feat: building block runs, definitions, event logs and meshstack api

[grubmeshi]

This PR becomes v0.3.0. The section below is what goreleaser generates from the commits; above it is what changes for a CLI user.

What changes for a user

New commands

• meshstack api <path or URL> calls any meshStack API path, with the media type and version taken from the API docs. A full URL, such as a _links href from an answer, works too: it picks the stored profile whose endpoint holds the URL, warns when that profile is not the current one, and fails rather than send a credential to another host.
• meshstack api-docs [<path or URL>] describes an operation as Markdown (--describe bb.list), or prints the filtered JSON with -o json. Swapping api for api-docs on the same command line works.
• meshstack profile manages the profiles in a terminal UI, and profile add|edit|delete|list|show do the same from scripts. profile show shows the profile another command would use.
• meshstack bbrun logs <run> [--follow] shows the logs of a building block run, and follows a run until it has finished.
• meshstack bb trigger-run <uuid> starts a run, names it, and fails with meshStack's reason when the run cannot start.
• meshstack bb tfstate show|exec <uuid> reads a building block's tofu state, or runs tofu against it through a local proxy (read-only unless --mode readwrite). It needs an API key login.
• meshstack eventlog list, meshstack bbd list and meshstack bbdv list list event logs, definitions and their versions.
• An install script: curl … | sh.

Changed behaviour

• INFO lines on stderr are plain text, without time and level. WARN and ERROR keep their level. --debug brings back the time and level for every line.
• Color follows NO_COLOR, FORCE_COLOR and CLICOLOR_FORCE. A known CI colors the log, never stdout. A building block run stays plain.
• MESHSTACK_API_TOKEN in the environment wins over a token a profile stores.
• bbrun list lists the runs of all building blocks newest first.
• A login that fails stores nothing. A login ends with its auth status, which shows the meshStack version.
• When stdin ends at a profile question (in a script), logout and login take the current profile, and profile add takes the defaults.
• -p is short for --profile, -w for --workspace.
• List commands keep to the profile's default workspace, unless -w or MESHSTACK_WORKSPACE names another.
• A wrong argument or flag prints the command's usage, and an unknown subcommand suggests the closest one.
• The root help says once where the endpoint, the profile and the workspace come from, and the commands' help is short.
• Clearer errors for a login without a workspace and for a workspace without a role; a failed login leaves no token behind.

For the Terraform provider (see Client API below): TriggerRun returns the building block it refreshed, TagInputTargetsFor(t) is now t.TagInputTargets(), and the exported event log client is gone; client.Raw reads event logs.

Release notes (generated)

Client API

• e7f95c1 feat(client): add the Payment Method building block input source
• 5a85853 feat(client): read the API key of a request with ReadSelf, and name the groups of ApiKeyPermissions
• 8439068 feat(client): reference a supported platform of a definition by uuid
• cd13503 feat(client): return the building block from TriggerRun
• 0f8595c fix(client): read a building block run's metadata.createdAt
• e337cf1 refactor(client): fold the helpers of a type into methods on it
• 67d5341 refactor(client): gather the CLI's raw JSON access on client.Client.Raw
• 368bf79 refactor(client): make TagInputTargetsFor a method of MeshBuildingBlockType

Features

• c13b1c0 feat(api): take a full URL and pick the profile whose endpoint holds it
• 77cea0b feat(auth): ask which profile to log in to
• 049a559 feat(auth): ask which profile to log out of
• 20d0f9c feat(auth): let an API key login go on without a workspace
• f987265 feat(auth): show where a login comes from and what it may do with meshstack auth status
• 5d91072 feat(buildingblock): show a building block's tofu state, and run tofu against it
• a3eeb0e feat(buildingblockrun): follow a run's logs until it has finished
• 9037bb4 feat(login): let the user choose an access level
• f0feed6 feat(profile): keep meshstack profile and a login from undoing each other's changes
• 963db1c feat(profile): manage the profiles with meshstack profile
• ce9052c feat(prompt): choose a profile or a workspace from a list on the terminal
• e5970c6 feat: add -p for --profile and -w for --workspace
• f236de8 feat: add meshstack api-docs, and version meshstack api by the API docs
• d3e7f0f feat: add meshstack api to call any meshStack API path
• b29f856 feat: add a POSIX sh install script
• 13ea001 feat: color the output on FORCE_COLOR or CLICOLOR_FORCE, and the log in a CI
• bef6c70 feat: end a login with its auth status, which shows the meshStack version
• 485b691 feat: keep a listing to the profile's default workspace
• b599d5a feat: list event logs with meshstack eventlog list
• 697df7b feat: log INFO as a plain line, and keep the time and level for --debug
• cecbff7 feat: name the run that trigger-run started, and fail when it could not start
• cd1ab67 feat: point the root help to meshstack login, -o json and meshstack api
• 7ae5b38 feat: show a command's usage after a wrong argument or flag
• 56885a3 feat: show building block run logs, list definitions and versions
• 0266ba8 feat: trigger a building block run from the CLI

