Relocate packaging: RPM, shell completions, no-TTY fix, repaired tests (#13)

## Why

The unit tests stopped compiling after the `--pm` → `-p`/`-i` match-modifier refactor was left uncommitted, there was no RPM/completions distribution story, and invoking the tool without a TTY against an empty pipe silently returned nothing. This makes the project releasable and safe to run from agents/CI.

## Changes

- Make stdin handling robust: replace the fragile `!isTerminal` check with `stdinReader()`, which only reads node names when stdin is a real pipe/redirect carrying data. Terminals, `/dev/null`, and empty/closed pipes now fall through to a normal query, so running without a TTY behaves like an interactive run.
- Repair and expand `main_test.go` to match the current `buildQuery`/`run` signatures; add coverage for the match modifiers, all output modes, config precedence, and the new `stdinReader` logic. `httptest` stubs PuppetDB (no live deps).
- Add nfpm packaging (`packaging/nfpm.yaml`, `scripts/build-rpm.sh`): installs the binary to `/usr/bin/node-lookup` and bundles generated bash/zsh/fish completions under the standard system paths.
- Rework the Makefile to build into `dist/` and add `completions`/`rpm` targets.
- Split PR CI into `build`, `test`, and `pre-commit` workflows and extend `release` to build the RPM and `PUT` it to the artifactapi `rpm-internal` repo. Every step sets a `serviceAccount` and k8s resources.

The project directory has also been relocated under `prodenv`.

Reviewed-on: #13
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

AGENTS.md

@@ -7,20 +7,51 @@
 ## Structure
 
 ```
-main.go        # entire application source
-go.mod         # Go module (module name: node-lookup)
-go.sum         # dependency checksums
-node-lookup    # compiled binary (not committed)
+main.go             # entire application source
+main_test.go        # unit tests (mock PuppetDB via httptest, no live deps)
+go.mod              # Go module (module name: node-lookup)
+go.sum              # dependency checksums
+Makefile            # build / test / lint / completions / rpm / version-bump targets
+packaging/nfpm.yaml # nfpm spec (envsubst-templated) for the RPM
+scripts/build-rpm.sh # generates completions + packages the RPM with nfpm
+.woodpecker/        # CI: build, test, pre-commit (PR) + release (tag)
+dist/               # build output: binary, completions, RPM (not committed)
 ```
 
 ## Build
 
 ```bash
+make build          # -> dist/node-lookup (CGO disabled, static)
+# or directly:
 go build -o node-lookup ./...
 ```
 
 Requires Go 1.21+. Dependencies: `github.com/spf13/cobra` (CLI), `gopkg.in/yaml.v3` (Ansible output).
 
+## Packaging (RPM)
+
+```bash
+make rpm            # build the binary + package it into dist/*.rpm via nfpm
+```
+
+`scripts/build-rpm.sh` generates bash/zsh/fish completions from the built binary
+and bundles them alongside `/usr/bin/node-lookup`. On a `v*` tag the release
+pipeline builds the RPM and `PUT`s it to the artifactapi `rpm-internal` repo.
+
+## Shell completions
+
+Cobra provides a `completion` subcommand:
+
+```bash
+node-lookup completion bash   # or zsh / fish / powershell
+```
+
+The RPM installs completions to the standard system paths
+(`/usr/share/bash-completion/completions/`, `/usr/share/zsh/site-functions/`,
+`/usr/share/fish/vendor_completions.d/`), so they work automatically once
+installed. To load ad-hoc in the current shell, e.g. zsh:
+`source <(node-lookup completion zsh)`.
+
 ## Running the Tool
 
 ```bash
@@ -28,8 +59,10 @@ Requires Go 1.21+. Dependencies: `github.com/spf13/cobra` (CLI), `gopkg.in/yaml.
 ./node-lookup -R                          # show all nodes with role fact
 ./node-lookup -n <hostname>               # lookup a specific node
 ./node-lookup -F <fact_name>              # filter by fact name
-./node-lookup -m <value>                  # exact value match
-./node-lookup --pm <pattern>              # partial/regex match on value
+./node-lookup -m <value>                  # exact value match (-m)
+./node-lookup -pm <value>                 # partial/regex match (-p -m combined)
+./node-lookup -im <value>                 # inverse exact match (-i -m combined)
+./node-lookup -ipm <value>                # inverse partial match (-i -p -m combined)
 ./node-lookup -R -1                       # node names only
 ./node-lookup -R -2                       # values only
 ./node-lookup -R -C                       # count occurrences
@@ -76,11 +109,11 @@ Show the active configuration (after all overrides applied):
 ## Code Patterns
 
 - **`loadConfig()`**: reads config file → applies env vars → returns `config` struct. Called once at startup in `main()`.
-- **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded).
+- **`buildQuery()`**: returns a PuppetDB PQL-compatible JSON array string. Uses `roleFact` from config (not hardcoded). Match modifiers: `-p` (partial/regex, uses `~` op), `-i` (inverse, wraps with `not`), composable.
 - **`queryPuppetDB(url, query)`**: takes the URL as a parameter — never reads globals.
 - **`processResults()`**: iterates facts, returns sorted `"certname value"` strings. JSON string values are unquoted; other JSON types rendered as compact JSON.
 - **Output modes**: JSON (`-j`), count (`-C`), Ansible YAML (`-A`), node-only (`-1`), value-only (`-2`), default (node + value).
-- **Stdin support**: when stdin is not a TTY and no `-n` is given, node names are read line-by-line and queried individually (one HTTP request per node).
+- **Stdin support**: `stdinReader()` reads node names from stdin only when it is a real pipe/redirect carrying data (and no `-n` given). Terminals, `/dev/null`, and empty/closed pipes fall through to a normal query — so running without a TTY (e.g. invoked by an agent or CI) behaves like an interactive run instead of consuming empty input.
 - **SIGPIPE handling**: `signal.Ignore(syscall.SIGPIPE)` so pipes to `head` etc. work cleanly.
 
 ## CLI Framework
@@ -89,7 +122,15 @@ Uses [Cobra](https://github.com/spf13/cobra). Root command is the query command.
 
 ## Testing
 
-No test suite exists. Manual testing requires access to the Consul/PuppetDB environment or a mock HTTP server.
+```bash
+make test           # go test -v -race ./...
+```
+
+`main_test.go` covers query construction (all `-m`/`-p`/`-i` combinations), value
+rendering, result processing/counting, config precedence (defaults < file < env),
+`writeDefaultConfig`, the `stdinReader` no-TTY behavior, and every `run()` output
+mode (default, `-1`, `-2`, `-C`, `-j`, `-A`, `-a`). PuppetDB is stubbed with
+`httptest` — no live Consul/PuppetDB access is required.
 
 ## Gotchas