overlay",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Ipam: composetypes.IPAMConfig{
-				Driver: "driver",
-				Config: []*composetypes.IPAMPool{
-					{
-						Subnet: "10.0.0.0",
-					},
-				},
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-		"outside": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "special",
-		},
-		"attachablenet": composetypes.NetworkConfig{
-			Driver:     "overlay",
-			Attachable: true,
-		},
-		"named": composetypes.NetworkConfig{
-			Name: "othername",
-		},
-	}
-	expected := map[string]network.CreateOptions{
-		"foo_default": {
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-			},
-		},
-		"foo_normal": {
-			Driver: "overlay",
-			IPAM: &network.IPAM{
-				Driver: "driver",
-				Config: []network.IPAMConfig{
-					{
-						Subnet: "10.0.0.0",
-					},
-				},
-			},
-			Options: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-		},
-		"foo_attachablenet": {
-			Driver:     "overlay",
-			Attachable: true,
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-			},
-		},
-		"othername": {
-			Labels: map[string]string{LabelNamespace: "foo"},
-		},
-	}
-
-	networks, externals := Networks(namespace, source, serviceNetworks)
-	assert.DeepEqual(t, expected, networks)
-	assert.DeepEqual(t, []string{"special"}, externals)
-}
-
-func TestSecrets(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-
-	secretText := "this is the first secret"
-	secretFile := fs.NewFile(t, "convert-secrets", fs.WithContent(secretText))
-	defer secretFile.Remove()
-
-	source := map[string]composetypes.SecretConfig{
-		"one": {
-			File:   secretFile.Path(),
-			Labels: map[string]string{"monster": "mash"},
-		},
-		"ext": {
-			External: composetypes.External{
-				External: true,
-			},
-		},
-	}
-
-	specs, err := Secrets(namespace, source)
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(specs, 1))
-	secret := specs[0]
-	assert.Check(t, is.Equal("foo_one", secret.Name))
-	assert.Check(t, is.DeepEqual(map[string]string{
-		"monster":      "mash",
-		LabelNamespace: "foo",
-	}, secret.Labels))
-	assert.Check(t, is.DeepEqual([]byte(secretText), secret.Data))
-}
-
-func TestConfigs(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-
-	configText := "this is the first config"
-	configFile := fs.NewFile(t, "convert-configs", fs.WithContent(configText))
-	defer configFile.Remove()
-
-	source := map[string]composetypes.ConfigObjConfig{
-		"one": {
-			File:   configFile.Path(),
-			Labels: map[string]string{"monster": "mash"},
-		},
-		"ext": {
-			External: composetypes.External{
-				External: true,
-			},
-		},
-	}
-
-	specs, err := Configs(namespace, source)
-	assert.NilError(t, err)
-	assert.Assert(t, is.Len(specs, 1))
-	config := specs[0]
-	assert.Check(t, is.Equal("foo_one", config.Name))
-	assert.Check(t, is.DeepEqual(map[string]string{
-		"monster":      "mash",
-		LabelNamespace: "foo",
-	}, config.Labels))
-	assert.Check(t, is.DeepEqual([]byte(configText), config.Data))
-}

pkg/upstream/convert/service.go

@@ -5,11 +5,13 @@ import (
 	"fmt"
 	"os"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
+	"unsafe"
 
 	"coopcloud.tech/abra/pkg/i18n"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/cli/opts"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
@@ -178,7 +180,7 @@ func ParseConfigs(client client.ConfigAPIClient, requestedConfigs []*swarmtypes.
 // Services from compose-file types to engine API types
 func Services(
 	namespace Namespace,
-	config *composetypes.Config,
+	config *composeGoTypes.Project,
 	client client.CommonAPIClient,
 ) (map[string]swarm.ServiceSpec, error) {
 	result := make(map[string]swarm.ServiceSpec)
@@ -211,14 +213,17 @@ func Services(
 func Service(
 	apiVersion string,
 	namespace Namespace,
-	service composetypes.ServiceConfig,
-	networkConfigs map[string]composetypes.NetworkConfig,
-	volumes map[string]composetypes.VolumeConfig,
+	service composeGoTypes.ServiceConfig,
+	networkConfigs map[string]composeGoTypes.NetworkConfig,
+	volumes map[string]composeGoTypes.VolumeConfig,
 	secrets []*swarm.SecretReference,
 	configs []*swarm.ConfigReference,
 ) (swarm.ServiceSpec, error) {
 	name := namespace.Scope(service.Name)
-	endpoint := convertEndpointSpec(service.Deploy.EndpointMode, service.Ports)
+	endpoint, err := convertEndpointSpec(service.Deploy.EndpointMode, service.Ports)
+	if err != nil {
+		return swarm.ServiceSpec{}, err
+	}
 
 	mode, err := convertDeployMode(service.Deploy.Mode, service.Deploy.Replicas)
 	if err != nil {
@@ -254,9 +259,16 @@ func Service(
 	dnsConfig := convertDNSConfig(service.DNS, service.DNSSearch)
 
 	var privileges swarm.Privileges
+
+	credSpec := service.CredentialSpec
+	if credSpec == nil {
+		credSpec = &composeGoTypes.CredentialSpecConfig{}
+	}
+
 	privileges.CredentialSpec, err = convertCredentialSpec(
-		namespace, service.CredentialSpec, configs,
+		namespace, *credSpec, configs,
 	)
+
 	if err != nil {
 		return swarm.ServiceSpec{}, err
 	}
@@ -271,6 +283,11 @@ func Service(
 
 	capAdd, capDrop := opts.EffectiveCapAddCapDrop(service.CapAdd, service.CapDrop)
 
+	var stopGracePtr time.Duration
+	if service.StopGracePeriod != nil {
+		stopGracePtr = time.Duration(*service.StopGracePeriod)
+	}
+
 	serviceSpec := swarm.ServiceSpec{
 		Annotations: swarm.Annotations{
 			Name:   name,
@@ -290,7 +307,7 @@ func Service(
 				Dir:             service.WorkingDir,
 				User:            service.User,
 				Mounts:          mounts,
-				StopGracePeriod: composetypes.ConvertDurationPtr(service.StopGracePeriod),
+				StopGracePeriod: &stopGracePtr,
 				StopSignal:      service.StopSignal,
 				TTY:             service.Tty,
 				OpenStdin:       service.StdinOpen,
@@ -338,7 +355,7 @@ func Service(
 	return serviceSpec, nil
 }
 
-func getPlacementPreference(preferences []composetypes.PlacementPreferences) []swarm.PlacementPreference {
+func getPlacementPreference(preferences []composeGoTypes.PlacementPreferences) []swarm.PlacementPreference {
 	result := []swarm.PlacementPreference{}
 	for _, preference := range preferences {
 		spreadDescriptor := preference.Spread
@@ -357,13 +374,13 @@ func sortStrings(strs []string) []string {
 }
 
 func convertServiceNetworks(
-	networks map[string]*composetypes.ServiceNetworkConfig,
-	networkConfigs networkMap,
+	networks map[string]*composeGoTypes.ServiceNetworkConfig,
+	networkConfigs map[string]composeGoTypes.NetworkConfig,
 	namespace Namespace,
 	name string,
 ) ([]swarm.NetworkAttachmentConfig, error) {
 	if len(networks) == 0 {
-		networks = map[string]*composetypes.ServiceNetworkConfig{
+		networks = map[string]*composeGoTypes.ServiceNetworkConfig{
 			defaultNetwork: {},
 		}
 	}
@@ -403,20 +420,20 @@ func convertServiceNetworks(
 func convertServiceSecrets(
 	client client.SecretAPIClient,
 	namespace Namespace,
-	secrets []composetypes.ServiceSecretConfig,
-	secretSpecs map[string]composetypes.SecretConfig,
+	secrets []composeGoTypes.ServiceSecretConfig,
+	secretSpecs map[string]composeGoTypes.SecretConfig,
 ) ([]*swarm.SecretReference, error) {
 	refs := []*swarm.SecretReference{}
 
-	lookup := func(key string) (composetypes.FileObjectConfig, error) {
+	lookup := func(key string) (composeGoTypes.FileObjectConfig, error) {
 		secretSpec, exists := secretSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.New(i18n.G("undefined secret %q", key))
+			return composeGoTypes.FileObjectConfig{}, errors.New(i18n.G("undefined secret %q", key))
 		}
-		return composetypes.FileObjectConfig(secretSpec), nil
+		return composeGoTypes.FileObjectConfig(secretSpec), nil
 	}
 	for _, secret := range secrets {
-		obj, err := convertFileObject(namespace, composetypes.FileReferenceConfig(secret), lookup)
+		obj, err := convertFileObject(namespace, composeGoTypes.FileReferenceConfig(secret), lookup)
 		if err != nil {
 			return nil, err
 		}
@@ -451,20 +468,20 @@ func convertServiceSecrets(
 func convertServiceConfigObjs(
 	client client.ConfigAPIClient,
 	namespace Namespace,
-	service composetypes.ServiceConfig,
-	configSpecs map[string]composetypes.ConfigObjConfig,
+	service composeGoTypes.ServiceConfig,
+	configSpecs map[string]composeGoTypes.ConfigObjConfig,
 ) ([]*swarm.ConfigReference, error) {
 	refs := []*swarm.ConfigReference{}
 
-	lookup := func(key string) (composetypes.FileObjectConfig, error) {
+	lookup := func(key string) (composeGoTypes.FileObjectConfig, error) {
 		configSpec, exists := configSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.New(i18n.G("undefined config %q", key))
+			return composeGoTypes.FileObjectConfig{}, errors.New(i18n.G("undefined config %q", key))
 		}
-		return composetypes.FileObjectConfig(configSpec), nil
+		return composeGoTypes.FileObjectConfig(configSpec), nil
 	}
 	for _, config := range service.Configs {
-		obj, err := convertFileObject(namespace, composetypes.FileReferenceConfig(config), lookup)
+		obj, err := convertFileObject(namespace, composeGoTypes.FileReferenceConfig(config), lookup)
 		if err != nil {
 			return nil, err
 		}
@@ -487,7 +504,7 @@ func convertServiceConfigObjs(
 	// if the credSpec uses a config, then we should grab the config name, and
 	// create a config reference for it. A File or Registry-type CredentialSpec
 	// does not need this operation.
-	if credSpec.Config != "" {
+	if credSpec != nil && credSpec.Config != "" {
 		// look up the config in the configSpecs.
 		obj, err := lookup(credSpec.Config)
 		if err != nil {
@@ -532,8 +549,8 @@ type swarmReferenceObject struct {
 
 func convertFileObject(
 	namespace Namespace,
-	config composetypes.FileReferenceConfig,
-	lookup func(key string) (composetypes.FileObjectConfig, error),
+	config composeGoTypes.FileReferenceConfig,
+	lookup func(key string) (composeGoTypes.FileObjectConfig, error),
 ) (swarmReferenceObject, error) {
 	obj, err := lookup(config.Source)
 	if err != nil {
@@ -558,40 +575,37 @@ func convertFileObject(
 	if gid == "" {
 		gid = "0"
 	}
-	mode := config.Mode
-	if mode == nil {
-		mode = uint32Ptr(0444)
-	}
 
-	return swarmReferenceObject{
+	ref := swarmReferenceObject{
 		File: swarmReferenceTarget{
 			Name: target,
 			UID:  uid,
 			GID:  gid,
-			Mode: os.FileMode(*mode),
 		},
 		Name: source,
-	}, nil
-}
+	}
 
-func uint32Ptr(value uint32) *uint32 {
-	return &value
+	if config.Mode == nil {
+		defaultMode := 0444
+		ref.File.Mode = os.FileMode(defaultMode)
+	} else {
+		ref.File.Mode = os.FileMode(*config.Mode)
+	}
+
+	return ref, nil
 }
 
 // convertExtraHosts converts <host>:<ip> mappings to SwarmKit notation:
 // "IP-address hostname(s)". The original order of mappings is preserved.
-func convertExtraHosts(extraHosts composetypes.HostsList) []string {
+func convertExtraHosts(extraHosts composeGoTypes.HostsList) []string {
 	hosts := []string{}
-	for _, hostIP := range extraHosts {
-		if v := strings.SplitN(hostIP, ":", 2); len(v) == 2 {
-			// Convert to SwarmKit notation: IP-address hostname(s)
-			hosts = append(hosts, fmt.Sprintf("%s %s", v[1], v[0]))
-		}
+	for hostName, hostIP := range extraHosts {
+		hosts = append(hosts, fmt.Sprintf("%s %s", hostIP, hostName))
 	}
 	return hosts
 }
 
-func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container.HealthConfig, error) {
+func convertHealthcheck(healthcheck *composeGoTypes.HealthCheckConfig) (*container.HealthConfig, error) {
 	if healthcheck == nil {
 		return nil, nil
 	}
@@ -629,7 +643,7 @@ func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container
 	}, nil
 }
 
-func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (*swarm.RestartPolicy, error) {
+func convertRestartPolicy(restart string, source *composeGoTypes.RestartPolicy) (*swarm.RestartPolicy, error) {
 	if source == nil {
 		policy, err := opts.ParseRestartPolicy(restart)
 		if err != nil {
@@ -653,15 +667,25 @@ func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (*
 		}
 	}
 
+	var windowPtr time.Duration
+	if source.Window != nil {
+		windowPtr = time.Duration(*source.Window)
+	}
+
+	var delayPtr time.Duration
+	if source.Delay != nil {
+		delayPtr = time.Duration(*source.Delay)
+	}
+
 	return &swarm.RestartPolicy{
 		Condition:   swarm.RestartPolicyCondition(source.Condition),
-		Delay:       composetypes.ConvertDurationPtr(source.Delay),
+		Delay:       &delayPtr,
 		MaxAttempts: source.MaxAttempts,
-		Window:      composetypes.ConvertDurationPtr(source.Window),
+		Window:      &windowPtr,
 	}, nil
 }
 
-func convertUpdateConfig(source *composetypes.UpdateConfig) *swarm.UpdateConfig {
+func convertUpdateConfig(source *composeGoTypes.UpdateConfig) *swarm.UpdateConfig {
 	if source == nil {
 		return nil
 	}
@@ -679,13 +703,13 @@ func convertUpdateConfig(source *composetypes.UpdateConfig) *swarm.UpdateConfig
 	}
 }
 
-func convertResources(source composetypes.Resources) (*swarm.ResourceRequirements, error) {
+func convertResources(source composeGoTypes.Resources) (*swarm.ResourceRequirements, error) {
 	resources := &swarm.ResourceRequirements{}
 	var err error
 	if source.Limits != nil {
 		var cpus int64
-		if source.Limits.NanoCPUs != "" {
-			cpus, err = opts.ParseCPUs(source.Limits.NanoCPUs)
+		if source.Limits.NanoCPUs > 0 {
+			cpus, err = opts.ParseCPUs(fmt.Sprintf("%f", source.Limits.NanoCPUs))
 			if err != nil {
 				return nil, err
 			}
@@ -698,8 +722,8 @@ func convertResources(source composetypes.Resources) (*swarm.ResourceRequirement
 	}
 	if source.Reservations != nil {
 		var cpus int64
-		if source.Reservations.NanoCPUs != "" {
-			cpus, err = opts.ParseCPUs(source.Reservations.NanoCPUs)
+		if source.Reservations.NanoCPUs > 0 {
+			cpus, err = opts.ParseCPUs(fmt.Sprintf("%f", source.Reservations.NanoCPUs))
 			if err != nil {
 				return nil, err
 			}
@@ -728,13 +752,29 @@ func convertResources(source composetypes.Resources) (*swarm.ResourceRequirement
 	return resources, nil
 }
 