Fixes

• 58911ef fix(auth): only warn on a logout of a profile that does not exist
• 20535b9 fix(auth): say how to log in again once a token cannot be renewed
• 00cf2c7 fix(auth): say plainly that a login has no role in a workspace
• 107178a fix(auth): send the API token of the environment over the one a profile stores
• c4b7136 fix(buildingblockrun): list the runs of every building block newest first
• 4311886 fix(buildingblockrun): take --workspace along with --building-block
• 04ec1ca fix(login): keep no token of a login that failed
• 62fa29b fix(login): name the argument a login does not take once, and quoted once
• 11837fb fix(login): say plainly that a login has no workspace to work in
• fd68058 fix(login): store nothing when a login fails
• babb304 fix(setting): suggest only the flags and variables a person can set when a setting is missing

Others

• 64c3edc chore(deps): bump the github-actions group with 4 updates
• 14b99d5 chore(deps): move to charm.land/log/v2
• 5d5113a chore(lint): anchor the forbidigo http client pattern to the package
• 15aeb84 chore(lint): disable SA4023 until go1.27.2
• ac981bd chore(release): group the changes of client/ in the release notes
• f9f7dc4 chore: update dependencies with Dependabot
• 88287a0 ci: check for known vulnerabilities with govulncheck
• bc910de ci: drop the temporary push trigger of the acceptance tests
• 9bf7b47 docs(api): shorten the help of meshstack api and api-docs
• 661e897 docs: add a page for meshstack profile, with a demo of its own
• 433bd73 docs: add a skill for meshObject commands, and the API docs to the client rules
• 8f169c6 docs: build the demo's fake meshStack from internal/testutil/fakemeshstack
• a8d556b docs: mark no breaking change with ! while the CLI is at 0.x
• af72c5e docs: name auth.ResolveClient, which both front ends build their client with
• 62ee93a docs: put behaviour on its type
• 324397a docs: record a demo of the CLI for the README
• 033b481 docs: run the acceptance suite against a local meshStack
• 8b3a00c docs: say once, in the root help, where the endpoint, profile and workspace come from
• 59ed9e9 docs: say which tests to add, and how to write them
• 58ce37c docs: shorten the commands' help, and keep only where a setting deviates
• 0e73c80 docs: trim Go comments that restate the code
• f56ddfc docs: trim instruction and config comments that restate the files
• 5fdb64a refactor(auth): move the prompt to cmd/internal/prompt
• aa0f217 refactor(auth): pass the api key and manual resolvers only the setting sources
• f3f309f refactor(cmd): give the command of a kind the type KindCommand
• c9bf532 refactor(cmd): make WriteList, WriteItem, CutShortNote and isRelease methods
• ab87f72 refactor(cmd): make the helpers of OutputFormat and of color's env methods
• 97f0ac9 refactor(http): download a document into a file, and keep it up to date
• eb2c63a refactor(login): parse the id of --apikey while the flags are parsed
• f46293d refactor(openapi): give path templates and API version lists types of their own
• 67cb4f1 refactor(openapi): select the operations of a request from the OpenAPI document
• 9d800f1 refactor(profile): load the profiles without resolving the profile name
• bc0b5c2 refactor(profile): make Add a method of Profiles
• 3cbd04d refactor(profile): move the profile operations of meshstack profile onto Profiles
• 6fcbe81 refactor(prompt): ask for a line with a default, and run any terminal UI
• 1fdf7e1 refactor: parse uuid flags and arguments into uuid.UUID as cobra parses them
• 77c3fe9 test(auth): turn the session, cache and status tests into scenarios
• cf67523 test(client): keep only the tests that pin what no acceptance test reaches
• 18234aa test(cmd): drop the command tests that an acceptance test already runs
• 042fb2a test(cmd/profile): run the list, show and store tests as scenarios
• 795df21 test(http): fold the retry, query and form tests onto one server each
• b4bc5b6 test(profile): run the resolution and lock tests as scenarios
• 7a2b2dc test(testacc): every GET operation of the API docs answers 2xx
• 906322b test(testacc): run every list command against the local stack
• 48984fa test(testacc): run the commands in process rather than a built binary
• 4c00513 test(testacc): run the suite as three scenarios that share their logins
• ffc70bc test(testacc): show that a meshObject endpoint refuses application/json
• 0f56dc1 test(testacc): take the current profile where stdin ends before the profile selection
• f07cc20 test(tfstate): drive one writable and one read-only proxy through their steps
• 6ce2bf3 test(version): drop the tests of String and MustParse
• ffc21e9 test: capture the log of a test with logs.Capture
• e57c3c4 test: serve every fake meshStack of the tests from internal/testutil/fakemeshstack

