feat(recipe): allow branch names in RECIPE=<name>:<version>

Fetch and resolve a branch name on demand (into refs/remotes/origin/*,
never refs/heads/*, to avoid corrupting default-branch detection),
checking it out detached at its tip as a chaos commit. Resolution order
stays tag -> hash -> branch so existing pins are unaffected. Adds
EnsureVersionCtx so offline mode fails clearly instead of hanging or
erroring opaquely when a branch hasn't been fetched yet.

This supersedes the previous behavior of rejecting branch names with a
clear error.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y6PrSttbx61PCQTie7HzLg

.drone.yml

@@ -3,12 +3,12 @@ kind: pipeline
 name: coopcloud.tech/abra
 steps:
   - name: make check
-    image: golang:1.27
+    image: golang:1.26
     commands:
       - make check
 
   - name: xgettext-go
-    image: golang:1.27
+    image: golang:1.26
     environment:
       GOPRIVATE: coopcloud.tech
     commands:
@@ -43,7 +43,7 @@ steps:
           - tag
 
   - name: make test
-    image: golang:1.27
+    image: golang:1.26
     environment:
       ABRA_DIR: /root/.abra_test
     commands:

.gitignore

@@ -7,3 +7,4 @@
 /bin
 dist/
 tests/integration/.bats
+.devbox

Dockerfile

@@ -1,5 +1,5 @@
 # Build image
-FROM golang:1.27-alpine AS build
+FROM golang:1.26-alpine AS build
 
 ENV GOPRIVATE=coopcloud.tech
 

cli/app/env.go

@@ -222,7 +222,13 @@ synchronize your local app environment values with what is deployed live.`),
 			mergedEnv[k] = v
 		}
 
-		if !strings.Contains(recipeEnvVar, ":") {
+		// The recipe version is always carried by TYPE (RECIPE, when present,
+		// is a bare source pointer). Stamp the deployed version onto TYPE and
+		// leave RECIPE untouched so the two never drift apart.
+		if t, ok := mergedEnv["TYPE"]; ok {
+			name, _, _ := strings.Cut(t, ":")
+			mergedEnv["TYPE"] = fmt.Sprintf("%s:%s", name, version)
+		} else {
 			mergedEnv[recipeKey] = fmt.Sprintf("%s:%s", mergedEnv[recipeKey], version)
 		}
 

cli/app/new.go

@@ -32,6 +32,18 @@ deploy <domain>" to do so.
 You can see what recipes are available (i.e. values for the [recipe] argument)
 by running "abra recipe ls".
 
+In addition to short catalogue names, [recipe] also accepts arbitrary git
+URLs to use a recipe from outside the catalogue (e.g. a fork or work in
+progress). Any of these forms is accepted:
+
+  abra app new git.example.com/user/recipe
+  abra app new https://git.example.com/user/recipe
+  abra app new git@git.example.com:user/recipe
+
+In that case a RECIPE=<canonical name> line is written to the app's .env
+file so a subsequent "abra app deploy" (on this or another machine) will
+re-fetch the recipe from the same git source.
+
 Recipe commit hashes are supported values for "[version]".
 
 Passing the "--secrets/-S" flag will automatically generate secrets for your
@@ -295,7 +307,7 @@ func ensureDomainFlag(recipe recipePkg.Recipe, server string) error {
 	if appDomain == "" && !internal.NoInput {
 		prompt := &survey.Input{
 			Message: i18n.G("Specify app domain"),
-			Default: fmt.Sprintf("%s.%s", recipe.Name, server),
+			Default: fmt.Sprintf("%s.%s", recipe.ShortName(), server),
 		}
 		if err := survey.AskOne(prompt, &appDomain); err != nil {
 			return err
@@ -306,6 +318,10 @@ func ensureDomainFlag(recipe recipePkg.Recipe, server string) error {
 		return errors.New(i18n.G("no domain provided"))
 	}
 
+	if strings.ContainsAny(appDomain, "/\\") {
+		return errors.New(i18n.G("invalid domain '%s': must not contain '/' or '\\'", appDomain))
+	}
+
 	return nil
 }
 

cli/app/rollback.go

@@ -188,6 +188,12 @@ beforehand. See "abra app backup" for more.`),
 			appPkg.SetChaosVersionLabel(compose, stackName, chosenDowngrade)
 		}
 
+		// NOTE: stamp the deployed version label ourselves rather than relying
+		// on the value baked into the recipe's compose.yml. Git-URL/WIP recipes
+		// often carry a stale or missing label, which would otherwise leave the
+		// live deployment reporting the wrong version after a rollback.
+		appPkg.SetVersionLabel(compose, stackName, chosenDowngrade)
+
 		// Gather secrets
 		secretInfo, err := deploy.GatherSecretsForDeploy(cl, app, internal.ShowUnchanged)
 		if err != nil {

cli/app/upgrade.go

@@ -200,6 +200,12 @@ beforehand. See "abra app backup" for more.`),
 			appPkg.SetChaosVersionLabel(compose, stackName, chosenUpgrade)
 		}
 
+		// NOTE: stamp the deployed version label ourselves rather than relying
+		// on the value baked into the recipe's compose.yml. Git-URL/WIP recipes
+		// often carry a stale or missing label, which would otherwise leave the
+		// live deployment reporting the wrong version after an upgrade.
+		appPkg.SetVersionLabel(compose, stackName, chosenUpgrade)
+
 		envVars, err := appPkg.CheckEnv(app)
 		if err != nil {
 			log.Fatal(err)
@@ -346,9 +352,17 @@ func getReleaseNotes(
 		return errors.New(i18n.G("parsing chosen upgrade version failed: %s", err))
 	}
 
-	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
-	if err != nil {
-		return errors.New(i18n.G("parsing deployment version failed: %s", err))
+	// The deployed version can be "unknown" (e.g. deployed without a version
+	// label, as is common for git-URL/work-in-progress recipes). In that case
+	// there is no lower bound to filter by, so we gather notes for every
+	// version below the chosen one instead of failing.
+	var parsedDeployedVersion tagcmp.Tag
+	haveDeployedVersion := deployMeta.Version != config.UNKNOWN_DEFAULT
+	if haveDeployedVersion {
+		parsedDeployedVersion, err = tagcmp.Parse(deployMeta.Version)
+		if err != nil {
+			return errors.New(i18n.G("parsing deployment version failed: %s", err))
+		}
 	}
 
 	for _, version := range internal.SortVersionsDesc(versions) {
@@ -357,7 +371,7 @@ func getReleaseNotes(
 			return errors.New(i18n.G("parsing recipe version failed: %s", err))
 		}
 
-		if parsedVersion.IsGreaterThan(parsedDeployedVersion) &&
+		if (!haveDeployedVersion || parsedVersion.IsGreaterThan(parsedDeployedVersion)) &&
 			parsedVersion.IsLessThan(parsedChosenUpgrade) {
 			note, err := app.Recipe.GetReleaseNotes(version, app.Domain)
 			if err != nil {
@@ -420,6 +434,12 @@ func validateUpgradeVersionArg(
 		return errors.New(i18n.G("'%s' is not a known version for %s", specificVersion, app.Recipe.Name))
 	}
 
+	// Without a known deployed version we cannot tell whether the requested
+	// version is an upgrade; trust the explicit choice rather than failing.
+	if deployMeta.Version == config.UNKNOWN_DEFAULT {
+		return nil
+	}
+
 	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
 	if err != nil {
 		return errors.New(i18n.G("'%s' is not a known version", deployMeta.Version))

cli/internal/validate.go

@@ -59,9 +59,15 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 		log.Fatal(i18n.G("no recipe name provided"))
 	}
 
-	if _, ok := knownRecipes[recipeName]; !ok {
-		if !strings.Contains(recipeName, "/") {
-			log.Fatal(i18n.G("no recipe '%s' exists?", recipeName))
+	recipeName = recipe.NormalizeRecipeName(recipeName)
+
+	lookupName := recipeName
+	if i := strings.LastIndex(lookupName, ":"); i >= 0 {
+		lookupName = lookupName[:i]
+	}
+	if _, ok := knownRecipes[lookupName]; !ok {
+		if !strings.Contains(lookupName, "/") {
+			log.Fatal(i18n.G("no recipe '%s' exists? pass a git URL (e.g. https://git.example.com/user/recipe) to use a recipe outside the catalogue", lookupName))
 		}
 	}
 

cli/recipe/list.go

@@ -2,11 +2,13 @@ package recipe
 
 import (
 	"fmt"
+	"path"
 	"sort"
 	"strconv"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
+	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/i18n"
 	"coopcloud.tech/abra/pkg/log"
@@ -41,6 +43,7 @@ var RecipeListCommand = &cobra.Command{
 
 		headers := []string{
 			i18n.G("name"),
+			i18n.G("source"),
 			i18n.G("category"),
 			i18n.G("status"),
 			i18n.G("healthcheck"),
@@ -56,6 +59,7 @@ var RecipeListCommand = &cobra.Command{
 		for _, recipe := range recipes {
 			row := []string{
 				recipe.Name,
+				i18n.G("catalogue"),
 				recipe.Category,
 				strconv.Itoa(recipe.Features.Status),
 				recipe.Features.Healthcheck,
@@ -76,6 +80,23 @@ var RecipeListCommand = &cobra.Command{
 			}
 		}
 
+		externals := externalRecipes(catl)
+		sort.Strings(externals)
+		for _, name := range externals {
+			row := []string{
+				name,
+				i18n.G("external"),
+				"-", "-", "-", "-", "-", "-", "-",
+			}
+			if pattern != "" {
+				if !strings.Contains(name, pattern) {
+					continue
+				}
+			}
+			table.Row(row...)
+			rows = append(rows, row)
+		}
+
 		if len(rows) > 0 {
 			if internal.MachineReadable {
 				out, err := formatter.ToJSON(headers, rows)
@@ -93,6 +114,30 @@ var RecipeListCommand = &cobra.Command{
 	},
 }
 
+// externalRecipes returns canonical names of locally-cloned recipes that
+// were sourced from an arbitrary git URL (i.e. they carry a .abra-source
+// sidecar) and are not already listed in the catalogue.
+func externalRecipes(catl recipe.RecipeCatalogue) []string {
+	dirs, err := recipe.GetRecipesLocal()
+	if err != nil {
+		log.Debug(i18n.G("can't read local recipes: %s", err))
+		return nil
+	}
+
+	var names []string
+	for _, dir := range dirs {
+		canonical := recipe.ReadRecipeSource(path.Join(config.RECIPES_DIR, dir))
+		if canonical == "" {
+			continue
+		}
+		if _, inCatalogue := catl[canonical]; inCatalogue {
+			continue
+		}
+		names = append(names, canonical)
+	}
+	return names
+}
+
 var (
 	pattern string
 )

cmd/abra/main.go

@@ -16,7 +16,7 @@ func main() {
 		Version = "dev"
 	}
 	if Commit == "" {
-		Commit = "       "
+		Commit = "unknown-commit"
 	}
 
 	cli.Run(Version, Commit)

go.mod

@@ -50,6 +50,7 @@ require (
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
@@ -96,6 +97,7 @@ require (
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
@@ -121,7 +123,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/net v0.56.0 // indirect
@@ -150,7 +152,7 @@ require (
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/spf13/cobra v1.10.1
-	github.com/stretchr/testify v1.12.1
+	github.com/stretchr/testify v1.11.1
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	golang.org/x/sys v0.47.0

go.sum

@@ -306,6 +306,7 @@ github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW
 github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
 github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decentral1se/cobra v1.10.2 h1:MZ8Ifi/jRels9sZrpSccDbUlK++3b2HlBODfv0Bh6x0=
 github.com/decentral1se/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
@@ -759,6 +760,7 @@ github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
@@ -855,8 +857,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
@@ -944,9 +946,8 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=

pkg/app/app.go

@@ -260,12 +260,30 @@ func ReadAppEnvFile(appFile AppFile, name AppName) (App, error) {
 func NewApp(env envfile.AppEnv, name string, appFile AppFile) (App, error) {
 	domain := env["DOMAIN"]
 
-	recipeName, exists := env["RECIPE"]
-	if !exists {
-		recipeName, exists = env["TYPE"]
-		if !exists {
-			return App{}, errors.New(i18n.G("%s is missing the TYPE env var?", name))
-		}
+	typeVar, hasType := env["TYPE"]
+	recipeVar, hasRecipe := env["RECIPE"]
+	if !hasType && !hasRecipe {
+		return App{}, errors.New(i18n.G("%s is missing the TYPE env var?", name))
+	}
+
+	// The recipe identity is taken from RECIPE when present (it records the
+	// canonical git source for externally-sourced recipes), otherwise from
+	// TYPE. The deployed version is always carried by TYPE when a TYPE line
+	// exists; only legacy apps that set RECIPE alone carry it there. RECIPE
+	// itself must stay a bare source pointer, never a versioned value.
+	identity := typeVar
+	if hasRecipe {
+		identity = recipeVar
+	}
+
+	versionSource := identity
+	if hasType {
+		versionSource = typeVar
+	}
+
+	recipeName, _, _ := strings.Cut(identity, ":")
+	if _, version, found := strings.Cut(versionSource, ":"); found && version != "" {
+		recipeName = fmt.Sprintf("%s:%s", recipeName, version)
 	}
 
 	return App{
@@ -392,11 +410,15 @@ func TemplateAppEnvSample(r recipe.Recipe, appName, server, domain string) error
 
 	newContents := strings.Replace(
 		string(read),
-		fmt.Sprintf("%s.example.com", r.Name),
+		fmt.Sprintf("%s.example.com", r.ShortName()),
 		domain,
 		-1,
 	)
 
+	if strings.Contains(r.Name, "/") {
+		newContents = injectRecipeLine(newContents, r.Name)
+	}
+
 	err = os.WriteFile(appEnvPath, []byte(newContents), 0)
 	if err != nil {
 		return err
@@ -407,6 +429,37 @@ func TemplateAppEnvSample(r recipe.Recipe, appName, server, domain string) error
 	return nil
 }
 