-func convertEndpointSpec(endpointMode string, source []composetypes.ServicePortConfig) *swarm.EndpointSpec {
+func str2uint32(s string) (uint32, error) {
+	var u32 uint32
+
+	u64, err := strconv.ParseUint(s, 10, 32)
+	if err != nil {
+		return u32, err
+	}
+
+	return uint32(u64), nil
+}
+
+func convertEndpointSpec(endpointMode string, source []composeGoTypes.ServicePortConfig) (*swarm.EndpointSpec, error) {
 	portConfigs := []swarm.PortConfig{}
 	for _, port := range source {
+		published, err := str2uint32(port.Published)
+		if err != nil {
+			return &swarm.EndpointSpec{}, err
+		}
+
 		portConfig := swarm.PortConfig{
 			Protocol:      swarm.PortConfigProtocol(port.Protocol),
 			TargetPort:    port.Target,
-			PublishedPort: port.Published,
+			PublishedPort: published,
 			PublishMode:   swarm.PortConfigPublishMode(port.Mode),
 		}
 		portConfigs = append(portConfigs, portConfig)
@@ -747,7 +787,7 @@ func convertEndpointSpec(endpointMode string, source []composetypes.ServicePortC
 	return &swarm.EndpointSpec{
 		Mode:  swarm.ResolutionMode(strings.ToLower(endpointMode)),
 		Ports: portConfigs,
-	}
+	}, nil
 }
 
 func convertEnvironment(source map[string]*string) []string {
@@ -765,7 +805,7 @@ func convertEnvironment(source map[string]*string) []string {
 	return output
 }
 
-func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error) {
+func convertDeployMode(mode string, replicas *int) (swarm.ServiceMode, error) {
 	serviceMode := swarm.ServiceMode{}
 
 	switch mode {
@@ -775,7 +815,8 @@ func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error)
 		}
 		serviceMode.Global = &swarm.GlobalService{}
 	case "replicated", "":
-		serviceMode.Replicated = &swarm.ReplicatedService{Replicas: replicas}
+		convReplicas := (*uint64)(unsafe.Pointer(replicas))
+		serviceMode.Replicated = &swarm.ReplicatedService{Replicas: convReplicas}
 	default:
 		return serviceMode, errors.New(i18n.G("unknown mode: %s", mode))
 	}
@@ -792,7 +833,7 @@ func convertDNSConfig(DNS []string, DNSSearch []string) *swarm.DNSConfig {
 	return nil
 }
 
-func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpecConfig, refs []*swarm.ConfigReference) (*swarm.CredentialSpec, error) {
+func convertCredentialSpec(namespace Namespace, spec composeGoTypes.CredentialSpecConfig, refs []*swarm.ConfigReference) (*swarm.CredentialSpec, error) {
 	var o []string
 
 	// Config was added in API v1.40
@@ -814,7 +855,13 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	case l > 2:
 		return nil, errors.New(i18n.G("invalid credential spec: cannot specify both %s, and %s", strings.Join(o[:l-1], ", "), o[l-1]))
 	}
-	swarmCredSpec := swarm.CredentialSpec(spec)
+
+	swarmCredSpec := swarm.CredentialSpec{
+		Config:   spec.Config,
+		File:     spec.File,
+		Registry: spec.Registry,
+	}
+
 	// if we're using a swarm Config for the credential spec, over-write it
 	// here with the config ID
 	if swarmCredSpec.Config != "" {
@@ -836,7 +883,7 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	return &swarmCredSpec, nil
 }
 
-func convertUlimits(origUlimits map[string]*composetypes.UlimitsConfig) []*units.Ulimit {
+func convertUlimits(origUlimits map[string]*composeGoTypes.UlimitsConfig) []*units.Ulimit {
 	newUlimits := make(map[string]*units.Ulimit)
 	for name, u := range origUlimits {
 		if u.Single != 0 {

pkg/upstream/convert/service_test.go

@@ -1,678 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/service_test.go
-
-import (
-	"context"
-	"os"
-	"sort"
-	"strings"
-	"testing"
-	"time"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/swarm"
-	"github.com/docker/docker/client"
-	"github.com/pkg/errors"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-)
-
-func TestConvertRestartPolicyFromNone(t *testing.T) {
-	policy, err := convertRestartPolicy("no", nil)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual((*swarm.RestartPolicy)(nil), policy))
-}
-
-func TestConvertRestartPolicyFromUnknown(t *testing.T) {
-	_, err := convertRestartPolicy("unknown", nil)
-	assert.Error(t, err, "unknown restart policy: unknown")
-}
-
-func TestConvertRestartPolicyFromAlways(t *testing.T) {
-	policy, err := convertRestartPolicy("always", nil)
-	expected := &swarm.RestartPolicy{
-		Condition: swarm.RestartPolicyConditionAny,
-	}
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, policy))
-}
-
-func TestConvertRestartPolicyFromFailure(t *testing.T) {
-	policy, err := convertRestartPolicy("on-failure:4", nil)
-	attempts := uint64(4)
-	expected := &swarm.RestartPolicy{
-		Condition:   swarm.RestartPolicyConditionOnFailure,
-		MaxAttempts: &attempts,
-	}
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, policy))
-}
-
-func strPtr(val string) *string {
-	return &val
-}
-
-func TestConvertEnvironment(t *testing.T) {
-	source := map[string]*string{
-		"foo": strPtr("bar"),
-		"key": strPtr("value"),
-	}
-	env := convertEnvironment(source)
-	sort.Strings(env)
-	assert.Check(t, is.DeepEqual([]string{"foo=bar", "key=value"}, env))
-}
-
-func TestConvertExtraHosts(t *testing.T) {
-	source := composetypes.HostsList{
-		"zulu:127.0.0.2",
-		"alpha:127.0.0.1",
-		"zulu:ff02::1",
-	}
-	assert.Check(t, is.DeepEqual([]string{"127.0.0.2 zulu", "127.0.0.1 alpha", "ff02::1 zulu"}, convertExtraHosts(source)))
-}
-
-func TestConvertResourcesFull(t *testing.T) {
-	source := composetypes.Resources{
-		Limits: &composetypes.ResourceLimit{
-			NanoCPUs:    "0.003",
-			MemoryBytes: composetypes.UnitBytes(300000000),
-		},
-		Reservations: &composetypes.Resource{
-			NanoCPUs:    "0.002",
-			MemoryBytes: composetypes.UnitBytes(200000000),
-		},
-	}
-	resources, err := convertResources(source)
-	assert.NilError(t, err)
-
-	expected := &swarm.ResourceRequirements{
-		Limits: &swarm.Limit{
-			NanoCPUs:    3000000,
-			MemoryBytes: 300000000,
-		},
-		Reservations: &swarm.Resources{
-			NanoCPUs:    2000000,
-			MemoryBytes: 200000000,
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, resources))
-}
-
-func TestConvertResourcesOnlyMemory(t *testing.T) {
-	source := composetypes.Resources{
-		Limits: &composetypes.ResourceLimit{
-			MemoryBytes: composetypes.UnitBytes(300000000),
-		},
-		Reservations: &composetypes.Resource{
-			MemoryBytes: composetypes.UnitBytes(200000000),
-		},
-	}
-	resources, err := convertResources(source)
-	assert.NilError(t, err)
-
-	expected := &swarm.ResourceRequirements{
-		Limits: &swarm.Limit{
-			MemoryBytes: 300000000,
-		},
-		Reservations: &swarm.Resources{
-			MemoryBytes: 200000000,
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, resources))
-}
-
-func TestConvertHealthcheck(t *testing.T) {
-	retries := uint64(10)
-	timeout := composetypes.Duration(30 * time.Second)
-	interval := composetypes.Duration(2 * time.Millisecond)
-	source := &composetypes.HealthCheckConfig{
-		Test:     []string{"EXEC", "touch", "/foo"},
-		Timeout:  &timeout,
-		Interval: &interval,
-		Retries:  &retries,
-	}
-	expected := &container.HealthConfig{
-		Test:     source.Test,
-		Timeout:  time.Duration(timeout),
-		Interval: time.Duration(interval),
-		Retries:  10,
-	}
-
-	healthcheck, err := convertHealthcheck(source)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, healthcheck))
-}
-
-func TestConvertHealthcheckDisable(t *testing.T) {
-	source := &composetypes.HealthCheckConfig{Disable: true}
-	expected := &container.HealthConfig{
-		Test: []string{"NONE"},
-	}
-
-	healthcheck, err := convertHealthcheck(source)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, healthcheck))
-}
-
-func TestConvertHealthcheckDisableWithTest(t *testing.T) {
-	source := &composetypes.HealthCheckConfig{
-		Disable: true,
-		Test:    []string{"EXEC", "touch"},
-	}
-	_, err := convertHealthcheck(source)
-	assert.Error(t, err, "test and disable can't be set at the same time")
-}
-
-func TestConvertEndpointSpec(t *testing.T) {
-	source := []composetypes.ServicePortConfig{
-		{
-			Protocol:  "udp",
-			Target:    53,
-			Published: 1053,
-			Mode:      "host",
-		},
-		{
-			Target:    8080,
-			Published: 80,
-		},
-	}
-	endpoint := convertEndpointSpec("vip", source)
-
-	expected := swarm.EndpointSpec{
-		Mode: swarm.ResolutionMode(strings.ToLower("vip")),
-		Ports: []swarm.PortConfig{
-			{
-				TargetPort:    8080,
-				PublishedPort: 80,
-			},
-			{
-				Protocol:      "udp",
-				TargetPort:    53,
-				PublishedPort: 1053,
-				PublishMode:   "host",
-			},
-		},
-	}
-
-	assert.Check(t, is.DeepEqual(expected, *endpoint))
-}
-
-func TestConvertServiceNetworksOnlyDefault(t *testing.T) {
-	networkConfigs := networkMap{}
-
-	configs, err := convertServiceNetworks(
-		nil, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "foo_default",
-			Aliases: []string{"service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertServiceNetworks(t *testing.T) {
-	networkConfigs := networkMap{
-		"front": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "fronttier",
-		},
-		"back": composetypes.NetworkConfig{},
-	}
-	networks := map[string]*composetypes.ServiceNetworkConfig{
-		"front": {
-			Aliases: []string{"something"},
-		},
-		"back": {
-			Aliases: []string{"other"},
-		},
-	}
-
-	configs, err := convertServiceNetworks(
-		networks, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "foo_back",
-			Aliases: []string{"other", "service"},
-		},
-		{
-			Target:  "fronttier",
-			Aliases: []string{"something", "service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertServiceNetworksCustomDefault(t *testing.T) {
-	networkConfigs := networkMap{
-		"default": composetypes.NetworkConfig{
-			External: composetypes.External{External: true},
-			Name:     "custom",
-		},
-	}
-	networks := map[string]*composetypes.ServiceNetworkConfig{}
-
-	configs, err := convertServiceNetworks(
-		networks, networkConfigs, NewNamespace("foo"), "service")
-
-	expected := []swarm.NetworkAttachmentConfig{
-		{
-			Target:  "custom",
-			Aliases: []string{"service"},
-		},
-	}
-
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, configs))
-}
-
-func TestConvertDNSConfigEmpty(t *testing.T) {
-	dnsConfig := convertDNSConfig(nil, nil)
-	assert.Check(t, is.DeepEqual((*swarm.DNSConfig)(nil), dnsConfig))
-}
-
-var (
-	nameservers = []string{"8.8.8.8", "9.9.9.9"}
-	search      = []string{"dc1.example.com", "dc2.example.com"}
-)
-
-func TestConvertDNSConfigAll(t *testing.T) {
-	dnsConfig := convertDNSConfig(nameservers, search)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nameservers,
-		Search:      search,
-	}, dnsConfig))
-}
-
-func TestConvertDNSConfigNameservers(t *testing.T) {
-	dnsConfig := convertDNSConfig(nameservers, nil)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nameservers,
-		Search:      nil,
-	}, dnsConfig))
-}
-
-func TestConvertDNSConfigSearch(t *testing.T) {
-	dnsConfig := convertDNSConfig(nil, search)
-	assert.Check(t, is.DeepEqual(&swarm.DNSConfig{
-		Nameservers: nil,
-		Search:      search,
-	}, dnsConfig))
-}
-
-func TestConvertCredentialSpec(t *testing.T) {
-	tests := []struct {
-		name        string
-		in          composetypes.CredentialSpecConfig
-		out         *swarm.CredentialSpec
-		configs     []*swarm.ConfigReference
-		expectedErr string
-	}{
-		{
-			name: "empty",
-		},
-		{
-			name:        "config-and-file",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", File: "somefile.json"},
-			expectedErr: `invalid credential spec: cannot specify both "Config" and "File"`,
-		},
-		{
-			name:        "config-and-registry",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "Config" and "Registry"`,
-		},
-		{
-			name:        "file-and-registry",
-			in:          composetypes.CredentialSpecConfig{File: "somefile.json", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "File" and "Registry"`,
-		},
-		{
-			name:        "config-and-file-and-registry",
-			in:          composetypes.CredentialSpecConfig{Config: "0bt9dmxjvjiqermk6xrop3ekq", File: "somefile.json", Registry: "testing"},
-			expectedErr: `invalid credential spec: cannot specify both "Config", "File", and "Registry"`,
-		},
-		{
-			name:        "missing-config-reference",
-			in:          composetypes.CredentialSpecConfig{Config: "missing"},
-			expectedErr: "invalid credential spec: spec specifies config missing, but no such config can be found",
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "someName",
-					ConfigID:   "missing",
-				},
-			},
-		},
-		{
-			name: "namespaced-config",
-			in:   composetypes.CredentialSpecConfig{Config: "name"},
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "namespaced-config_name",
-					ConfigID:   "someID",
-				},
-			},
-			out: &swarm.CredentialSpec{Config: "someID"},
-		},
-		{
-			name: "config",
-			in:   composetypes.CredentialSpecConfig{Config: "someName"},
-			configs: []*swarm.ConfigReference{
-				{
-					ConfigName: "someOtherName",
-					ConfigID:   "someOtherID",
-				}, {
-					ConfigName: "someName",
-					ConfigID:   "someID",
-				},
-			},
-			out: &swarm.CredentialSpec{Config: "someID"},
-		},
-		{
-			name: "file",
-			in:   composetypes.CredentialSpecConfig{File: "somefile.json"},
-			out:  &swarm.CredentialSpec{File: "somefile.json"},
-		},
-		{
-			name: "registry",
-			in:   composetypes.CredentialSpecConfig{Registry: "testing"},
-			out:  &swarm.CredentialSpec{Registry: "testing"},
-		},
-	}
-
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			namespace := NewNamespace(tc.name)
-			swarmSpec, err := convertCredentialSpec(namespace, tc.in, tc.configs)
-
-			if tc.expectedErr != "" {
-				assert.Error(t, err, tc.expectedErr)
-			} else {
-				assert.NilError(t, err)
-			}
-			assert.DeepEqual(t, swarmSpec, tc.out)
-		})
-	}
-}
-
-func TestConvertUpdateConfigOrder(t *testing.T) {
-	// test default behavior
-	updateConfig := convertUpdateConfig(&composetypes.UpdateConfig{})
-	assert.Check(t, is.Equal("", updateConfig.Order))
-
-	// test start-first
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Order: "start-first",
-	})
-	assert.Check(t, is.Equal(updateConfig.Order, "start-first"))
-
-	// test stop-first
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Order: "stop-first",
-	})
-	assert.Check(t, is.Equal(updateConfig.Order, "stop-first"))
-}
-
-func TestConvertFileObject(t *testing.T) {
-	namespace := NewNamespace("testing")
-	config := composetypes.FileReferenceConfig{
-		Source: "source",
-		Target: "target",
-		UID:    "user",
-		GID:    "group",
-		Mode:   uint32Ptr(0644),
-	}
-	swarmRef, err := convertFileObject(namespace, config, lookupConfig)
-	assert.NilError(t, err)
-
-	expected := swarmReferenceObject{
-		Name: "testing_source",
-		File: swarmReferenceTarget{
-			Name: config.Target,
-			UID:  config.UID,
-			GID:  config.GID,
-			Mode: os.FileMode(0644),
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, swarmRef))
-}
-
-func lookupConfig(key string) (composetypes.FileObjectConfig, error) {
-	if key != "source" {
-		return composetypes.FileObjectConfig{}, errors.New("bad key")
-	}
-	return composetypes.FileObjectConfig{}, nil
-}
-
-func TestConvertFileObjectDefaults(t *testing.T) {
-	namespace := NewNamespace("testing")
-	config := composetypes.FileReferenceConfig{Source: "source"}
-	swarmRef, err := convertFileObject(namespace, config, lookupConfig)
-	assert.NilError(t, err)
-
-	expected := swarmReferenceObject{
-		Name: "testing_source",
-		File: swarmReferenceTarget{
-			Name: config.Source,
-			UID:  "0",
-			GID:  "0",
-			Mode: os.FileMode(0444),
-		},
-	}
-	assert.Check(t, is.DeepEqual(expected, swarmRef))
-}
-
-func TestServiceConvertsIsolation(t *testing.T) {
-	src := composetypes.ServiceConfig{
-		Isolation: "hyperv",
-	}
-	result, err := Service("1.35", Namespace{name: "foo"}, src, nil, nil, nil, nil)
-	assert.NilError(t, err)
-	assert.Check(t, is.Equal(container.IsolationHyperV, result.TaskTemplate.ContainerSpec.Isolation))
-}
-
-func TestConvertServiceSecrets(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	secrets := []composetypes.ServiceSecretConfig{
-		{Source: "foo_secret"},
-		{Source: "bar_secret"},
-	}
-	secretSpecs := map[string]composetypes.SecretConfig{
-		"foo_secret": {
-			Name: "foo_secret",
-		},
-		"bar_secret": {
-			Name: "bar_secret",
-		},
-	}
-	client := &fakeClient{
-		secretListFunc: func(opts types.SecretListOptions) ([]swarm.Secret, error) {
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "foo_secret"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "bar_secret"))
-			return []swarm.Secret{
-				{Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "foo_secret"}}},
-				{Spec: swarm.SecretSpec{Annotations: swarm.Annotations{Name: "bar_secret"}}},
-			}, nil
-		},
-	}
-	refs, err := convertServiceSecrets(client, namespace, secrets, secretSpecs)
-	assert.NilError(t, err)
-	expected := []*swarm.SecretReference{
-		{
-			SecretName: "bar_secret",
-			File: &swarm.SecretReferenceFileTarget{
-				Name: "bar_secret",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-		{
-			SecretName: "foo_secret",
-			File: &swarm.SecretReferenceFileTarget{
-				Name: "foo_secret",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-	}
-	assert.DeepEqual(t, expected, refs)
-}
-
-func TestConvertServiceConfigs(t *testing.T) {
-	namespace := Namespace{name: "foo"}
-	service := composetypes.ServiceConfig{
-		Configs: []composetypes.ServiceConfigObjConfig{
-			{Source: "foo_config"},
-			{Source: "bar_config"},
-		},
-		CredentialSpec: composetypes.CredentialSpecConfig{
-			Config: "baz_config",
-		},
-	}
-	configSpecs := map[string]composetypes.ConfigObjConfig{
-		"foo_config": {
-			Name: "foo_config",
-		},
-		"bar_config": {
-			Name: "bar_config",
-		},
-		"baz_config": {
-			Name: "baz_config",
-		},
-	}
-	client := &fakeClient{
-		configListFunc: func(opts types.ConfigListOptions) ([]swarm.Config, error) {
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "foo_config"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "bar_config"))
-			assert.Check(t, is.Contains(opts.Filters.Get("name"), "baz_config"))
-			return []swarm.Config{
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "foo_config"}}},
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "bar_config"}}},
-				{Spec: swarm.ConfigSpec{Annotations: swarm.Annotations{Name: "baz_config"}}},
-			}, nil
-		},
-	}
-	refs, err := convertServiceConfigObjs(client, namespace, service, configSpecs)
-	assert.NilError(t, err)
-	expected := []*swarm.ConfigReference{
-		{
-			ConfigName: "bar_config",
-			File: &swarm.ConfigReferenceFileTarget{
-				Name: "bar_config",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-		{
-			ConfigName: "baz_config",
-			Runtime:    &swarm.ConfigReferenceRuntimeTarget{},
-		},
-		{
-			ConfigName: "foo_config",
-			File: &swarm.ConfigReferenceFileTarget{
-				Name: "foo_config",
-				UID:  "0",
-				GID:  "0",
-				Mode: 0444,
-			},
-		},
-	}
-	assert.DeepEqual(t, expected, refs)
-}
-
-type fakeClient struct {
-	client.Client
-	secretListFunc func(types.SecretListOptions) ([]swarm.Secret, error)
-	configListFunc func(types.ConfigListOptions) ([]swarm.Config, error)
-}
-
-func (c *fakeClient) SecretList(ctx context.Context, options types.SecretListOptions) ([]swarm.Secret, error) {
-	if c.secretListFunc != nil {
-		return c.secretListFunc(options)
-	}
-	return []swarm.Secret{}, nil
-}
-
-func (c *fakeClient) ConfigList(ctx context.Context, options types.ConfigListOptions) ([]swarm.Config, error) {
-	if c.configListFunc != nil {
-		return c.configListFunc(options)
-	}
-	return []swarm.Config{}, nil
-}
-
-func TestConvertUpdateConfigParallelism(t *testing.T) {
-	parallel := uint64(4)
-
-	// test default behavior
-	updateConfig := convertUpdateConfig(&composetypes.UpdateConfig{})
-	assert.Check(t, is.Equal(uint64(1), updateConfig.Parallelism))
-
-	// Non default value
-	updateConfig = convertUpdateConfig(&composetypes.UpdateConfig{
-		Parallelism: &parallel,
-	})
-	assert.Check(t, is.Equal(parallel, updateConfig.Parallelism))
-}
-
-func TestConvertServiceCapAddAndCapDrop(t *testing.T) {
-	tests := []struct {
-		title   string
-		in, out composetypes.ServiceConfig
-	}{
-		{
-			title: "default behavior",
-		},
-		{
-			title: "some values",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"SYS_NICE", "CAP_NET_ADMIN"},
-				CapDrop: []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"CAP_NET_ADMIN", "CAP_SYS_NICE"},
-				CapDrop: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID"},
-			},
-		},
-		{
-			title: "adding ALL capabilities",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"ALL", "CAP_NET_ADMIN"},
-				CapDrop: []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"ALL"},
-				CapDrop: []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID", "CAP_NET_ADMIN"},
-			},
-		},
-		{
-			title: "dropping ALL capabilities",
-			in: composetypes.ServiceConfig{
-				CapAdd:  []string{"CHOWN", "CAP_NET_ADMIN", "DAC_OVERRIDE", "CAP_FSETID", "CAP_FOWNER"},
-				CapDrop: []string{"ALL", "CAP_NET_ADMIN", "CAP_FOO"},
-			},
-			out: composetypes.ServiceConfig{
-				CapAdd:  []string{"CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_FSETID", "CAP_NET_ADMIN"},
-				CapDrop: []string{"ALL"},
-			},
-		},
-	}
-	for _, tc := range tests {
-		tc := tc
-		t.Run(tc.title, func(t *testing.T) {
-			result, err := Service("1.41", Namespace{name: "foo"}, tc.in, nil, nil, nil, nil)
-			assert.NilError(t, err)
-			assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.CapabilityAdd, tc.out.CapAdd))
-			assert.Check(t, is.DeepEqual(result.TaskTemplate.ContainerSpec.CapabilityDrop, tc.out.CapDrop))
-		})
-	}
-}