🤖 Generated with Claude Code

[meshcloud-gh-actions]

Coverage of the acceptance run against the meshStack backend, on 485b69158908cdb5584513089c8b8c65e7e81753.

Scope	Coverage
Unit tests	79.5%
Acceptance tests	53.0%
Combined	83.5%

Uncovered functions

client/api_key.go:55: meshApiKeyClient.Create 0.0%
client/api_key.go:59: meshApiKeyClient.Read 0.0%
client/api_key.go:63: meshApiKeyClient.Update 0.0%
client/api_key.go:71: meshApiKeyClient.Delete 0.0%
client/api_key_permissions.go:20: ApiKeyPermissions.AllCodes 0.0%
client/api_key_permissions.go:33: ApiKeyPermissions.WorkspaceCodes 0.0%
client/api_key_permissions.go:295: AllApiKeyPermissions 0.0%
client/api_key_permissions.go:299: WorkspacePermissionCodes 0.0%
client/building_block_definition.go:71: MeshBuildingBlockDefinitionApprovalPolicies.NothingRequiresApproval 0.0%
client/building_block_definition.go:82: DisabledSchedule 0.0%
client/building_block_definition.go:89: MeshBuildingBlockDefinitionSchedule.IsDisabled 0.0%
client/building_block_definition.go:93: MeshBuildingBlockDefinitionSpec.HasNeutralPolicies 0.0%
client/building_block_definition.go:97: MeshBuildingBlockDefinitionSpec.WithNeutralPolicies 0.0%
client/building_block_definition.go:166: meshBuildingBlockDefinitionClient.List 0.0%
client/building_block_definition.go:173: meshBuildingBlockDefinitionClient.Read 0.0%
client/building_block_definition.go:177: meshBuildingBlockDefinitionClient.Create 0.0%
client/building_block_definition.go:181: meshBuildingBlockDefinitionClient.Update 0.0%
client/building_block_definition.go:185: meshBuildingBlockDefinitionClient.Delete 0.0%
client/building_block_definition_version.go:100: MeshBuildingBlockType.TagInputTargets 0.0%
client/building_block_definition_version.go:245: meshBuildingBlockDefinitionVersionClient.Create 0.0%
client/building_block_definition_version.go:254: meshBuildingBlockDefinitionVersionClient.Update 0.0%
client/building_block_definition_version_implementation.go:80: MeshBuildingBlockDefinitionImplementation.InferType 0.0%
client/building_block_definition_version_implementation.go:94: MeshBuildingBlockDefinitionImplementation.MarshalJSON 0.0%
client/building_block_definition_version_implementation.go:107: *MeshBuildingBlockDefinitionImplementation.UnmarshalJSON 0.0%
client/building_block_runner.go:82: meshBuildingBlockRunnerClient.Create 0.0%
... and 123 more

covdata func names a method without its receiver, so an entry can belong to an implementation nothing selects rather than to a function the tests never reached. Open the file and line before reading one as a coverage gap.