initial attempt at a working textql build

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+* @Workiva/Cloud42
+* @Workiva/release-management-pp

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,50 @@
+## JIRA Ticket
+
+## Problem/Feature
+
+## Solution/Approach
+
+## What To Test
+- [ ] Update Vault with any wk-dev environment variable changes
+- [ ] Request RM update Vault in remaining clusters if applicable
+- [ ] Deploy to wk-dev
+  - [ ] Confirm [chain-qa signals test](https://wf-skynet-hrd.appspot.com/signals/5395667162) passes
+  - [ ] Confirm [health signals test](https://wf-skynet-hrd.appspot.com/signals/5319666959) passes
+- [ ] QA changes specific to this PR
+  - [ ] <Add Suggested Testing Steps for your PR>
+- [ ] Correct version label is applied to this PR (See `Semantic Versioning` below)
+
+## Test Coverage
+- [ ] Unit Tests
+- [ ] Integration Tests
+- [ ] Release Tests
+- [ ] Load Tests
+- [ ] N/A
+  - Add an explanation for why test coverage is not applicable here
+
+## Deployment Considerations
+- [ ] This change requires Vault changes before deployment (please link JIRA RM tickets)
+
+## Semantic Versioning (check all that apply)
+- [ ] **Patch**
+    - This change does not affect the exposed functionality of the API or UI
+    - This change adjusts internal behavior and does not affect the API or UI
+    - This change fixes existing incorrect behavior without any additions to the API or UI
+- [ ] **Minor**
+    - This change adds something to the API or UI
+    - This change deprecates a part of the API or UI
+- [ ] **Major**
+    - This change modifies part of the API or UI in a backwards-incompatible manner
+    - This change removes part of the API or UI
+
+*You may opt to require a minor change for any patch if you believe that the internal changes are significant enough.*
+*If you'd like to know more about Semantic versioning, you can read the specification [here](http://semver.org/spec/v2.0.0.html)
+
+## Third Party Dependency Licensing Considerations
+- [ ] **New Third Party Dependency Added**
+    - This change adds a new third party dependency and requires us to [submit a TPOSS ticket for approval](https://wiki.atl.workiva.net/display/DEV/Third-Party+Open+Source+Software+%28OSS%29+Usage+Policy)
+    - The TPOSS ticket should link to [WK-3082608](https://jira.atl.workiva.net/browse/WK-3082608) and also mention it in the description to streamline the legal review
+    - Associated TPOSS Ticket: N/A unless checked
+
+## Reviewers
+@Workiva/cloud42

.github/actions/build-binaries/action.yml

@@ -0,0 +1,50 @@
+name: Build Binaries
+
+inputs:
+  deployment:
+    description: "Deployment"
+    required: true
+  version:
+    description: "Version"
+    required: true
+  build-time:
+    description: "Build Timestamp"
+    required: true
+  extension:
+    description: "File Extension to Use"
+    required: false
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - name: Build GroundRunner
+      shell: bash
+      run: >-
+        go build -tags oem -ldflags="
+          -X github.com/Workiva/oc-droplet/config.runnerType=2
+          -X github.com/Workiva/oc-droplet/config.environment=${{ inputs.deployment }}
+          -X github.com/Workiva/oc-droplet/config.version=${{ inputs.version }}
+          -X github.com/Workiva/oc-droplet/config.releaseDate=${{ inputs.build-time }}" -o dist_oem/GroundRunner${{ inputs.extension }} "github.com/Workiva/oc-droplet"
+
+    - name: Set GroundRunner Permissions
+      shell: bash
+      run: chmod 555 dist_oem/GroundRunner${{ inputs.extension }}
+
+    - name: Build GroundRunnerMonitor
+      shell: bash
+      run: >-
+        go build -tags oem -ldflags="
+          -X github.com/Workiva/oc-droplet/monitor/config.version=${{ inputs.version }}" -o dist_oem/GroundRunnerMonitor${{ inputs.extension }} "github.com/Workiva/oc-droplet/monitor"
+
+    - name: Set GroundRunnerMonitor Permissions
+      shell: bash
+      run: chmod 555 dist_oem/GroundRunnerMonitor${{ inputs.extension }}
+
+    - name: Build Installer
+      shell: bash
+      run: go build -tags oem -o dist_oem/installer${{ inputs.extension }} "github.com/Workiva/oc-droplet/cli"
+
+    - name: Set Installer Permissions
+      shell: bash
+      run: chmod 555 dist_oem/installer${{ inputs.extension }}

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    labels:
+      - "dependencies"
+      - "semver: Patch"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "20:00"
+      timezone: "America/Chicago"
+    groups:
+      gha-dependencies:
+        patterns:
+          - "workiva/gha-*"
+  - package-ecosystem: gomod
+    directory: "/"
+    labels:
+      - "dependencies"
+      - "semver: Patch"
+    groups:
+      golang:
+        patterns:
+          - "golang.org/*"
+      aws:
+        patterns:
+          - "github.com/aws/*"
+      otel:
+        patterns:
+          - "go.opentelemetry.io/*"
+    schedule:
+      interval: weekly
+      time: "10:00"
+    open-pull-requests-limit: 10

