feat: added workflows and renovate config

.github/release-drafter.yml

@@ -0,0 +1,53 @@
+name-template: "v$RESOLVED_VERSION"
+tag-template: "v$RESOLVED_VERSION"
+
+categories:
+  - title: "💥 Breaking Changes"
+    semver-increment: "major"
+    when:
+      conventional:
+        breaking: true
+  - title: "🚀 Features"
+    semver-increment: "minor"
+    when:
+      conventional:
+        type: "feat"
+  - title: "🔒 Security"
+    semver-increment: "patch"
+    when:
+      labels:
+        - "security"
+  - title: "📦 Dependencies"
+    semver-increment: "patch"
+    when:
+      labels:
+        - "renovate"
+  - title: "🐛 Fixes"
+    semver-increment: "patch"
+    when:
+      labels:
+        - "fix"
+
+autolabeler:
+  - label: "breaking"
+    title:
+      - "/^(feat|fix)!:/"
+  - label: "feature"
+    title:
+      - '/^feat(\(.+\))?:/'
+  - label: "fix"
+    title:
+      - '/^fix(?!\(deps\))(\(.+\))?:/'
+  - label: "renovate"
+    title:
+      - '/^(fix|chore)\(deps\):/'
+  - label: "security"
+    title:
+      - '/^fix\(security\):/'
+
+change-template: "- $TITLE (#$NUMBER) @$AUTHOR"
+
+template: |
+  ## Changes
+
+  $CHANGES

.github/workflows/build_test.yml

@@ -0,0 +1,31 @@
+name: "Test the build"
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    name: test if aws-ssh can be built
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v7
+      - name: set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: 1.27.x
+      - name: cache modules
+        uses: actions/cache@v6
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - name: download dependencies
+        run: go mod download
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v9.3.0
+      - name: build the app
+        run: go build
+      - name: test the app
+        run: go test -v -race ./...

.github/workflows/govulncheck.yml

@@ -0,0 +1,51 @@
+name: Vulnerability Scan
+
+on:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: "0 21 * * *"
+  workflow_dispatch: {}
+
+jobs:
+  govulncheck:
+    name: Run govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v7
+
+      - name: set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: 1.27.x
+
+      - name: install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: run govulncheck
+        id: scan
+        run: |
+          if govulncheck ./...; then
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: notify slack
+        if: steps.scan.outputs.found == 'true'
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          SLACK_CHANNEL_ID: ${{ vars.SLACK_CHANNEL_ID }}
+          SLACK_USERGROUP_ID: ${{ vars.SLACK_USERGROUP_ID }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+
+          TEXT="<!subteam^${SLACK_USERGROUP_ID}> govulncheck found a reachable vulnerability in \`ssm-parent\`. <${RUN_URL}|View the run> for details."
+
+          curl -sf -X POST https://slack.com/api/chat.postMessage \
+            -H "Authorization: Bearer ${SLACK_BOT_TOKEN}" \
+            -H "Content-Type: application/json; charset=utf-8" \
+            --data "$(jq -n --arg channel "$SLACK_CHANNEL_ID" --arg text "$TEXT" '{channel: $channel, text: $text}')"

.github/workflows/pr-autolabeler.yml

@@ -0,0 +1,23 @@
+name: PR Autolabeler
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+    branches:
+      - master
+
+jobs:
+  auto-label:
+    name: Auto Label
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Autolabel PR
+        uses: release-drafter/release-drafter/autolabeler@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.CICD_TOKEN }}

.github/workflows/release-drafter.yml

@@ -0,0 +1,56 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  update-release-draft:
+    name: Update Release Draft
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - name: Update release draft
+        uses: release-drafter/release-drafter@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.CICD_TOKEN }}
+
+  publish-if-security-fix:
+    needs: update-release-draft
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Check if pushed commit's PR was a security fix
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.CICD_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          IS_SECURITY=$(gh api "repos/${GH_REPO}/commits/${{ github.sha }}/pulls" \
+            --jq 'any(.[].labels[].name; . == "security")')
+
+          echo "is_security=$IS_SECURITY" >> "$GITHUB_OUTPUT"
+
+      - name: Publish current draft release
+        if: steps.check.outputs.is_security == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.CICD_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          DRAFT_TAG=$(gh release list --limit 10 --json tagName,isDraft --jq '[.[] | select(.isDraft == true)] | .[0].tagName // empty')
+
+          if [ -z "$DRAFT_TAG" ]; then
+            echo "No draft release found — nothing to publish."
+            exit 0
+          fi
+
+          echo "Publishing draft release: $DRAFT_TAG"
+          gh release edit "$DRAFT_TAG" --draft=false

.github/workflows/release-publish-scheduled.yml

@@ -0,0 +1,31 @@
+name: Publish Scheduled Release
+
+on:
+  schedule:
+    - cron: "0 17 1,15 * *"
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+jobs:
+  publish_draft_release:
+    name: Publish Draft Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish current draft release, if any
+        env:
+          GH_TOKEN: ${{ secrets.CICD_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          DRAFT_TAG=$(gh release list --limit 10 --json tagName,isDraft --jq '[.[] | select(.isDraft == true)] | .[0].tagName // empty')
+
+          if [ -z "$DRAFT_TAG" ]; then
+            echo "No draft release found — nothing to publish."
+            exit 0
+          fi
+
+          echo "Publishing draft release: $DRAFT_TAG"
+          gh release edit "$DRAFT_TAG" --draft=false

