Package as RPM, add completions, fix no-TTY behavior, repair tests

The test suite no longer compiled after the -p/-i match-modifier refactor,
there was no RPM packaging or shell-completion story, and running without a
TTY against an empty pipe silently returned nothing.

- Replace the fragile !isTerminal stdin check with stdinReader(): only read
  node names when stdin is a real pipe/redirect carrying data, so /dev/null,
  terminals, and empty/closed pipes fall through to a normal query (works when
  invoked by an agent/CI with no TTY).
- Rewrite main_test.go to match the current buildQuery/run signatures and add
  coverage for match modifiers, output modes, config precedence, and the new
  stdinReader logic.
- Add nfpm packaging (packaging/nfpm.yaml, scripts/build-rpm.sh) that installs
  the binary to /usr/bin and bundles generated bash/zsh/fish completions.
- Rework the Makefile to build into dist/ and add completions/rpm targets.
- Split the PR CI into build + test + pre-commit workflows and extend release
  to build the RPM and PUT it to the artifactapi rpm-internal repo; every step
  now sets a serviceAccount and k8s resources.

.woodpecker/build.yaml

@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build
+    image: golang:1.25
+    commands:
+      - make build
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/lint.yaml

@@ -1,8 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: lint
-    image: golangci/golangci-lint:latest
-    commands:
-      - golangci-lint run ./...

.woodpecker/pre-commit.yaml

@@ -3,6 +3,16 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260325
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
       - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/release.yaml

@@ -3,36 +3,97 @@ when:
 
 steps:
   - name: test
-    image: golang:latest
+    image: golang:1.25
     commands:
-      - go test ./...
+      - go test -race ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
 
-  - name: build-linux-amd64
-    image: golang:latest
-    commands:
-      - GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-amd64 ./...
-    depends_on: [test]
-
-  - name: build-linux-arm64
-    image: golang:latest
-    commands:
-      - GOOS=linux GOARCH=arm64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-arm64 ./...
-    depends_on: [test]
-
-  - name: build-darwin-amd64
-    image: golang:latest
+  # Build the linux/amd64 binary into dist/ (consumed by the RPM step) plus the
+  # cross-platform binaries attached to the Gitea release.
+  - name: build
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
+      - make build VERSION=${CI_COMMIT_TAG}
+      - GOOS=linux  GOARCH=amd64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-amd64 ./...
+      - GOOS=linux  GOARCH=arm64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-linux-arm64 ./...
       - GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-darwin-amd64 ./...
-    depends_on: [test]
-
-  - name: build-darwin-arm64
-    image: golang:latest
-    commands:
       - GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" -o node-lookup-darwin-arm64 ./...
     depends_on: [test]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
 
+  # Package the built binary + generated shell completions into an RPM.
+  - name: package
+    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    commands:
+      - ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
+    depends_on: [build]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  # Publish the RPM to the artifactapi local rpm repo (a real yum repo;
+  # repodata regenerates automatically).
+  - name: upload-rpm
+    image: git.unkin.net/unkin/almalinux9-base:20260606
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-internal"
+        for rpm in dist/*.rpm; do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (returns 405); probe with GET against
+          # the served path (RPMs are stored under Packages/) to avoid re-upload.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
+            continue
+          fi
+          echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
+          curl -f -X PUT \
+            "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
+            -H "Content-Type: application/x-rpm" \
+            --data-binary @"$$rpm"
+        done
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+
+  # Cut a Gitea release with the cross-platform binaries attached.
   - name: release
-    image: git.unkin.net/unkin/almalinux9-base:20260325
+    image: git.unkin.net/unkin/almalinux9-base:20260606
     environment:
       RELEASER_TOKEN:
         from_secret: RELEASER_TOKEN
@@ -53,7 +114,14 @@ steps:
           node-lookup-darwin-amd64 \
           node-lookup-darwin-arm64 \
           --login gitea --repo "${CI_REPO}"
+    depends_on: [upload-rpm]
     backend_options:
       kubernetes:
         serviceAccountName: default
-    depends_on: [build-linux-amd64, build-linux-arm64, build-darwin-amd64, build-darwin-arm64]
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m

.woodpecker/test.yaml

@@ -0,0 +1,33 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: lint
+    image: golangci/golangci-lint:latest
+    commands:
+      - golangci-lint run ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: test
+    image: golang:1.25
+    commands:
+      - go test -v -race ./...
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/unit-tests.yaml

@@ -1,8 +0,0 @@
-when:
-  - event: pull_request
-
-steps:
-  - name: unit-tests
-    image: golang:latest
-    commands:
-      - go test -v -race ./...