pkg/upstream/convert/volume.go

@@ -2,15 +2,15 @@ package convert // https://github.com/docker/cli/blob/master/cli/compose/convert
 
 import (
 	"coopcloud.tech/abra/pkg/i18n"
-	composetypes "github.com/docker/cli/cli/compose/types"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/pkg/errors"
 )
 
-type volumes map[string]composetypes.VolumeConfig
+type volumes map[string]composeGoTypes.VolumeConfig
 
 // Volumes from compose-file types to engine api types
-func Volumes(serviceVolumes []composetypes.ServiceVolumeConfig, stackVolumes volumes, namespace Namespace) ([]mount.Mount, error) {
+func Volumes(serviceVolumes []composeGoTypes.ServiceVolumeConfig, stackVolumes volumes, namespace Namespace) ([]mount.Mount, error) {
 	var mounts []mount.Mount
 
 	for _, volumeConfig := range serviceVolumes {
@@ -23,7 +23,7 @@ func Volumes(serviceVolumes []composetypes.ServiceVolumeConfig, stackVolumes vol
 	return mounts, nil
 }
 
-func createMountFromVolume(volume composetypes.ServiceVolumeConfig) mount.Mount {
+func createMountFromVolume(volume composeGoTypes.ServiceVolumeConfig) mount.Mount {
 	return mount.Mount{
 		Type:        mount.Type(volume.Type),
 		Target:      volume.Target,
@@ -34,7 +34,7 @@ func createMountFromVolume(volume composetypes.ServiceVolumeConfig) mount.Mount
 }
 
 func handleVolumeToMount(
-	volume composetypes.ServiceVolumeConfig,
+	volume composeGoTypes.ServiceVolumeConfig,
 	stackVolumes volumes,
 	namespace Namespace,
 ) (mount.Mount, error) {
@@ -68,7 +68,7 @@ func handleVolumeToMount(
 	}
 
 	// External named volumes
-	if stackVolume.External.External {
+	if stackVolume.External {
 		return result, nil
 	}
 
@@ -83,7 +83,7 @@ func handleVolumeToMount(
 	return result, nil
 }
 
-func handleBindToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleBindToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source == "" {
@@ -103,7 +103,7 @@ func handleBindToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, er
 	return result, nil
 }
 
-func handleTmpfsToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleTmpfsToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source != "" {
@@ -117,13 +117,13 @@ func handleTmpfsToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, e
 	}
 	if volume.Tmpfs != nil {
 		result.TmpfsOptions = &mount.TmpfsOptions{
-			SizeBytes: volume.Tmpfs.Size,
+			SizeBytes: int64(volume.Tmpfs.Size),
 		}
 	}
 	return result, nil
 }
 
-func handleNpipeToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, error) {
+func handleNpipeToMount(volume composeGoTypes.ServiceVolumeConfig) (mount.Mount, error) {
 	result := createMountFromVolume(volume)
 
 	if volume.Source == "" {
@@ -144,7 +144,7 @@ func handleNpipeToMount(volume composetypes.ServiceVolumeConfig) (mount.Mount, e
 }
 
 func convertVolumeToMount(
-	volume composetypes.ServiceVolumeConfig,
+	volume composeGoTypes.ServiceVolumeConfig,
 	stackVolumes volumes,
 	namespace Namespace,
 ) (mount.Mount, error) {

pkg/upstream/convert/volume_test.go

@@ -1,361 +0,0 @@
-package convert // https://github.com/docker/cli/blob/master/cli/compose/convert/volume_test.go
-
-import (
-	"testing"
-
-	composetypes "github.com/docker/cli/cli/compose/types"
-	"github.com/docker/docker/api/types/mount"
-	"gotest.tools/v3/assert"
-	is "gotest.tools/v3/assert/cmp"
-)
-
-func TestConvertVolumeToMountAnonymousVolume(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Target: "/foo/bar",
-	}
-	expected := mount.Mount{
-		Type:   mount.TypeVolume,
-		Target: "/foo/bar",
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountAnonymousBind(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Target: "/foo/bar",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "invalid bind source, source cannot be empty")
-}
-
-func TestConvertVolumeToMountUnapprovedType(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "foo",
-		Target: "/foo/bar",
-	}
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "volume type must be volume, bind, tmpfs or npipe")
-}
-
-func TestConvertVolumeToMountConflictingOptionsBindInVolume(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "foo",
-		Target: "/target",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "bind options are incompatible with type volume")
-}
-
-func TestConvertVolumeToMountConflictingOptionsTmpfsInVolume(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "foo",
-		Target: "/target",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "tmpfs options are incompatible with type volume")
-}
-
-func TestConvertVolumeToMountConflictingOptionsVolumeInBind(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Source: "/foo",
-		Target: "/target",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "volume options are incompatible with type bind")
-}
-
-func TestConvertVolumeToMountConflictingOptionsTmpfsInBind(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "bind",
-		Source: "/foo",
-		Target: "/target",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "tmpfs options are incompatible with type bind")
-}
-
-func TestConvertVolumeToMountConflictingOptionsBindInTmpfs(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/target",
-		Bind: &composetypes.ServiceVolumeBind{
-			Propagation: "slave",
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "bind options are incompatible with type tmpfs")
-}
-
-func TestConvertVolumeToMountConflictingOptionsVolumeInTmpfs(t *testing.T) {
-	namespace := NewNamespace("foo")
-
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/target",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "volume options are incompatible with type tmpfs")
-}
-
-func TestConvertVolumeToMountNamedVolume(t *testing.T) {
-	stackVolumes := volumes{
-		"normal": composetypes.VolumeConfig{
-			Driver: "glusterfs",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:     mount.TypeVolume,
-		Source:   "foo_normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		VolumeOptions: &mount.VolumeOptions{
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-			DriverConfig: &mount.Driver{
-				Name: "glusterfs",
-				Options: map[string]string{
-					"opt": "value",
-				},
-			},
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeWithNameCustomizd(t *testing.T) {
-	stackVolumes := volumes{
-		"normal": composetypes.VolumeConfig{
-			Name:   "user_specified_name",
-			Driver: "vsphere",
-			DriverOpts: map[string]string{
-				"opt": "value",
-			},
-			Labels: map[string]string{
-				"something": "labeled",
-			},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:     mount.TypeVolume,
-		Source:   "user_specified_name",
-		Target:   "/foo",
-		ReadOnly: true,
-		VolumeOptions: &mount.VolumeOptions{
-			Labels: map[string]string{
-				LabelNamespace: "foo",
-				"something":    "labeled",
-			},
-			DriverConfig: &mount.Driver{
-				Name: "vsphere",
-				Options: map[string]string{
-					"opt": "value",
-				},
-			},
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "normal",
-		Target:   "/foo",
-		ReadOnly: true,
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeExternal(t *testing.T) {
-	stackVolumes := volumes{
-		"outside": composetypes.VolumeConfig{
-			Name:     "special",
-			External: composetypes.External{External: true},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:          mount.TypeVolume,
-		Source:        "special",
-		Target:        "/foo",
-		VolumeOptions: &mount.VolumeOptions{NoCopy: false},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "outside",
-		Target: "/foo",
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountNamedVolumeExternalNoCopy(t *testing.T) {
-	stackVolumes := volumes{
-		"outside": composetypes.VolumeConfig{
-			Name:     "special",
-			External: composetypes.External{External: true},
-		},
-	}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:   mount.TypeVolume,
-		Source: "special",
-		Target: "/foo",
-		VolumeOptions: &mount.VolumeOptions{
-			NoCopy: true,
-		},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "volume",
-		Source: "outside",
-		Target: "/foo",
-		Volume: &composetypes.ServiceVolumeVolume{
-			NoCopy: true,
-		},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountBind(t *testing.T) {
-	stackVolumes := volumes{}
-	namespace := NewNamespace("foo")
-	expected := mount.Mount{
-		Type:        mount.TypeBind,
-		Source:      "/bar",
-		Target:      "/foo",
-		ReadOnly:    true,
-		BindOptions: &mount.BindOptions{Propagation: mount.PropagationShared},
-	}
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "bind",
-		Source:   "/bar",
-		Target:   "/foo",
-		ReadOnly: true,
-		Bind:     &composetypes.ServiceVolumeBind{Propagation: "shared"},
-	}
-	mount, err := convertVolumeToMount(config, stackVolumes, namespace)
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertVolumeToMountVolumeDoesNotExist(t *testing.T) {
-	namespace := NewNamespace("foo")
-	config := composetypes.ServiceVolumeConfig{
-		Type:     "volume",
-		Source:   "unknown",
-		Target:   "/foo",
-		ReadOnly: true,
-	}
-	_, err := convertVolumeToMount(config, volumes{}, namespace)
-	assert.Error(t, err, "undefined volume \"unknown\"")
-}
-
-func TestConvertTmpfsToMountVolume(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Target: "/foo/bar",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-	expected := mount.Mount{
-		Type:         mount.TypeTmpfs,
-		Target:       "/foo/bar",
-		TmpfsOptions: &mount.TmpfsOptions{SizeBytes: 1000},
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}
-
-func TestConvertTmpfsToMountVolumeWithSource(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "tmpfs",
-		Source: "/bar",
-		Target: "/foo/bar",
-		Tmpfs: &composetypes.ServiceVolumeTmpfs{
-			Size: 1000,
-		},
-	}
-
-	_, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.Error(t, err, "invalid tmpfs source, source must be empty")
-}
-
-func TestConvertVolumeToMountAnonymousNpipe(t *testing.T) {
-	config := composetypes.ServiceVolumeConfig{
-		Type:   "npipe",
-		Source: `\\.\pipe\foo`,
-		Target: `\\.\pipe\foo`,
-	}
-	expected := mount.Mount{
-		Type:   mount.TypeNamedPipe,
-		Source: `\\.\pipe\foo`,
-		Target: `\\.\pipe\foo`,
-	}
-	mount, err := convertVolumeToMount(config, volumes{}, NewNamespace("foo"))
-	assert.NilError(t, err)
-	assert.Check(t, is.DeepEqual(expected, mount))
-}

pkg/upstream/stack/loader.go

@@ -1,6 +1,7 @@
 package stack // https://github.com/docker/cli/blob/master/cli/command/stack/loader/loader.go
 
 import (
+	"context"
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
@@ -8,58 +9,62 @@ import (
 	"strings"
 