.github/veracode.sh

@@ -0,0 +1,59 @@
+#! /bin/bash
+
+# Not actually for dependabot, but it is code auditing
+# Docs: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/395tS2Q0xKOLNRNaqg_Gtg
+
+set -e # Exit on failure
+set -x # Print commands as executed
+
+# Change directory to path so we can run this from anywhere
+# cd `dirname $0` # SHOULD RUN WITH CWD containing main.go
+
+# Configuration for result
+RES=out/veracode/github.com/Workiva/$1
+REPO=github.com/Workiva/$1
+
+# Make output directory
+rm -rf out/veracode/github.com
+mkdir -p $RES
+
+# Move main into the working directory
+cp main.go $RES
+
+# Move remaining wFont source files to working directory
+for PACKAGE in `go list -f '{{join .Deps "\n"}}' | grep $REPO`; do
+  for FILE in `go list -f '{{join .GoFiles "\n"}}' $PACKAGE`; do
+    RELATIVE=`echo "$PACKAGE" | cut -d'/' -f4-`
+    mkdir -p "$RES/$RELATIVE"
+    cp "$RELATIVE/$FILE" "$RES/$RELATIVE/$FILE"
+  done
+done
+
+# Vendor dependencies
+go mod vendor
+find vendor/ -type f -not -name "*.go" -delete
+find vendor/ -type f -name "*_test.go" -delete
+if [ "$(uname)" == "Darwin" ]; then
+  find vendor/ -type d -empty -delete  # busybox doesn't support empty
+fi
+mv vendor $RES
+
+# Produce the veracode configuration
+cat <<EOF > out/veracode/github.com/veracode.json
+{
+  "MainRoot": "Workiva/$1",
+  "MainPkgName": "main",
+  "FirstParty": [
+    "github.com/Workiva/"
+  ]
+}
+EOF
+
+# Package the full archive!
+cd out/veracode
+if [ "$(uname)" == "Darwin" ]; then
+  # Mac tar adds hidden files that cannot be seen (even with tar listing).
+  docker run --rm -it -w /data -v $PWD:/data ubuntu tar -czf go.tar.gz github.com
+else
+  tar -czf go.tar.gz github.com
+fi

.github/workflows/build.yml

@@ -0,0 +1,77 @@
+name: oc-droplet build
+on:
+  push:
+    branches: ["master"]
+    tags: ["*"]
+  pull_request:
+    branches: ["master"]
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  # TODO:
+  # These secrets are configured directly in Github by RM which we cannot see and so have no way of knowing about
+  # If we instead set them up with Workiva/github-actions-secrets their config would be more apparent
+  # secrets.COMPANY_TOKEN is also configured this way (used in smoke-test.yml)
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  AWS_DEFAULT_OUTPUT: yaml
+
+jobs:
+  unit-tests:
+    strategy:
+      matrix:
+        # TODO: Tests do not work properly on windows runner
+        os: [ubuntu-20.04, macos-13]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Configure Github credentials
+        run: git config --global url."https://${{ secrets.WK_GITHUB_PASS }}@github.com".insteadOf "https://github.com"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+      # - name: Install sqlite3 on windows
+      #   if: ${{ contains(matrix.os, 'windows') }}
+      #   run: choco install sqlite
+      - name: Run Tests
+        run: make test
+      - name: Upload coverage to Codecov
+        if: ${{ contains(matrix.os, 'ubuntu') && !startsWith(github.ref, 'refs/tags/') && !contains(github.actor, 'dependabot') }}
+        uses: codecov/codecov-action@v4
+        with:
+          use_oidc: true
+          files: ./c.out
+
+  build:
+    needs: [unit-tests]
+    strategy:
+      matrix:
+        build: [
+            { os: ubuntu-20.04, goos: linux, bin: textql_linux },
+            { os: macos-13, goos: darwin, bin: textql_macos },
+            { os: windows-2019, goos: windows, bin: textql.exe },
+        ]
+    env:
+      GOOS: ${{ matrix.build.goos }}
+      GOARCH: amd64
+      CGO_ENABLED: 1
+    runs-on: ${{ matrix.build.os }}
+    steps:
+      - name: Configure Github credentials
+        run: git config --global url."https://${{ secrets.WK_GITHUB_PASS }}@github.com".insteadOf "https://github.com"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+      - name: Build
+        run: make ${{ matrix.build.bin }}
+      - name: Archive Binaries for Smoke Test
+        # if: ${{ env.GOOS == 'linux' && env.GOARCH == 'amd64' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{matrix.build.bin}}
+          path: ./build/${{matrix.build.bin}}
+          retention-days: 1

.gitignore

@@ -6,4 +6,8 @@ build/
 *.db*
 *.csv
 
-dist/
+dist/
+
+c.out
+main
+unit-test-report.xml

.tool-versions

@@ -0,0 +1 @@
+golang 1.23.2