Add nvpkg CLI for NovusPack package management

.github/dependabot.yml

@@ -1,7 +1,43 @@
 version: 2
 updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
   - package-ecosystem: "gomod"
     directory: "/api/go"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+
+  - package-ecosystem: "gomod"
+    directory: "/cli/nvpkg"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+
+  - package-ecosystem: "pip"
+    directory: "/scripts"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"

.github/workflows/check-dev-docs.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Check for stray files in dev_docs
         run: |

.github/workflows/docs-check.yml

@@ -43,10 +43,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: '20'
 

.github/workflows/go-bdd.yml

@@ -9,6 +9,13 @@ on:
       - 'api/go/**/*.go'
       - 'features/**/*.feature'
       - 'api/go/**/_bdd/**/*.go'
+  push:
+    branches:
+      - main
+    paths:
+      - 'api/go/**/*.go'
+      - 'features/**/*.feature'
+      - 'api/go/**/_bdd/**/*.go'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -23,7 +30,7 @@ jobs:
         working-directory: api/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/go-ci.yml

@@ -25,7 +25,7 @@ jobs:
         working-directory: api/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -47,7 +47,7 @@ jobs:
         working-directory: api/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -67,15 +67,15 @@ jobs:
         run: go vet ./...
 
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.7.0
+          version: latest
           working-directory: api/go
 
       - name: Run golangci-lint (BDD)
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.7.0
+          version: latest
           working-directory: api/go
           args: --build-tags=bdd
 
@@ -87,7 +87,7 @@ jobs:
         working-directory: api/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5
@@ -106,7 +106,7 @@ jobs:
         working-directory: api/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v5

.github/workflows/nvpkg-ci.yml

@@ -0,0 +1,116 @@
+name: nvpkg CI
+
+# NOTE: This workflow must be kept in sync with the 'ci' target in cli/nvpkg/Makefile.
+#       When adding or modifying CI checks, update both this workflow and cli/nvpkg/Makefile.
+#       Runs test, lint, build, and coverage for the nvpkg CLI.
+
+on:
+  push:
+    paths:
+      - 'cli/nvpkg/**'
+      - 'api/go/**'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-nvpkg:
+    name: Test nvpkg
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cli/nvpkg
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: cli/nvpkg/go.sum
+
+      - name: Verify go.mod is tidy
+        run: go mod tidy && git diff --exit-code go.mod go.sum
+
+      - name: Verify dependencies
+        run: go mod verify
+
+      - name: Run unit tests
+        run: go test -v ./...
+
+  lint-nvpkg:
+    name: Lint nvpkg
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cli/nvpkg
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: cli/nvpkg/go.sum
+
+      - name: Check formatting
+        run: |
+          if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then
+            echo "Code is not formatted. Run 'go fmt ./...'"
+            gofmt -s -d .
+            exit 1
+          fi
+
+      - name: Run go vet
+        run: go vet ./...
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+          working-directory: cli/nvpkg
+
+  build-nvpkg:
+    name: Build nvpkg
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cli/nvpkg
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: cli/nvpkg/go.sum
+
+      - name: Install UPX
+        run: sudo apt-get update && sudo apt-get install -y upx-ucl
+
+      - name: Build
+        run: make build
+
+  coverage-nvpkg:
+    name: Coverage nvpkg
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cli/nvpkg
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          cache-dependency-path: cli/nvpkg/go.sum
+
+      - name: Run tests with coverage
+        run: make coverage

.github/workflows/nvpkg-release.yml

@@ -0,0 +1,108 @@
+name: nvpkg Build and Publish
+
+# Builds release (Go -ldflags -s -w + UPX) and dev binaries in separate per-OS/arch jobs (matrix).
+# Output: one folder per target (e.g. linux-amd64/, darwin-arm64/, windows-amd64/, freebsd-amd64/)
+# with nvpkg and nvpkg-dev (Unix) or nvpkg.exe and nvpkg-dev.exe (Windows).
+# Platforms match cli/nvpkg/Makefile: Linux, macOS (darwin), Windows, FreeBSD (amd64, arm64 each where applicable).
+# Uploads artifacts and attaches to GitHub Release.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GO_VERSION: '1.25'
+
+jobs:
+  build:
+    name: Build nvpkg ${{ matrix.goos }}-${{ matrix.goarch }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+          - goos: freebsd
+            goarch: amd64
+          - goos: freebsd
+            goarch: arm64
+    defaults:
+      run:
+        working-directory: cli/nvpkg
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: cli/nvpkg/go.sum
+
+      - name: Install UPX
+        run: sudo apt-get update && sudo apt-get install -y upx-ucl
+
+      - name: Build release and dev binaries
+        run: |
+          set -e
+          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }}
+          dir="../dist/${GOOS}-${GOARCH}"
+          mkdir -p "$dir"
+          if [ "$GOOS" = "windows" ]; then
+            release_name="nvpkg.exe"
+            dev_name="nvpkg-dev.exe"
+          else
+            release_name="nvpkg"
+            dev_name="nvpkg-dev"
+          fi
+          CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build -ldflags="-s -w" -trimpath -o "$release_name" .
+          upx --best "$release_name" 2>/dev/null || true
+          mv "$release_name" "$dir/"
+          GOOS="$GOOS" GOARCH="$GOARCH" go build -o "$dev_name" .
+          mv "$dev_name" "$dir/"
+          find "$dir" -type f | sort
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.goos }}-${{ matrix.goarch }}
+          path: cli/dist/${{ matrix.goos }}-${{ matrix.goarch }}
+          retention-days: 90
+
+  publish:
+    name: Publish to Release
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name == 'release'
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+
+      - name: Create archives per platform
+        run: |
+          for dir in */; do
+            (cd "$dir" && zip -r "../${dir%/}.zip" .)
+          done
+
+      - name: Publish to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          files: |
+            *.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/python-lint.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v5

.markdownlint-cli2.jsonc

@@ -6,6 +6,7 @@
   "ignores": [
     "**/node_modules/**",
     "tmp/**",
+    "**/dist/**",
     "**/*.plan.md",
     "**/.*/**"
   ],