[FEAT] - GHA streamling in cloudoperators

[abhijith-darshan]

Priority

(Medium) I'm annoyed but I'll live

User Story

Standardize build, test, lint and release workflows for greenhouse extensions and cloudctl

Description

• common test (go)
• common lint (go)
• common build (make docker-build + make build) pass docker-build and build as inputs
• common release
  • bump chart and app versions
    • trigger via workflow dispatch with inputs (Major, Minor, Patch)
    • Ref: https://github.com/cloudoperators/repo-guard/blob/main/.github/workflows/release-cut.yaml
    • bump using version from Makefile (with: bump-make-version)
• common e2e setup to spin up admin cluster with greenhouse manager + KinD cluster
  • conditional remote setup
  • shoot-grafter, repo-guard, permission-manager and cloudctl

Enable auto-merge of PR on repositories on required checks (Optional)
Enable Release environment on repositories for gating

Acceptance Criteria

• shoot-grafter, repo-guard, permission-manager, cloudctl should consume shared workflows (build, test, lint and e2e)
• shoot-grafter, repo-guard, permission-manager on release should update (Cluster)PluginDefinition versions in greenhouse-extensions via repository dispatch
• common e2e setup to bring up greenhouse manager on KinD

Reference Issues

No response

[onuryilmaz]

Implementation update — shared GHA workflows

The shared reusable workflows have been implemented across all target repos. All changes are in PRs (none merged to main yet).

---

cloudoperators/common — new shared workflows

PR: common#65

Five new reusable workflows added to .github/workflows/:

File	Purpose
shared-go-lint.yaml	golangci-lint + optional govulncheck
shared-go-test.yaml	Parameterized make test target + optional coverage artifact upload
shared-go-build.yaml	Go binary build + optional Docker multi-arch build/push to GHCR
shared-release.yaml	Semver bump (patch/minor/major) → Chart.yaml + Makefile update → release PR → GitHub release → optional repository_dispatch to greenhouse-extensions
shared-e2e.yaml	Wraps existing workflows/e2e composite action for KinD-based e2e

All actions use pinned full commit SHAs consistent with existing patterns.

---

Consumer repo PRs

Repo	PR	What changed
repo-guard	repo-guard#167	ci.yaml: lint + test jobs → shared workflows. release-cut.yaml: all inline semver/PR/release logic → shared-release.yaml (+ dispatches to greenhouse-extensions on release)
cloudctl	cloudctl#57	test.yaml: unit test job → shared-go-test.yaml
shoot-grafter	shoot-grafter#66	ci.yaml: build + test jobs → shared workflows. checks.yaml: golangci-lint + govulncheck → shared-go-lint.yaml
permission-manager	permission-manager#39	New ci.yaml added with lint + test + build via shared workflows (repo previously had no CI)

---

Merge order

1. common#65 must merge first — all consumer PRs depend on it
2. Consumer PRs can merge in any order after that

---

Out of scope / follow-ups

• e2e jobs in repo-guard and cloudctl remain inline — both use k3d with repo-specific mock setups incompatible with the greenhouse KinD composite in shared-e2e.yaml. A follow-up is needed to align these.
• shoot-grafter + permission-manager release workflows not added — neither repo has a charts/ directory or VERSION in the Makefile. Needs a release process decision first.
• shoot-grafter remaining checks (shellcheck, typos, addlicense, reuse, dependency-licenses) stay inline — not covered by any shared workflow yet.
• greenhouse-extensions — Helm-based CI/release is a different paradigm; left unchanged as agreed.