+// injectRecipeLine ensures the env file carries a RECIPE=<canonical name>
+// line so a downstream `abra app deploy` (potentially on another machine)
+// can re-fetch the recipe from its original git source. If a RECIPE= line
+// already exists in the copied .env.sample it is replaced; otherwise a new
+// line is inserted immediately after the TYPE= line, or appended at the
+// end if no TYPE= line is present.
+func injectRecipeLine(contents, canonicalName string) string {
+	lines := strings.Split(contents, "\n")
+	for i, line := range lines {
+		trimmed := strings.TrimLeft(line, " \t")
+		if strings.HasPrefix(trimmed, "RECIPE=") {
+			lines[i] = "RECIPE=" + canonicalName
+			return strings.Join(lines, "\n")
+		}
+	}
+	for i, line := range lines {
+		trimmed := strings.TrimLeft(line, " \t")
+		if strings.HasPrefix(trimmed, "TYPE=") {
+			out := make([]string, 0, len(lines)+1)
+			out = append(out, lines[:i+1]...)
+			out = append(out, "RECIPE="+canonicalName)
+			out = append(out, lines[i+1:]...)
+			return strings.Join(out, "\n")
+		}
+	}
+	if contents != "" && !strings.HasSuffix(contents, "\n") {
+		contents += "\n"
+	}
+	return contents + "RECIPE=" + canonicalName + "\n"
+}
+
 // SanitiseAppName makes a app name usable with Docker by replacing illegal
 // characters.
 func SanitiseAppName(name string) string {
@@ -514,10 +567,22 @@ func ExposeAllEnv(
 				_, exists := service.Environment[k]
 				if !exists {
 					value := v
-					if k == "TYPE" || k == "RECIPE" {
+					switch k {
+					case "TYPE":
 						// NOTE(d1): don't use the wrong version from the app env
-						//           since we are deploying a new version
-						value = toDeployVersion
+						//           since we are deploying a new version. Keep the
+						//           recipe name already recorded in TYPE and only
+						//           swap in the version being deployed.
+						name, _, _ := strings.Cut(v, ":")
+						if _, version, found := strings.Cut(toDeployVersion, ":"); found {
+							value = fmt.Sprintf("%s:%s", name, version)
+						} else {
+							value = name
+						}
+					case "RECIPE":
+						// RECIPE records the canonical git source only; the
+						// version is carried by TYPE, so keep it bare here.
+						value, _, _ = strings.Cut(toDeployVersion, ":")
 					}
 					service.Environment[k] = &value
 					log.Debug(i18n.G("%s: %s: %s", stackName, k, value))
@@ -642,60 +707,55 @@ func (a App) WriteRecipeVersion(version string, dryRun bool) error {
 	if err != nil {
 		return err
 	}
-	defer file.Close()
 
 	var (
-		dirtyVersion string
-		skipped      bool
-		lines        []string
-		scanner      = bufio.NewScanner(file)
+		lines   []string
+		hasType bool
+		scanner = bufio.NewScanner(file)
 	)
 
 	for scanner.Scan() {
 		line := scanner.Text()
-		if !strings.HasPrefix(line, "RECIPE=") && !strings.HasPrefix(line, "TYPE=") {
-			lines = append(lines, line)
-			continue
-		}
-
-		if strings.HasPrefix(line, "#") {
-			lines = append(lines, line)
-			continue
-		}
-
-		if strings.Contains(line, version) && !a.Recipe.Dirty && !strings.HasSuffix(line, config.DIRTY_DEFAULT) {
-			skipped = true
-			lines = append(lines, line)
-			continue
-		}
-
-		splitted := strings.Split(line, ":")
-
-		line = fmt.Sprintf("%s:%s", splitted[0], version)
 		lines = append(lines, line)
+		if strings.HasPrefix(line, "TYPE=") {
+			hasType = true
+		}
 	}
 
 	if err := scanner.Err(); err != nil {
+		file.Close()
+		log.Fatal(err)
+	}
+	file.Close()
+
+	// The recipe version is carried by a single field: TYPE when present (the
+	// standard recipe key), otherwise the legacy RECIPE key. When both exist
+	// (git-URL recipes) RECIPE stays a bare source pointer and only TYPE is
+	// versioned, so the two can never drift apart.
+	targetPrefix := "RECIPE="
+	if hasType {
+		targetPrefix = "TYPE="
+	}
+
+	for i, line := range lines {
+		if !strings.HasPrefix(line, targetPrefix) || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		name, _, _ := strings.Cut(line, ":")
+		lines[i] = fmt.Sprintf("%s:%s", name, version)
+	}
+
+	if dryRun {
+		log.Debug(i18n.G("skipping writing version %s because dry run", version))
+		return nil
+	}
+
+	if err := os.WriteFile(a.Path, []byte(strings.Join(lines, "\n")), os.ModePerm); err != nil {
 		log.Fatal(err)
 	}
 
-	if a.Recipe.Dirty && dirtyVersion != "" {
-		version = dirtyVersion
-	}
-
-	if !dryRun {
-		if err := os.WriteFile(a.Path, []byte(strings.Join(lines, "\n")), os.ModePerm); err != nil {
-			log.Fatal(err)
-		}
-	} else {
-		log.Debug(i18n.G("skipping writing version %s because dry run", version))
-	}
-
-	if !skipped {
-		log.Debug(i18n.G("version %s saved to %s.env", version, a.Domain))
-	} else {
-		log.Debug(i18n.G("skipping version %s write as already exists in %s.env", version, a.Domain))
-	}
+	log.Debug(i18n.G("version %s saved to %s.env", version, a.Domain))
 
 	return nil
 }

pkg/app/app_test.go

@@ -3,6 +3,8 @@ package app_test
 import (
 	"encoding/json"
 	"fmt"
+	"os"
+	"path/filepath"
 	"reflect"
 	"testing"
 
@@ -271,6 +273,60 @@ func TestWriteRecipeVersionOverwrite(t *testing.T) {
 	assert.Equal(t, "foo", app.Recipe.EnvVersion)
 }
 
+// TestWriteRecipeVersionSingleField ensures the version is written to exactly
+// one field: TYPE when present (even alongside a RECIPE source pointer, as with
+// git-URL recipes), otherwise the legacy RECIPE field. RECIPE must stay bare
+// when a TYPE line exists so the two can never drift apart.
+func TestWriteRecipeVersionSingleField(t *testing.T) {
+	cases := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{
+			name:  "git recipe: TYPE and RECIPE both present",
+			input: "TYPE=myrecipe\nRECIPE=git.example.com/user/myrecipe\nDOMAIN=x\n",
+			want:  "TYPE=myrecipe:1.2.3+4.5.6\nRECIPE=git.example.com/user/myrecipe\nDOMAIN=x",
+		},
+		{
+			name:  "git recipe: re-versioning replaces only TYPE",
+			input: "TYPE=myrecipe:0.1.0+1.0.0\nRECIPE=git.example.com/user/myrecipe\nDOMAIN=x\n",
+			want:  "TYPE=myrecipe:1.2.3+4.5.6\nRECIPE=git.example.com/user/myrecipe\nDOMAIN=x",
+		},
+		{
+			name:  "legacy recipe: only RECIPE present",
+			input: "RECIPE=test_recipe\nDOMAIN=x\n",
+			want:  "RECIPE=test_recipe:1.2.3+4.5.6\nDOMAIN=x",
+		},
+		{
+			name:  "catalogue recipe: only TYPE present",
+			input: "TYPE=nextcloud\nDOMAIN=x\n",
+			want:  "TYPE=nextcloud:1.2.3+4.5.6\nDOMAIN=x",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			p := filepath.Join(t.TempDir(), "app.env")
+			if err := os.WriteFile(p, []byte(tc.input), 0o644); err != nil {
+				t.Fatal(err)
+			}
+
+			app := appPkg.App{Path: p, Domain: "x"}
+			if err := app.WriteRecipeVersion("1.2.3+4.5.6", false); err != nil {
+				t.Fatal(err)
+			}
+
+			got, err := os.ReadFile(p)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			assert.Equal(t, tc.want, string(got))
+		})
+	}
+}
+
 func TestWriteRecipeVersionUnknown(t *testing.T) {
 	test.Setup()
 	t.Cleanup(func() { test.Teardown() })

pkg/app/inject_recipe_test.go

@@ -0,0 +1,30 @@
+package app
+
+import "testing"
+
+func TestInjectRecipeLineAfterType(t *testing.T) {
+	in := "DOMAIN=example.com\nTYPE=foo\nVERSION=1.0\n"
+	want := "DOMAIN=example.com\nTYPE=foo\nRECIPE=org/foo\nVERSION=1.0\n"
+	got := injectRecipeLine(in, "org/foo")
+	if got != want {
+		t.Errorf("injectRecipeLine inserted RECIPE in wrong position\nwant:\n%q\ngot:\n%q", want, got)
+	}
+}
+
+func TestInjectRecipeLineReplacesExisting(t *testing.T) {
+	in := "TYPE=foo\nRECIPE=old\nDOMAIN=example.com\n"
+	want := "TYPE=foo\nRECIPE=org/foo\nDOMAIN=example.com\n"
+	got := injectRecipeLine(in, "org/foo")
+	if got != want {
+		t.Errorf("injectRecipeLine should replace existing RECIPE line\nwant:\n%q\ngot:\n%q", want, got)
+	}
+}
+
+func TestInjectRecipeLineNoTypeAppends(t *testing.T) {
+	in := "DOMAIN=example.com\n"
+	want := "DOMAIN=example.com\nRECIPE=org/foo\n"
+	got := injectRecipeLine(in, "org/foo")
+	if got != want {
+		t.Errorf("injectRecipeLine should append when TYPE is missing\nwant:\n%q\ngot:\n%q", want, got)
+	}
+}

pkg/formatter/formatter.go

@@ -27,10 +27,16 @@ var BoldUnderlineStyle = lipgloss.NewStyle().
 	Underline(true)
 
 func ShortenID(str string) string {
+	if len(str) < 12 {
+		return str
+	}
 	return str[:12]
 }
 
 func SmallSHA(hash string) string {
+	if len(hash) < 8 {
+		return hash
+	}
 	return hash[:8]
 }
 

pkg/git/read.go

@@ -36,6 +36,11 @@ func IsClean(repoPath string) (bool, error) {
 		return false, err
 	}
 
+	// Ignore the abra-managed sidecar file that records the canonical
+	// source URL for externally-cloned recipes; it lives alongside the
+	// recipe but is not part of the upstream tree.
+	patterns = append(patterns, gitignore.ParsePattern(".abra-source", nil))
+
 	if len(patterns) > 0 {
 		worktree.Excludes = append(patterns, worktree.Excludes...)
 	}

pkg/git/read_test.go

@@ -2,6 +2,8 @@ package git
 
 import (
 	"errors"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/go-git/go-git/v5"
@@ -13,3 +15,37 @@ func TestIsClean(t *testing.T) {
 	assert.Equal(t, isClean, false)
 	assert.True(t, errors.Is(err, git.ErrRepositoryNotExists))
 }
+
+// TestIsCleanIgnoresAbraSource confirms that the .abra-source sidecar
+// file written by abra next to externally-cloned recipes does not cause
+// IsClean to report the worktree as dirty.
+func TestIsCleanIgnoresAbraSource(t *testing.T) {
+	dir := t.TempDir()
+
+	if _, err := git.PlainInit(dir, false); err != nil {
+		t.Fatalf("git init failed: %s", err)
+	}
+
+	sidecar := filepath.Join(dir, ".abra-source")
+	if err := os.WriteFile(sidecar, []byte("git.example.com/u/recipe\n"), 0o644); err != nil {
+		t.Fatalf("writing sidecar failed: %s", err)
+	}
+
+	isClean, err := IsClean(dir)
+	if err != nil {
+		t.Fatalf("IsClean returned error: %s", err)
+	}
+	assert.True(t, isClean, "expected worktree with only .abra-source to be reported clean")
+
+	// Sanity check: an unrelated untracked file should still mark it dirty.
+	other := filepath.Join(dir, "random.txt")
+	if err := os.WriteFile(other, []byte("hello"), 0o644); err != nil {
+		t.Fatalf("writing extra file failed: %s", err)
+	}
+
+	isClean, err = IsClean(dir)
+	if err != nil {
+		t.Fatalf("IsClean returned error: %s", err)
+	}
+	assert.False(t, isClean, "expected worktree with unrelated untracked file to be reported dirty")
+}

pkg/i18n/locales/es.po

@@ -1,5 +1,17 @@
 msgid ""
-msgstr "Project-Id-Version: \nReport-Msgid-Bugs-To: EMAIL\nPOT-Creation-Date: 2026-06-14 17:56+0200\nPO-Revision-Date: 2026-08-11 06:51+0000\nLast-Translator: chasqui <chasqui@cryptolab.net>\nLanguage-Team: Spanish <https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/>\nLanguage: es\nMIME-Version: 1.0\nContent-Type: text/plain; charset=UTF-8\nContent-Transfer-Encoding: 8bit\nPlural-Forms: nplurals=2; plural=n != 1;\nX-Generator: Weblate 5.12.2\n"
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2026-06-14 17:56+0200\n"
+"PO-Revision-Date: 2026-02-28 13:52+0000\n"
+"Last-Translator: chasqui <chasqui@cryptolab.net>\n"
+"Language-Team: Spanish <https://translate.coopcloud.tech/projects/co-op-cloud/abra/es/>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+"X-Generator: Weblate 5.12.2\n"
 
 #: cli/app/cp.go:38
 msgid ""
@@ -100,7 +112,18 @@ msgid ""
 "\n"
 "  # list apps of all servers which match a specific recipe\n"
 "  abra app ls -r gitea"
-msgstr "  # Listar todas las aplicaciones instaladas con mayor detalle\n  abra aplicacion listar --estado\n\n  # Listar todas las aplicaciones \"wordpress\" (puedes probar otras recetas)\n  abra aplicacion listar --receta wordpress\n\n  # Listar todas las aplicaciones \"wordpress\" con mayor detalle\n  abra aplicacion listar --receta wordpress --estado\n\n  #  Listar todas las aplicaciones instaladas con mayor detalle usando los comandos abreviados\n  abra app ls -S"
+msgstr ""
+"  # Listar las aplicaciones instaladas\n"
+"  abra aplicacion listar\n"
+"\n"
+"  # Listar las aplicaciones instaladas en un servidor específico\n"
+"  abra aplicacion listar -s 1312.net\n"
+"\n"
+"  # Listar aplicaciones instaladas en servidor específico con detalles\n"
+"  abra aplicacion listar -s 1312.net -S\n"
+"\n"
+"  # Listar en qué servidores está desplegada la aplicación \"gitea\"\n"
+"  abra aplicacion listar -r gitea"
 
 #: cli/app/move.go:59
 msgid ""
@@ -490,7 +513,7 @@ msgstr "%s eliminado del almacén de contraseñas"
 #: cli/app/new.go:224
 #, c-format
 msgid "%s requires secret generation before deploy, run \"abra app secret generate %s --all\""
-msgstr "%s requiere generación de secretos antes del despliegue, ejecuta \"abra aplicacion secreto generar %s --todos\""
+msgstr "%s requiere generación de secretos antes del despliegue, ejecuta \"abra aplicacion secreto generar %s --all\""
 
 #: cli/app/new.go:228
 #, c-format
@@ -1084,7 +1107,10 @@ msgid ""
 "Generate a report of all managed apps.\n"
 "\n"
 "Use \"--status/-S\" flag to query all servers for the live deployment status."
-msgstr "BIENVENIDE AL MANUAL DE USO COMANDO \"LISTAR\"\n\nEl comando \"abra aplicacion listar\" permite consultar de forma rápida qué aplicaciones están siendo gestionadas. \nAl ejecutarlo, Abra genera un informe con la lista de aplicaciones disponibles y la información básica de cada una.\nPuedes imaginar el comando listar como una forma de decirle a Abra: «muéstrame qué aplicaciones tengo»\n\nLos comandos pueden aceptar opciones y flags que permiten modificar o ampliar la información que muestran, \nen este caso es bastante útil el uso de \"--estado\". Estas opciones se escriben después del comando siguiendo \nla sintaxis detallada más adelante."
+msgstr ""
+"Genera un informe de todas las aplicaciones gestionadas.\n"
+"\n"
+"Usa la opción \"--estado/-S\" para consultar en todos los servidores sobre el estado de despliegue."
 
