sync to refactored break

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Each line is a file pattern followed by one or more owners.
+
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# Order is important; the last matching pattern takes the most precedence.
+
+# Teams can be specified as code owners as well. Teams should
+# be identified in the format @org/team-name. Teams must have
+# explicit write access to the repository. 
+
+*  @silogen/platform

.github/workflows/helm-chart-checks.yaml

@@ -0,0 +1,30 @@
+name: Helm chart checks
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  root-chart:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        values:
+          [
+            ./root/values.yaml,
+            ./root/values_small.yaml,
+            ./root/values_medium.yaml,
+            ./root/values_large.yaml
+          ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v4.3.0
+
+      - name: Helm lint
+        run: helm lint ./root -f ${{ matrix.values }}
+
+      - name: Helm template
+        run: helm template ./root -f ${{ matrix.values }}

.github/workflows/pr-component-validation.yaml

@@ -0,0 +1,29 @@
+name: PR Component Validation
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'sbom/components.yaml'
+      - 'root/values.yaml'
+      - 'sbom/*.sh'
+
+jobs:
+  validate-components:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install yq
+      run: |
+        sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+        sudo chmod +x /usr/local/bin/yq
+
+    - name: Validate SBOM Sync (Gatekeeper)
+      working-directory: ./sbom
+      run: |
+        chmod +x validate-*.sh
+        ./validate-sync.sh

.github/workflows/release-pipeline.yaml

@@ -0,0 +1,137 @@
+name: Release Pipeline
+
+on:
+  workflow_dispatch:
+    inputs:
+      version_override:
+        description: 'Override version (leave empty to auto-calculate)'
+        required: false
+        type: string
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.semver.outputs.next }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Calculate Next Version
+        id: calculate_version
+        uses: ietf-tools/semver-action@v1
+        with:
+          branch: ${{ github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          maxTagsToFetch: 100
+          skipInvalidTags: true
+          patchAll: true
+
+      - name: Set Next Version
+        id: semver
+        run: |
+          VERSION="${{ github.event.inputs.version_override }}"
+          if [[ -z "$VERSION" ]]; then
+            echo "Using auto-calculated version: $VERSION"
+            VERSION="${{ steps.calculate_version.outputs.next }}"
+          else
+            echo "Using manual override version: $VERSION"
+          fi
+          echo "next=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Update helm values file
+        uses: mikefarah/yq@master
+        env:
+          GIT_TAG: ${{ steps.semver.outputs.next }}
+        with:
+          cmd: |
+            yq -i '.clusterForge.targetRevision = env(GIT_TAG)' root/values.yaml
+            yq -i '.targetRevision = env(GIT_TAG)' scripts/init-gitea-job/values.yaml
+
+      - name: Commit and push changes
+        uses: stefanzweifel/git-auto-commit-action@v4
+        env:
+          GIT_TAG: ${{ steps.semver.outputs.next }}
+        with:
+          commit_message: 'Update version to ${{ env.GIT_TAG }} [actions skip]'
+
+      - name: Create GitHub Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.semver.outputs.next }}
+          EXTRA_ARGS: ${{ steps.version.outputs.extra_args }}
+        run: |
+          # Prepare release artifact
+          tar -zcvf "release-enterprise-ai-${VERSION}.tar.gz" --transform 's,^,cluster-forge/,' root/ scripts/ sources
+
+          # Create release
+          gh release create "$VERSION" "release-enterprise-ai-${VERSION}.tar.gz#ClusterForge Enterprise AI Package" \
+            --title="ClusterForge Release $VERSION" \
+            --generate-notes \
+            --prerelease || true # Ignore if release already exists
+
+  sbom:
+    needs: [release]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.release.outputs.new_version }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Generate SBOM
+        id: generate_sbom
+        working-directory: ./sbom
+        run: |
+          echo "Generating SBOM for release ${VERSION}..."
+
+          chmod +x generate-sbom.sh
+          ./generate-sbom.sh
+
+          if [[ ! -f "SBOM.md" ]]; then
+            echo "❌ Error: SBOM.md was not generated"
+            exit 1
+          fi
+
+          # Create the renamed SBOM file with release name and git hash
+          SHORT_HASH=$(echo "${{ github.sha }}" | cut -c1-7)
+          NEW_SBOM_NAME="sbom-${VERSION}-${SHORT_HASH}.md"
+
+          cp SBOM.md "$NEW_SBOM_NAME"
+          echo "✅ SBOM generated successfully as $NEW_SBOM_NAME"
+
+          # Show SBOM summary
+          echo ""
+          echo "=== SBOM Summary ==="
+          echo "Release: ${VERSION}"
+          echo "Generated at: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
+
+          # Count components in each category
+          all_components=$(yq eval '.components | keys | length' components.yaml)
+          helm_components=$(yq eval '.components | to_entries | map(select(.value.valuesFile != null)) | length' components.yaml)
+          manifest_components=$((all_components - helm_components))
+
+          echo "Total components: $all_components"
+          echo "Helm charts: $helm_components"
+          echo "Kubernetes manifests: $manifest_components"
+          echo "===================="
+
+          echo "sbom_name=${NEW_SBOM_NAME}" >> $GITHUB_OUTPUT
+
+      - name: Upload SBOM as artifact
+        working-directory: ./sbom
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SBOM_NAME: ${{ steps.generate_sbom.outputs.sbom_name }}
+        run: |
+          gh release upload ${VERSION} ${SBOM_NAME} --clobber

.gitignore

@@ -2,14 +2,12 @@
 logs/*
 !logs/.gitkeep
 working/*
-!working/.gitkeep
-!working/pre
-working/pre/*
-!working/pre/.gitkeep
 output/*
 !output/.gitkeep
-stacks/*
-!stacks/.gitkeep
+stacks
+
+.krew
+devbox.lock
 
 Library*
 
@@ -35,7 +33,33 @@ go.work
 !vendor/**/zz_generated.*
 
 # editor and IDE paraphernalia
+.vscode
 .idea
 *.swp
 *.swo
 *~
+
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+dev-debug.log
+# Dependency directories
+node_modules/
+# Environment variables
+.env
+# Editor directories and files
+.vscode
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+# OS specific
+.DS_Store
+
+# Task files
+# tasks.json
+# tasks/