fix: escape secrets (#10)

- must use $$ for escaped secrets

Reviewed-on: #10

.woodpecker/lint.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: lint
+    image: golangci/golangci-lint:latest
+    commands:
+      - golangci-lint run ./...

.woodpecker/pre-commit.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260325
+    commands:
+      - uvx pre-commit run --all-files

.woodpecker/release.yaml

@@ -0,0 +1,37 @@
+when:
+  - event: release
+
+steps:
+  - name: test
+    image: golang:latest
+    commands:
+      - go test ./...
+
+  - name: build
+    image: golang:latest
+    commands:
+      - VERSION=${CI_COMMIT_TAG}
+      - go build -ldflags="-s -w -X main.version=${VERSION}" -o node-lookup ./...
+    depends_on: [test]
+
+  - name: release
+    image: git.unkin.net/unkin/almalinux9-base:20260325
+    environment:
+      RELEASER_TOKEN:
+        from_secret: RELEASER_TOKEN
+    commands:
+      - |
+        curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
+        tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
+        PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+        if [ -n "$PREV_TAG" ]; then
+          NOTES=$(git log "${PREV_TAG}..${CI_COMMIT_TAG}" --merges --pretty=format:"- %s")
+        else
+          NOTES=$(git log --merges --pretty=format:"- %s")
+        fi
+        tea releases edit "${CI_COMMIT_TAG}" --note "${NOTES}" --login gitea --repo "${CI_REPO}"
+        tea releases assets create "${CI_COMMIT_TAG}" node-lookup --login gitea --repo "${CI_REPO}"
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+    depends_on: [build]

.woodpecker/unit-tests.yaml

@@ -0,0 +1,8 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: unit-tests
+    image: golang:latest
+    commands:
+      - go test -v -race ./...

Makefile

@@ -1,7 +1,8 @@
 BINARY   := node-lookup
-GOFLAGS  := -ldflags="-s -w"
+VERSION  := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+GOFLAGS  := -ldflags="-s -w -X main.version=$(VERSION)"
 
-.PHONY: all build test lint clean install
+.PHONY: all build test lint clean install patch minor major _release
 
 all: build
 
@@ -19,3 +20,27 @@ clean:
 
 install:
 	go install $(GOFLAGS) ./...
+
+# Bump helpers — reads the latest semver tag and creates the next one.
+# If no tag exists yet, starts from v0.0.0.
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _release TAG=$$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _release TAG=$$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _release TAG=$$NEW
+
+_release:
+	git push origin $(TAG)
+	tea releases create --tag $(TAG) --title $(TAG)

main.go

@@ -25,6 +25,8 @@ const (
 	appName            = "node-lookup"
 )
 
+var version = "dev"
+
 // config holds all configurable values. Fields map 1:1 to config file keys,
 // env vars (NODE_LOOKUP_*), and (where applicable) CLI flags.
 type config struct {
@@ -148,7 +150,7 @@ func queryPuppetDB(puppetDBURL, query string) ([]fact, error) {
 	if err != nil {
 		return nil, fmt.Errorf("request failed: %w", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
@@ -174,7 +176,7 @@ func valueString(raw json.RawMessage) string {
 
 func valueAny(raw json.RawMessage) interface{} {
 	var v interface{}
-	json.Unmarshal(raw, &v)
+	_ = json.Unmarshal(raw, &v)
 	return v
 }
 
@@ -213,14 +215,34 @@ func isTerminal(f *os.File) bool {
 	return (fi.Mode() & os.ModeCharDevice) != 0
 }
 
-func run(cfg config, nodeName, factName, match, partialMatch string, showRole, nodeOnly, valueOnly, count, ansible, jsonMode bool) error {
+func allFactsForNode(puppetDBURL, node string) ([]fact, error) {
+	query, _ := json.Marshal([]interface{}{"=", "certname", node})
+	return queryPuppetDB(puppetDBURL, string(query))
+}
+
+func run(cfg config, nodeName, factName, match, partialMatch string, showRole, nodeOnly, valueOnly, count, ansible, jsonMode, allFacts bool) error {
 	signal.Ignore(syscall.SIGPIPE)
 
+	if allFacts {
+		if nodeName == "" {
+			return fmt.Errorf("-a requires -n")
+		}
+		facts, err := allFactsForNode(cfg.PuppetDBURL, nodeName)
+		if err != nil {
+			return err
+		}
+		sort.Slice(facts, func(i, j int) bool { return facts[i].Name < facts[j].Name })
+		for _, f := range facts {
+			fmt.Printf("%-40s %s\n", f.Name, valueString(f.Value))
+		}
+		return nil
+	}
+
 	if (nodeOnly || valueOnly || count || ansible) && !showRole && factName == "" {
 		return fmt.Errorf("-R or -F must be used with -1, -2, -C, or -A")
 	}
 
