Drive releases with goreleaser and test against a real Vault

Replace the nfpm/build-rpm.sh release path with a single goreleaser
config producing the RPM, the raw sshsignhost-<os>-<arch> binaries the
puppetserver-compiler initContainer fetches, tarballs and checksums; the
tag pipeline runs goreleaser then PUTs the RPM to artifactapi.

Add an integration suite behind the 'integration' build tag that
provisions an ssh CA mount, host role and approle on a dev-mode Vault
and signs a host key through the built binary with Puppet's exact argv,
asserting an empty stderr and a decoded host certificate.

scripts/build-rpm.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-#
-# Package the (already built) sshsignhost binary into an RPM with nfpm,
-# bundling generated bash/zsh/fish shell completions.
-# Usage: scripts/build-rpm.sh [version]   (version defaults to $CI_COMMIT_TAG)
-#
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "${ROOT_DIR}"
-
-VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
-VERSION="${VERSION#v}" # strip a leading v
-BINARY="sshsignhost"
-DIST="dist"
-
-if [ ! -f "${DIST}/${BINARY}" ]; then
-  echo "ERROR: ${DIST}/${BINARY} not found; run 'make build' first" >&2
-  exit 1
-fi
-
-COMP_DIR="${DIST}/completions"
-mkdir -p "${COMP_DIR}"
-"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
-"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
-"./${DIST}/${BINARY}" completion fish >"${COMP_DIR}/${BINARY}.fish"
-
-export PACKAGE_NAME="${BINARY}"
-export PACKAGE_VERSION="${VERSION}"
-export PACKAGE_RELEASE="1"
-export PACKAGE_ARCH="amd64"
-export PACKAGE_PLATFORM="linux"
-export PACKAGE_DESCRIPTION="Signs SSH host certificates with Vault; called by Puppet during catalog compilation"
-export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
-export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/sshsignhost"
-export PACKAGE_LICENSE="MIT"
-
-envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
-nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
-
-echo "Built:"
-ls -1 "${DIST}"/*.rpm

scripts/integration-test.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+#
+# Run the Vault integration suite against a throwaway dev-mode Vault.
+# Set SSHSIGNHOST_TEST_VAULT_ADDR (and VAULT_TOKEN) to reuse a running server;
+# otherwise a container is started and removed again.
+#
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${ROOT_DIR}"
+
+GO_TEST=(go test -tags=integration -count=1 -v -run TestIntegration ./...)
+
+if [ -n "${SSHSIGNHOST_TEST_VAULT_ADDR:-}" ]; then
+  exec "${GO_TEST[@]}"
+fi
+
+RUNTIME="${CONTAINER_RUNTIME:-}"
+if [ -z "${RUNTIME}" ]; then
+  for candidate in docker podman; do
+    if command -v "${candidate}" >/dev/null 2>&1; then
+      RUNTIME="${candidate}"
+      break
+    fi
+  done
+fi
+if [ -z "${RUNTIME}" ]; then
+  echo "ERROR: need docker or podman, or set SSHSIGNHOST_TEST_VAULT_ADDR" >&2
+  exit 1
+fi
+
+IMAGE="${VAULT_IMAGE:-hashicorp/vault:1.20}"
+PORT="${VAULT_PORT:-8200}"
+NAME="sshsignhost-vault-$$"
+TOKEN="dev-root-token"
+
+cleanup() { "${RUNTIME}" rm -f "${NAME}" >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+"${RUNTIME}" run -d --rm --name "${NAME}" \
+  -p "127.0.0.1:${PORT}:8200" \
+  -e "VAULT_DEV_ROOT_TOKEN_ID=${TOKEN}" \
+  -e "VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200" \
+  "${IMAGE}" >/dev/null
+
+# The suite polls /v1/sys/health itself, so there is nothing to sleep on here.
+export SSHSIGNHOST_TEST_VAULT_ADDR="http://127.0.0.1:${PORT}"
+export VAULT_TOKEN="${TOKEN}"
+"${GO_TEST[@]}"