 #: cli/app/new.go:321
 msgid "Generate app secrets?"
@@ -1998,7 +2024,33 @@ msgid ""
 "  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}\n"
 "\n"
 "Use \"{{.CommandPath}} [command] --help\" for more information about a command.{{end}}\n"
-msgstr "Sintaxis del comando:{{if .Runnable}}\n  {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}\n  {{.CommandPath}} [command]{{end}}{{if gt (len .Aliases) 0}}\n\nComando y comando abreviado:\n  {{.NameAndAliases}}{{end}}{{if .HasExample}}\n\nUSO DE\"OPCIONES\" y \"FLAGS\":\nImportante: 1312.net es únicamente un ejemplo utilizado para mostrar cómo debe configurarse este campo. No es necesario utilizar este nombre.\nAl ejecutar el comando, reemplaza 1312.net por el nombre o dominio real de tu aplicación.\n\n{{.Example}}{{end}}{{if .HasAvailableSubCommands}}\n\nComandos disponibles:{{range .Commands}}{{if (or .IsAvailableCommand (eq .Name \"help\"))}}\n  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}\n\nOpciones:\n{{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasAvailableInheritedFlags}}\n\nOpciones globales:\n{{.InheritedFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasHelpSubCommands}}\n\nTemas de ayuda adicionales:{{range .Commands}}{{if .IsAdditionalHelpTopicCommand}}\n  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}\n\nUse \"{{.CommandPath}} [command] --help\" para más información sobre un comando.{{end}}\n"
+msgstr ""
+"Uso:{{if .Runnable}}\n"
+"  {{.UseLine}}{{end}}{{if .HasAvailableSubCommands}}\n"
+"  {{.CommandPath}} [command]{{end}}{{if gt (len .Aliases) 0}}\n"
+"\n"
+"Comando:\n"
+"  {{.NameAndAliases}}{{end}}{{if .HasExample}}\n"
+"\n"
+"Ejemplos:\n"
+"  # Nota: \"1312.net\" es solo un ejemplo de nombre de aplicación.\n"
+"# Reemplázalo por el dominio o nombre real de tu aplicación.\n"
+"\n"
+"{{.Example}}{{end}}{{if .HasAvailableSubCommands}}\n"
+"\n"
+"Comandos disponibles:{{range .Commands}}{{if (or .IsAvailableCommand (eq .Name \"help\"))}}\n"
+"  {{rpad .Name .NamePadding }} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableLocalFlags}}\n"
+"\n"
+"Opciones:\n"
+"{{.LocalFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasAvailableInheritedFlags}}\n"
+"\n"
+"Opciones globales:\n"
+"{{.InheritedFlags.FlagUsages | trimTrailingWhitespaces}}{{end}}{{if .HasHelpSubCommands}}\n"
+"\n"
+"Temas de ayuda adicionales:{{range .Commands}}{{if .IsAdditionalHelpTopicCommand}}\n"
+"  {{rpad .CommandPath .CommandPathPadding}} {{.Short}}{{end}}{{end}}{{end}}{{if .HasAvailableSubCommands}}\n"
+"\n"
+"Use \"{{.CommandPath}} [command] --help\" para más información sobre un comando.{{end}}\n"
 
 #: cli/recipe/fetch.go:28
 msgid "Using \"--force/-f\" Git syncs an existing recipe. It does not erase unstaged changes."

pkg/recipe/git.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path"
 	"slices"
 	"sort"
 	"strings"
@@ -16,9 +17,15 @@ import (
 	"coopcloud.tech/tagcmp"
 	"github.com/distribution/reference"
 	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
+// SourceFile is the sidecar file written next to an externally-cloned
+// recipe so the canonical "host/path" name can be recovered later (the
+// on-disk directory name escapes "/" and "." to "_", which is lossy).
+const SourceFile = ".abra-source"
+
 type EnsureContext struct {
 	Chaos            bool
 	Offline          bool
@@ -58,7 +65,7 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 			return errors.New(i18n.G(`cannot redeploy previous chaos version (%s), did you mean to use "--chaos"?`))
 		}
 
-		if _, err := r.EnsureVersion(r.EnvVersion); err != nil {
+		if _, err := r.EnsureVersionCtx(ctx, r.EnvVersion); err != nil {
 			return err
 		}
 
@@ -78,6 +85,12 @@ func (r Recipe) EnsureExists() error {
 		if err := gitPkg.Clone(r.Dir, r.GitURL); err != nil {
 			return err
 		}
+		if strings.Contains(r.Name, "/") {
+			sidecar := path.Join(r.Dir, SourceFile)
+			if err := os.WriteFile(sidecar, []byte(r.Name+"\n"), 0o644); err != nil {
+				log.Debug(i18n.G("failed to write recipe source sidecar %s: %s", sidecar, err))
+			}
+		}
 	}
 
 	if err := gitPkg.EnsureGitRepo(r.Dir); err != nil {
@@ -87,6 +100,18 @@ func (r Recipe) EnsureExists() error {
 	return nil
 }
 
+// ReadRecipeSource returns the canonical name recorded in the .abra-source
+// sidecar inside the given recipe directory, or the empty string if no
+// sidecar exists. This lets callers recover the unescaped "host/path"
+// form for externally-cloned recipes.
+func ReadRecipeSource(recipeDir string) string {
+	data, err := os.ReadFile(path.Join(recipeDir, SourceFile))
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(data))
+}
+
 // IsChaosCommit determines if a version sttring is a chaos commit or not.
 func (r Recipe) IsChaosCommit(version string) (bool, error) {
 	isChaosCommit := false
@@ -124,6 +149,13 @@ func (r Recipe) IsChaosCommit(version string) (bool, error) {
 
 // EnsureVersion checks whether a specific version exists for a recipe.
 func (r Recipe) EnsureVersion(version string) (bool, error) {
+	return r.EnsureVersionCtx(EnsureContext{}, version)
+}
+
+// EnsureVersionCtx is like EnsureVersion but is aware of the surrounding
+// EnsureContext, so that e.g. offline mode can skip network fetches when
+// resolving a branch name that isn't already available locally.
+func (r Recipe) EnsureVersionCtx(ctx EnsureContext, version string) (bool, error) {
 	isChaosCommit := false
 
 	if err := gitPkg.EnsureGitRepo(r.Dir); err != nil {
@@ -158,30 +190,46 @@ func (r Recipe) EnsureVersion(version string) (bool, error) {
 	}
 
 	var opts *git.CheckoutOptions
+	var checkedOutRef string
 	if tagRef.String() == "" {
 		log.Debug(i18n.G("attempting to checkout '%s' as chaos commit", version))
 
-		hash, err := repo.ResolveRevision(plumbing.Revision(version))
-		if err != nil {
-			log.Fatal(i18n.G("unable to resolve '%s': %s", version, err))
-		}
+		hash, hashErr := repo.ResolveRevision(plumbing.Revision(version))
+		if hashErr != nil {
+			branchHash, found, branchErr := resolveBranch(repo, version, ctx.Offline)
+			if errors.Is(branchErr, errOfflineBranchUnresolved) {
+				return isChaosCommit, errors.New(i18n.G("'%s' is not available locally and cannot be fetched in offline mode; retry without --offline", version))
+			}
+			if branchErr != nil {
+				return isChaosCommit, branchErr
+			}
+			if !found {
+				return isChaosCommit, errors.New(i18n.G("unable to resolve '%s': %s", version, hashErr))
+			}
 
-		opts = &git.CheckoutOptions{Hash: *hash, Create: false, Force: true}
-		isChaosCommit = true
+			opts = &git.CheckoutOptions{Hash: branchHash, Create: false, Force: true}
+			isChaosCommit = true
+			checkedOutRef = version
+		} else {
+			opts = &git.CheckoutOptions{Hash: *hash, Create: false, Force: true}
+			isChaosCommit = true
+			checkedOutRef = hash.String()
+		}
 	} else {
 		opts = &git.CheckoutOptions{Branch: tagRef, Create: false, Force: true}
+		checkedOutRef = tagRef.Short()
 	}
 
 	worktree, err := repo.Worktree()
 	if err != nil {
-		return isChaosCommit, nil
+		return isChaosCommit, err
 	}
 
 	if err := worktree.Checkout(opts); err != nil {
-		return isChaosCommit, nil
+		return isChaosCommit, err
 	}
 
-	log.Debug(i18n.G("successfully checked %s out to %s in %s", r.Name, tagRef.Short(), r.Dir))
+	log.Debug(i18n.G("successfully checked %s out to %s in %s", r.Name, checkedOutRef, r.Dir))
 
 	return isChaosCommit, nil
 }
@@ -479,6 +527,51 @@ func (r Recipe) GetRecipeVersions() (RecipeVersions, []string, error) {
 	return versions, uniqueWarnings, nil
 }
 
+// resolveBranch resolves name as a branch on the "origin" remote, fetching
+// it on demand into a remote-tracking ref (never into refs/heads/*, which
+// would corrupt GetDefaultBranch's local-branch-name heuristic). It returns
+// (hash, true, nil) if name is a branch, (_, false, nil) if name is
+// confirmed not to be a branch, and a non-nil error for any other failure
+// (e.g. network/auth issues) that should not be silently treated as "not a
+// branch". When offline is true, no fetch is attempted and only an
+// already-fetched remote-tracking ref is consulted.
+func resolveBranch(repo *git.Repository, name string, offline bool) (plumbing.Hash, bool, error) {
+	remoteTrackingRef := plumbing.NewRemoteReferenceName("origin", name)
+
+	if !offline {
+		refSpec := gitCfg.RefSpec(fmt.Sprintf("+refs/heads/%s:%s", name, remoteTrackingRef))
+		err := repo.Fetch(&git.FetchOptions{
+			RemoteName: "origin",
+			RefSpecs:   []gitCfg.RefSpec{refSpec},
+			Force:      true,
+		})
+		if err != nil {
+			var noMatch git.NoMatchingRefSpecError
+			switch {
+			case errors.Is(err, git.NoErrAlreadyUpToDate):
+			case errors.As(err, &noMatch):
+				return plumbing.ZeroHash, false, nil
+			default:
+				return plumbing.ZeroHash, false, errors.New(i18n.G("unable to fetch branch '%s': %s", name, err))
+			}
+		}
+	}
+
+	ref, err := repo.Reference(remoteTrackingRef, true)
+	if err != nil {
+		if offline {
+			return plumbing.ZeroHash, false, errOfflineBranchUnresolved
+		}
+		return plumbing.ZeroHash, false, errors.New(i18n.G("unable to resolve fetched branch '%s': %s", name, err))
+	}
+
+	return ref.Hash(), true, nil
+}
+
+// errOfflineBranchUnresolved is returned by resolveBranch when offline mode
+// prevents fetching a branch that isn't already available locally.
+var errOfflineBranchUnresolved = errors.New(i18n.G("not fetched and cannot resolve offline"))
+
 // Head retrieves latest HEAD metadata.
 func (r Recipe) Head() (*plumbing.Reference, error) {
 	repo, err := git.PlainOpen(r.Dir)

pkg/recipe/git_test.go

@@ -6,6 +6,8 @@ import (
 	"testing"
 
 	"coopcloud.tech/abra/pkg/test"
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -36,3 +38,122 @@ func TestIsDirty(t *testing.T) {
 
 	assert.True(t, dirty)
 }
+
+func TestEnsureVersionBranch(t *testing.T) {
+	test.SetupWithUpstream()
+	t.Cleanup(func() { test.Teardown() })
+
+	upstream, err := git.PlainOpen(test.UpstreamRecipeDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	featureRef, err := upstream.Reference(plumbing.NewBranchReferenceName(test.FeatureBranch), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := Get(test.RecipeName)
+
+	isChaosCommit, err := r.EnsureVersion(test.FeatureBranch)
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.True(t, isChaosCommit)
+
+	head, err := r.Head()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, featureRef.Hash(), head.Hash())
+}
+
+func TestEnsureVersionBranchRefetchesOnRedeploy(t *testing.T) {
+	test.SetupWithUpstream()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := Get(test.RecipeName)
+
+	if _, err := r.EnsureVersion(test.FeatureBranch); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := test.CreateBranchWithCommit(test.UpstreamRecipeDir, test.FeatureBranch, "feature2.txt", "more feature work"); err != nil {
+		t.Fatal(err)
+	}
+
+	upstream, err := git.PlainOpen(test.UpstreamRecipeDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	featureRef, err := upstream.Reference(plumbing.NewBranchReferenceName(test.FeatureBranch), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := r.EnsureVersion(test.FeatureBranch); err != nil {
+		t.Fatal(err)
+	}
+
+	head, err := r.Head()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, featureRef.Hash(), head.Hash())
+}
+
+func TestEnsureVersionOfflineUnfetchedBranch(t *testing.T) {
+	test.SetupWithUpstream()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := Get(test.RecipeName)
+
+	headBefore, err := r.Head()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = r.EnsureVersionCtx(EnsureContext{Offline: true}, test.FeatureBranch)
+	assert.ErrorContains(t, err, "offline")
+
+	headAfter, err := r.Head()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, headBefore.Hash(), headAfter.Hash())
+}
+
+func TestEnsureVersionUnknownNameErrors(t *testing.T) {
+	test.SetupWithUpstream()
+	t.Cleanup(func() { test.Teardown() })
+
+	r := Get(test.RecipeName)
+
+	_, err := r.EnsureVersion("does-not-exist-anywhere")
+	assert.Error(t, err)
+}
+
+func TestEnsureBranchPinnedRecipe(t *testing.T) {
+	test.SetupWithUpstream()
+	t.Cleanup(func() { test.Teardown() })
+
+	upstream, err := git.PlainOpen(test.UpstreamRecipeDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	featureRef, err := upstream.Reference(plumbing.NewBranchReferenceName(test.FeatureBranch), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	r := Get(test.RecipeName + ":" + test.FeatureBranch)
+
+	if err := r.Ensure(EnsureContext{}); err != nil {
+		t.Fatal(err)
+	}
+
+	head, err := r.Head()
+	if err != nil {
+		t.Fatal(err)
+	}
+	assert.Equal(t, featureRef.Hash(), head.Hash())
+}

pkg/recipe/recipe.go

@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -121,7 +122,84 @@ type Features struct {
 	SSO         string `json:"sso"`
 }
 
+// scpURLPattern matches SCP-style git URLs like git@host:path or git@host:port/path.
+// Captures: 1=host(:port)?, 2=path.
+var scpURLPattern = regexp.MustCompile(`^[\w.-]+@([\w.-]+(?::\d+)?):(.+)$`)
+
+// NormalizeRecipeName canonicalizes a recipe identifier to a stable
+// "host/path" form (or returns short catalog names unchanged). Accepts:
+//
+//   - https://host/path[.git][:version]
+//   - http://host/path[.git][:version]
+//   - ssh://git@host[:port]/path[.git][:version]
+//   - git@host:path[.git][:version]            (SCP-style)
+//   - host/path[.git][:version]                (already canonical)
+//   - short-name[:version]                     (catalog recipe, pass through)
+//
+// The optional trailing :version suffix is preserved verbatim. The .git
+// suffix and trailing slashes on the path are stripped so the four URL
+// forms of the same repository collapse to one canonical value.
+func NormalizeRecipeName(input string) string {
+	input = strings.TrimSpace(input)
+
+	// Split off the version suffix first, but only if it's not part of a
+	// scheme (https://) or SCP-style git@host: prefix. The simplest way is
+	// to detect those prefixes and treat the rest as the path-with-version.
+	var (
+		body    = input
+		version string
+	)
+
+	switch {
+	case strings.HasPrefix(input, "https://") || strings.HasPrefix(input, "http://") || strings.HasPrefix(input, "ssh://"):
+		u, err := url.Parse(input)
+		if err != nil {
+			return input
+		}
+		host := u.Hostname() // strip port to keep canonical form colon-free
+		p := strings.TrimPrefix(u.Path, "/")
+		p, version = splitVersion(p)
+		body = host + "/" + p
+	case scpURLPattern.MatchString(input):
+		m := scpURLPattern.FindStringSubmatch(input)
+		host := m[1]
+		if i := strings.Index(host, ":"); i >= 0 {
+			host = host[:i] // strip port
+		}
+		p, v := splitVersion(m[2])
+		body = host + "/" + p
+		version = v
+	default:
+		body, version = splitVersion(input)
+	}
+
+	body = strings.TrimSuffix(body, "/")
+	body = strings.TrimSuffix(body, ".git")
+
+	if version != "" {
+		return body + ":" + version
+	}
+	return body
+}
+
+// splitVersion separates a trailing ":version" suffix from a recipe path.
+// It only treats the final colon-separated segment as a version when it is
+// non-empty and contains no slash (a slash means the colon belonged to the
+// path, e.g. a host:port or scheme separator).
+func splitVersion(s string) (string, string) {
+	idx := strings.LastIndex(s, ":")
+	if idx < 0 {
+		return s, ""
+	}
+	candidate := s[idx+1:]
+	if candidate == "" || strings.Contains(candidate, "/") {
+		return s, ""
+	}
+	return s[:idx], candidate
+}
+
 func Get(name string) Recipe {
+	name = NormalizeRecipeName(name)
 	version := ""
 	versionRaw := ""
 	if strings.Contains(name, ":") {
@@ -209,6 +287,16 @@ func (r Recipe) String() string {
 	return out
 }
 