 	"coopcloud.tech/abra/pkg/i18n"
-	"coopcloud.tech/abra/pkg/log"
+	composeGoCli "github.com/compose-spec/compose-go/v2/cli"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/docker/cli/cli/compose/loader"
 	"github.com/docker/cli/cli/compose/schema"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
-// DontSkipValidation ensures validation is done for compose file loading
-func DontSkipValidation(opts *loader.Options) {
-	opts.SkipValidation = false
+type LoadConf struct {
+	ComposeFiles []string
+	AppEnv       map[string]string
 }
 
-// SkipInterpolation skip interpolating environment variables.
-func SkipInterpolation(opts *loader.Options) {
-	opts.SkipInterpolation = true
-}
+func LoadCompose(conf LoadConf) (*composeGoTypes.Project, error) {
+	var project *composeGoTypes.Project
 
-// LoadComposefile parse the composefile specified in the cli and returns its Config and version.
-func LoadComposefile(opts Deploy, appEnv map[string]string, options ...func(*loader.Options)) (*composetypes.Config, error) {
-	configDetails, err := getConfigDetails(opts.Composefiles, appEnv)
-	if err != nil {
-		return nil, err
+	// NOTE(d1): silence compose-go internal logger
+	logrus.SetOutput(ioutil.Discard)
+
+	var projectOptions *composeGoCli.ProjectOptions
+	if len(conf.ComposeFiles) == 0 {
+		return project, errors.New(i18n.G("LoadCompose: provide compose files"))
 	}
 
-	if options == nil {
-		options = []func(*loader.Options){DontSkipValidation}
-	}
-
-	dicts := getDictsFrom(configDetails.ConfigFiles)
-	config, err := loader.Load(configDetails, options...)
-	if err != nil {
-		if fpe, ok := err.(*loader.ForbiddenPropertiesError); ok {
-			return nil, errors.New(i18n.G("compose file contains unsupported options: %s", propertyWarnings(fpe.Properties)))
+	if len(conf.AppEnv) == 0 {
+		var err error
+		projectOptions, err = composeGoCli.NewProjectOptions(
+			conf.ComposeFiles,
+			composeGoCli.WithInterpolation(false),
+		)
+		if err != nil {
+			return project, err
+		}
+	} else {
+		var env []string
+		for k, v := range conf.AppEnv {
+			env = append(env, fmt.Sprintf("%s=%s", k, v))
+		}
+
+		var err error
+		projectOptions, err = composeGoCli.NewProjectOptions(
+			conf.ComposeFiles,
+			composeGoCli.WithEnv(env),
+		)
+		if err != nil {
+			return project, err
 		}
-		return nil, err
 	}
 
-	recipeName, exists := appEnv["RECIPE"]
-	if !exists {
-		recipeName, _ = appEnv["TYPE"]
+	project, err := projectOptions.LoadProject(context.Background())
+	if err != nil {
+		return project, err
 	}
 
-	unsupportedProperties := loader.GetUnsupportedProperties(dicts...)
-	if len(unsupportedProperties) > 0 {
-		log.Warn(i18n.G("%s: ignoring unsupported options: %s", recipeName, strings.Join(unsupportedProperties, ", ")))
-	}
-
-	deprecatedProperties := loader.GetDeprecatedProperties(dicts...)
-	if len(deprecatedProperties) > 0 {
-		log.Warn(i18n.G("%s: ignoring deprecated options: %s", recipeName, propertyWarnings(deprecatedProperties)))
-	}
-	return config, nil
+	return project, nil
 }
 
 func getDictsFrom(configFiles []composetypes.ConfigFile) []map[string]interface{} {
@@ -138,7 +143,7 @@ func loadConfigFile(filename string) (*composetypes.ConfigFile, error) {
 
 	config, err := loader.ParseYAML(bytes)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("%s: %s", filename, err)
 	}
 
 	return &composetypes.ConfigFile{

pkg/upstream/stack/loader_test.go

@@ -0,0 +1,26 @@
+package stack_test // https://github.com/docker/cli/blob/master/cli/command/stack/loader/loader.go
+
+import (
+	"testing"
+
+	"coopcloud.tech/abra/pkg/app"
+	"coopcloud.tech/abra/pkg/test"
+)
+
+func TestSkipInterpolation(t *testing.T) {
+	test.Setup()
+	t.Cleanup(func() { test.Teardown() })
+
+	a, err := app.Get(test.AppName)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = a.Recipe.GetComposeConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// TODO: ensure compose has a port with no interpolated value
+	// TODO: ensure compose has port with interpolated value
+}

pkg/upstream/stack/stack.go

@@ -12,6 +12,7 @@ import (
 	stdlibErr "errors"
 
 	tea "github.com/charmbracelet/bubbletea"
+	composeGoTypes "github.com/compose-spec/compose-go/v2/types"
 
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/i18n"
@@ -20,7 +21,6 @@ import (
 	"coopcloud.tech/abra/pkg/upstream/convert"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/stack/formatter"
-	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
@@ -197,7 +197,7 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 func RunDeploy(
 	cl *dockerClient.Client,
 	opts Deploy,
-	cfg *composetypes.Config,
+	cfg *composeGoTypes.Project,
 	appName string,
 	serverName string,
 	dontWait bool,
@@ -246,7 +246,7 @@ func deployCompose(
 	ctx context.Context,
 	cl *dockerClient.Client,
 	opts Deploy,
-	config *composetypes.Config,
+	config *composeGoTypes.Project,
 	appName string,
 	serverName string,
 	dontWait bool,
@@ -325,7 +325,7 @@ func deployCompose(
 	return nil
 }
 
-func getServicesDeclaredNetworks(serviceConfigs []composetypes.ServiceConfig) map[string]struct{} {
+func getServicesDeclaredNetworks(serviceConfigs map[string]composeGoTypes.ServiceConfig) map[string]struct{} {
 	serviceNetworks := map[string]struct{}{}
 	for _, serviceConfig := range serviceConfigs {
 		if len(serviceConfig.Networks) == 0 {

renovate.json

@@ -8,7 +8,7 @@
     "gomodTidy"
   ],
   "ignoreDeps": [
-    "github.com/urfave/cli",
-    "goreleaser/goreleaser"
+    "github.com/docker/cli",
+    "github.com/spf13/cobra"
   ]
 }

scripts/installer/installer

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-ABRA_VERSION="0.12.0-beta"
+ABRA_VERSION="0.13.0-beta"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.12.0-beta"
+RC_VERSION="0.13.0-beta"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$RC_VERSION"
 
 for arg in "$@"; do
@@ -89,7 +89,7 @@ function install_abra_release {
   if [ $? -ne 0 ]; then
       echo "$(tput setaf 3)WARNING: $HOME/.local/bin/ is not in \$PATH! If you want to run abra by just typing "abra" you should add it to your \$PATH! To do that run this once and restart your terminal:$(tput sgr0)"
       p=$HOME/.local/bin
-      com="echo PATH=\$PATH:$p"
+      com='echo PATH="$PATH:'"$p"'"'
       if [[ $SHELL =~ "bash" ]]; then
           echo "$com >> $HOME/.bashrc"
       elif [[ $SHELL =~ "fizsh" ]]; then

scripts/tests/run-ci-int

@@ -50,7 +50,7 @@ echo "========================================================================"
 echo "========================================================================"
 echo "BUILDING ABRA"
 echo "========================================================================"
-export PATH="/usr/lib/go-1.21/bin:$PATH"
+export PATH="$PATH:/usr/local/go/bin"
 make build
 echo "========================================================================"
 

tests/integration/app_check.bats

@@ -106,7 +106,7 @@ teardown(){
 
   run $ABRA app check "$TEST_APP_DOMAIN" --chaos
   assert_failure
-  assert_output --partial 'unable to discover .env.sample'
+  assert_output --partial 'no such file or directory'
 }
 
 @test "error if missing env var" {

tests/integration/app_deploy.bats

@@ -23,12 +23,24 @@ teardown(){
   _reset_recipe
   _undeploy_app
   _undeploy_app2 "gitea.$TEST_SERVER"
+  _undeploy_app2 "zammad.$TEST_SERVER"
 
   _reset_app
   _reset_tags
 
   run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  if [[ -d "$ABRA_DIR/recipes/foo" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/foo"
+    assert_not_exists "$ABRA_DIR/recipes/foo"
+  fi
+
+  # NOTE(d1): give some extra space for the pure chaos that we are unleashing
+  #           on the CI machine with these deploy tests. the hope is to prevent
+  #           lock-ups and network failures which are common in flaky swarm
+  #           mode
+  sleep 1
 }
 
 @test "validate app argument" {
@@ -75,8 +87,10 @@ teardown(){
   assert_success
 }
 
-# bats test_tags=slow
 @test "bail if recipe lint errors and no --chaos" {
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout main
+  assert_success
+
   # Break the recipe
   run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
   assert_success
@@ -88,8 +102,8 @@ teardown(){
   assert_success
 
   # Make a broken release
-  run $ABRA recipe sync --patch "$TEST_RECIPE"
   run $ABRA recipe release --patch -n "$TEST_RECIPE"
+  assert_success
 
   # Make sure we deploy latest
   _wipe_env_version
@@ -602,3 +616,89 @@ teardown(){
   refute_output --partial "WITH_COMMENT=foo"
   assert_output --partial "WITH_COMMENT=bar"
 }
+
+# bats test_tags=slow
+@test "deploy with udp and tcp on same port" {
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/p4u1\/abra-test-recipe:030e8a1cb1a0f17281847b3e55d829220ad32c50/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run bash -c "printf '\nCOMPOSE_FILE=\"\$COMPOSE_FILE:compose.udp-and-tcp.yml\"' >> $ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  run docker service inspect  --format '{{ range .Endpoint.Ports }}{{ .Protocol }}={{ .PublishedPort }}{{ end }}' \
+    "${TEST_APP_DOMAIN//./_}_app"
+  assert_success
+  assert_output --partial "tcp=1312"
+  assert_output --partial "udp=1312"
+}
+
+# bats test_tags=slow
+@test "does not crash when docker image has no tag" {
+  run sed -i 's/TYPE=abra-test-recipe:.*/TYPE=git.coopcloud.tech\/p4u1\/abra-test-recipe:b29422d5a344ea45df271443182f775ea82b4da8/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run bash -c "printf '\nCOMPOSE_FILE=\"\$COMPOSE_FILE:compose.no-image-tag.yml\"' >> $ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+}
+
+
+@test "does not use old recipe version when recipe is broken" {
+  run $ABRA app new zammad \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "zammad.$TEST_SERVER" \
+    --secrets
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/zammad.$TEST_SERVER.env"
+
+  # NOTE(d1): --no-converge-checks because the zammad recipe is a beast and we
+  #           mostly only care about the correct version being used
+  run $ABRA app deploy "zammad.$TEST_SERVER" \
+    --no-input --no-converge-checks
+  assert_success
+  refute_output --partial "1.0.0+6.3.1-95"
+}
+
+# bats test_tags=slow
+@test "unable to deploy borked tag" {
+  _remove_tags
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
+    -a "2.4.8_1" -m "feat: completely borked tag"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "2.4.8_1" \
+    --no-input --no-converge-checks --debug
+  assert_failure
+  assert_output --partial "unable to parse"
+}
+
+# bats test_tags=slow
+@test "app deploy with borked sample env gives useful error" {
+  run $ABRA recipe new foo --no-input
+  assert_success
+
+  run $ABRA app new foo \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "foo.$TEST_SERVER" \
+    --chaos
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/foo.$TEST_SERVER.env"
+
+  run bash -c "printf '\nEVIL-VAR=EVIL' >> $ABRA_DIR/recipes/foo/.env.sample"
+  assert_success
+
+  run $ABRA app deploy "foo.$TEST_SERVER" \
+    --no-input --no-converge-checks --chaos
+  assert_failure
+  assert_output --partial "unexpected character"
+}

tests/integration/app_list.bats

@@ -67,6 +67,16 @@ teardown(){
   assert_output --partial "$TEST_SERVER"
   assert_output --partial "$TEST_APP_DOMAIN"
   assert_output --partial "deployed"
+  assert_output --partial "latest"
+
+  _remove_tags
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "$TEST_SERVER"
+  assert_output --partial "$TEST_APP_DOMAIN"
+  assert_output --partial "deployed"
+  assert_output --partial "latest"
 }
 
 @test "filter by server" {
@@ -151,7 +161,7 @@ teardown(){
     --no-input --no-converge-checks --chaos
   assert_success
 
-  run $ABRA app ls --status
+  run $ABRA app ls --status --chaos
   assert_success
   assert_output --partial "+U"
 
@@ -180,13 +190,16 @@ teardown(){
 
 # bats test_tags=slow
 @test "list ignores borked tags" {
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "2.4.8_1" -m "feat: completely borked tag"
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks
   assert_success
 
-  _deploy_app
+  # NOTE(d1): always upgradable tag which is also borked
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
+    -a "100.100.100_1_2_3" -m "feat: completely borked tag"
+  assert_success
 
   run $ABRA app ls --status --debug
   assert_success
-  assert_output --partial "unable to parse 2.4.8_1"
+  assert_output --partial "unable to parse"
 }

tests/integration/app_new.bats

@@ -63,6 +63,30 @@ teardown(){
   assert_success
 }
 
+@test "ensure recipe is up-to-date" {
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l'
+  assert_success
+  assert_output --partial '0.3.5+1.21.0'
+
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -d 0.3.5+1.21.0'
+  assert_success
+
+  run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l'
+  assert_success
+  refute_output --partial '0.3.5+1.21.0'
+
+  run $ABRA app new "$TEST_RECIPE" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  run grep -q "TYPE=$TEST_RECIPE:0.3.5+1.21.0" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+}
+
 @test "create new app with version commit" {
   tagHash=$(_get_tag_hash "0.3.0+1.21.0")
 

tests/integration/helpers/common.bash

@@ -13,7 +13,6 @@ _common_setup() {
   load "$PWD/tests/integration/helpers/docker"
 
   export ABRA="$PWD/abra"
-  export KADABRA="$PWD/kadabra"
 
   export TEST_APP_NAME="$(basename "${BATS_TEST_FILENAME//./_}")"
   export TEST_APP_DOMAIN="$TEST_APP_NAME.$TEST_SERVER"
@@ -21,4 +20,20 @@ _common_setup() {
   export TEST_RECIPE="abra-test-recipe"
 
