Add workflow to CLI to consume agent-proxy

.github/workflows/release-demo.yml

@@ -0,0 +1,79 @@
+name: release-demo
+
+# Build the `doppler-agent` preview (this CLI fork, which bundles the agent-proxy) and
+# publish it to GCS for pilot customers. Manual trigger only; entirely separate from the
+# production `release` workflow.
+#
+# agent-proxy is a private module (github.com/DopplerTest/agent-proxy), so the runner
+# needs read access to fetch it — see the "private module access" step below. The
+# customer never touches it: agent-proxy is statically linked into the shipped binary.
+#
+# Secrets used (demo-scoped, distinct from the production release):
+#   GCP_KEY_DEMO          — service-account key with write access to the demo bucket.
+#   AGENT_PROXY_READ_TOKEN — token with read access to DopplerTest/agent-proxy, so `go`
+#                            can fetch the private module during the build.
+# And replace PLACEHOLDER_DEMO_BUCKET below with the real bucket once infra provisions it.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish, e.g. 0.1.0"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  DEMO_BUCKET: PLACEHOLDER_DEMO_BUCKET # TODO(infra): real demo GCS bucket
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0 # goreleaser needs tags/history
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Private module access (github.com/DopplerTest/agent-proxy)
+        run: |
+          git config --global \
+            url."https://x-access-token:${AGENT_PROXY_READ_TOKEN}@github.com/DopplerTest/".insteadOf \
+            "https://github.com/DopplerTest/"
+          echo "GOPRIVATE=github.com/DopplerTest/*" >> "$GITHUB_ENV"
+        env:
+          AGENT_PROXY_READ_TOKEN: ${{ secrets.AGENT_PROXY_READ_TOKEN }}
+
+      - name: Tag this commit for goreleaser
+        run: git tag "v${{ inputs.version }}"
+
+      - name: Write GCP credentials
+        run: |
+          printf '%s' "$GCP_KEY_DEMO" > "$RUNNER_TEMP/gcp.json"
+          echo "GOOGLE_APPLICATION_CREDENTIALS=$RUNNER_TEMP/gcp.json" >> "$GITHUB_ENV"
+        env:
+          GCP_KEY_DEMO: ${{ secrets.GCP_KEY_DEMO }}
+
+      - name: Install goreleaser
+        run: |
+          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
+          sudo apt update
+          sudo apt install -y goreleaser
+
+      - name: Validate config
+        run: goreleaser check -f .goreleaser.demo.yml
+
+      - name: Build + upload archives to GCS
+        run: goreleaser release -f .goreleaser.demo.yml --clean
+
+      - name: Publish the latest marker + install script
+        run: |
+          printf '%s' "${{ inputs.version }}" | gcloud storage cp - "gs://${DEMO_BUCKET}/doppler-agent/latest"
+          gcloud storage cp scripts/install-demo.sh "gs://${DEMO_BUCKET}/install.sh"

