Provide a go toolkit component

Loic Nicollerequested to merge
_initial into main

This MR introduces a new GitLab CI component.

It is intended to replace our legacy go-operator CI template and the TBC Go templates.

This component is not just a conversion from GitLab CI templates to components; it also changes the existing logic. The previous templates relied on custom images for each job, which made them difficult to maintain because project and tooling versions could drift apart. They also did not ensure that the Makefile targets actually worked.

The new component uses the provided Makefile as the entry point for most jobs instead of relying on custom images. In return, the consuming project must define a tools/ directory listing the required dependencies. This keeps the tooling versions aligned with the Go version used by the project.

One drawback is that first run can be a bit longer as it need to create cache for go dependencies instead of relying on embedded tools

All jobs can be disabled if needed, and the Makefile targets can also be adjusted.

Old job Source New job (go-toolkit, prefix <as>) Notes
ensure-manifests-are-generated ci-templates/operator-template.yml <as>-generate Same pattern: run make manifests generate then git diff --quiet.
test-operator ci-templates/operator-template.yml <as>-test Same JUnit + Cobertura publishing; report tools installed from consumer's tools/go.mod instead of @latest.
test-operator-e2e ci-templates/operator-template.yml <as>-e2e Opt-in via e2e-enabled: true. Docker CLI now installed as a static binary pinned to docker-version.
test-operator-kube-api-linter ci-templates/operator-template.yml <as>-kube-api-linter Opt-in via kube-api-linter-enabled: true. File-change rules dropped (component doesn't hardcode project paths).
deploy-operator ci-templates/operator-template.yml — Not replaced. Operator-specific kind-cluster deploy step; belongs elsewhere.
go-ci-lint to-be-continuous/golang <as>-lint Now delegates to make lint. Consumer controls the exact command in the Makefile.
go-build-test to-be-continuous/golang <as>-build + <as>-test Split into two jobs running in parallel after <as>-lint.
go-govulncheck to-be-continuous/golang <as>-govulncheck Text output as artifact. Exit code 3 (vulns found) tolerated so job stays green. GitLab report integration dropped — govulncheck's schemas aren't accepted by sast.
go-sbom to-be-continuous/golang <as>-sbom CycloneDX via cyclonedx-gomod, published as reports.cyclonedx (surfaces in GitLab Dependency List).
go-semgrep to-be-continuous/golang <as>-semgrep Now uses semgrep ci --config=auto (CI-aware, diff-only on MR pipelines), publishes GitLab-native SAST report.
go-outdated to-be-continuous/golang — Not replaced (follow-up).
go-fmt, go-vet to-be-continuous/golang folded into <as>-lint Standard operator Makefiles chain fmt vet into lint.

Worth to note, I've changed the go vulncheck job so It will never failed (except a failure in command itself) as we are using it more as an informative job; We never block MRs for that.

deploy-operator job was dropped, as we now have e2e testing that replaced it. It also avoid to maintain a custom image (which was never well aligned with what we are doing in sylva-core) go mod outdated job was dropped, previously it was a manual job and I don't think we have people running it (can be added later, if required)

Component was tested here:

When merged and adopted we could deprecate:

and

Edited by Loic Nicolle

Merge request reports