   _ensure_swarm
+  _ensure_ssh_agent
+}
+
+
+_ensure_ssh_agent() {
+  if ! command -v ssh-agent >/dev/null 2>&1
+  then
+    echo "ssh-agent is missing, please install it"
+    exit 1
+  fi
+
+  export SSH_AUTH_SOCK="$HOME/.ssh/ssh_auth_sock"
+  if [ ! -S ~/.ssh/ssh_auth_sock ]; then
+    eval `ssh-agent`
+    ln -sf "$SSH_AUTH_SOCK" ~/.ssh/ssh_auth_sock
+  fi
 }

tests/integration/helpers/git.bash

@@ -17,7 +17,12 @@ _remove_tags(){
 
   run bash -c 'git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -l | wc -l'
   assert_success
-  assert_output '0'
+  # If this was done without the --regexp I get this error:
+  # -- output differs --
+  # expected : 0
+  # actual   :        0
+  # --
+  assert_output --regexp '[[:space:]]*0'
 }
 
 _reset_tags() {

tests/integration/helpers/recipe.bash

@@ -5,11 +5,22 @@ _latest_release(){
 }
 
 _fetch_recipe() {
+  # clone first to a bare repo which will serve as origin-ssh
+  # this enables simulating git push in recipe release
   if [[ ! -d "$ABRA_DIR/recipes/$TEST_RECIPE" ]]; then
+    run mkdir -p "$ABRA_DIR/origin-recipes"
+    assert_success
+
+    run git clone "https://git.coopcloud.tech/toolshed/$TEST_RECIPE" "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" --bare
+    assert_success
+
     run mkdir -p "$ABRA_DIR/recipes"
     assert_success
 
-    run git clone "https://git.coopcloud.tech/toolshed/$TEST_RECIPE" "$ABRA_DIR/recipes/$TEST_RECIPE"
+    run git clone "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git" "$ABRA_DIR/recipes/$TEST_RECIPE"
+    assert_success
+
+    run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote add origin-ssh "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
     assert_success
   fi
 }
@@ -19,6 +30,10 @@ _reset_recipe(){
   assert_success
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
 
+  run rm -rf "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+  assert_success
+  assert_not_exists "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+
   _fetch_recipe
 }
 

tests/integration/recipe_release.bats

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
 
-setup_file(){
+setup_file() {
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _add_server
   _new_app
 }
 
-teardown_file(){
+teardown_file() {
   _rm_server
   _reset_recipe
 }
 
-setup(){
+setup() {
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _set_git_author
@@ -21,6 +21,14 @@ setup(){
 teardown() {
   _reset_recipe
   _reset_tags
+  if [[ -d "$ABRA_DIR/recipes/foobar" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/foobar"
+    assert_success
+  fi
+  if [[ -d "$ABRA_DIR/origin-recipes/foobar.git" ]]; then
+    run rm -rf "$ABRA_DIR/origin-recipes/foobar.git"
+    assert_success
+  fi
 }
 
 @test "validate recipe argument" {
@@ -32,10 +40,10 @@ teardown() {
 }
 
 @test "release patch bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
   assert_success
 
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
   assert_success
   assert_output --partial 'image: nginx:1.21.6'
 
@@ -45,17 +53,9 @@ teardown() {
     -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
   assert_success
 
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-  assert_output --partial 'synced label'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --partial 'coop-cloud.${STACK_NAME}.version=0.3.1+1.21.6'
-
   run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
   assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'INFO new release published:'
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag --list
   assert_success
@@ -63,10 +63,10 @@ teardown() {
 }
 
 @test "release minor bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor --commit
   assert_success
 
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
   assert_success
   assert_output --regexp 'image: nginx:1.2.*'
 
@@ -76,58 +76,57 @@ teardown() {
     -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
   assert_success
 
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-  assert_output --partial 'synced label'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.4\.0\+1\.2.*'
-
   run $ABRA recipe release "$TEST_RECIPE" --no-input --minor
   assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'INFO new release published:'
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag --list
   assert_success
   assert_output --regexp '0\.4\.0\+1\.2.*'
 }
 
-@test "unknown files not committed" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
+@test "release with unstaged changes" {
+  run bash -c 'echo "# unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
   assert_success
 
-  run bash -c 'echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"'
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet
+  assert_failure
 
   run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
-  assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rm foo
   assert_failure
-  assert_output --partial "fatal: pathspec 'foo' did not match any files"
+  assert_output --partial "working directory not clean"
+}
+
+@test "release with staged changes" {
+  run bash -c 'echo "# staged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"'
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add compose.yml
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet --cached
+  assert_failure
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial "working directory not clean"
 }
 
 @test "release with next release note" {
   _mkfile "$ABRA_DIR/recipes/$TEST_RECIPE/release/next" "those are some release notes for the next release"
 
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout main
+  assert_success
+
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" add release/next
   assert_success
 
   run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -m "added some release notes"
   assert_success
 
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --minor
   assert_success
-
-  run $ABRA recipe release  "$TEST_RECIPE" --no-input  --minor
-  assert_success
-  assert_output --partial 'no -p/--publish passed, not publishing'
+  assert_output --partial 'new release published:'
 
   assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/release/next"
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/release/0.4.0+1.21.0"
@@ -146,14 +145,125 @@ teardown() {
   assert_success
   assert_output --regexp 'nginx:1.29.1'
 
-  run sed -i "s/0.2.0+1.21.0/0.2.0+1.29.1/g" "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -am "updated nginx"
   assert_success
 
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.2\.0\+1\.29\.1'
-
-  run $ABRA recipe release "$TEST_RECIPE" --no-input --minor
+  run $ABRA recipe release "$TEST_RECIPE" --no-input "0.2.0+1.29.1"
   assert_failure
   assert_output --partial '0.2.0+... conflicts with a previous release: 0.2.0+1.21.0'
 }
+
+@test "error if recipe release --no-input and no initial version" {
+  _remove_tags
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial 'unable to continue'
+  assert_output --partial 'initial version'
+}
+
+@test "recipe release without input fails with prompt" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run $ABRA recipe release foobar --no-input --patch
+  assert_failure
+  assert_output --partial "input required for initial version"
+}
+
+@test "release new recipe: fail without input" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run bash -c "$ABRA recipe release foobar --no-input"
+  assert_failure
+  assert_output --partial 'unable to continue, input required for initial version'
+}
+
+# note: piping 0.1.0 from stdin is not testable right now because release notes also wants input
+# survey lib used for prompts breaks multi-line stdin for multi-prompt
+@test "release new recipe: development release" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  # fake origin
+  git clone "$ABRA_DIR/recipes/foobar" "$ABRA_DIR/origin-recipes/foobar.git" --bare
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/foobar" remote add origin-ssh "$ABRA_DIR/origin-recipes/foobar.git"
+  assert_success
+
+  run bash -c "$ABRA recipe release foobar 0.1.0+1.2.0 --no-input"
+  assert_success
+  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.1\.0\+1\.2.*'
+}
+
+@test "release newly created recipe with no version label" {
+  run $ABRA recipe new foobar
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/foobar"
+
+  run sed -i 's/- "coop-cloud.${STACK_NAME}.version="/#- "coop-cloud.${STACK_NAME}.version="/g' \
+    "$ABRA_DIR/recipes/foobar/compose.yml"
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/foobar" commit -am "updated nginx"
+  assert_success
+
+  run bash -c "echo 0.1.0 | $ABRA recipe release foobar --patch"
+  assert_failure
+  assert_output --partial "automagic insertion not supported yet"
+}
+
+@test "push during release fails" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
+  assert_success
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" show
+  assert_success
+  assert_output --partial 'image: nginx:1.21.6'
+
+  wantHash="$(_get_current_hash)"
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/does/not/exist"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+  assert_output --partial 'failed to publish new release:'
+  assert_output --partial 'any changes made have been reverted'
+
+  assert_equal "$wantHash" "$(_get_current_hash)"
+
+  assert_equal "$(_git_status)" ""
+}
+
+@test "release, fail, release: works" {
+  tagHash=$(_get_tag_hash "0.2.0+1.21.0")
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" checkout "$tagHash"
+  assert_success
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch --commit
+  assert_success
+
+  # NOTE(d1): fake broken remote so the release fails
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/does/not/exist"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_failure
+
+  # NOTE(d1): correct remote so release can proceed
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" remote set-url origin-ssh "$ABRA_DIR/origin-recipes/$TEST_RECIPE.git"
+  assert_success
+
+  run $ABRA recipe release "$TEST_RECIPE" --no-input --patch
+  assert_success
+}

tests/integration/recipe_sync.bats

@@ -1,200 +0,0 @@
-#!/usr/bin/env bash
-
-setup_file(){
-  load "$PWD/tests/integration/helpers/common"
-  _common_setup
-  _add_server
-  _new_app
-}
-
-teardown_file(){
-  _rm_server
-}
-
-setup(){
-  load "$PWD/tests/integration/helpers/common"
-  _common_setup
-}
-
-teardown(){
-  _reset_recipe
-  _reset_tags
-  if [[ -d "$ABRA_DIR/recipes/foobar" ]]; then
-    run rm -rf "$ABRA_DIR/recipes/foobar"
-    assert_success
-  fi
-}
-
-@test "validate recipe argument" {
-  run $ABRA recipe sync --no-input
-  assert_failure
-
-  run $ABRA recipe sync DOESNTEXIST --no-input
-  assert_failure
-}
-
-@test "allow unstaged changes" {
-  run echo "unstaged changes" >> "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" status
-  assert_success
-  assert_output --partial 'foo'
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_equal "$(_git_status)" "M compose.yml ?? foo"
-
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-  assert_success
-  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
-}
-
-@test "detect unstaged label changes" {
-  run $ABRA recipe fetch "$TEST_RECIPE"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --patch
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --patch
-  assert_success
-  assert_output --partial 'is already set, nothing to do?'
-}
-
-@test "sync patch label bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --partial 'image: nginx:1.21.6'
-
-  # NOTE(d1): ensure the latest tag is the one we expect
-  _remove_tags
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.3\.1\+1\.2.*'
-}
-
-@test "sync minor label bump" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'image: nginx:1.2.*'
-
-  # NOTE(d1): ensure the latest tag is the one we expect
-  _remove_tags
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.4\.0\+1\.2.*'
-}
-
-@test "error if --no-input and no initial version" {
-  _remove_tags
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_failure
-  assert_output --partial 'unable to continue'
-  assert_output --partial 'initial version'
-}
-
-@test "output label sync only once" {
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'image: nginx:1.2.*'
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --minor
-  assert_success
-  assert_line --index 0 --partial 'synced label'
-  refute_line --index 1 --partial 'synced label'
-}
-
-@test "sync with no tags or previous release" {
-  _remove_tags
-
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --partial 'image: nginx:1.21.6'
-
-  # NOTE(d1): ensure the latest tag is the one we expect
-  _remove_tags
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag \
-    -a "0.3.0+1.21.0" -m "fake: 0.3.0+1.21.0"
-  assert_success
-
-  run $ABRA recipe sync "$TEST_RECIPE" --no-input --patch
-  assert_success
-
-  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.3\.1\+1\.2.*'
-}
-
-@test "sync recipe without input fails with prompt" {
-  run $ABRA recipe new foobar
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/foobar"
-
-  run $ABRA recipe sync foobar --no-input --patch
-  assert_failure
-  assert_output --partial "input required for initial version"
-}
-
-@test "sync new recipe: development release" {
-  run $ABRA recipe new foobar
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/foobar"
-
-  run bash -c "echo 0.1.0 | $ABRA recipe sync foobar --patch"
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=0\.1\.0\+1\.2.*'
-}
-
-@test "sync new recipe: public release" {
-  run $ABRA recipe new foobar
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/foobar"
-
-  run bash -c "echo 1.0.0 | $ABRA recipe sync foobar --patch"
-  assert_success
-  assert_output --regexp 'coop-cloud\.\$\{STACK_NAME\}\.version=1\.0\.0\+1\.2.*'
-}
-
-@test "sync newly created recipe with no version label" {
-  run $ABRA recipe new foobar
-  assert_success
-  assert_exists "$ABRA_DIR/recipes/foobar"
-
-  run sed -i 's/- "coop-cloud.${STACK_NAME}.version="/#- "coop-cloud.${STACK_NAME}.version="/g' \
-    "$ABRA_DIR/recipes/foobar/compose.yml"
-  assert_success
-
-  run bash -c "echo 0.1.0 | $ABRA recipe sync foobar --patch"
-  assert_failure
-  assert_output --partial "automagic insertion not supported yet"
-}

tests/integration/recipe_upgrade.bats

@@ -106,3 +106,37 @@ teardown(){
   assert_success
   assert_output --regexp 'image: nginx:1.2.*'
 }
+
+@test "upgrade and commit" {
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list --count HEAD
+  assert_success
+  expected_count="$((output + 1))"
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --minor --commit
+  assert_success
+  assert_output --partial 'committed changes as'
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list --count HEAD
+  assert_success
+  assert_output "$expected_count"
+}
+
+@test "upgrade nothing, skip commit" {
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list --count HEAD
+  assert_success
+  expected_count="$output"
+
+  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input --commit
+  assert_success
+  assert_output --partial "no changes, skip creating commit"
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" diff --quiet
+  assert_success
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-list --count HEAD
+  assert_success
+  assert_output "$expected_count"
+}

tests/resources/test_recipe/.env.sample

@@ -1,6 +1,9 @@
 RECIPE=test_recipe
 DOMAIN=test_app.example.com
 
-# NOTE(d1): ensure commented out TIMEOUT doesn't get included
-#           see TestReadEnv in ./pkg/envfile
-# TIMEOUT=120
+#
+# NOTE(d1): for new changes, you *MUST* also update ../test_server/test_app.example.com.env
+#
+
+# NOTE(d1): TestReadEnv
+# FOO=BAR

tests/resources/test_recipe/compose.interpolate.yml

@@ -0,0 +1,7 @@
+---
+
+services:
+  app:
+    ports:
+      - target: 22
+        published: ${PORT}

tests/resources/test_recipe/compose.yml

@@ -1,5 +1,4 @@
 ---
-version: "3.8"
 
 services:
   app:
@@ -8,6 +7,7 @@ services:
       - proxy
     deploy:
       labels:
+        - "coop-cloud.${STACK_NAME}.version=0.1.0+0.1.0"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
 
 networks:

tests/resources/test_server/test_app.example.com.env

@@ -1,6 +1,9 @@
 RECIPE=test_recipe
 DOMAIN=test_app.example.com
 
-# NOTE(d1): ensure commented out TIMEOUT doesn't get included
-#           see TestReadEnv in ./pkg/envfile
-# TIMEOUT=120
+#
+# NOTE(d1): for new changes, you *MUST* also update ../test_recipe/.env.sample
+#
+
+# NOTE(d1): TestReadEnv
+# FOO=BAR

vendor/github.com/BurntSushi/toml/README.md

@@ -1,7 +1,7 @@
 TOML stands for Tom's Obvious, Minimal Language. This Go package provides a
 reflection interface similar to Go's standard library `json` and `xml` packages.
 
-Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).
+Compatible with TOML version [v1.1.0](https://toml.io/en/v1.1.0).
 