+// ShortName returns the final path segment of the recipe name, i.e. the
+// bare recipe name without any "host/org/" prefix carried by externally
+// sourced (git URL) recipes. For catalogue recipes it returns Name unchanged.
+func (r Recipe) ShortName() string {
+	if i := strings.LastIndex(r.Name, "/"); i >= 0 {
+		return r.Name[i+1:]
+	}
+	return r.Name
+}
+
 func escapeRecipeName(recipeName string) string {
 	recipeName = strings.ReplaceAll(recipeName, "/", "_")
 	recipeName = strings.ReplaceAll(recipeName, ".", "_")

pkg/recipe/recipe_test.go

@@ -88,6 +88,88 @@ func TestGet(t *testing.T) {
 				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
 			},
 		},
+		{
+			name: "https://mygit.org/myorg/cool-recipe",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "https://mygit.org/myorg/cool-recipe.git",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "https://mygit.org/myorg/cool-recipe.git:1.2.4",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				EnvVersion:    "1.2.4",
+				EnvVersionRaw: "1.2.4",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "ssh://git@mygit.org/myorg/cool-recipe.git",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "git@mygit.org:myorg/cool-recipe.git",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
+		{
+			name: "git@mygit.org:myorg/cool-recipe:1.2.4",
+			recipe: Recipe{
+				Name:          "mygit.org/myorg/cool-recipe",
+				EnvVersion:    "1.2.4",
+				EnvVersionRaw: "1.2.4",
+				Dir:           path.Join(cfg.GetAbraDir(), "/recipes/mygit_org_myorg_cool-recipe"),
+				GitURL:        "https://mygit.org/myorg/cool-recipe.git",
+				SSHURL:        "ssh://git@mygit.org/myorg/cool-recipe.git",
+				ComposePath:   path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/compose.yml"),
+				ReadmePath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/README.md"),
+				SampleEnvPath: path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/.env.sample"),
+				AbraShPath:    path.Join(cfg.GetAbraDir(), "recipes/mygit_org_myorg_cool-recipe/abra.sh"),
+			},
+		},
 	}
 
 	for _, tc := range testcases {
@@ -101,6 +183,49 @@ func TestGet(t *testing.T) {
 	}
 }
 
+func TestNormalizeRecipeName(t *testing.T) {
+	cases := []struct {
+		in, want string
+	}{
+		// catalog short names pass through
+		{"foo", "foo"},
+		{"foo:1.2.3", "foo:1.2.3"},
+
+		// bare host/path form
+		{"mygit.org/myorg/cool-recipe", "mygit.org/myorg/cool-recipe"},
+		{"mygit.org/myorg/cool-recipe.git", "mygit.org/myorg/cool-recipe"},
+		{"mygit.org/myorg/cool-recipe.git:1.2.3", "mygit.org/myorg/cool-recipe:1.2.3"},
+		{"mygit.org/myorg/cool-recipe/", "mygit.org/myorg/cool-recipe"},
+
+		// https://
+		{"https://mygit.org/myorg/cool-recipe", "mygit.org/myorg/cool-recipe"},
+		{"https://mygit.org/myorg/cool-recipe.git", "mygit.org/myorg/cool-recipe"},
+		{"https://mygit.org/myorg/cool-recipe.git:1.2.3", "mygit.org/myorg/cool-recipe:1.2.3"},
+		{"http://mygit.org/myorg/cool-recipe", "mygit.org/myorg/cool-recipe"},
+
+		// ssh://, with and without port
+		{"ssh://git@mygit.org/myorg/cool-recipe.git", "mygit.org/myorg/cool-recipe"},
+		{"ssh://git@mygit.org:2222/myorg/cool-recipe.git", "mygit.org/myorg/cool-recipe"},
+
+		// SCP-style git@host:path
+		{"git@mygit.org:myorg/cool-recipe", "mygit.org/myorg/cool-recipe"},
+		{"git@mygit.org:myorg/cool-recipe.git", "mygit.org/myorg/cool-recipe"},
+		{"git@mygit.org:myorg/cool-recipe:1.2.3", "mygit.org/myorg/cool-recipe:1.2.3"},
+
+		// whitespace
+		{"  https://mygit.org/myorg/cool-recipe  ", "mygit.org/myorg/cool-recipe"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.in, func(t *testing.T) {
+			got := NormalizeRecipeName(tc.in)
+			if got != tc.want {
+				t.Errorf("NormalizeRecipeName(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestGetVersionLabelLocalDoesNotUseTimeoutLabel(t *testing.T) {
 	test.Setup()
 	t.Cleanup(func() { test.Teardown() })

pkg/secret/testdir/compose.yaml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.31.4
+    image: nginx:1.31.3
     secrets:
       - test_pass_one
       - test_pass_two

pkg/test/test.go

@@ -8,6 +8,9 @@ import (
 
 	gitPkg "coopcloud.tech/abra/pkg/git"
 	"git.coopcloud.tech/toolshed/godotenv"
+	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/object"
 )
 
 var (
@@ -76,6 +79,126 @@ func Setup() {
 	}
 }
 
+// UpstreamRecipeDir is the "remote" repo used by SetupWithUpstream, kept
+// outside recipes/ so Teardown's blanket removal of $ABRA_DIR still cleans
+// it up.
+var UpstreamRecipeDir = os.ExpandEnv("$ABRA_DIR/_upstream/test_recipe")
+
+// FeatureBranch is the non-default branch created by SetupWithUpstream.
+const FeatureBranch = "feature"
+
+// SetupWithUpstream is like Setup, but the recipe under $ABRA_DIR/recipes
+// is a real clone of a separate "upstream" repo (UpstreamRecipeDir) rather
+// than a git-inited copy of the fixture. The upstream repo additionally has
+// a FeatureBranch with one extra commit not present on main, so tests can
+// exercise resolving/fetching a non-default branch as a recipe :version.
+func SetupWithUpstream() {
+	Teardown()
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/servers"), 0700); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+
+	if err := os.Mkdir(os.ExpandEnv("$ABRA_DIR/recipes"), 0764); err != nil {
+		if !os.IsExist(err) {
+			log.Fatal(err)
+		}
+	}
+
+	serverSrcDir := os.ExpandEnv("$PWD/../../tests/resources/test_server")
+	serverDestDir := os.ExpandEnv("$ABRA_DIR/servers/test_server")
+	if err := os.CopyFS(serverDestDir, os.DirFS(serverSrcDir)); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := os.MkdirAll(path.Dir(UpstreamRecipeDir), 0764); err != nil {
+		log.Fatal(err)
+	}
+
+	recipeSrcDir := os.ExpandEnv("$PWD/../../tests/resources/test_recipe")
+	if err := os.CopyFS(UpstreamRecipeDir, os.DirFS(recipeSrcDir)); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := os.WriteFile(path.Join(UpstreamRecipeDir, ".env.sample"), []byte("TYPE=test_recipe\n"), 0o644); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := gitPkg.Init(UpstreamRecipeDir, true, "tester", "helo@coopcloud.tech"); err != nil {
+		log.Fatal(err)
+	}
+
+	if err := CreateBranchWithCommit(UpstreamRecipeDir, FeatureBranch, "feature.txt", "feature work"); err != nil {
+		log.Fatal(err)
+	}
+
+	recipeDestDir := os.ExpandEnv("$ABRA_DIR/recipes/test_recipe")
+	if err := gitPkg.Clone(recipeDestDir, UpstreamRecipeDir); err != nil {
+		log.Fatal(err)
+	}
+}
+
+// CreateBranchWithCommit checks out branchName in repoPath (creating it off
+// the current HEAD if it doesn't exist yet, or extending it if it does),
+// writes fileName with contents, commits it, then returns to the repo's
+// default branch (leaving the new commit reachable only via the branch's
+// ref, matching how a contributor would push a feature branch upstream
+// without switching the repo's HEAD away from main).
+func CreateBranchWithCommit(repoPath, branchName, fileName, contents string) error {
+	repo, err := git.PlainOpen(repoPath)
+	if err != nil {
+		return err
+	}
+
+	head, err := repo.Head()
+	if err != nil {
+		return err
+	}
+
+	worktree, err := repo.Worktree()
+	if err != nil {
+		return err
+	}
+
+	branchRef := plumbing.NewBranchReferenceName(branchName)
+	create := true
+	if _, err := repo.Reference(branchRef, true); err == nil {
+		create = false
+	}
+
+	checkoutOpts := &git.CheckoutOptions{Branch: branchRef, Create: create}
+	if create {
+		checkoutOpts.Hash = head.Hash()
+	}
+	if err := worktree.Checkout(checkoutOpts); err != nil {
+		return err
+	}
+
+	if err := os.WriteFile(path.Join(repoPath, fileName), []byte(contents), 0o644); err != nil {
+		return err
+	}
+
+	if _, err := worktree.Add(fileName); err != nil {
+		return err
+	}
+
+	if _, err := worktree.Commit(fileName, &git.CommitOptions{
+		Author: &object.Signature{Name: "tester", Email: "helo@coopcloud.tech"},
+	}); err != nil {
+		return err
+	}
+
+	return worktree.Checkout(&git.CheckoutOptions{Branch: head.Name()})
+}
+
 func AddEnv(envKey, envValue string) error {
 	filePath := os.ExpandEnv(fmt.Sprintf("$ABRA_DIR/servers/%s/%s.env", ServerName, AppName))
 

tests/resources/test_recipe/compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.31.4
+    image: nginx:1.31.3
     networks:
       - proxy
     deploy:

vendor/coopcloud.tech/tagcmp/.drone.yml

@@ -3,16 +3,16 @@ kind: pipeline
 name: coopcloud.tech/tagcmp
 steps:
   - name: gofmt
-    image: golang:1.27
+    image: golang:1.26
     commands:
       - test -z "$(gofmt -l .)"
 
   - name: go build
-    image: golang:1.27
+    image: golang:1.26
     commands:
       - go build -v .
 
   - name: go test
-    image: golang:1.27
+    image: golang:1.26
     commands:
       - go test . -cover

vendor/github.com/davecgh/go-spew/spew/bypass.go

@@ -18,7 +18,6 @@
 // tag is deprecated and thus should not be used.
 // Go versions prior to 1.4 are disabled because they use a different layout
 // for interfaces which make the implementation of unsafeReflectValue more complex.
-//go:build !js && !appengine && !safe && !disableunsafe && go1.4
 // +build !js,!appengine,!safe,!disableunsafe,go1.4
 
 package spew

vendor/github.com/davecgh/go-spew/spew/bypasssafe.go

@@ -16,7 +16,6 @@
 // when the code is running on Google App Engine, compiled by GopherJS, or
 // "-tags safe" is added to the go build command line.  The "disableunsafe"
 // tag is deprecated and thus should not be used.
-//go:build js || appengine || safe || disableunsafe || !go1.4
 // +build js appengine safe disableunsafe !go1.4
 
 package spew

vendor/github.com/davecgh/go-spew/spew/config.go

@@ -254,15 +254,15 @@ pointer addresses used to indirect to the final value.  It provides the
 following features over the built-in printing facilities provided by the fmt
 package:
 
-  - Pointers are dereferenced and followed
-  - Circular data structures are detected and handled properly
-  - Custom Stringer/error interfaces are optionally invoked, including
-    on unexported types
-  - Custom types which only implement the Stringer/error interfaces via
-    a pointer receiver are optionally invoked when passing non-pointer
-    variables
-  - Byte arrays and slices are dumped like the hexdump -C command which
-    includes offsets, byte values in hex, and ASCII output
+	* Pointers are dereferenced and followed
+	* Circular data structures are detected and handled properly
+	* Custom Stringer/error interfaces are optionally invoked, including
+	  on unexported types
+	* Custom types which only implement the Stringer/error interfaces via
+	  a pointer receiver are optionally invoked when passing non-pointer
+	  variables
+	* Byte arrays and slices are dumped like the hexdump -C command which
+	  includes offsets, byte values in hex, and ASCII output
 
 The configuration options are controlled by modifying the public members
 of c.  See ConfigState for options documentation.
@@ -295,12 +295,12 @@ func (c *ConfigState) convertArgs(args []interface{}) (formatters []interface{})
 
 // NewDefaultConfig returns a ConfigState with the following default settings.
 //
-//	Indent: " "
-//	MaxDepth: 0
-//	DisableMethods: false
-//	DisablePointerMethods: false
-//	ContinueOnMethod: false
-//	SortKeys: false
+// 	Indent: " "
+// 	MaxDepth: 0
+// 	DisableMethods: false
+// 	DisablePointerMethods: false
+// 	ContinueOnMethod: false
+// 	SortKeys: false
 func NewDefaultConfig() *ConfigState {
 	return &ConfigState{Indent: " "}
 }

vendor/github.com/davecgh/go-spew/spew/doc.go

@@ -21,36 +21,35 @@ debugging.
 A quick overview of the additional features spew provides over the built-in
 printing facilities for Go data types are as follows:
 
-  - Pointers are dereferenced and followed
-  - Circular data structures are detected and handled properly
-  - Custom Stringer/error interfaces are optionally invoked, including
-    on unexported types
-  - Custom types which only implement the Stringer/error interfaces via
-    a pointer receiver are optionally invoked when passing non-pointer
-    variables
-  - Byte arrays and slices are dumped like the hexdump -C command which
-    includes offsets, byte values in hex, and ASCII output (only when using
-    Dump style)
+	* Pointers are dereferenced and followed
+	* Circular data structures are detected and handled properly
+	* Custom Stringer/error interfaces are optionally invoked, including
+	  on unexported types
+	* Custom types which only implement the Stringer/error interfaces via
+	  a pointer receiver are optionally invoked when passing non-pointer
+	  variables
+	* Byte arrays and slices are dumped like the hexdump -C command which
+	  includes offsets, byte values in hex, and ASCII output (only when using
+	  Dump style)
 
 There are two different approaches spew allows for dumping Go data structures:
 
-  - Dump style which prints with newlines, customizable indentation,
-    and additional debug information such as types and all pointer addresses
-    used to indirect to the final value
-  - A custom Formatter interface that integrates cleanly with the standard fmt
-    package and replaces %v, %+v, %#v, and %#+v to provide inline printing
-    similar to the default %v while providing the additional functionality
-    outlined above and passing unsupported format verbs such as %x and %q
-    along to fmt
+	* Dump style which prints with newlines, customizable indentation,
+	  and additional debug information such as types and all pointer addresses
+	  used to indirect to the final value
+	* A custom Formatter interface that integrates cleanly with the standard fmt
+	  package and replaces %v, %+v, %#v, and %#+v to provide inline printing
+	  similar to the default %v while providing the additional functionality
+	  outlined above and passing unsupported format verbs such as %x and %q
+	  along to fmt
 
-# Quick Start
+Quick Start
 
 This section demonstrates how to quickly get started with spew.  See the
 sections below for further details on formatting and configuration options.
 
 To dump a variable with full newlines, indentation, type, and pointer
 information use Dump, Fdump, or Sdump:
-
 	spew.Dump(myVar1, myVar2, ...)
 	spew.Fdump(someWriter, myVar1, myVar2, ...)
 	str := spew.Sdump(myVar1, myVar2, ...)
@@ -59,13 +58,12 @@ Alternatively, if you would prefer to use format strings with a compacted inline
 printing style, use the convenience wrappers Printf, Fprintf, etc with
 %v (most compact), %+v (adds pointer addresses), %#v (adds types), or
 %#+v (adds types and pointer addresses):
-
 	spew.Printf("myVar1: %v -- myVar2: %+v", myVar1, myVar2)
 	spew.Printf("myVar3: %#v -- myVar4: %#+v", myVar3, myVar4)
 	spew.Fprintf(someWriter, "myVar1: %v -- myVar2: %+v", myVar1, myVar2)
 	spew.Fprintf(someWriter, "myVar3: %#v -- myVar4: %#+v", myVar3, myVar4)
 
-# Configuration Options
+Configuration Options
 
 Configuration of spew is handled by fields in the ConfigState type.  For
 convenience, all of the top-level functions use a global state available
@@ -76,52 +74,51 @@ equivalent to the top-level functions.  This allows concurrent configuration
 options.  See the ConfigState documentation for more details.
 
 The following configuration options are available:
+	* Indent
+		String to use for each indentation level for Dump functions.
+		It is a single space by default.  A popular alternative is "\t".
 
-  - Indent
-    String to use for each indentation level for Dump functions.
-    It is a single space by default.  A popular alternative is "\t".
+	* MaxDepth
+		Maximum number of levels to descend into nested data structures.
+		There is no limit by default.
 
-  - MaxDepth
-    Maximum number of levels to descend into nested data structures.
-    There is no limit by default.
+	* DisableMethods
+		Disables invocation of error and Stringer interface methods.
+		Method invocation is enabled by default.
 