-	var allFacts []fact
+	var collected []fact
 	var stdinLines []string
 
 	doQuery := func(node string) error {
@@ -229,7 +251,7 @@ func run(cfg config, nodeName, factName, match, partialMatch string, showRole, n
 		if err != nil {
 			return err
 		}
-		allFacts = append(allFacts, facts...)
+		collected = append(collected, facts...)
 		return nil
 	}
 
@@ -256,12 +278,12 @@ func run(cfg config, nodeName, factName, match, partialMatch string, showRole, n
 		}
 	}
 
-	returnData := processResults(allFacts)
+	returnData := processResults(collected)
 
 	switch {
 	case jsonMode:
 		hostFactMap := map[string]map[string]interface{}{}
-		for _, f := range allFacts {
+		for _, f := range collected {
 			if _, ok := hostFactMap[f.Certname]; !ok {
 				hostFactMap[f.Certname] = map[string]interface{}{}
 			}
@@ -278,7 +300,7 @@ func run(cfg config, nodeName, factName, match, partialMatch string, showRole, n
 		enc := json.NewEncoder(os.Stdout)
 		enc.SetIndent("", "  ")
 		enc.SetEscapeHTML(false)
-		enc.Encode(hostFactMap)
+		_ = enc.Encode(hostFactMap)
 
 	case count:
 		values := stdinLines
@@ -297,7 +319,7 @@ func run(cfg config, nodeName, factName, match, partialMatch string, showRole, n
 			"all": map[string]interface{}{"hosts": hosts},
 		}
 		b, _ := yaml.Marshal(inventory)
-		os.Stdout.Write(b)
+		_, _ = os.Stdout.Write(b)
 
 	case nodeOnly:
 		for _, line := range returnData {
@@ -337,6 +359,7 @@ func main() {
 		count        bool
 		ansible      bool
 		jsonMode     bool
+		allFacts     bool
 		puppetDBURL  string
 	)
 
@@ -350,7 +373,7 @@ func main() {
 			return nil
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return run(cfg, nodeName, factName, match, partialMatch, showRole, nodeOnly, valueOnly, count, ansible, jsonMode)
+			return run(cfg, nodeName, factName, match, partialMatch, showRole, nodeOnly, valueOnly, count, ansible, jsonMode, allFacts)
 		},
 		SilenceUsage: true,
 	}
@@ -366,6 +389,7 @@ func main() {
 	f.BoolVarP(&count, "count", "C", false, "Count fact occurrences")
 	f.BoolVarP(&ansible, "ansible", "A", false, "Output as Ansible inventory")
 	f.BoolVarP(&jsonMode, "json", "j", false, "Emit valid JSON for all output")
+	f.BoolVarP(&allFacts, "all", "a", false, "Show all facts for a node (requires -n)")
 	rootCmd.PersistentFlags().StringVar(&puppetDBURL, "url", cfg.PuppetDBURL, "PuppetDB facts URL (overrides config and NODE_LOOKUP_URL)")
 
 	configCmd := &cobra.Command{
@@ -397,6 +421,14 @@ func main() {
 	configCmd.AddCommand(configInitCmd, configShowCmd)
 	rootCmd.AddCommand(configCmd)
 
+	versionCmd := &cobra.Command{
+		Use:          "version",
+		Short:        "Print the version",
+		Run:          func(cmd *cobra.Command, args []string) { fmt.Println(version) },
+		SilenceUsage: true,
+	}
+	rootCmd.AddCommand(versionCmd)
+
 	if err := rootCmd.Execute(); err != nil {
 		os.Exit(1)
 	}

main_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -12,19 +13,11 @@ import (
 
 // ---- helpers ----------------------------------------------------------------
 
-func mustMarshal(v interface{}) []byte {
-	b, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return b
-}
-
 func newTestServer(t *testing.T, facts []fact) *httptest.Server {
 	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(facts)
+		_ = json.NewEncoder(w).Encode(facts)
 	}))
 }
 
@@ -183,7 +176,7 @@ func TestQueryPuppetDB_HTTPError(t *testing.T) {
 
 func TestQueryPuppetDB_BadJSON(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte("not json"))
+		_, _ = w.Write([]byte("not json"))
 	}))
 	defer srv.Close()
 