 Documentation: https://pkg.go.dev/github.com/BurntSushi/toml
 

vendor/github.com/BurntSushi/toml/decode.go

@@ -206,6 +206,13 @@ func markDecodedRecursive(md *MetaData, tmap map[string]any) {
 			markDecodedRecursive(md, tmap)
 			md.context = md.context[0 : len(md.context)-1]
 		}
+		if tarr, ok := tmap[key].([]map[string]any); ok {
+			for _, elm := range tarr {
+				md.context = append(md.context, key)
+				markDecodedRecursive(md, elm)
+				md.context = md.context[0 : len(md.context)-1]
+			}
+		}
 	}
 }
 
@@ -423,7 +430,7 @@ func (md *MetaData) unifyString(data any, rv reflect.Value) error {
 		if i, ok := data.(int64); ok {
 			rv.SetString(strconv.FormatInt(i, 10))
 		} else if f, ok := data.(float64); ok {
-			rv.SetString(strconv.FormatFloat(f, 'f', -1, 64))
+			rv.SetString(strconv.FormatFloat(f, 'g', -1, 64))
 		} else {
 			return md.badtype("string", data)
 		}

vendor/github.com/BurntSushi/toml/encode.go

@@ -228,9 +228,9 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 		}
 		switch v.Location() {
 		default:
-			enc.wf(v.Format(format))
+			enc.write(v.Format(format))
 		case internal.LocalDatetime, internal.LocalDate, internal.LocalTime:
-			enc.wf(v.In(time.UTC).Format(format))
+			enc.write(v.In(time.UTC).Format(format))
 		}
 		return
 	case Marshaler:
@@ -279,40 +279,40 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 	case reflect.String:
 		enc.writeQuoted(rv.String())
 	case reflect.Bool:
-		enc.wf(strconv.FormatBool(rv.Bool()))
+		enc.write(strconv.FormatBool(rv.Bool()))
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		enc.wf(strconv.FormatInt(rv.Int(), 10))
+		enc.write(strconv.FormatInt(rv.Int(), 10))
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		enc.wf(strconv.FormatUint(rv.Uint(), 10))
+		enc.write(strconv.FormatUint(rv.Uint(), 10))
 	case reflect.Float32:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.wf("-")
+				enc.write("-")
 			}
-			enc.wf("nan")
+			enc.write("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.wf("-")
+				enc.write("-")
 			}
-			enc.wf("inf")
+			enc.write("inf")
 		} else {
-			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 32)))
+			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 32)))
 		}
 	case reflect.Float64:
 		f := rv.Float()
 		if math.IsNaN(f) {
 			if math.Signbit(f) {
-				enc.wf("-")
+				enc.write("-")
 			}
-			enc.wf("nan")
+			enc.write("nan")
 		} else if math.IsInf(f, 0) {
 			if math.Signbit(f) {
-				enc.wf("-")
+				enc.write("-")
 			}
-			enc.wf("inf")
+			enc.write("inf")
 		} else {
-			enc.wf(floatAddDecimal(strconv.FormatFloat(f, 'f', -1, 64)))
+			enc.write(floatAddDecimal(strconv.FormatFloat(f, 'g', -1, 64)))
 		}
 	case reflect.Array, reflect.Slice:
 		enc.eArrayOrSliceElement(rv)
@@ -330,27 +330,32 @@ func (enc *Encoder) eElement(rv reflect.Value) {
 // By the TOML spec, all floats must have a decimal with at least one number on
 // either side.
 func floatAddDecimal(fstr string) string {
-	if !strings.Contains(fstr, ".") {
-		return fstr + ".0"
+	for _, c := range fstr {
+		if c == 'e' { // Exponent syntax
+			return fstr
+		}
+		if c == '.' {
+			return fstr
+		}
 	}
-	return fstr
+	return fstr + ".0"
 }
 
 func (enc *Encoder) writeQuoted(s string) {
-	enc.wf("\"%s\"", dblQuotedReplacer.Replace(s))
+	enc.write(`"` + dblQuotedReplacer.Replace(s) + `"`)
 }
 
 func (enc *Encoder) eArrayOrSliceElement(rv reflect.Value) {
 	length := rv.Len()
-	enc.wf("[")
+	enc.write("[")
 	for i := 0; i < length; i++ {
 		elem := eindirect(rv.Index(i))
 		enc.eElement(elem)
 		if i != length-1 {
-			enc.wf(", ")
+			enc.write(", ")
 		}
 	}
-	enc.wf("]")
+	enc.write("]")
 }
 
 func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
@@ -363,7 +368,7 @@ func (enc *Encoder) eArrayOfTables(key Key, rv reflect.Value) {
 			continue
 		}
 		enc.newline()
-		enc.wf("%s[[%s]]", enc.indentStr(key), key)
+		enc.writef("%s[[%s]]", enc.indentStr(key), key)
 		enc.newline()
 		enc.eMapOrStruct(key, trv, false)
 	}
@@ -376,7 +381,7 @@ func (enc *Encoder) eTable(key Key, rv reflect.Value) {
 		enc.newline()
 	}
 	if len(key) > 0 {
-		enc.wf("%s[%s]", enc.indentStr(key), key)
+		enc.writef("%s[%s]", enc.indentStr(key), key)
 		enc.newline()
 	}
 	enc.eMapOrStruct(key, rv, false)
@@ -422,7 +427,7 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{mapKey.String()}, val, true)
 				if trailC || i != len(mapKeys)-1 {
-					enc.wf(", ")
+					enc.write(", ")
 				}
 			} else {
 				enc.encode(key.add(mapKey.String()), val)
@@ -431,12 +436,12 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}
 
 	if inline {
-		enc.wf("{")
+		enc.write("{")
 	}
 	writeMapKeys(mapKeysDirect, len(mapKeysSub) > 0)
 	writeMapKeys(mapKeysSub, false)
 	if inline {
-		enc.wf("}")
+		enc.write("}")
 	}
 }
 
@@ -534,7 +539,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 			if inline {
 				enc.writeKeyValue(Key{keyName}, fieldVal, true)
 				if fieldIndex[0] != totalFields-1 {
-					enc.wf(", ")
+					enc.write(", ")
 				}
 			} else {
 				enc.encode(key.add(keyName), fieldVal)
@@ -543,14 +548,14 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}
 
 	if inline {
-		enc.wf("{")
+		enc.write("{")
 	}
 
 	l := len(fieldsDirect) + len(fieldsSub)
 	writeFields(fieldsDirect, l)
 	writeFields(fieldsSub, l)
 	if inline {
-		enc.wf("}")
+		enc.write("}")
 	}
 }
 
@@ -700,7 +705,7 @@ func isEmpty(rv reflect.Value) bool {
 
 func (enc *Encoder) newline() {
 	if enc.hasWritten {
-		enc.wf("\n")
+		enc.write("\n")
 	}
 }
 
@@ -722,14 +727,22 @@ func (enc *Encoder) writeKeyValue(key Key, val reflect.Value, inline bool) {
 		enc.eElement(val)
 		return
 	}
-	enc.wf("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
+	enc.writef("%s%s = ", enc.indentStr(key), key.maybeQuoted(len(key)-1))
 	enc.eElement(val)
 	if !inline {
 		enc.newline()
 	}
 }
 
-func (enc *Encoder) wf(format string, v ...any) {
+func (enc *Encoder) write(s string) {
+	_, err := enc.w.WriteString(s)
+	if err != nil {
+		encPanic(err)
+	}
+	enc.hasWritten = true
+}
+
+func (enc *Encoder) writef(format string, v ...any) {
 	_, err := fmt.Fprintf(enc.w, format, v...)
 	if err != nil {
 		encPanic(err)

vendor/github.com/BurntSushi/toml/lex.go

@@ -13,7 +13,6 @@ type itemType int
 
 const (
 	itemError itemType = iota
-	itemNIL            // used in the parser to indicate no type
 	itemEOF
 	itemText
 	itemString
@@ -47,14 +46,13 @@ func (p Position) String() string {
 }
 
 type lexer struct {
-	input    string
-	start    int
-	pos      int
-	line     int
-	state    stateFn
-	items    chan item
-	tomlNext bool
-	esc      bool
+	input string
+	start int
+	pos   int
+	line  int
+	state stateFn
+	items chan item
+	esc   bool
 
 	// Allow for backing up up to 4 runes. This is necessary because TOML
 	// contains 3-rune tokens (""" and ''').
@@ -90,14 +88,13 @@ func (lx *lexer) nextItem() item {
 	}
 }
 
-func lex(input string, tomlNext bool) *lexer {
+func lex(input string) *lexer {
 	lx := &lexer{
-		input:    input,
-		state:    lexTop,
-		items:    make(chan item, 10),
-		stack:    make([]stateFn, 0, 10),
-		line:     1,
-		tomlNext: tomlNext,
+		input: input,
+		state: lexTop,
+		items: make(chan item, 10),
+		stack: make([]stateFn, 0, 10),
+		line:  1,
 	}
 	return lx
 }
@@ -108,7 +105,7 @@ func (lx *lexer) push(state stateFn) {
 
 func (lx *lexer) pop() stateFn {
 	if len(lx.stack) == 0 {
-		return lx.errorf("BUG in lexer: no states to pop")
+		panic("BUG in lexer: no states to pop")
 	}
 	last := lx.stack[len(lx.stack)-1]
 	lx.stack = lx.stack[0 : len(lx.stack)-1]
@@ -305,6 +302,8 @@ func lexTop(lx *lexer) stateFn {
 		return lexTableStart
 	case eof:
 		if lx.pos > lx.start {
+			// TODO: never reached? I think this can only occur on a bug in the
+			// lexer(?)
 			return lx.errorf("unexpected EOF")
 		}
 		lx.emit(itemEOF)
@@ -392,8 +391,6 @@ func lexTableNameStart(lx *lexer) stateFn {
 func lexTableNameEnd(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.next(); {
-	case isWhitespace(r):
-		return lexTableNameEnd
 	case r == '.':
 		lx.ignore()
 		return lexTableNameStart
@@ -412,7 +409,7 @@ func lexTableNameEnd(lx *lexer) stateFn {
 // Lexes only one part, e.g. only 'a' inside 'a.b'.
 func lexBareName(lx *lexer) stateFn {
 	r := lx.next()
-	if isBareKeyChar(r, lx.tomlNext) {
+	if isBareKeyChar(r) {
 		return lexBareName
 	}
 	lx.backup()
@@ -420,23 +417,23 @@ func lexBareName(lx *lexer) stateFn {
 	return lx.pop()
 }
 
-// lexBareName lexes one part of a key or table.
-//
-// It assumes that at least one valid character for the table has already been
-// read.
+// lexQuotedName lexes one part of a quoted key or table name. It assumes that
+// it starts lexing at the quote itself (" or ').
 //
 // Lexes only one part, e.g. only '"a"' inside '"a".b'.
 func lexQuotedName(lx *lexer) stateFn {
 	r := lx.next()
 	switch {
-	case isWhitespace(r):
-		return lexSkip(lx, lexValue)
 	case r == '"':
 		lx.ignore() // ignore the '"'
 		return lexString
 	case r == '\'':
 		lx.ignore() // ignore the "'"
 		return lexRawString
+
+	// TODO: I don't think any of the below conditions can ever be reached?
+	case isWhitespace(r):
+		return lexSkip(lx, lexValue)
 	case r == eof:
 		return lx.errorf("unexpected EOF; expected value")
 	default:
@@ -464,17 +461,19 @@ func lexKeyStart(lx *lexer) stateFn {
 func lexKeyNameStart(lx *lexer) stateFn {
 	lx.skip(isWhitespace)
 	switch r := lx.peek(); {
-	case r == '=' || r == eof:
-		return lx.errorf("unexpected '='")
-	case r == '.':
-		return lx.errorf("unexpected '.'")
+	default:
+		lx.push(lexKeyEnd)
+		return lexBareName
 	case r == '"' || r == '\'':
 		lx.ignore()
 		lx.push(lexKeyEnd)
 		return lexQuotedName
-	default:
-		lx.push(lexKeyEnd)
-		return lexBareName
+
+	// TODO: I think these can never be reached?
+	case r == '=' || r == eof:
+		return lx.errorf("unexpected '='")
+	case r == '.':
+		return lx.errorf("unexpected '.'")
 	}
 }
 
@@ -485,7 +484,7 @@ func lexKeyEnd(lx *lexer) stateFn {
 	switch r := lx.next(); {
 	case isWhitespace(r):
 		return lexSkip(lx, lexKeyEnd)
-	case r == eof:
+	case r == eof: // TODO: never reached
 		return lx.errorf("unexpected EOF; expected key separator '='")
 	case r == '.':
 		lx.ignore()
@@ -628,10 +627,7 @@ func lexInlineTableValue(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValue)
 	case isNL(r):
-		if lx.tomlNext {
-			return lexSkip(lx, lexInlineTableValue)
-		}
-		return lx.errorPrevLine(errLexInlineTableNL{})
+		return lexSkip(lx, lexInlineTableValue)
 	case r == '#':
 		lx.push(lexInlineTableValue)
 		return lexCommentStart
@@ -653,10 +649,7 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 	case isWhitespace(r):
 		return lexSkip(lx, lexInlineTableValueEnd)
 	case isNL(r):
-		if lx.tomlNext {
-			return lexSkip(lx, lexInlineTableValueEnd)
-		}
-		return lx.errorPrevLine(errLexInlineTableNL{})
+		return lexSkip(lx, lexInlineTableValueEnd)
 	case r == '#':
 		lx.push(lexInlineTableValueEnd)
 		return lexCommentStart
@@ -664,10 +657,7 @@ func lexInlineTableValueEnd(lx *lexer) stateFn {
 		lx.ignore()
 		lx.skip(isWhitespace)
 		if lx.peek() == '}' {
-			if lx.tomlNext {
-				return lexInlineTableValueEnd
-			}
-			return lx.errorf("trailing comma not allowed in inline tables")
+			return lexInlineTableValueEnd
 		}
 		return lexInlineTableValue
 	case r == '}':
@@ -855,9 +845,6 @@ func lexStringEscape(lx *lexer) stateFn {
 	r := lx.next()
 	switch r {
 	case 'e':
-		if !lx.tomlNext {
-			return lx.error(errLexEscape{r})
-		}
 		fallthrough
 	case 'b':
 		fallthrough
@@ -878,9 +865,6 @@ func lexStringEscape(lx *lexer) stateFn {
 	case '\\':
 		return lx.pop()
 	case 'x':
-		if !lx.tomlNext {
-			return lx.error(errLexEscape{r})
-		}
 		return lexHexEscape
 	case 'u':
 		return lexShortUnicodeEscape
@@ -928,19 +912,9 @@ func lexLongUnicodeEscape(lx *lexer) stateFn {
 // lexBaseNumberOrDate can differentiate base prefixed integers from other
 // types.
 func lexNumberOrDateStart(lx *lexer) stateFn {
-	r := lx.next()
-	switch r {
-	case '0':
+	if lx.next() == '0' {
 		return lexBaseNumberOrDate
 	}
-
-	if !isDigit(r) {
-		// The only way to reach this state is if the value starts
-		// with a digit, so specifically treat anything else as an
-		// error.
-		return lx.errorf("expected a digit but got %q", r)
-	}
-
 	return lexNumberOrDate
 }
 
@@ -1196,13 +1170,13 @@ func lexSkip(lx *lexer, nextState stateFn) stateFn {
 }
 
 func (s stateFn) String() string {
+	if s == nil {
+		return "<nil>"
+	}
 	name := runtime.FuncForPC(reflect.ValueOf(s).Pointer()).Name()
 	if i := strings.LastIndexByte(name, '.'); i > -1 {
 		name = name[i+1:]
 	}
-	if s == nil {
-		name = "<nil>"
-	}
 	return name + "()"
 }
 
@@ -1210,8 +1184,6 @@ func (itype itemType) String() string {
 	switch itype {
 	case itemError:
 		return "Error"
-	case itemNIL:
-		return "NIL"
 	case itemEOF:
 		return "EOF"
 	case itemText:
@@ -1226,18 +1198,22 @@ func (itype itemType) String() string {
 		return "Float"
 	case itemDatetime:
 		return "DateTime"
-	case itemTableStart:
-		return "TableStart"
-	case itemTableEnd:
-		return "TableEnd"
-	case itemKeyStart:
-		return "KeyStart"
-	case itemKeyEnd:
-		return "KeyEnd"
 	case itemArray:
 		return "Array"
 	case itemArrayEnd:
 		return "ArrayEnd"
+	case itemTableStart:
+		return "TableStart"
+	case itemTableEnd:
+		return "TableEnd"
+	case itemArrayTableStart:
+		return "ArrayTableStart"
+	case itemArrayTableEnd:
+		return "ArrayTableEnd"
+	case itemKeyStart:
+		return "KeyStart"
+	case itemKeyEnd:
+		return "KeyEnd"
 	case itemCommentStart:
 		return "CommentStart"
 	case itemInlineTableStart:
@@ -1266,7 +1242,7 @@ func isDigit(r rune) bool  { return r >= '0' && r <= '9' }
 func isBinary(r rune) bool { return r == '0' || r == '1' }
 func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
 func isHex(r rune) bool    { return (r >= '0' && r <= '9') || (r|0x20 >= 'a' && r|0x20 <= 'f') }
-func isBareKeyChar(r rune, tomlNext bool) bool {
+func isBareKeyChar(r rune) bool {
 	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') ||
 		(r >= '0' && r <= '9') || r == '_' || r == '-'
 }

vendor/github.com/BurntSushi/toml/parse.go

@@ -3,7 +3,6 @@ package toml
 import (
 	"fmt"
 	"math"
-	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -17,7 +16,6 @@ type parser struct {
 	context    Key      // Full key for the current hash in scope.
 	currentKey string   // Base key name for everything except hashes.
 	pos        Position // Current position in the TOML file.
-	tomlNext   bool
 
 	ordered []Key // List of keys in the order that they appear in the TOML data.
 