-  - DisableMethods
-    Disables invocation of error and Stringer interface methods.
-    Method invocation is enabled by default.
+	* DisablePointerMethods
+		Disables invocation of error and Stringer interface methods on types
+		which only accept pointer receivers from non-pointer variables.
+		Pointer method invocation is enabled by default.
 
-  - DisablePointerMethods
-    Disables invocation of error and Stringer interface methods on types
-    which only accept pointer receivers from non-pointer variables.
-    Pointer method invocation is enabled by default.
+	* DisablePointerAddresses
+		DisablePointerAddresses specifies whether to disable the printing of
+		pointer addresses. This is useful when diffing data structures in tests.
 
-  - DisablePointerAddresses
-    DisablePointerAddresses specifies whether to disable the printing of
-    pointer addresses. This is useful when diffing data structures in tests.
+	* DisableCapacities
+		DisableCapacities specifies whether to disable the printing of
+		capacities for arrays, slices, maps and channels. This is useful when
+		diffing data structures in tests.
 
-  - DisableCapacities
-    DisableCapacities specifies whether to disable the printing of
-    capacities for arrays, slices, maps and channels. This is useful when
-    diffing data structures in tests.
+	* ContinueOnMethod
+		Enables recursion into types after invoking error and Stringer interface
+		methods. Recursion after method invocation is disabled by default.
 
-  - ContinueOnMethod
-    Enables recursion into types after invoking error and Stringer interface
-    methods. Recursion after method invocation is disabled by default.
+	* SortKeys
+		Specifies map keys should be sorted before being printed. Use
+		this to have a more deterministic, diffable output.  Note that
+		only native types (bool, int, uint, floats, uintptr and string)
+		and types which implement error or Stringer interfaces are
+		supported with other types sorted according to the
+		reflect.Value.String() output which guarantees display
+		stability.  Natural map order is used by default.
 
-  - SortKeys
-    Specifies map keys should be sorted before being printed. Use
-    this to have a more deterministic, diffable output.  Note that
-    only native types (bool, int, uint, floats, uintptr and string)
-    and types which implement error or Stringer interfaces are
-    supported with other types sorted according to the
-    reflect.Value.String() output which guarantees display
-    stability.  Natural map order is used by default.
+	* SpewKeys
+		Specifies that, as a last resort attempt, map keys should be
+		spewed to strings and sorted by those strings.  This is only
+		considered if SortKeys is true.
 
-  - SpewKeys
-    Specifies that, as a last resort attempt, map keys should be
-    spewed to strings and sorted by those strings.  This is only
-    considered if SortKeys is true.
-
-# Dump Usage
+Dump Usage
 
 Simply call spew.Dump with a list of variables you want to dump:
 
@@ -136,7 +133,7 @@ A third option is to call spew.Sdump to get the formatted output as a string:
 
 	str := spew.Sdump(myVar1, myVar2, ...)
 
-# Sample Dump Output
+Sample Dump Output
 
 See the Dump example for details on the setup of the types and variables being
 shown here.
@@ -153,14 +150,13 @@ shown here.
 
 Byte (and uint8) arrays and slices are displayed uniquely like the hexdump -C
 command as shown.
-
 	([]uint8) (len=32 cap=32) {
 	 00000000  11 12 13 14 15 16 17 18  19 1a 1b 1c 1d 1e 1f 20  |............... |
 	 00000010  21 22 23 24 25 26 27 28  29 2a 2b 2c 2d 2e 2f 30  |!"#$%&'()*+,-./0|
 	 00000020  31 32                                             |12|
 	}
 
-# Custom Formatter
+Custom Formatter
 
 Spew provides a custom formatter that implements the fmt.Formatter interface
 so that it integrates cleanly with standard fmt package printing functions. The
@@ -174,7 +170,7 @@ standard fmt package for formatting.  In addition, the custom formatter ignores
 the width and precision arguments (however they will still work on the format
 specifiers not handled by the custom formatter).
 
-# Custom Formatter Usage
+Custom Formatter Usage
 
 The simplest way to make use of the spew custom formatter is to call one of the
 convenience functions such as spew.Printf, spew.Println, or spew.Printf.  The
@@ -188,17 +184,15 @@ functions have syntax you are most likely already familiar with:
 
 See the Index for the full list convenience functions.
 
-# Sample Formatter Output
+Sample Formatter Output
 
 Double pointer to a uint8:
-
 	  %v: <**>5
 	 %+v: <**>(0xf8400420d0->0xf8400420c8)5
 	 %#v: (**uint8)5
 	%#+v: (**uint8)(0xf8400420d0->0xf8400420c8)5
 
 Pointer to circular struct with a uint8 field and a pointer to itself:
-
 	  %v: <*>{1 <*><shown>}
 	 %+v: <*>(0xf84003e260){ui8:1 c:<*>(0xf84003e260)<shown>}
 	 %#v: (*main.circular){ui8:(uint8)1 c:(*main.circular)<shown>}
@@ -207,7 +201,7 @@ Pointer to circular struct with a uint8 field and a pointer to itself:
 See the Printf example for details on the setup of variables being shown
 here.
 
-# Errors
+Errors
 
 Since it is possible for custom Stringer/error interfaces to panic, spew
 detects them and handles them internally by printing the panic information

vendor/github.com/davecgh/go-spew/spew/dump.go

@@ -488,15 +488,15 @@ pointer addresses used to indirect to the final value.  It provides the
 following features over the built-in printing facilities provided by the fmt
 package:
 
-  - Pointers are dereferenced and followed
-  - Circular data structures are detected and handled properly
-  - Custom Stringer/error interfaces are optionally invoked, including
-    on unexported types
-  - Custom types which only implement the Stringer/error interfaces via
-    a pointer receiver are optionally invoked when passing non-pointer
-    variables
-  - Byte arrays and slices are dumped like the hexdump -C command which
-    includes offsets, byte values in hex, and ASCII output
+	* Pointers are dereferenced and followed
+	* Circular data structures are detected and handled properly
+	* Custom Stringer/error interfaces are optionally invoked, including
+	  on unexported types
+	* Custom types which only implement the Stringer/error interfaces via
+	  a pointer receiver are optionally invoked when passing non-pointer
+	  variables
+	* Byte arrays and slices are dumped like the hexdump -C command which
+	  includes offsets, byte values in hex, and ASCII output
 
 The configuration options are controlled by an exported package global,
 spew.Config.  See ConfigState for options documentation.

vendor/github.com/pjbgf/sha1cd/Dockerfile.arm

@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
+FROM golang:1.26@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647
 
 ENV GOOS=linux
 ENV GOARCH=arm

vendor/github.com/pjbgf/sha1cd/Dockerfile.arm64

@@ -1,4 +1,4 @@
-FROM golang:1.27@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb
+FROM golang:1.26@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647
 
 ENV GOOS=linux
 ENV GOARCH=arm64

vendor/github.com/pmezard/go-difflib/LICENSE

@@ -24,4 +24,4 @@ TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/pmezard/go-difflib/difflib/difflib.go

@@ -8,14 +8,11 @@
 //
 // - unified_diff
 //
+// - context_diff
+//
 // Getting unified diffs was the main goal of the port. Keep in mind this code
 // is mostly suitable to output text differences in a human friendly way, there
 // are no guarantees generated diffs are consumable by patch(1).
-//
-// This package was adopted from [github.com/pmezard/go-difflib] which
-// is no longer maintained.
-//
-// [github.com/pmezard/go-difflib]: https://github.com/pmezard/go-difflib
 package difflib
 
 import (
@@ -40,6 +37,13 @@ func max(a, b int) int {
 	return b
 }
 
+func calculateRatio(matches, length int) float64 {
+	if length > 0 {
+		return 2.0 * float64(matches) / float64(length)
+	}
+	return 1.0
+}
+
 type Match struct {
 	A    int
 	B    int
@@ -99,6 +103,14 @@ func NewMatcher(a, b []string) *SequenceMatcher {
 	return &m
 }
 
+func NewMatcherWithJunk(a, b []string, autoJunk bool,
+	isJunk func(string) bool) *SequenceMatcher {
+
+	m := SequenceMatcher{IsJunk: isJunk, autoJunk: autoJunk}
+	m.SetSeqs(a, b)
+	return &m
+}
+
 // Set two sequences to be compared.
 func (m *SequenceMatcher) SetSeqs(a, b []string) {
 	m.SetSeq1(a)
@@ -187,15 +199,12 @@ func (m *SequenceMatcher) isBJunk(s string) bool {
 // If IsJunk is not defined:
 //
 // Return (i,j,k) such that a[i:i+k] is equal to b[j:j+k], where
-//
-//	alo <= i <= i+k <= ahi
-//	blo <= j <= j+k <= bhi
-//
+//     alo <= i <= i+k <= ahi
+//     blo <= j <= j+k <= bhi
 // and for all (i',j',k') meeting those conditions,
-//
-//	k >= k'
-//	i <= i'
-//	and if i == i', j <= j'
+//     k >= k'
+//     i <= i'
+//     and if i == i', j <= j'
 //
 // In other words, of all maximal matching blocks, return one that
 // starts earliest in a, and of all those maximal matching blocks that
@@ -442,6 +451,66 @@ func (m *SequenceMatcher) GetGroupedOpCodes(n int) [][]OpCode {
 	return groups
 }
 
+// Return a measure of the sequences' similarity (float in [0,1]).
+//
+// Where T is the total number of elements in both sequences, and
+// M is the number of matches, this is 2.0*M / T.
+// Note that this is 1 if the sequences are identical, and 0 if
+// they have nothing in common.
+//
+// .Ratio() is expensive to compute if you haven't already computed
+// .GetMatchingBlocks() or .GetOpCodes(), in which case you may
+// want to try .QuickRatio() or .RealQuickRation() first to get an
+// upper bound.
+func (m *SequenceMatcher) Ratio() float64 {
+	matches := 0
+	for _, m := range m.GetMatchingBlocks() {
+		matches += m.Size
+	}
+	return calculateRatio(matches, len(m.a)+len(m.b))
+}
+
+// Return an upper bound on ratio() relatively quickly.
+//
+// This isn't defined beyond that it is an upper bound on .Ratio(), and
+// is faster to compute.
+func (m *SequenceMatcher) QuickRatio() float64 {
+	// viewing a and b as multisets, set matches to the cardinality
+	// of their intersection; this counts the number of matches
+	// without regard to order, so is clearly an upper bound
+	if m.fullBCount == nil {
+		m.fullBCount = map[string]int{}
+		for _, s := range m.b {
+			m.fullBCount[s] = m.fullBCount[s] + 1
+		}
+	}
+
+	// avail[x] is the number of times x appears in 'b' less the
+	// number of times we've seen it in 'a' so far ... kinda
+	avail := map[string]int{}
+	matches := 0
+	for _, s := range m.a {
+		n, ok := avail[s]
+		if !ok {
+			n = m.fullBCount[s]
+		}
+		avail[s] = n - 1
+		if n > 0 {
+			matches += 1
+		}
+	}
+	return calculateRatio(matches, len(m.a)+len(m.b))
+}
+
+// Return an upper bound on ratio() very quickly.
+//
+// This isn't defined beyond that it is an upper bound on .Ratio(), and
+// is faster to compute than either .Ratio() or .QuickRatio().
+func (m *SequenceMatcher) RealQuickRatio() float64 {
+	la, lb := len(m.a), len(m.b)
+	return calculateRatio(min(la, lb), la+lb)
+}
+
 // Convert range to the "ed" format
 func formatRangeUnified(start, stop int) string {
 	// Per the diff spec at http://www.unix.org/single_unix_specification/
@@ -583,6 +652,117 @@ func formatRangeContext(start, stop int) string {
 	return fmt.Sprintf("%d,%d", beginning, beginning+length-1)
 }
 
+type ContextDiff UnifiedDiff
+
+// Compare two sequences of lines; generate the delta as a context diff.
+//
+// Context diffs are a compact way of showing line changes and a few
+// lines of context. The number of context lines is set by diff.Context
+// which defaults to three.
+//
+// By default, the diff control lines (those with *** or ---) are
+// created with a trailing newline.
+//
+// For inputs that do not have trailing newlines, set the diff.Eol
+// argument to "" so that the output will be uniformly newline free.
+//
+// The context diff format normally has a header for filenames and
+// modification times.  Any or all of these may be specified using
+// strings for diff.FromFile, diff.ToFile, diff.FromDate, diff.ToDate.
+// The modification times are normally expressed in the ISO 8601 format.
+// If not specified, the strings default to blanks.
+func WriteContextDiff(writer io.Writer, diff ContextDiff) error {
+	buf := bufio.NewWriter(writer)
+	defer buf.Flush()
+	var diffErr error
+	wf := func(format string, args ...interface{}) {
+		_, err := buf.WriteString(fmt.Sprintf(format, args...))
+		if diffErr == nil && err != nil {
+			diffErr = err
+		}
+	}
+	ws := func(s string) {
+		_, err := buf.WriteString(s)
+		if diffErr == nil && err != nil {
+			diffErr = err
+		}
+	}
+
+	if len(diff.Eol) == 0 {
+		diff.Eol = "\n"
+	}
+
+	prefix := map[byte]string{
+		'i': "+ ",
+		'd': "- ",
+		'r': "! ",
+		'e': "  ",
+	}
+
+	started := false
+	m := NewMatcher(diff.A, diff.B)
+	for _, g := range m.GetGroupedOpCodes(diff.Context) {
+		if !started {
+			started = true
+			fromDate := ""
+			if len(diff.FromDate) > 0 {
+				fromDate = "\t" + diff.FromDate
+			}
+			toDate := ""
+			if len(diff.ToDate) > 0 {
+				toDate = "\t" + diff.ToDate
+			}
+			if diff.FromFile != "" || diff.ToFile != "" {
+				wf("*** %s%s%s", diff.FromFile, fromDate, diff.Eol)
+				wf("--- %s%s%s", diff.ToFile, toDate, diff.Eol)
+			}
+		}
+
+		first, last := g[0], g[len(g)-1]
+		ws("***************" + diff.Eol)
+
+		range1 := formatRangeContext(first.I1, last.I2)
+		wf("*** %s ****%s", range1, diff.Eol)
+		for _, c := range g {
+			if c.Tag == 'r' || c.Tag == 'd' {
+				for _, cc := range g {
+					if cc.Tag == 'i' {
+						continue
+					}
+					for _, line := range diff.A[cc.I1:cc.I2] {
+						ws(prefix[cc.Tag] + line)
+					}
+				}
+				break
+			}
+		}
+
+		range2 := formatRangeContext(first.J1, last.J2)
+		wf("--- %s ----%s", range2, diff.Eol)
+		for _, c := range g {
+			if c.Tag == 'r' || c.Tag == 'i' {
+				for _, cc := range g {
+					if cc.Tag == 'd' {
+						continue
+					}
+					for _, line := range diff.B[cc.J1:cc.J2] {
+						ws(prefix[cc.Tag] + line)
+					}
+				}
+				break
+			}
+		}
+	}
+	return diffErr
+}
+
+// Like WriteContextDiff but returns the diff a string.
+func GetContextDiffString(diff ContextDiff) (string, error) {
+	w := &bytes.Buffer{}
+	err := WriteContextDiff(w, diff)
+	return string(w.Bytes()), err
+}
+
 // Split a string on "\n" while preserving them. The output can be used
 // as input for UnifiedDiff and ContextDiff structures.
 func SplitLines(s string) []string {

vendor/github.com/stretchr/testify/assert/assertion_format.go

@@ -84,7 +84,7 @@ func Equalf(t TestingT, expected interface{}, actual interface{}, msg string, ar
 	return Equal(t, expected, actual, append([]interface{}{msg}, args...)...)
 }
 
-// EqualErrorf asserts that a function returned a non-nil error (i.e. an error)
+// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
 // and that it is equal to the provided error.
 //
 //	actualObj, err := SomeFunction()
@@ -124,7 +124,7 @@ func EqualValuesf(t TestingT, expected interface{}, actual interface{}, msg stri
 	return EqualValues(t, expected, actual, append([]interface{}{msg}, args...)...)
 }
 
