Add the initial repospawner service

repospawner turns JSON new-repo requests into terraform-git pull requests
via kubernetes Jobs, follows those PRs to merge and optionally activates
the repository in Woodpecker.

ui/embed_test.go

@@ -0,0 +1,34 @@
+package ui
+
+import (
+	"io/fs"
+	"strings"
+	"testing"
+)
+
+// TestAssetsShipEverythingThePageNeeds guards the embed: a missing asset would
+// only surface as a broken page at runtime, since the CSP forbids CDNs.
+func TestAssetsShipEverythingThePageNeeds(t *testing.T) {
+	assets := Assets()
+	for _, name := range []string{"index.html", "app.css", "app.js"} {
+		if _, err := fs.Stat(assets, name); err != nil {
+			t.Errorf("asset %s missing: %v", name, err)
+		}
+	}
+}
+
+func TestIndexReferencesLocalAssetsOnly(t *testing.T) {
+	b, err := fs.ReadFile(Assets(), "index.html")
+	if err != nil {
+		t.Fatalf("read index.html: %v", err)
+	}
+	html := string(b)
+	if strings.Contains(html, "//cdn.") || strings.Contains(html, "https://") {
+		t.Error("index.html references an external origin; the CSP blocks those")
+	}
+	for _, want := range []string{`href="app.css"`, `src="app.js"`, `id="new-form"`, `id="rows"`} {
+		if !strings.Contains(html, want) {
+			t.Errorf("index.html is missing %s", want)
+		}
+	}
+}