@@ -32,8 +30,6 @@ type keyInfo struct {
 }
 
 func parse(data string) (p *parser, err error) {
-	_, tomlNext := os.LookupEnv("BURNTSUSHI_TOML_110")
-
 	defer func() {
 		if r := recover(); r != nil {
 			if pErr, ok := r.(ParseError); ok {
@@ -73,10 +69,9 @@ func parse(data string) (p *parser, err error) {
 	p = &parser{
 		keyInfo:   make(map[string]keyInfo),
 		mapping:   make(map[string]any),
-		lx:        lex(data, tomlNext),
+		lx:        lex(data),
 		ordered:   make([]Key, 0),
 		implicits: make(map[string]struct{}),
-		tomlNext:  tomlNext,
 	}
 	for {
 		item := p.next()
@@ -350,17 +345,14 @@ func (p *parser) valueFloat(it item) (any, tomlType) {
 var dtTypes = []struct {
 	fmt  string
 	zone *time.Location
-	next bool
 }{
-	{time.RFC3339Nano, time.Local, false},
-	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime, false},
-	{"2006-01-02", internal.LocalDate, false},
-	{"15:04:05.999999999", internal.LocalTime, false},
-
-	// tomlNext
-	{"2006-01-02T15:04Z07:00", time.Local, true},
-	{"2006-01-02T15:04", internal.LocalDatetime, true},
-	{"15:04", internal.LocalTime, true},
+	{time.RFC3339Nano, time.Local},
+	{"2006-01-02T15:04:05.999999999", internal.LocalDatetime},
+	{"2006-01-02", internal.LocalDate},
+	{"15:04:05.999999999", internal.LocalTime},
+	{"2006-01-02T15:04Z07:00", time.Local},
+	{"2006-01-02T15:04", internal.LocalDatetime},
+	{"15:04", internal.LocalTime},
 }
 
 func (p *parser) valueDatetime(it item) (any, tomlType) {
@@ -371,9 +363,6 @@ func (p *parser) valueDatetime(it item) (any, tomlType) {
 		err error
 	)
 	for _, dt := range dtTypes {
-		if dt.next && !p.tomlNext {
-			continue
-		}
 		t, err = time.ParseInLocation(dt.fmt, it.val, dt.zone)
 		if err == nil {
 			if missingLeadingZero(it.val, dt.fmt) {
@@ -644,6 +633,11 @@ func (p *parser) setValue(key string, value any) {
 		// Note that since it has already been defined (as a hash), we don't
 		// want to overwrite it. So our business is done.
 		if p.isArray(keyContext) {
+			if !p.isImplicit(keyContext) {
+				if _, ok := hash[key]; ok {
+					p.panicf("Key '%s' has already been defined.", keyContext)
+				}
+			}
 			p.removeImplicit(keyContext)
 			hash[key] = value
 			return
@@ -802,10 +796,8 @@ func (p *parser) replaceEscapes(it item, str string) string {
 			b.WriteByte(0x0d)
 			skip = 1
 		case 'e':
-			if p.tomlNext {
-				b.WriteByte(0x1b)
-				skip = 1
-			}
+			b.WriteByte(0x1b)
+			skip = 1
 		case '"':
 			b.WriteByte(0x22)
 			skip = 1
@@ -815,11 +807,9 @@ func (p *parser) replaceEscapes(it item, str string) string {
 		// The lexer guarantees the correct number of characters are present;
 		// don't need to check here.
 		case 'x':
-			if p.tomlNext {
-				escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
-				b.WriteRune(escaped)
-				skip = 3
-			}
+			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+4])
+			b.WriteRune(escaped)
+			skip = 3
 		case 'u':
 			escaped := p.asciiEscapeToUnicode(it, str[i+2:i+6])
 			b.WriteRune(escaped)

vendor/github.com/ProtonMail/go-crypto/openpgp/armor/armor.go

@@ -69,6 +69,8 @@ func (l *lineReader) Read(p []byte) (n int, err error) {
 	if isPrefix {
 		return 0, ArmorCorrupt
 	}
+	// Trim the line to remove any whitespace
+	line = bytes.TrimSpace(line)
 
 	if bytes.HasPrefix(line, armorEnd) {
 		l.eof = true

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/curve25519.go

@@ -125,7 +125,10 @@ func (c *curve25519) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecr
 	//	"VB = convert point V to the octet string"
 	// sharedPoint corresponds to `VB`.
 	var sharedPoint x25519lib.Key
-	x25519lib.Shared(&sharedPoint, &ephemeralPrivate, &pubKey)
+	ok := x25519lib.Shared(&sharedPoint, &ephemeralPrivate, &pubKey)
+	if !ok {
+		return nil, nil, errors.KeyInvalidError("ecc: the public key is a low order point")
+	}
 
 	return ephemeralPublic[:], sharedPoint[:], nil
 }
@@ -146,7 +149,10 @@ func (c *curve25519) Decaps(vsG, secret []byte) (sharedSecret []byte, err error)
 	// RFC6637 §8: "Note that the recipient obtains the shared secret by calculating
 	//   S = rV = rvG, where (r,R) is the recipient's key pair."
 	// sharedPoint corresponds to `S`.
-	x25519lib.Shared(&sharedPoint, &decodedPrivate, &ephemeralPublic)
+	ok := x25519lib.Shared(&sharedPoint, &decodedPrivate, &ephemeralPublic)
+	if !ok {
+		return nil, errors.KeyInvalidError("ecc: the public key is a low order point")
+	}
 
 	return sharedPoint[:], nil
 }

vendor/github.com/ProtonMail/go-crypto/openpgp/internal/ecc/generic.go

@@ -78,7 +78,7 @@ func (c *genericCurve) GenerateECDSA(rand io.Reader) (x, y, secret *big.Int, err
 func (c *genericCurve) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSecret []byte, err error) {
 	xP, yP := elliptic.Unmarshal(c.Curve, point)
 	if xP == nil {
-		panic("invalid point")
+		return nil, nil, errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
 	}
 
 	d, x, y, err := elliptic.GenerateKey(c.Curve, rand)
@@ -99,6 +99,9 @@ func (c *genericCurve) Encaps(rand io.Reader, point []byte) (ephemeral, sharedSe
 
 func (c *genericCurve) Decaps(ephemeral, secret []byte) (sharedSecret []byte, err error) {
 	x, y := elliptic.Unmarshal(c.Curve, ephemeral)
+	if x == nil {
+		return nil, errors.KeyInvalidError(fmt.Sprintf("ecc (%s): invalid point", c.Curve.Params().Name))
+	}
 	zbBig, _ := c.Curve.ScalarMult(x, y, secret)
 	byteLen := (c.Curve.Params().BitSize + 7) >> 3
 	zb := make([]byte, byteLen)

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go

@@ -178,6 +178,18 @@ type Config struct {
 	// When set to true, a key without flags is treated as if all flags are enabled.
 	// This behavior is consistent with GPG.
 	InsecureAllowAllKeyFlagsWhenMissing bool
+	// InsecureGenerateNonCriticalKeyFlags causes the "Key Flags" signature subpacket
+	// to be non-critical in newly generated signatures.
+	// This may be needed for keys to be accepted by older clients who do not recognize
+	// the subpacket.
+	// For example, rpm 4.14.3-150400.59.3.1 in OpenSUSE Leap 15.4 does not recognize it.
+	InsecureGenerateNonCriticalKeyFlags bool
+	// InsecureGenerateNonCriticalSignatureCreationTime causes the "Signature Creation Time" signature subpacket
+	// to be non-critical in newly generated signatures.
+	// This may be needed for keys to be accepted by older clients who do not recognize
+	// the subpacket.
+	// For example, yum 3.4.3-168 in CentOS 7 and yum 3.4.3-158 in Amazon Linux 2 do not recognize it.
+	InsecureGenerateNonCriticalSignatureCreationTime bool
 
 	// MaxDecompressedMessageSize specifies the maximum number of bytes that can be
 	// read from a compressed packet. This serves as an upper limit to prevent
@@ -420,6 +432,20 @@ func (c *Config) AllowAllKeyFlagsWhenMissing() bool {
 	return c.InsecureAllowAllKeyFlagsWhenMissing
 }
 
+func (c *Config) GenerateNonCriticalKeyFlags() bool {
+	if c == nil {
+		return false
+	}
+	return c.InsecureGenerateNonCriticalKeyFlags
+}
+
+func (c *Config) GenerateNonCriticalSignatureCreationTime() bool {
+	if c == nil {
+		return false
+	}
+	return c.InsecureGenerateNonCriticalSignatureCreationTime
+}
+
 func (c *Config) DecompressedMessageSizeLimit() *int64 {
 	if c == nil {
 		return nil

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/signature.go

@@ -933,7 +933,7 @@ func (sig *Signature) Sign(h hash.Hash, priv *PrivateKey, config *Config) (err e
 		}
 		sig.Notations = append(sig.Notations, &notation)
 	}
-	sig.outSubpackets, err = sig.buildSubpackets(priv.PublicKey)
+	sig.outSubpackets, err = sig.buildSubpackets(priv.PublicKey, config)
 	if err != nil {
 		return err
 	}
@@ -1254,11 +1254,11 @@ type outputSubpacket struct {
 	contents      []byte
 }
 
-func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubpacket, err error) {
+func (sig *Signature) buildSubpackets(issuer PublicKey, config *Config) (subpackets []outputSubpacket, err error) {
 	creationTime := make([]byte, 4)
 	binary.BigEndian.PutUint32(creationTime, uint32(sig.CreationTime.Unix()))
 	// Signature Creation Time
-	subpackets = append(subpackets, outputSubpacket{true, creationTimeSubpacket, true, creationTime})
+	subpackets = append(subpackets, outputSubpacket{true, creationTimeSubpacket, !config.GenerateNonCriticalSignatureCreationTime(), creationTime})
 	// Signature Expiration Time
 	if sig.SigLifetimeSecs != nil && *sig.SigLifetimeSecs != 0 {
 		sigLifetime := make([]byte, 4)
@@ -1357,7 +1357,7 @@ func (sig *Signature) buildSubpackets(issuer PublicKey) (subpackets []outputSubp
 		if sig.FlagGroupKey {
 			flags |= KeyFlagGroupKey
 		}
-		subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, true, []byte{flags}})
+		subpackets = append(subpackets, outputSubpacket{true, keyFlagsSubpacket, !config.GenerateNonCriticalKeyFlags(), []byte{flags}})
 	}
 	// Signer's User ID
 	if sig.SignerUserId != nil {

vendor/github.com/charmbracelet/colorprofile/.golangci.yml

@@ -33,6 +33,9 @@ linters:
     generated: lax
     presets:
       - common-false-positives
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

vendor/github.com/charmbracelet/colorprofile/env.go

@@ -2,6 +2,7 @@ package colorprofile
 
 import (
 	"bytes"
+	"context"
 	"io"
 	"os/exec"
 	"runtime"
@@ -83,8 +84,8 @@ func colorProfile(isatty bool, env environ) (p Profile) {
 	}
 
 	if envNoColor(env) && isatty {
-		if p > Ascii {
-			p = Ascii
+		if p > ASCII {
+			p = ASCII
 		}
 		return //nolint:nakedret
 	}
@@ -153,29 +154,29 @@ func envColorProfile(env environ) (p Profile) {
 		p = ANSI
 	}
 
-	parts := strings.Split(term, "-")
-	switch parts[0] {
-	case "alacritty",
-		"contour",
-		"foot",
-		"ghostty",
-		"kitty",
-		"rio",
-		"st",
-		"wezterm":
+	switch {
+	case strings.Contains(term, "alacritty"),
+		strings.Contains(term, "contour"),
+		strings.Contains(term, "foot"),
+		strings.Contains(term, "ghostty"),
+		strings.Contains(term, "kitty"),
+		strings.Contains(term, "rio"),
+		strings.Contains(term, "st"),
+		strings.Contains(term, "wezterm"):
 		return TrueColor
-	case "xterm":
-		if len(parts) > 1 {
-			switch parts[1] {
-			case "ghostty", "kitty":
-				// These terminals can be defined as xterm-TERMNAME
-				return TrueColor
-			}
-		}
-	case "tmux", "screen":
+	case strings.HasPrefix(term, "tmux"), strings.HasPrefix(term, "screen"):
 		if p < ANSI256 {
 			p = ANSI256
 		}
+	case strings.HasPrefix(term, "xterm"):
+		if p < ANSI {
+			p = ANSI
+		}
+	}
+
+	if len(env["WT_SESSION"]) > 0 {
+		// Windows Terminal supports TrueColor
+		return TrueColor
 	}
 
 	if isCloudShell, _ := strconv.ParseBool(env.get("GOOGLE_CLOUD_SHELL")); isCloudShell {
@@ -244,13 +245,13 @@ func tmux(env environ) (p Profile) {
 	// Check if tmux has either Tc or RGB capabilities. Otherwise, return
 	// ANSI256.
 	p = ANSI256
-	cmd := exec.Command("tmux", "info")
+	cmd := exec.CommandContext(context.Background(), "tmux", "info")
 	out, err := cmd.Output()
 	if err != nil {
 		return
 	}
 
-	for _, line := range bytes.Split(out, []byte("\n")) {
+	for line := range bytes.SplitSeq(out, []byte("\n")) {
 		if (bytes.Contains(line, []byte("Tc")) || bytes.Contains(line, []byte("RGB"))) &&
 			bytes.Contains(line, []byte("true")) {
 			return TrueColor

vendor/github.com/charmbracelet/colorprofile/env_windows.go

@@ -14,11 +14,6 @@ func windowsColorProfile(env map[string]string) (Profile, bool) {
 		return TrueColor, true
 	}
 
-	if len(env["WT_SESSION"]) > 0 {
-		// Windows Terminal supports TrueColor
-		return TrueColor, true
-	}
-
 	major, _, build := windows.RtlGetNtVersionNumbers()
 	if build < 10586 || major < 10 {
 		// No ANSI support before WindowsNT 10 build 10586

vendor/github.com/charmbracelet/colorprofile/profile.go

@@ -11,10 +11,12 @@ import (
 type Profile byte
 
 const (
+	// Unknown is a profile that represents the absence of a profile.
+	Unknown Profile = iota
 	// NoTTY is a profile with no terminal support.
-	NoTTY Profile = iota
-	// Ascii is a profile with no color support.
-	Ascii //nolint:revive
+	NoTTY
+	// ASCII is a profile with no color support.
+	ASCII
 	// ANSI is a profile with 16 colors (4-bit).
 	ANSI
 	// ANSI256 is a profile with 256 colors (8-bit).
@@ -23,6 +25,9 @@ const (
 	TrueColor
 )
 