-// Errorf asserts that a function returned a non-nil error (ie. an error).
+// Errorf asserts that a function returned an error (i.e. not `nil`).
 //
 //	actualObj, err := SomeFunction()
 //	assert.Errorf(t, err, "error message %s", "formatted")
@@ -144,8 +144,8 @@ func ErrorAsf(t TestingT, err error, target interface{}, msg string, args ...int
 	return ErrorAs(t, err, target, append([]interface{}{msg}, args...)...)
 }
 
-// ErrorContainsf asserts that a function returned a non-nil error (i.e. an
-// error) and that the error contains the specified substring.
+// ErrorContainsf asserts that a function returned an error (i.e. not `nil`)
+// and that the error contains the specified substring.
 //
 //	actualObj, err := SomeFunction()
 //	assert.ErrorContainsf(t, err,  expectedErrorSubString, "error message %s", "formatted")
@@ -190,10 +190,10 @@ func Eventuallyf(t TestingT, condition func() bool, waitFor time.Duration, tick
 //		time.Sleep(8*time.Second)
 //		externalValue = true
 //	}()
-//	assert.EventuallyWithTf(t, func(c *assert.CollectT) {
+//	assert.EventuallyWithTf(t, func(c *assert.CollectT, "error message %s", "formatted") {
 //		// add assertions as needed; any assertion failure will fail the current tick
 //		assert.True(c, externalValue, "expected 'externalValue' to be true")
-//	}, 10*time.Second, 1*time.Second, "error message %s", "formatted")
+//	}, 10*time.Second, 1*time.Second, "external state has not changed to 'true'; still false")
 func EventuallyWithTf(t TestingT, condition func(collect *CollectT), waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
 	if h, ok := t.(tHelper); ok {
 		h.Helper()
@@ -552,7 +552,7 @@ func NoDirExistsf(t TestingT, path string, msg string, args ...interface{}) bool
 	return NoDirExists(t, path, append([]interface{}{msg}, args...)...)
 }
 
-// NoErrorf asserts that a function returned a nil error (ie. no error).
+// NoErrorf asserts that a function returned no error (i.e. `nil`).
 //
 //	  actualObj, err := SomeFunction()
 //	  if assert.NoErrorf(t, err, "error message %s", "formatted") {
@@ -849,19 +849,7 @@ func WithinRangef(t TestingT, actual time.Time, start time.Time, end time.Time,
 	return WithinRange(t, actual, start, end, append([]interface{}{msg}, args...)...)
 }
 
-// YAMLEqf asserts that the first documents in the two YAML strings are equivalent.
-//
-//	expected := `---
-//	key: value
-//	---
-//	key: this is a second document, it is not evaluated
-//	`
-//	actual := `---
-//	key: value
-//	---
-//	key: this is a subsequent document, it is not evaluated
-//	`
-//	assert.YAMLEqf(t, expected, actual, "error message %s", "formatted")
+// YAMLEqf asserts that two YAML strings are equivalent.
 func YAMLEqf(t TestingT, expected string, actual string, msg string, args ...interface{}) bool {
 	if h, ok := t.(tHelper); ok {
 		h.Helper()

vendor/github.com/stretchr/testify/assert/assertion_forward.go

@@ -146,7 +146,7 @@ func (a *Assertions) Equal(expected interface{}, actual interface{}, msgAndArgs
 	return Equal(a.t, expected, actual, msgAndArgs...)
 }
 
-// EqualError asserts that a function returned a non-nil error (i.e. an error)
+// EqualError asserts that a function returned an error (i.e. not `nil`)
 // and that it is equal to the provided error.
 //
 //	actualObj, err := SomeFunction()
@@ -158,7 +158,7 @@ func (a *Assertions) EqualError(theError error, errString string, msgAndArgs ...
 	return EqualError(a.t, theError, errString, msgAndArgs...)
 }
 
-// EqualErrorf asserts that a function returned a non-nil error (i.e. an error)
+// EqualErrorf asserts that a function returned an error (i.e. not `nil`)
 // and that it is equal to the provided error.
 //
 //	actualObj, err := SomeFunction()
@@ -240,7 +240,7 @@ func (a *Assertions) Equalf(expected interface{}, actual interface{}, msg string
 	return Equalf(a.t, expected, actual, msg, args...)
 }
 
-// Error asserts that a function returned a non-nil error (ie. an error).
+// Error asserts that a function returned an error (i.e. not `nil`).
 //
 //	actualObj, err := SomeFunction()
 //	a.Error(err)
@@ -269,8 +269,8 @@ func (a *Assertions) ErrorAsf(err error, target interface{}, msg string, args ..
 	return ErrorAsf(a.t, err, target, msg, args...)
 }
 
-// ErrorContains asserts that a function returned a non-nil error (i.e. an
-// error) and that the error contains the specified substring.
+// ErrorContains asserts that a function returned an error (i.e. not `nil`)
+// and that the error contains the specified substring.
 //
 //	actualObj, err := SomeFunction()
 //	a.ErrorContains(err,  expectedErrorSubString)
@@ -281,8 +281,8 @@ func (a *Assertions) ErrorContains(theError error, contains string, msgAndArgs .
 	return ErrorContains(a.t, theError, contains, msgAndArgs...)
 }
 
-// ErrorContainsf asserts that a function returned a non-nil error (i.e. an
-// error) and that the error contains the specified substring.
+// ErrorContainsf asserts that a function returned an error (i.e. not `nil`)
+// and that the error contains the specified substring.
 //
 //	actualObj, err := SomeFunction()
 //	a.ErrorContainsf(err,  expectedErrorSubString, "error message %s", "formatted")
@@ -311,7 +311,7 @@ func (a *Assertions) ErrorIsf(err error, target error, msg string, args ...inter
 	return ErrorIsf(a.t, err, target, msg, args...)
 }
 
-// Errorf asserts that a function returned a non-nil error (ie. an error).
+// Errorf asserts that a function returned an error (i.e. not `nil`).
 //
 //	actualObj, err := SomeFunction()
 //	a.Errorf(err, "error message %s", "formatted")
@@ -372,10 +372,10 @@ func (a *Assertions) EventuallyWithT(condition func(collect *CollectT), waitFor
 //		time.Sleep(8*time.Second)
 //		externalValue = true
 //	}()
-//	a.EventuallyWithTf(func(c *assert.CollectT) {
+//	a.EventuallyWithTf(func(c *assert.CollectT, "error message %s", "formatted") {
 //		// add assertions as needed; any assertion failure will fail the current tick
 //		assert.True(c, externalValue, "expected 'externalValue' to be true")
-//	}, 10*time.Second, 1*time.Second, "error message %s", "formatted")
+//	}, 10*time.Second, 1*time.Second, "external state has not changed to 'true'; still false")
 func (a *Assertions) EventuallyWithTf(condition func(collect *CollectT), waitFor time.Duration, tick time.Duration, msg string, args ...interface{}) bool {
 	if h, ok := a.t.(tHelper); ok {
 		h.Helper()
@@ -1096,7 +1096,7 @@ func (a *Assertions) NoDirExistsf(path string, msg string, args ...interface{})
 	return NoDirExistsf(a.t, path, msg, args...)
 }
 
-// NoError asserts that a function returned a nil error (ie. no error).
+// NoError asserts that a function returned no error (i.e. `nil`).
 //
 //	  actualObj, err := SomeFunction()
 //	  if a.NoError(err) {
@@ -1109,7 +1109,7 @@ func (a *Assertions) NoError(err error, msgAndArgs ...interface{}) bool {
 	return NoError(a.t, err, msgAndArgs...)
 }
 
-// NoErrorf asserts that a function returned a nil error (ie. no error).
+// NoErrorf asserts that a function returned no error (i.e. `nil`).
 //
 //	  actualObj, err := SomeFunction()
 //	  if a.NoErrorf(err, "error message %s", "formatted") {
@@ -1690,19 +1690,7 @@ func (a *Assertions) WithinRangef(actual time.Time, start time.Time, end time.Ti
 	return WithinRangef(a.t, actual, start, end, msg, args...)
 }
 
-// YAMLEq asserts that the first documents in the two YAML strings are equivalent.
-//
-//	expected := `---
-//	key: value
-//	---
-//	key: this is a second document, it is not evaluated
-//	`
-//	actual := `---
-//	key: value
-//	---
-//	key: this is a subsequent document, it is not evaluated
-//	`
-//	a.YAMLEq(expected, actual)
+// YAMLEq asserts that two YAML strings are equivalent.
 func (a *Assertions) YAMLEq(expected string, actual string, msgAndArgs ...interface{}) bool {
 	if h, ok := a.t.(tHelper); ok {
 		h.Helper()
@@ -1710,19 +1698,7 @@ func (a *Assertions) YAMLEq(expected string, actual string, msgAndArgs ...interf
 	return YAMLEq(a.t, expected, actual, msgAndArgs...)
 }
 
-// YAMLEqf asserts that the first documents in the two YAML strings are equivalent.
-//
-//	expected := `---
-//	key: value
-//	---
-//	key: this is a second document, it is not evaluated
-//	`
-//	actual := `---
-//	key: value
-//	---
-//	key: this is a subsequent document, it is not evaluated
-//	`
-//	a.YAMLEqf(expected, actual, "error message %s", "formatted")
+// YAMLEqf asserts that two YAML strings are equivalent.
 func (a *Assertions) YAMLEqf(expected string, actual string, msg string, args ...interface{}) bool {
 	if h, ok := a.t.(tHelper); ok {
 		h.Helper()

vendor/github.com/stretchr/testify/assert/assertion_order.go

@@ -9,7 +9,7 @@ import (
 func isOrdered(t TestingT, object interface{}, allowedComparesResults []compareResult, failMessage string, msgAndArgs ...interface{}) bool {
 	objKind := reflect.TypeOf(object).Kind()
 	if objKind != reflect.Slice && objKind != reflect.Array {
-		return Fail(t, fmt.Sprintf("object %T is not an ordered collection", object), msgAndArgs...)
+		return false
 	}
 
 	objValue := reflect.ValueOf(object)
@@ -50,9 +50,6 @@ func isOrdered(t TestingT, object interface{}, allowedComparesResults []compareR
 //	assert.IsIncreasing(t, []float{1, 2})
 //	assert.IsIncreasing(t, []string{"a", "b"})
 func IsIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
 	return isOrdered(t, object, []compareResult{compareLess}, "\"%v\" is not less than \"%v\"", msgAndArgs...)
 }
 
@@ -62,9 +59,6 @@ func IsIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) boo
 //	assert.IsNonIncreasing(t, []float{2, 1})
 //	assert.IsNonIncreasing(t, []string{"b", "a"})
 func IsNonIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
 	return isOrdered(t, object, []compareResult{compareEqual, compareGreater}, "\"%v\" is not greater than or equal to \"%v\"", msgAndArgs...)
 }
 
@@ -74,9 +68,6 @@ func IsNonIncreasing(t TestingT, object interface{}, msgAndArgs ...interface{})
 //	assert.IsDecreasing(t, []float{2, 1})
 //	assert.IsDecreasing(t, []string{"b", "a"})
 func IsDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
 	return isOrdered(t, object, []compareResult{compareGreater}, "\"%v\" is not greater than \"%v\"", msgAndArgs...)
 }
 
@@ -86,8 +77,5 @@ func IsDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) boo
 //	assert.IsNonDecreasing(t, []float{1, 2})
 //	assert.IsNonDecreasing(t, []string{"a", "b"})
 func IsNonDecreasing(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
-	if h, ok := t.(tHelper); ok {
-		h.Helper()
-	}
 	return isOrdered(t, object, []compareResult{compareLess, compareEqual}, "\"%v\" is not less than or equal to \"%v\"", msgAndArgs...)
 }

vendor/github.com/stretchr/testify/assert/assertions.go

@@ -17,10 +17,11 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	// Wrapper around go.yaml.in/yaml/v3
+	"github.com/davecgh/go-spew/spew"
+	"github.com/pmezard/go-difflib/difflib"
+
+	// Wrapper around gopkg.in/yaml.v3
 	"github.com/stretchr/testify/assert/yaml"
-	"github.com/stretchr/testify/internal/difflib"
-	"github.com/stretchr/testify/internal/spew"
 )
 
 //go:generate sh -c "cd ../_codegen && go build && cd - && ../_codegen/_codegen -output-package=assert -template=assertion_format.go.tmpl"
@@ -32,19 +33,19 @@ type TestingT interface {
 
 // ComparisonAssertionFunc is a common function prototype when comparing two values.  Can be useful
 // for table driven tests.
-type ComparisonAssertionFunc = func(TestingT, interface{}, interface{}, ...interface{}) bool
+type ComparisonAssertionFunc func(TestingT, interface{}, interface{}, ...interface{}) bool
 
 // ValueAssertionFunc is a common function prototype when validating a single value.  Can be useful
 // for table driven tests.
-type ValueAssertionFunc = func(TestingT, interface{}, ...interface{}) bool
+type ValueAssertionFunc func(TestingT, interface{}, ...interface{}) bool
 
 // BoolAssertionFunc is a common function prototype when validating a bool value.  Can be useful
 // for table driven tests.
-type BoolAssertionFunc = func(TestingT, bool, ...interface{}) bool
+type BoolAssertionFunc func(TestingT, bool, ...interface{}) bool
 
 // ErrorAssertionFunc is a common function prototype when validating an error value.  Can be useful
 // for table driven tests.
-type ErrorAssertionFunc = func(TestingT, error, ...interface{}) bool
+type ErrorAssertionFunc func(TestingT, error, ...interface{}) bool
 
 // PanicAssertionFunc is a common function prototype when validating a panic value.  Can be useful
 // for table driven tests.
@@ -324,15 +325,13 @@ func messageFromMsgAndArgs(msgAndArgs ...interface{}) string {
 func indentMessageLines(message string, longestLabelLen int) string {
 	outBuf := new(bytes.Buffer)
 
-	scanner := bufio.NewScanner(strings.NewReader(message))
-	for firstLine := true; scanner.Scan(); firstLine = false {
-		if !firstLine {
-			fmt.Fprint(outBuf, "\n\t"+strings.Repeat(" ", longestLabelLen+1)+"\t")
+	for i, scanner := 0, bufio.NewScanner(strings.NewReader(message)); scanner.Scan(); i++ {
+		// no need to align first line because it starts at the correct location (after the label)
+		if i != 0 {
+			// append alignLen+1 spaces to align with "{{longestLabel}}:" before adding tab
+			outBuf.WriteString("\n\t" + strings.Repeat(" ", longestLabelLen+1) + "\t")
 		}
-		fmt.Fprint(outBuf, scanner.Text())
-	}
-	if err := scanner.Err(); err != nil {
-		return fmt.Sprintf("cannot display message: %s", err)
+		outBuf.WriteString(scanner.Text())
 	}
 
 	return outBuf.String()
@@ -545,8 +544,9 @@ func Same(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}) b
 	if !same {
 		// both are pointers but not the same type & pointing to the same address
 		return Fail(t, fmt.Sprintf("Not same: \n"+
-			"expected: %[2]s (%[1]T)(%[1]p)\n"+
-			"actual  : %[4]s (%[3]T)(%[3]p)", expected, truncatingFormat("%#v", expected), actual, truncatingFormat("%#v", actual)), msgAndArgs...)
+			"expected: %p %#[1]v\n"+
+			"actual  : %p %#[2]v",
+			expected, actual), msgAndArgs...)
 	}
 
 	return true
@@ -571,8 +571,8 @@ func NotSame(t TestingT, expected, actual interface{}, msgAndArgs ...interface{}
 
 	if same {
 		return Fail(t, fmt.Sprintf(
-			"Expected and actual point to the same object: %p %s",
-			expected, truncatingFormat("%#v", expected)), msgAndArgs...)
+			"Expected and actual point to the same object: %p %#[1]v",
+			expected), msgAndArgs...)
 	}
 	return true
 }
@@ -604,26 +604,25 @@ func samePointers(first, second interface{}) (same bool, ok bool) {
 // to a type conversion in the Go grammar.
 func formatUnequalValues(expected, actual interface{}) (e string, a string) {
 	if reflect.TypeOf(expected) != reflect.TypeOf(actual) {
-		return fmt.Sprintf("%T(%s)", expected, truncatingFormat("%#v", expected)),
-			fmt.Sprintf("%T(%s)", actual, truncatingFormat("%#v", actual))
+		return fmt.Sprintf("%T(%s)", expected, truncatingFormat(expected)),
+			fmt.Sprintf("%T(%s)", actual, truncatingFormat(actual))
 	}
 	switch expected.(type) {
 	case time.Duration:
 		return fmt.Sprintf("%v", expected), fmt.Sprintf("%v", actual)
 	}
-	return truncatingFormat("%#v", expected), truncatingFormat("%#v", actual)
+	return truncatingFormat(expected), truncatingFormat(actual)
 }
 