@@ -243,8 +236,12 @@ func TestLoadConfig_FileOverride(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\nrole_fact: file_role\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\nrole_fact: file_role\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	cfg, err := loadConfig()
 	if err != nil {
@@ -265,8 +262,12 @@ func TestLoadConfig_EnvOverridesFile(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte("puppetdb_url: http://file:8080/facts\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	cfg, err := loadConfig()
 	if err != nil {
@@ -284,8 +285,12 @@ func TestLoadConfig_InvalidYAML(t *testing.T) {
 	t.Setenv("NODE_LOOKUP_ROLE_FACT", "")
 
 	cfgDir := filepath.Join(dir, appName)
-	os.MkdirAll(cfgDir, 0o755)
+	if err := os.MkdirAll(cfgDir, 0o755); err != nil {
-	os.WriteFile(filepath.Join(cfgDir, configFileName), []byte(":\tinvalid: yaml:\n"), 0o644)
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(cfgDir, configFileName), []byte(":\tinvalid: yaml:\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
 
 	_, err := loadConfig()
 	if err == nil {
@@ -315,9 +320,112 @@ func TestWriteDefaultConfig_AlreadyExists(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("XDG_CONFIG_HOME", dir)
 
-	writeDefaultConfig()
+	if err := writeDefaultConfig(); err != nil {
+		t.Fatal(err)
+	}
 	err := writeDefaultConfig()
 	if err == nil {
 		t.Fatal("expected error when config already exists")
 	}
 }
+
+// ---- allFactsForNode --------------------------------------------------------
+
+func TestAllFactsForNode_ReturnsSortedFacts(t *testing.T) {
+	facts := []fact{
+		{Certname: "node1", Name: "zebra", Value: rawJSON("z-val")},
+		{Certname: "node1", Name: "alpha", Value: rawJSON("a-val")},
+		{Certname: "node1", Name: "middle", Value: rawJSON(42)},
+	}
+	srv := newTestServer(t, facts)
+	defer srv.Close()
+
+	got, err := allFactsForNode(srv.URL+"/pdb/query/v4/facts", "node1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 3 {
+		t.Fatalf("expected 3 facts, got %d", len(got))
+	}
+}
+
+func TestAllFactsForNode_QueryContainsCertname(t *testing.T) {
+	var receivedQuery string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedQuery = r.URL.Query().Get("query")
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode([]fact{})
+	}))
+	defer srv.Close()
+
+	_, _ = allFactsForNode(srv.URL+"/pdb/query/v4/facts", "mynode.example.com")
+	if !strings.Contains(receivedQuery, "mynode.example.com") {
+		t.Fatalf("expected certname in query, got: %s", receivedQuery)
+	}
+	if !strings.Contains(receivedQuery, "certname") {
+		t.Fatalf("expected 'certname' in query, got: %s", receivedQuery)
+	}
+}
+
+func TestAllFactsForNode_HTTPError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	_, err := allFactsForNode(srv.URL+"/pdb/query/v4/facts", "node1")
+	if err == nil {
+		t.Fatal("expected error for HTTP 500")
+	}
+}
+
+// ---- run with -a flag -------------------------------------------------------
+
+func TestRun_AllFacts_RequiresNode(t *testing.T) {
+	cfg := config{PuppetDBURL: "http://unused", RoleFact: "enc_role"}
+	err := run(cfg, "", "", "", "", false, false, false, false, false, false, true)
+	if err == nil || !strings.Contains(err.Error(), "-a requires -n") {
+		t.Fatalf("expected -a requires -n error, got: %v", err)
+	}
+}
+
+func TestRun_AllFacts_PrintsSortedByName(t *testing.T) {
+	facts := []fact{
+		{Certname: "node1", Name: "zzz_fact", Value: rawJSON("last")},
+		{Certname: "node1", Name: "aaa_fact", Value: rawJSON("first")},
+		{Certname: "node1", Name: "mmm_fact", Value: rawJSON(true)},
+	}
+	srv := newTestServer(t, facts)
+	defer srv.Close()
+
+	old := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	cfg := config{PuppetDBURL: srv.URL + "/pdb/query/v4/facts", RoleFact: "enc_role"}
+	err := run(cfg, "node1", "", "", "", false, false, false, false, false, false, true)
+
+	_ = w.Close()
+	os.Stdout = old
+	var buf strings.Builder
+	_, _ = io.Copy(&buf, r)
+	out := buf.String()
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	if len(lines) != 3 {
+		t.Fatalf("expected 3 lines, got %d: %q", len(lines), out)
+	}
+	if !strings.HasPrefix(lines[0], "aaa_fact") {
+		t.Errorf("first line should be aaa_fact, got: %s", lines[0])
+	}
+	if !strings.HasPrefix(lines[1], "mmm_fact") {
+		t.Errorf("second line should be mmm_fact, got: %s", lines[1])
+	}
+	if !strings.HasPrefix(lines[2], "zzz_fact") {
+		t.Errorf("third line should be zzz_fact, got: %s", lines[2])
+	}
+}