+// Ascii is an alias for the [ASCII] profile for backwards compatibility.
+const Ascii = ASCII //nolint:revive
+
 // String returns the string representation of a Profile.
 func (p Profile) String() string {
 	switch p {
@@ -32,12 +37,13 @@ func (p Profile) String() string {
 		return "ANSI256"
 	case ANSI:
 		return "ANSI"
-	case Ascii:
+	case ASCII:
 		return "Ascii"
 	case NoTTY:
 		return "NoTTY"
+	default:
+		return "Unknown"
 	}
-	return "Unknown"
 }
 
 var (
@@ -50,7 +56,7 @@ var (
 
 // Convert transforms a given Color to a Color supported within the Profile.
 func (p Profile) Convert(c color.Color) (cc color.Color) {
-	if p <= Ascii {
+	if p <= ASCII {
 		return nil
 	}
 	if p == TrueColor {
@@ -90,11 +96,13 @@ func (p Profile) Convert(c color.Color) (cc color.Color) {
 		return c
 
 	default:
-		if p == ANSI256 {
+		switch p {
+		case ANSI256:
 			return ansi.Convert256(c)
-		} else if p == ANSI {
+		case ANSI:
 			return ansi.Convert16(c)
+		default:
+			return c
 		}
-		return c
 	}
 }

vendor/github.com/charmbracelet/colorprofile/writer.go

@@ -36,13 +36,15 @@ type Writer struct {
 
 // Write writes the given text to the underlying writer.
 func (w *Writer) Write(p []byte) (int, error) {
-	switch w.Profile {
-	case TrueColor:
+	switch {
+	case w.Profile == TrueColor:
 		return w.Forward.Write(p) //nolint:wrapcheck
-	case NoTTY:
-		return io.WriteString(w.Forward, ansi.Strip(string(p))) //nolint:wrapcheck
-	case Ascii, ANSI, ANSI256:
-		return w.downsample(p)
+	case w.Profile <= NoTTY:
+		_, err := io.WriteString(w.Forward, ansi.Strip(string(p)))
+		return len(p), err
+	case w.Profile == ASCII, w.Profile == ANSI, w.Profile == ANSI256:
+		_, err := w.downsample(p)
+		return len(p), err
 	default:
 		return 0, fmt.Errorf("invalid profile: %v", w.Profile)
 	}
@@ -112,7 +114,7 @@ func handleSgr(w *Writer, p *ansi.Parser, buf *bytes.Buffer) {
 			if w.Profile < ANSI {
 				continue
 			}
-			style = style.DefaultForegroundColor()
+			style = style.ForegroundColor(nil)
 		case 40, 41, 42, 43, 44, 45, 46, 47: // 8-bit background color
 			if w.Profile < ANSI {
 				continue
@@ -132,7 +134,7 @@ func handleSgr(w *Writer, p *ansi.Parser, buf *bytes.Buffer) {
 			if w.Profile < ANSI {
 				continue
 			}
-			style = style.DefaultBackgroundColor()
+			style = style.BackgroundColor(nil)
 		case 58: // 16 or 24-bit underline color
 			var c color.Color
 			if n := ansi.ReadStyleColor(params[i:], &c); n > 0 {
@@ -146,7 +148,7 @@ func handleSgr(w *Writer, p *ansi.Parser, buf *bytes.Buffer) {
 			if w.Profile < ANSI {
 				continue
 			}
-			style = style.DefaultUnderlineColor()
+			style = style.UnderlineColor(nil)
 		case 90, 91, 92, 93, 94, 95, 96, 97: // 8-bit bright foreground color
 			if w.Profile < ANSI {
 				continue

vendor/github.com/charmbracelet/log/.golangci.yml

@@ -7,7 +7,6 @@ linters:
     - exhaustive
     - goconst
     - godot
-    - godox
     - gomoddirectives
     - goprintffuncname
     - gosec
@@ -27,9 +26,16 @@ linters:
     - whitespace
     - wrapcheck
   exclusions:
+    rules:
+      - text: '(slog|log)\.\w+'
+        linters:
+          - noctx
     generated: lax
     presets:
       - common-false-positives
+  settings:
+    exhaustive:
+      default-signifies-exhaustive: true
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

vendor/github.com/charmbracelet/log/json.go

@@ -7,7 +7,7 @@ import (
 	"time"
 )
 
-func (l *Logger) jsonFormatter(keyvals ...interface{}) {
+func (l *Logger) jsonFormatter(keyvals ...any) {
 	jw := &jsonWriter{w: &l.b}
 	jw.start()
 

vendor/github.com/charmbracelet/log/logfmt.go

@@ -8,7 +8,7 @@ import (
 	"github.com/go-logfmt/logfmt"
 )
 
-func (l *Logger) logfmtFormatter(keyvals ...interface{}) {
+func (l *Logger) logfmtFormatter(keyvals ...any) {
 	e := logfmt.NewEncoder(&l.b)
 
 	for i := 0; i < len(keyvals); i += 2 {

vendor/github.com/charmbracelet/log/logger.go

@@ -41,19 +41,19 @@ type Logger struct {
 	reportCaller    bool
 	reportTimestamp bool
 
-	fields []interface{}
+	fields []any
 
 	helpers *sync.Map
 	styles  *Styles
 }
 
 // Logf logs a message with formatting.
-func (l *Logger) Logf(level Level, format string, args ...interface{}) {
+func (l *Logger) Logf(level Level, format string, args ...any) {
 	l.Log(level, fmt.Sprintf(format, args...))
 }
 
 // Log logs the given message with the given keyvals for the given level.
-func (l *Logger) Log(level Level, msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Log(level Level, msg any, keyvals ...any) {
 	if atomic.LoadUint32(&l.isDiscard) != 0 {
 		return
 	}
@@ -81,8 +81,8 @@ func (l *Logger) Log(level Level, msg interface{}, keyvals ...interface{}) {
 	l.handle(level, l.timeFunc(time.Now()), []runtime.Frame{frame}, msg, keyvals...)
 }
 
-func (l *Logger) handle(level Level, ts time.Time, frames []runtime.Frame, msg interface{}, keyvals ...interface{}) {
-	var kvs []interface{}
+func (l *Logger) handle(level Level, ts time.Time, frames []runtime.Frame, msg any, keyvals ...any) {
+	var kvs []any
 	if l.reportTimestamp && !ts.IsZero() {
 		kvs = append(kvs, TimestampKey, ts)
 	}
@@ -327,7 +327,7 @@ func (l *Logger) SetStyles(s *Styles) {
 }
 
 // With returns a new logger with the given keyvals added.
-func (l *Logger) With(keyvals ...interface{}) *Logger {
+func (l *Logger) With(keyvals ...any) *Logger {
 	var st Styles
 	l.mu.Lock()
 	sl := *l
@@ -336,7 +336,7 @@ func (l *Logger) With(keyvals ...interface{}) *Logger {
 	sl.b = bytes.Buffer{}
 	sl.mu = &sync.RWMutex{}
 	sl.helpers = &sync.Map{}
-	sl.fields = append(make([]interface{}, 0, len(l.fields)+len(keyvals)), l.fields...)
+	sl.fields = append(make([]any, 0, len(l.fields)+len(keyvals)), l.fields...)
 	sl.fields = append(sl.fields, keyvals...)
 	sl.styles = &st
 	return &sl
@@ -350,63 +350,63 @@ func (l *Logger) WithPrefix(prefix string) *Logger {
 }
 
 // Debug prints a debug message.
-func (l *Logger) Debug(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Debug(msg any, keyvals ...any) {
 	l.Log(DebugLevel, msg, keyvals...)
 }
 
 // Info prints an info message.
-func (l *Logger) Info(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Info(msg any, keyvals ...any) {
 	l.Log(InfoLevel, msg, keyvals...)
 }
 
 // Warn prints a warning message.
-func (l *Logger) Warn(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Warn(msg any, keyvals ...any) {
 	l.Log(WarnLevel, msg, keyvals...)
 }
 
 // Error prints an error message.
-func (l *Logger) Error(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Error(msg any, keyvals ...any) {
 	l.Log(ErrorLevel, msg, keyvals...)
 }
 
 // Fatal prints a fatal message and exits.
-func (l *Logger) Fatal(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Fatal(msg any, keyvals ...any) {
 	l.Log(FatalLevel, msg, keyvals...)
 	os.Exit(1)
 }
 
 // Print prints a message with no level.
-func (l *Logger) Print(msg interface{}, keyvals ...interface{}) {
+func (l *Logger) Print(msg any, keyvals ...any) {
 	l.Log(noLevel, msg, keyvals...)
 }
 
 // Debugf prints a debug message with formatting.
-func (l *Logger) Debugf(format string, args ...interface{}) {
+func (l *Logger) Debugf(format string, args ...any) {
 	l.Log(DebugLevel, fmt.Sprintf(format, args...))
 }
 
 // Infof prints an info message with formatting.
-func (l *Logger) Infof(format string, args ...interface{}) {
+func (l *Logger) Infof(format string, args ...any) {
 	l.Log(InfoLevel, fmt.Sprintf(format, args...))
 }
 
 // Warnf prints a warning message with formatting.
-func (l *Logger) Warnf(format string, args ...interface{}) {
+func (l *Logger) Warnf(format string, args ...any) {
 	l.Log(WarnLevel, fmt.Sprintf(format, args...))
 }
 
 // Errorf prints an error message with formatting.
-func (l *Logger) Errorf(format string, args ...interface{}) {
+func (l *Logger) Errorf(format string, args ...any) {
 	l.Log(ErrorLevel, fmt.Sprintf(format, args...))
 }
 
 // Fatalf prints a fatal message with formatting and exits.
-func (l *Logger) Fatalf(format string, args ...interface{}) {
+func (l *Logger) Fatalf(format string, args ...any) {
 	l.Log(FatalLevel, fmt.Sprintf(format, args...))
 	os.Exit(1)
 }
 
 // Printf prints a message with no level and formatting.
-func (l *Logger) Printf(format string, args ...interface{}) {
+func (l *Logger) Printf(format string, args ...any) {
 	l.Log(noLevel, fmt.Sprintf(format, args...))
 }

vendor/github.com/charmbracelet/log/logger_121.go

@@ -36,7 +36,7 @@ func (l *Logger) Handle(ctx context.Context, record slog.Record) error {
 		return nil
 	}
 
-	fields := make([]interface{}, 0, record.NumAttrs()*2)
+	fields := make([]any, 0, record.NumAttrs()*2)
 	record.Attrs(func(a slog.Attr) bool {
 		fields = append(fields, a.Key, a.Value)
 		return true
@@ -52,7 +52,7 @@ func (l *Logger) Handle(ctx context.Context, record slog.Record) error {
 //
 // Implements slog.Handler.
 func (l *Logger) WithAttrs(attrs []slog.Attr) slog.Handler {
-	fields := make([]interface{}, 0, len(attrs)*2)
+	fields := make([]any, 0, len(attrs)*2)
 	for _, attr := range attrs {
 		fields = append(fields, attr.Key, attr.Value)
 	}

vendor/github.com/charmbracelet/log/logger_no121.go

@@ -33,7 +33,7 @@ func (l *Logger) Enabled(_ context.Context, level slog.Level) bool {
 //
 // Implements slog.Handler.
 func (l *Logger) Handle(_ context.Context, record slog.Record) error {
-	fields := make([]interface{}, 0, record.NumAttrs()*2)
+	fields := make([]any, 0, record.NumAttrs()*2)
 	record.Attrs(func(a slog.Attr) bool {
 		fields = append(fields, a.Key, a.Value)
 		return true
@@ -49,7 +49,7 @@ func (l *Logger) Handle(_ context.Context, record slog.Record) error {
 //
 // Implements slog.Handler.
 func (l *Logger) WithAttrs(attrs []slog.Attr) slog.Handler {
-	fields := make([]interface{}, 0, len(attrs)*2)
+	fields := make([]any, 0, len(attrs)*2)
 	for _, attr := range attrs {
 		fields = append(fields, attr.Key, attr.Value)
 	}

vendor/github.com/charmbracelet/log/options.go

@@ -55,7 +55,7 @@ type Options struct {
 	// CallerOffset is the caller format for the logger. The default is 0.
 	CallerOffset int
 	// Fields is the fields for the logger. The default is no fields.
-	Fields []interface{}
+	Fields []any
 	// Formatter is the formatter for the logger. The default is TextFormatter.
 	Formatter Formatter
 }

vendor/github.com/charmbracelet/log/pkg.go

@@ -155,7 +155,7 @@ func GetPrefix() string {
 }
 
 // With returns a new logger with the given keyvals.
-func With(keyvals ...interface{}) *Logger {
+func With(keyvals ...any) *Logger {
 	return Default().With(keyvals...)
 }
 
@@ -172,74 +172,74 @@ func Helper() {
 }
 
 // Log logs a message with the given level.
-func Log(level Level, msg interface{}, keyvals ...interface{}) {
+func Log(level Level, msg any, keyvals ...any) {
 	Default().Log(level, msg, keyvals...)
 }
 
 // Debug logs a debug message.
-func Debug(msg interface{}, keyvals ...interface{}) {
+func Debug(msg any, keyvals ...any) {
 	Default().Log(DebugLevel, msg, keyvals...)
 }
 
 // Info logs an info message.
-func Info(msg interface{}, keyvals ...interface{}) {
+func Info(msg any, keyvals ...any) {
 	Default().Log(InfoLevel, msg, keyvals...)
 }
 
 // Warn logs a warning message.
-func Warn(msg interface{}, keyvals ...interface{}) {
+func Warn(msg any, keyvals ...any) {
 	Default().Log(WarnLevel, msg, keyvals...)
 }
 
 // Error logs an error message.
-func Error(msg interface{}, keyvals ...interface{}) {
+func Error(msg any, keyvals ...any) {
 	Default().Log(ErrorLevel, msg, keyvals...)
 }
 
 // Fatal logs a fatal message and exit.
-func Fatal(msg interface{}, keyvals ...interface{}) {
+func Fatal(msg any, keyvals ...any) {
 	Default().Log(FatalLevel, msg, keyvals...)
 	os.Exit(1)
 }
 
 // Print logs a message with no level.
-func Print(msg interface{}, keyvals ...interface{}) {
+func Print(msg any, keyvals ...any) {
 	Default().Log(noLevel, msg, keyvals...)
 }
 
 // Logf logs a message with formatting and level.
-func Logf(level Level, format string, args ...interface{}) {
+func Logf(level Level, format string, args ...any) {
 	Default().Logf(level, format, args...)
 }
 
 // Debugf logs a debug message with formatting.
-func Debugf(format string, args ...interface{}) {
+func Debugf(format string, args ...any) {
 	Default().Log(DebugLevel, fmt.Sprintf(format, args...))
 }
 
 // Infof logs an info message with formatting.
-func Infof(format string, args ...interface{}) {
+func Infof(format string, args ...any) {
 	Default().Log(InfoLevel, fmt.Sprintf(format, args...))
 }
 
 // Warnf logs a warning message with formatting.
-func Warnf(format string, args ...interface{}) {
+func Warnf(format string, args ...any) {
 	Default().Log(WarnLevel, fmt.Sprintf(format, args...))
 }
 
 // Errorf logs an error message with formatting.
-func Errorf(format string, args ...interface{}) {
+func Errorf(format string, args ...any) {
 	Default().Log(ErrorLevel, fmt.Sprintf(format, args...))
 }
 
 // Fatalf logs a fatal message with formatting and exit.
-func Fatalf(format string, args ...interface{}) {
+func Fatalf(format string, args ...any) {
 	Default().Log(FatalLevel, fmt.Sprintf(format, args...))
 	os.Exit(1)
 }
 
 // Printf logs a message with formatting and no level.
-func Printf(format string, args ...interface{}) {
+func Printf(format string, args ...any) {
 	Default().Log(noLevel, fmt.Sprintf(format, args...))
 }
 

vendor/github.com/charmbracelet/log/text.go

@@ -62,7 +62,7 @@ const (
 )
 
 var bufPool = sync.Pool{
-	New: func() interface{} {
+	New: func() any {
 		return new(strings.Builder)
 	},
 }
@@ -164,7 +164,7 @@ func writeSpace(w io.Writer, first bool) {
 	}
 }
 
-func (l *Logger) textFormatter(keyvals ...interface{}) {
+func (l *Logger) textFormatter(keyvals ...any) {
 	st := l.styles
 	lenKeyvals := len(keyvals)