 // truncatingFormat formats the data and truncates it if it's too long.
 //
 // This helps keep formatted error messages lines from exceeding the
 // bufio.MaxScanTokenSize max line length that the go testing framework imposes.
-func truncatingFormat(format string, data interface{}) string {
-	value := fmt.Sprintf(format, data)
-	// Give us space for two truncated objects and the surrounding sentence.
-	maxMessageSize := bufio.MaxScanTokenSize/2 - 100
-	if len(value) > maxMessageSize {
-		value = value[0:maxMessageSize] + "<... truncated>"
+func truncatingFormat(data interface{}) string {
+	value := fmt.Sprintf("%#v", data)
+	max := bufio.MaxScanTokenSize - 100 // Give us some space the type info too if needed.
+	if len(value) > max {
+		value = value[0:max] + "<... truncated>"
 	}
 	return value
 }
@@ -744,7 +743,7 @@ func Nil(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
 	if h, ok := t.(tHelper); ok {
 		h.Helper()
 	}
-	return Fail(t, fmt.Sprintf("Expected nil, but got: %s", truncatingFormat("%#v", object)), msgAndArgs...)
+	return Fail(t, fmt.Sprintf("Expected nil, but got: %#v", object), msgAndArgs...)
 }
 
 // isEmpty gets whether the specified object is considered empty or not.
@@ -794,7 +793,7 @@ func Empty(t TestingT, object interface{}, msgAndArgs ...interface{}) bool {
 		if h, ok := t.(tHelper); ok {
 			h.Helper()
 		}
-		Fail(t, fmt.Sprintf("Should be empty, but was %s", truncatingFormat("%v", object)), msgAndArgs...)
+		Fail(t, fmt.Sprintf("Should be empty, but was %v", object), msgAndArgs...)
 	}
 
 	return pass
@@ -837,11 +836,11 @@ func Len(t TestingT, object interface{}, length int, msgAndArgs ...interface{})
 	}
 	l, ok := getLen(object)
 	if !ok {
-		return Fail(t, fmt.Sprintf("%q could not be applied builtin len()", truncatingFormat("%v", object)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("\"%v\" could not be applied builtin len()", object), msgAndArgs...)
 	}
 
 	if l != length {
-		return Fail(t, fmt.Sprintf("%q should have %d item(s), but has %d", truncatingFormat("%v", object), length, l), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("\"%v\" should have %d item(s), but has %d", object, length, l), msgAndArgs...)
 	}
 	return true
 }
@@ -890,7 +889,7 @@ func NotEqual(t TestingT, expected, actual interface{}, msgAndArgs ...interface{
 	}
 
 	if ObjectsAreEqual(expected, actual) {
-		return Fail(t, fmt.Sprintf("Should not be: %s\n", truncatingFormat("%#v", actual)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("Should not be: %#v\n", actual), msgAndArgs...)
 	}
 
 	return true
@@ -905,7 +904,7 @@ func NotEqualValues(t TestingT, expected, actual interface{}, msgAndArgs ...inte
 	}
 
 	if ObjectsAreEqualValues(expected, actual) {
-		return Fail(t, fmt.Sprintf("Should not be: %s\n", truncatingFormat("%#v", actual)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("Should not be: %#v\n", actual), msgAndArgs...)
 	}
 
 	return true
@@ -965,10 +964,10 @@ func Contains(t TestingT, s, contains interface{}, msgAndArgs ...interface{}) bo
 
 	ok, found := containsElement(s, contains)
 	if !ok {
-		return Fail(t, fmt.Sprintf("%s could not be applied builtin len()", truncatingFormat("%#v", s)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%#v could not be applied builtin len()", s), msgAndArgs...)
 	}
 	if !found {
-		return Fail(t, fmt.Sprintf("%s does not contain %#v", truncatingFormat("%#v", s), contains), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%#v does not contain %#v", s, contains), msgAndArgs...)
 	}
 
 	return true
@@ -987,10 +986,10 @@ func NotContains(t TestingT, s, contains interface{}, msgAndArgs ...interface{})
 
 	ok, found := containsElement(s, contains)
 	if !ok {
-		return Fail(t, fmt.Sprintf("%s could not be applied builtin len()", truncatingFormat("%#v", s)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%#v could not be applied builtin len()", s), msgAndArgs...)
 	}
 	if found {
-		return Fail(t, fmt.Sprintf("%s should not contain %#v", truncatingFormat("%#v", s), contains), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%#v should not contain %#v", s, contains), msgAndArgs...)
 	}
 
 	return true
@@ -1032,10 +1031,10 @@ func Subset(t TestingT, list, subset interface{}, msgAndArgs ...interface{}) (ok
 			av := actualMap.MapIndex(k)
 
 			if !av.IsValid() {
-				return Fail(t, fmt.Sprintf("%s does not contain %s", truncatingFormat("%#v", list), truncatingFormat("%#v", subset)), msgAndArgs...)
+				return Fail(t, fmt.Sprintf("%#v does not contain %#v", list, subset), msgAndArgs...)
 			}
 			if !ObjectsAreEqual(ev.Interface(), av.Interface()) {
-				return Fail(t, fmt.Sprintf("%s does not contain %s", truncatingFormat("%#v", list), truncatingFormat("%#v", subset)), msgAndArgs...)
+				return Fail(t, fmt.Sprintf("%#v does not contain %#v", list, subset), msgAndArgs...)
 			}
 		}
 
@@ -1057,7 +1056,7 @@ func Subset(t TestingT, list, subset interface{}, msgAndArgs ...interface{}) (ok
 			return Fail(t, fmt.Sprintf("%#v could not be applied builtin len()", list), msgAndArgs...)
 		}
 		if !found {
-			return Fail(t, fmt.Sprintf("%s does not contain %#v", truncatingFormat("%#v", list), element), msgAndArgs...)
+			return Fail(t, fmt.Sprintf("%#v does not contain %#v", list, element), msgAndArgs...)
 		}
 	}
 
@@ -1083,12 +1082,12 @@ func NotSubset(t TestingT, list, subset interface{}, msgAndArgs ...interface{})
 
 	listKind := reflect.TypeOf(list).Kind()
 	if listKind != reflect.Array && listKind != reflect.Slice && listKind != reflect.Map {
-		return Fail(t, fmt.Sprintf("%#v has an unsupported type %s", list, listKind), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", list, listKind), msgAndArgs...)
 	}
 
 	subsetKind := reflect.TypeOf(subset).Kind()
 	if subsetKind != reflect.Array && subsetKind != reflect.Slice && subsetKind != reflect.Map {
-		return Fail(t, fmt.Sprintf("%#v has an unsupported type %s", subset, subsetKind), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%q has an unsupported type %s", subset, subsetKind), msgAndArgs...)
 	}
 
 	if subsetKind == reflect.Map && listKind == reflect.Map {
@@ -1107,7 +1106,7 @@ func NotSubset(t TestingT, list, subset interface{}, msgAndArgs ...interface{})
 			}
 		}
 
-		return Fail(t, fmt.Sprintf("%s is a subset of %s", truncatingFormat("%#v", subset), truncatingFormat("%#v", list)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("%q is a subset of %q", subset, list), msgAndArgs...)
 	}
 
 	subsetList := reflect.ValueOf(subset)
@@ -1122,14 +1121,14 @@ func NotSubset(t TestingT, list, subset interface{}, msgAndArgs ...interface{})
 		element := subsetList.Index(i).Interface()
 		ok, found := containsElement(list, element)
 		if !ok {
-			return Fail(t, fmt.Sprintf("%#v could not be applied builtin len()", list), msgAndArgs...)
+			return Fail(t, fmt.Sprintf("%q could not be applied builtin len()", list), msgAndArgs...)
 		}
 		if !found {
 			return true
 		}
 	}
 
-	return Fail(t, fmt.Sprintf("%s is a subset of %s", truncatingFormat("%#v", subset), truncatingFormat("%#v", list)), msgAndArgs...)
+	return Fail(t, fmt.Sprintf("%q is a subset of %q", subset, list), msgAndArgs...)
 }
 
 // ElementsMatch asserts that the specified listA(array, slice...) is equal to specified
@@ -1344,15 +1343,9 @@ func PanicsWithError(t TestingT, errString string, f PanicTestFunc, msgAndArgs .
 	if !funcDidPanic {
 		return Fail(t, fmt.Sprintf("func %#v should panic\n\tPanic value:\t%#v", f, panicValue), msgAndArgs...)
 	}
-	panicErr, isError := panicValue.(error)
-	if !isError || panicErr.Error() != errString {
-		msg := fmt.Sprintf("func %#v should panic with error message:\t%#v\n", f, errString)
-		if isError {
-			msg += fmt.Sprintf("\tError message:\t%#v\n", panicErr.Error())
-		}
-		msg += fmt.Sprintf("\tPanic value:\t%#v\n", panicValue)
-		msg += fmt.Sprintf("\tPanic stack:\t%s\n", panickedStack)
-		return Fail(t, msg, msgAndArgs...)
+	panicErr, ok := panicValue.(error)
+	if !ok || panicErr.Error() != errString {
+		return Fail(t, fmt.Sprintf("func %#v should panic with error message:\t%#v\n\tPanic value:\t%#v\n\tPanic stack:\t%s", f, errString, panicValue, panickedStack), msgAndArgs...)
 	}
 
 	return true
@@ -1631,7 +1624,7 @@ func InEpsilonSlice(t TestingT, expected, actual interface{}, epsilon float64, m
 	Errors
 */
 
-// NoError asserts that a function returned a nil error (ie. no error).
+// NoError asserts that a function returned no error (i.e. `nil`).
 //
 //	  actualObj, err := SomeFunction()
 //	  if assert.NoError(t, err) {
@@ -1642,13 +1635,13 @@ func NoError(t TestingT, err error, msgAndArgs ...interface{}) bool {
 		if h, ok := t.(tHelper); ok {
 			h.Helper()
 		}
-		return Fail(t, fmt.Sprintf("Received unexpected error:\n%s", truncatingFormat("%+v", err)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("Received unexpected error:\n%+v", err), msgAndArgs...)
 	}
 
 	return true
 }
 
-// Error asserts that a function returned a non-nil error (ie. an error).
+// Error asserts that a function returned an error (i.e. not `nil`).
 //
 //	actualObj, err := SomeFunction()
 //	assert.Error(t, err)
@@ -1663,7 +1656,7 @@ func Error(t TestingT, err error, msgAndArgs ...interface{}) bool {
 	return true
 }
 
-// EqualError asserts that a function returned a non-nil error (i.e. an error)
+// EqualError asserts that a function returned an error (i.e. not `nil`)
 // and that it is equal to the provided error.
 //
 //	actualObj, err := SomeFunction()
@@ -1681,13 +1674,13 @@ func EqualError(t TestingT, theError error, errString string, msgAndArgs ...inte
 	if expected != actual {
 		return Fail(t, fmt.Sprintf("Error message not equal:\n"+
 			"expected: %q\n"+
-			"actual  : %s", expected, truncatingFormat("%q", actual)), msgAndArgs...)
+			"actual  : %q", expected, actual), msgAndArgs...)
 	}
 	return true
 }
 
-// ErrorContains asserts that a function returned a non-nil error (i.e. an
-// error) and that the error contains the specified substring.
+// ErrorContains asserts that a function returned an error (i.e. not `nil`)
+// and that the error contains the specified substring.
 //
 //	actualObj, err := SomeFunction()
 //	assert.ErrorContains(t, err,  expectedErrorSubString)
@@ -1701,7 +1694,7 @@ func ErrorContains(t TestingT, theError error, contains string, msgAndArgs ...in
 
 	actual := theError.Error()
 	if !strings.Contains(actual, contains) {
-		return Fail(t, fmt.Sprintf("Error %s does not contain %#v", truncatingFormat("%#v", actual), contains), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("Error %#v does not contain %#v", actual, contains), msgAndArgs...)
 	}
 
 	return true
@@ -1767,7 +1760,7 @@ func Zero(t TestingT, i interface{}, msgAndArgs ...interface{}) bool {
 		h.Helper()
 	}
 	if i != nil && !reflect.DeepEqual(i, reflect.Zero(reflect.TypeOf(i)).Interface()) {
-		return Fail(t, fmt.Sprintf("Should be zero, but was %s", truncatingFormat("%v", i)), msgAndArgs...)
+		return Fail(t, fmt.Sprintf("Should be zero, but was %v", i), msgAndArgs...)
 	}
 	return true
 }
@@ -1881,19 +1874,7 @@ func JSONEq(t TestingT, expected string, actual string, msgAndArgs ...interface{
 	return Equal(t, expectedJSONAsInterface, actualJSONAsInterface, msgAndArgs...)
 }
 
-// YAMLEq asserts that the first documents in the two YAML strings are equivalent.
-//
-//	expected := `---
-//	key: value
-//	---
-//	key: this is a second document, it is not evaluated
-//	`
-//	actual := `---
-//	key: value
-//	---
-//	key: this is a subsequent document, it is not evaluated
-//	`
-//	assert.YAMLEq(t, expected, actual)
+// YAMLEq asserts that two YAML strings are equivalent.
 func YAMLEq(t TestingT, expected string, actual string, msgAndArgs ...interface{}) bool {
 	if h, ok := t.(tHelper); ok {
 		h.Helper()
@@ -2207,8 +2188,8 @@ func ErrorIs(t TestingT, err, target error, msgAndArgs ...interface{}) bool {
 	chain := buildErrorChainString(err, false)
 
 	return Fail(t, fmt.Sprintf("Target error should be in err chain:\n"+
-		"expected: %s\n"+
-		"in chain: %s", truncatingFormat("%q", expectedText), truncatingFormat("%s", chain),
+		"expected: %q\n"+
+		"in chain: %s", expectedText, chain,
 	), msgAndArgs...)
 }
 
@@ -2230,8 +2211,8 @@ func NotErrorIs(t TestingT, err, target error, msgAndArgs ...interface{}) bool {
 	chain := buildErrorChainString(err, false)
 
 	return Fail(t, fmt.Sprintf("Target error should not be in err chain:\n"+
-		"found: %s\n"+
-		"in chain: %s", truncatingFormat("%q", expectedText), truncatingFormat("%s", chain),
+		"found: %q\n"+
+		"in chain: %s", expectedText, chain,
 	), msgAndArgs...)
 }
 
@@ -2255,7 +2236,7 @@ func ErrorAs(t TestingT, err error, target interface{}, msgAndArgs ...interface{
 
 	return Fail(t, fmt.Sprintf("Should be in error chain:\n"+
 		"expected: %s\n"+
-		"in chain: %s", expectedType, truncatingFormat("%s", chain),
+		"in chain: %s", expectedType, chain,
 	), msgAndArgs...)
 }
 