.github/workflows/release.yml

@@ -1,29 +1,25 @@
 name: Build and publish aws-ssh
 on:
-  push:
-    tags:
-      - '*'
+  release:
+    types: [published]
+
 jobs:
-  build_and_deploy:
-    name: build and deploy aws-ssh
+  build_and_publish:
+    name: build and publish aws-ssh
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
-        uses: actions/checkout@v2
-      -
-        name: Unshallow to restore tags
-        run: git fetch --prune --unshallow
-      -
-        name: Set up Go
-        uses: actions/setup-go@v1
+      - name: checkout
+        uses: actions/checkout@v7
         with:
-          go-version: 1.17.x
-      -
-        name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v1
+          fetch-depth: 0 # needed for tags
+      - name: set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: 1.27.x
+      - name: run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
         with:
           version: latest
-          args: release --rm-dist
+          args: release
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}

cmd/completion.go

@@ -54,13 +54,13 @@ PowerShell:
 	Run: func(cmd *cobra.Command, args []string) {
 		switch args[0] {
 		case "bash":
-			cmd.Root().GenBashCompletion(os.Stdout)
+			cobra.CheckErr(cmd.Root().GenBashCompletion(os.Stdout))
 		case "zsh":
-			cmd.Root().GenZshCompletion(os.Stdout)
+			cobra.CheckErr(cmd.Root().GenZshCompletion(os.Stdout))
 		case "fish":
-			cmd.Root().GenFishCompletion(os.Stdout, true)
+			cobra.CheckErr(cmd.Root().GenFishCompletion(os.Stdout, true))
 		case "powershell":
-			cmd.Root().GenPowerShellCompletionWithDesc(os.Stdout)
+			cobra.CheckErr(cmd.Root().GenPowerShellCompletionWithDesc(os.Stdout))
 		}
 	},
 }

cmd/connect.go

@@ -103,21 +103,18 @@ func init() {
 	connectCmd.Flags().StringP("ssh-config-path", "c", defaultSSHConfigFile, "Path to the ssh config to generate")
 	connectCmd.Flags().StringP("user", "u", "", "Existing user on the instance")
 
-	viper.BindPFlag("instanceid", connectCmd.Flags().Lookup("instanceid"))
-	viper.BindPFlag("proxyjump", connectCmd.Flags().Lookup("proxyjump"))
-	viper.BindPFlag("ssh-config-path", connectCmd.Flags().Lookup("ssh-config-path"))
-	viper.BindPFlag("user", connectCmd.Flags().Lookup("user"))
+	cobra.CheckErr(viper.BindPFlag("instanceid", connectCmd.Flags().Lookup("instanceid")))
+	cobra.CheckErr(viper.BindPFlag("proxyjump", connectCmd.Flags().Lookup("proxyjump")))
+	cobra.CheckErr(viper.BindPFlag("ssh-config-path", connectCmd.Flags().Lookup("ssh-config-path")))
+	cobra.CheckErr(viper.BindPFlag("user", connectCmd.Flags().Lookup("user")))
 
 	// custom completion for instances
-	connectCmd.RegisterFlagCompletionFunc("instanceid", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	cobra.CheckErr(connectCmd.RegisterFlagCompletionFunc("instanceid", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		cache := cache.NewYAMLCache(viper.GetString("cache-dir"))
-		names, err := cache.ListCanonicalNames()
-		if err != nil {
-			// can happen if there's no cache yet
-			// safe to just ignore it here
-		}
+		// the error is expected if there's no cache yet, safe to ignore
+		names, _ := cache.ListCanonicalNames()
 		return names, cobra.ShellCompDirectiveNoFileComp
-	})
+	}))
 
 	rootCmd.AddCommand(connectCmd)
 }

cmd/root.go

@@ -14,8 +14,6 @@ import (
 	"github.com/spf13/viper"
 )
 
-var cfgFile string
-
 // rootCmd represents the base command when called without any subcommands
 var rootCmd = &cobra.Command{
 	Use:   "aws-ssh",
@@ -58,10 +56,10 @@ func init() {
 	rootCmd.PersistentFlags().StringSliceP("profile", "p", []string{}, "Profiles to query. Can be specified multiple times. If not specified, goes through all profiles in ~/.aws/config and ~/.aws/credentials")
 	rootCmd.PersistentFlags().StringP("cache-dir", "", defaultCacheDir, "Cache dir, which is used by \"update\" and \"connect\" commands")
 
-	viper.BindPFlag("debug", rootCmd.PersistentFlags().Lookup("debug"))
-	viper.BindPFlag("no-profile-prefix", rootCmd.PersistentFlags().Lookup("no-profile-prefix"))
-	viper.BindPFlag("profiles", rootCmd.PersistentFlags().Lookup("profile"))
-	viper.BindPFlag("cache-dir", rootCmd.PersistentFlags().Lookup("cache-dir"))
+	cobra.CheckErr(viper.BindPFlag("debug", rootCmd.PersistentFlags().Lookup("debug")))
+	cobra.CheckErr(viper.BindPFlag("no-profile-prefix", rootCmd.PersistentFlags().Lookup("no-profile-prefix")))
+	cobra.CheckErr(viper.BindPFlag("profiles", rootCmd.PersistentFlags().Lookup("profile")))
+	cobra.CheckErr(viper.BindPFlag("cache-dir", rootCmd.PersistentFlags().Lookup("cache-dir")))
 
 	viper.SetEnvPrefix("aws_ssh") // will be uppercased
 

cmd/update.go

@@ -28,13 +28,6 @@ allowing to automatically fill those values in.
 			log.WithError(err).Warn("got some errors")
 		}
 
-		var sshEntries []lib.SSHEntry
-
-		// go through all profileSummaries and
-		// create sshEntries out of it
-		for _, summary := range profileSummaries {
-			sshEntries = append(sshEntries, summary.SSHEntries...)
-		}
 		if err := cache.Save(profileSummaries); err != nil {
 			log.WithError(err).Fatal("couldn't save cache")