.gitignore

@@ -28,3 +28,6 @@ completions/
 
 # IDEs
 .idea/
+.vscode/
+go.work
+go.work.sum

.goreleaser.demo.yml

@@ -0,0 +1,71 @@
+version: 2
+project_name: doppler-agent
+
+# Demo/preview distribution of the CLI fork (which bundles the agent-proxy) for a handful
+# of pilot customers. Kept SEPARATE from .goreleaser.yml (the production release) on
+# purpose: a distinct binary name and config dir so it never collides with a customer's
+# real `doppler` install on PATH or in ~/.doppler.
+#
+# The code's defaults are unchanged (doppler / ~/.doppler); the ldflags below flip the
+# identity at build time via the injectable vars in pkg/version. See that package for
+# the full explanation.
+#
+# The CLI depends on agent-proxy as a tagged private module (github.com/DopplerTest/
+# agent-proxy); go.mod requires a real version, no local replace. CI fetches it with a
+# read token (see release-demo.yml). For local builds, add an uncommitted
+# `replace github.com/DopplerTest/agent-proxy => ../agent-proxy`.
+
+before:
+  hooks:
+    - go mod download
+
+builds:
+  - id: doppler-agent
+    binary: doppler-agent
+    env:
+      - CGO_ENABLED=0
+    # The big 4: covers every Mac and Linux dev box / devcontainer a pilot customer runs.
+    # `doppler agent enforce` is Linux-only, but `proxy start` / `agent run` work on macOS
+    # via Docker Desktop. Add windows/amd64 here only if a customer needs it.
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - amd64
+      - arm64
+    ldflags:
+      - -s -w
+      - -X github.com/DopplerHQ/cli/pkg/version.ProgramVersion=v{{.Version}}
+      # Build-time identity — the rename lives entirely here, not in the code:
+      - -X github.com/DopplerHQ/cli/pkg/version.ProgramName=doppler-agent
+      - -X github.com/DopplerHQ/cli/pkg/version.ConfigDirName=.doppler-agent
+      - -X github.com/DopplerHQ/cli/pkg/version.ConfigFileName=.doppler-agent.yaml
+
+archives:
+  - id: doppler-agent
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- .Version }}_
+      {{- if eq .Os "darwin" }}macOS
+      {{- else }}{{ .Os }}{{ end }}_
+      {{- .Arch }}
+    files:
+      - README.md
+      - LICENSE
+
+checksum:
+  name_template: checksums.txt
+  algorithm: sha256
+
+# No GitHub release, brew tap, Docker image, or apt/rpm packages — the demo ships only as
+# archives in GCS, fetched by install.sh.
+release:
+  disable: true
+
+# Upload the archives + checksums to GCS. The bucket is a placeholder until infra
+# provisions one; the workflow authenticates with GOOGLE_APPLICATION_CREDENTIALS
+# (a demo service-account key), the same mechanism the production release uses.
+blobs:
+  - provider: gs
+    bucket: PLACEHOLDER_DEMO_BUCKET # TODO(infra): replace with the real demo GCS bucket
+    directory: "doppler-agent/{{ .Version }}"

.goreleaser.yml

@@ -111,7 +111,6 @@ dockers_v2:
       - doppler
     platforms:
       - linux/amd64
-      - linux/arm64
     images:
       - dopplerhq/cli
       - gcr.io/dopplerhq/cli
@@ -127,11 +126,6 @@ dockers_v2:
     sbom: false
     flags:
       - "--provenance=false"
-    hooks:
-      # runs after the images are pushed but before the GitHub release is cut. Keep the platform list in sync with `platforms` above
-      post:
-        - cmd: ./scripts/release/verify-images.sh {{ .IsSnapshot }} linux/amd64,linux/arm64 {{ range .Images }}{{ . }} {{ end }}
-          output: true
 
 homebrew_casks:
   - name: doppler

go.mod

@@ -26,6 +26,14 @@ require (
 )
 
 require (
+	github.com/aws/aws-sdk-go-v2 v1.46.0 // indirect
+	github.com/aws/smithy-go v1.28.1 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+)
+
+require (
+	github.com/DopplerTest/agent-proxy v0.1.0
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect

go.sum

@@ -2,13 +2,19 @@ github.com/AlecAivazis/survey/v2 v2.3.6 h1:NvTuVHISgTHEHeBFqt6BHOe4Ny/NwGZr7w+F8
 github.com/AlecAivazis/survey/v2 v2.3.6/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI=
 github.com/DopplerHQ/gocui v0.1.0 h1:koC9KoJsJCLrhmU7kd3APEzyeteU4h+3+rxogvjtLHk=
 github.com/DopplerHQ/gocui v0.1.0/go.mod h1:sh6LfDRF5KYZbKXdyTgZ62eVhx1dIVTTKxsTzD9Qmg4=
+github.com/DopplerTest/agent-proxy v0.1.0 h1:7RFRf7KspEBZ7qGTgKRFE/xb9SaxqanK+d7Nz+i706o=
+github.com/DopplerTest/agent-proxy v0.1.0/go.mod h1:/4mBC4sVO32mUZWNi2KDwjymrJybOV4LHsQSK6g8Cfw=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
 github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
+github.com/aws/aws-sdk-go-v2 v1.46.0 h1:1kt7m/EKcEHt5mlyyxx9cSlMddRPIKbjb6DIQsu4HPk=
+github.com/aws/aws-sdk-go-v2 v1.46.0/go.mod h1:bttEH6JqnUL8LepvDVfdrds/fZ5bCIxzpe3abyUrhDU=
+github.com/aws/smithy-go v1.28.1 h1:R/nXH00c8qcfCzQVELtRw+eLQWtzv+VAIEFJ1/xxXlQ=
+github.com/aws/smithy-go v1.28.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
@@ -128,6 +134,10 @@ golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2d
 golang.org/x/exp v0.0.0-20260718201538-764159d718ef h1:LkZ48HFgy/TvhTI0bcWkjgFkgLyKUwcTbDjS0DUjw+A=
 golang.org/x/exp v0.0.0-20260718201538-764159d718ef/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=