@@ -2273,7 +2254,7 @@ func NotErrorAs(t TestingT, err error, target interface{}, msgAndArgs ...interfa
 
 	return Fail(t, fmt.Sprintf("Target error should not be in err chain:\n"+
 		"found: %s\n"+
-		"in chain: %s", reflect.TypeOf(target).Elem().String(), truncatingFormat("%s", chain),
+		"in chain: %s", reflect.TypeOf(target).Elem().String(), chain,
 	), msgAndArgs...)
 }
 

vendor/github.com/stretchr/testify/assert/doc.go

@@ -40,8 +40,8 @@
 //
 // # Assertions
 //
-// Assertions allow you to easily write test code, and are global funcs in the assert package.
-// All assertion functions take, as the first argument, the [*testing.T] object provided by the
+// Assertions allow you to easily write test code, and are global funcs in the `assert` package.
+// All assertion functions take, as the first argument, the `*testing.T` object provided by the
 // testing framework. This allows the assertion funcs to write the failings and other details to
 // the correct place.
 //

vendor/github.com/stretchr/testify/assert/yaml/yaml_custom.go

@@ -7,7 +7,7 @@
 //	go test -tags testify_yaml_custom
 //
 // This implementation can be used at build time to replace the default implementation
-// to avoid linking with [go.yaml.in/yaml/v3].
+// to avoid linking with [gopkg.in/yaml.v3].
 //
 // In your test package:
 //

vendor/github.com/stretchr/testify/assert/yaml/yaml_default.go

@@ -6,7 +6,7 @@
 // indirection with an alternative implementation of this package that uses
 // another implementation of YAML deserialization. This allows to not either not
 // use YAML deserialization at all, or to use another implementation than
-// [go.yaml.in/yaml/v3] (for example for license compatibility reasons, see [PR #1120]).
+// [gopkg.in/yaml.v3] (for example for license compatibility reasons, see [PR #1120]).
 //
 // Alternative implementations are selected using build tags:
 //
@@ -28,9 +28,9 @@
 // [PR #1120]: https://github.com/stretchr/testify/pull/1120
 package yaml
 
-import goyaml "go.yaml.in/yaml/v3"
+import goyaml "gopkg.in/yaml.v3"
 
-// Unmarshal is just a wrapper of [go.yaml.in/yaml/v3.Unmarshal].
+// Unmarshal is just a wrapper of [gopkg.in/yaml.v3.Unmarshal].
 func Unmarshal(in []byte, out interface{}) error {
 	return goyaml.Unmarshal(in, out)
 }

vendor/github.com/stretchr/testify/assert/yaml/yaml_fail.go

@@ -3,7 +3,7 @@
 // Package yaml is an implementation of YAML functions that always fail.
 //
 // This implementation can be used at build time to replace the default implementation
-// to avoid linking with [go.yaml.in/yaml/v3]:
+// to avoid linking with [gopkg.in/yaml.v3]:
 //
 //	go test -tags testify_yaml_fail
 package yaml

vendor/github.com/stretchr/testify/internal/spew/README.md

@@ -1,12 +0,0 @@
-go-spew
-=======
-
-[![ISC License](http://img.shields.io/badge/license-ISC-blue.svg)](http://copyfree.org)
-
-Go-spew implements a deep pretty printer for Go data structures to aid in
-debugging.  A comprehensive suite of tests with 100% test coverage is provided
-to ensure proper functionality.
-
-## License
-
-Go-spew is licensed under the [copyfree](http://copyfree.org) ISC License.

vendor/go.yaml.in/yaml/v3/parserc.go

@@ -226,9 +226,9 @@ func yaml_parser_state_machine(parser *yaml_parser_t, event *yaml_event_t) bool
 }
 
 // Parse the production:
+// stream   ::= STREAM-START implicit_document? explicit_document* STREAM-END
 //
-//	stream   ::= STREAM-START implicit_document? explicit_document* STREAM-END
-//	             ************
+//	************
 func yaml_parser_parse_stream_start(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -249,11 +249,13 @@ func yaml_parser_parse_stream_start(parser *yaml_parser_t, event *yaml_event_t)
 }
 
 // Parse the productions:
+// implicit_document    ::= block_node DOCUMENT-END*
 //
-//	implicit_document    ::= block_node DOCUMENT-END*
-//	                         *
-//	explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
-//	                         *************************
+//	*
+//
+// explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
+//
+//	*************************
 func yaml_parser_parse_document_start(parser *yaml_parser_t, event *yaml_event_t, implicit bool) bool {
 
 	token := peek_token(parser)
@@ -357,9 +359,9 @@ func yaml_parser_parse_document_start(parser *yaml_parser_t, event *yaml_event_t
 }
 
 // Parse the productions:
+// explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
 //
-//	explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
-//	                                                   ***********
+//	***********
 func yaml_parser_parse_document_content(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -380,10 +382,11 @@ func yaml_parser_parse_document_content(parser *yaml_parser_t, event *yaml_event
 }
 
 // Parse the productions:
+// implicit_document    ::= block_node DOCUMENT-END*
 //
-//	implicit_document    ::= block_node DOCUMENT-END*
-//	                                    *************
-//	explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
+//	*************
+//
+// explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
 func yaml_parser_parse_document_end(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -429,32 +432,42 @@ func yaml_parser_set_event_comments(parser *yaml_parser_t, event *yaml_event_t)
 }
 
 // Parse the productions:
+// block_node_or_indentless_sequence    ::=
 //
-//	block_node_or_indentless_sequence    ::=
-//	                         ALIAS
-//	                         *****
-//	                         | properties (block_content | indentless_block_sequence)?
-//	                           **********  *
-//	                         | block_content | indentless_block_sequence
-//	                           *
-//	block_node           ::= ALIAS
-//	                         *****
-//	                         | properties block_content?
-//	                           ********** *
-//	                         | block_content
-//	                           *
-//	flow_node            ::= ALIAS
-//	                         *****
-//	                         | properties flow_content?
-//	                           ********** *
-//	                         | flow_content
-//	                           *
-//	properties           ::= TAG ANCHOR? | ANCHOR TAG?
-//	                         *************************
-//	block_content        ::= block_collection | flow_collection | SCALAR
-//	                                                              ******
-//	flow_content         ::= flow_collection | SCALAR
-//	                                           ******
+//	ALIAS
+//	*****
+//	| properties (block_content | indentless_block_sequence)?
+//	  **********  *
+//	| block_content | indentless_block_sequence
+//	  *
+//
+// block_node           ::= ALIAS
+//
+//	*****
+//	| properties block_content?
+//	  ********** *
+//	| block_content
+//	  *
+//
+// flow_node            ::= ALIAS
+//
+//	*****
+//	| properties flow_content?
+//	  ********** *
+//	| flow_content
+//	  *
+//
+// properties           ::= TAG ANCHOR? | ANCHOR TAG?
+//
+//	*************************
+//
+// block_content        ::= block_collection | flow_collection | SCALAR
+//
+//	******
+//
+// flow_content         ::= flow_collection | SCALAR
+//
+//	******
 func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, indentless_sequence bool) bool {
 	//defer trace("yaml_parser_parse_node", "block:", block, "indentless_sequence:", indentless_sequence)()
 
@@ -684,9 +697,9 @@ func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, i
 }
 
 // Parse the productions:
+// block_sequence ::= BLOCK-SEQUENCE-START (BLOCK-ENTRY block_node?)* BLOCK-END
 //
-//	block_sequence ::= BLOCK-SEQUENCE-START (BLOCK-ENTRY block_node?)* BLOCK-END
-//	                   ********************  *********** *             *********
+//	********************  *********** *             *********
 func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -742,9 +755,9 @@ func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_e
 }
 
 // Parse the productions:
+// indentless_sequence  ::= (BLOCK-ENTRY block_node?)+
 //
-//	indentless_sequence  ::= (BLOCK-ENTRY block_node?)+
-//	                          *********** *
+//	*********** *
 func yaml_parser_parse_indentless_sequence_entry(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -808,15 +821,15 @@ func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
 }
 
 // Parse the productions:
+// block_mapping        ::= BLOCK-MAPPING_START
 //
-//	block_mapping        ::= BLOCK-MAPPING_START
-//	                         *******************
-//	                         ((KEY block_node_or_indentless_sequence?)?
-//	                           *** *
-//	                         (VALUE block_node_or_indentless_sequence?)?)*
+//	*******************
+//	((KEY block_node_or_indentless_sequence?)?
+//	  *** *
+//	(VALUE block_node_or_indentless_sequence?)?)*
 //
-//	                         BLOCK-END
-//	                         *********
+//	BLOCK-END
+//	*********
 func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -883,14 +896,13 @@ func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_even
 }
 
 // Parse the productions:
+// block_mapping        ::= BLOCK-MAPPING_START
 //
-//	block_mapping        ::= BLOCK-MAPPING_START
+//	((KEY block_node_or_indentless_sequence?)?
 //
-//	                          ((KEY block_node_or_indentless_sequence?)?
-//
-//	                          (VALUE block_node_or_indentless_sequence?)?)*
-//	                           ***** *
-//	                          BLOCK-END
+//	(VALUE block_node_or_indentless_sequence?)?)*
+//	 ***** *
+//	BLOCK-END
 func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -917,17 +929,19 @@ func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_ev
 }
 
 // Parse the productions:
+// flow_sequence        ::= FLOW-SEQUENCE-START
 //
-//	flow_sequence        ::= FLOW-SEQUENCE-START
-//	                         *******************
-//	                         (flow_sequence_entry FLOW-ENTRY)*
-//	                          *                   **********
-//	                         flow_sequence_entry?
-//	                         *
-//	                         FLOW-SEQUENCE-END
-//	                         *****************
-//	flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                         *
+//	*******************
+//	(flow_sequence_entry FLOW-ENTRY)*
+//	 *                   **********
+//	flow_sequence_entry?
+//	*
+//	FLOW-SEQUENCE-END
+//	*****************
+//
+// flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//
+//	*
 func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -991,9 +1005,9 @@ func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_ev
 }
 
 // Parse the productions:
+// flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
 //
-//	flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                                     *** *
+//	*** *
 func yaml_parser_parse_flow_sequence_entry_mapping_key(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -1012,9 +1026,9 @@ func yaml_parser_parse_flow_sequence_entry_mapping_key(parser *yaml_parser_t, ev
 }
 
 // Parse the productions:
+// flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
 //
-//	flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                                                     ***** *
+//	***** *
 func yaml_parser_parse_flow_sequence_entry_mapping_value(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -1036,9 +1050,9 @@ func yaml_parser_parse_flow_sequence_entry_mapping_value(parser *yaml_parser_t,
 }
 
 // Parse the productions:
+// flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
 //
-//	flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                                                                     *
+//	*
 func yaml_parser_parse_flow_sequence_entry_mapping_end(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -1054,17 +1068,18 @@ func yaml_parser_parse_flow_sequence_entry_mapping_end(parser *yaml_parser_t, ev
 }
 
 // Parse the productions:
+// flow_mapping         ::= FLOW-MAPPING-START
 //
-//	flow_mapping         ::= FLOW-MAPPING-START
-//	                         ******************
-//	                         (flow_mapping_entry FLOW-ENTRY)*
-//	                          *                  **********
-//	                         flow_mapping_entry?
-//	                         ******************
-//	                         FLOW-MAPPING-END
-//	                         ****************
-//	flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                         *           *** *
+//	******************
+//	(flow_mapping_entry FLOW-ENTRY)*
+//	 *                  **********
+//	flow_mapping_entry?
+//	******************
+//	FLOW-MAPPING-END
+//	****************
+//
+// flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//   - *** *
 func yaml_parser_parse_flow_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -1129,9 +1144,8 @@ func yaml_parser_parse_flow_mapping_key(parser *yaml_parser_t, event *yaml_event
 }
 
 // Parse the productions:
-//
-//	flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//	                                  *                  ***** *
+// flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//   - ***** *
 func yaml_parser_parse_flow_mapping_value(parser *yaml_parser_t, event *yaml_event_t, empty bool) bool {
 	token := peek_token(parser)
 	if token == nil {

vendor/go.yaml.in/yaml/v3/yamlh.go

@@ -433,19 +433,21 @@ type yaml_document_t struct {
 
 // The prototype of a read handler.
 //
-//	The read handler is called when the parser needs to read more bytes from the
-//	source. The handler should write not more than size bytes to the buffer.
-//	The number of written bytes should be set to the size_read variable.
+// The read handler is called when the parser needs to read more bytes from the
+// source. The handler should write not more than size bytes to the buffer.
+// The number of written bytes should be set to the size_read variable.
 //
-//	[in,out]   data        A pointer to an application data specified by
-//	                       yaml_parser_set_input().
-//	[out]      buffer      The buffer to write the data from the source.
-//	[in]       size        The size of the buffer.
-//	[out]      size_read   The actual number of bytes read from the source.
+// [in,out]   data        A pointer to an application data specified by
 //
-//	On success, the handler should return 1.  If the handler failed,
-//	the returned value should be 0. On EOF, the handler should set the
-//	size_read to 0 and return 1.
+//	yaml_parser_set_input().
+//
+// [out]      buffer      The buffer to write the data from the source.
+// [in]       size        The size of the buffer.
+// [out]      size_read   The actual number of bytes read from the source.
+//
+// On success, the handler should return 1.  If the handler failed,
+// the returned value should be 0. On EOF, the handler should set the
+// size_read to 0 and return 1.
 type yaml_read_handler_t func(parser *yaml_parser_t, buffer []byte) (n int, err error)
 
 // This structure holds information about a potential simple key.
@@ -653,17 +655,19 @@ type yaml_comment_t struct {
 
 // The prototype of a write handler.
 //
-//	The write handler is called when the emitter needs to flush the accumulated
-//	characters to the output.  The handler should write @a size bytes of the
-//	@a buffer to the output.
+// The write handler is called when the emitter needs to flush the accumulated
+// characters to the output.  The handler should write @a size bytes of the
+// @a buffer to the output.
 //
-//	@param[in,out]   data        A pointer to an application data specified by
-//	                             yaml_emitter_set_output().
-//	@param[in]       buffer      The buffer with bytes to be written.
-//	@param[in]       size        The size of the buffer.
+// @param[in,out]   data        A pointer to an application data specified by
 //
-//	@returns On success, the handler should return @c 1.  If the handler failed,
-//	the returned value should be @c 0.
+//	yaml_emitter_set_output().
+//
+// @param[in]       buffer      The buffer with bytes to be written.
+// @param[in]       size        The size of the buffer.
+//
+// @returns On success, the handler should return @c 1.  If the handler failed,
+// the returned value should be @c 0.
 type yaml_write_handler_t func(emitter *yaml_emitter_t, buffer []byte) error
 
 type yaml_emitter_state_t int

vendor/modules.txt

@@ -147,6 +147,9 @@ github.com/cpuguy83/go-md2man/v2/md2man
 ## explicit; go 1.18
 github.com/cyphar/filepath-securejoin
 github.com/cyphar/filepath-securejoin/internal/consts
+# github.com/davecgh/go-spew v1.1.1
+## explicit
+github.com/davecgh/go-spew/spew
 # github.com/decentral1se/passgen v1.0.1
 ## explicit; go 1.14
 github.com/decentral1se/passgen
@@ -498,6 +501,9 @@ github.com/pjbgf/sha1cd/ubc
 # github.com/pkg/errors v0.9.1
 ## explicit
 github.com/pkg/errors
+# github.com/pmezard/go-difflib v1.0.0
+## explicit
+github.com/pmezard/go-difflib/difflib
 # github.com/prometheus/client_golang v1.23.2
 ## explicit; go 1.23.0
 github.com/prometheus/client_golang/internal/github.com/golang/gddo/httputil
@@ -543,12 +549,10 @@ github.com/spf13/cobra/doc
 # github.com/spf13/pflag v1.0.10
 ## explicit; go 1.12
 github.com/spf13/pflag
-# github.com/stretchr/testify v1.12.1
+# github.com/stretchr/testify v1.11.1
 ## explicit; go 1.17
 github.com/stretchr/testify/assert
 github.com/stretchr/testify/assert/yaml
-github.com/stretchr/testify/internal/difflib
-github.com/stretchr/testify/internal/spew
 # github.com/theupdateframework/notary v0.7.0
 ## explicit; go 1.12
 # github.com/xanzy/ssh-agent v0.3.3
@@ -656,7 +660,7 @@ go.opentelemetry.io/proto/otlp/trace/v1
 # go.yaml.in/yaml/v2 v2.4.4
 ## explicit; go 1.15
 go.yaml.in/yaml/v2
-# go.yaml.in/yaml/v3 v3.0.5
+# go.yaml.in/yaml/v3 v3.0.4
 ## explicit; go 1.16
 go.yaml.in/yaml/v3
 # golang.org/x/crypto v0.53.0