[minor] Add compiled GCP smoke cleanup runner

.github/workflows/cloud-smoke-cleanup.yml

@@ -94,6 +94,15 @@ jobs:
           test -n "$GSA" || { echo "GSA environment variable or secret is required for GCP cleanup"; exit 1; }
           test -n "$GCLOUD_PROJECT" || { echo "GCLOUD_PROJECT environment variable or secret is required for GCP cleanup"; exit 1; }
 
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Build trusted cloud CI runner
+        run: make cloud-compose-ci
+
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:

.github/workflows/cloud-smoke.yml

@@ -43,10 +43,8 @@ jobs:
       - name: Run repository lint
         run: make lint-check
 
-      - name: Validate fallback cleanup behavior
-        run: |
-          bash ci/cloud-smoke-cleanup-contract.sh
-          make hosted-cleanup-retry-contract
+      - name: Validate hosted cleanup retry behavior
+        run: make hosted-cleanup-retry-contract
 
   config-management-lint:
     name: Ansible and Salt lint
@@ -195,6 +193,15 @@ jobs:
           terraform_version: 1.14.6
           terraform_wrapper: false
 
+      - name: Install Go for cloud CI runner
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Build cloud CI runner
+        run: make cloud-compose-ci
+
       - name: Check GCP smoke configuration
         run: |
           test -n "$GCLOUD_OIDC_POOL" || { echo "GCLOUD_OIDC_POOL environment variable or secret is required for GCP smoke tests"; exit 1; }

.gitignore

@@ -12,3 +12,4 @@ site/
 docs/site/
 docs/.cache/
 .cloud-compose-smoke/
+.bin/

Makefile

@@ -1,4 +1,4 @@
-.PHONY: lint lint-check actionlint shell-lint runtime-config-contract application-env-contract compose-runtime-contract backup-contract overlay-contract filesystem-prep-contract key-rotation-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract sitectl-version-contract template-version-contract rollout-parity-contract rootfs-package-contract host-runtime-security cos-jq-portability-contract source-trust-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract artifact-install-contract config-management-smoke
+.PHONY: lint lint-check actionlint shell-lint runtime-config-contract application-env-contract compose-runtime-contract backup-contract overlay-contract filesystem-prep-contract key-rotation-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract sitectl-version-contract go-fmt-check go-vet go-contracts template-version-contract rollout-parity-contract rootfs-package-contract host-runtime-security cos-jq-portability-contract source-trust-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract artifact-install-contract config-management-smoke cloud-compose-ci
 .PHONY: terraform-fmt terraform-fmt-check terraform-validate terraform-validate-contract terraform-lint-check terraform-docs terraform-docs-check
 .PHONY: config-management-cloud-smoke config-management-cloud-smoke-ansible-drupal config-management-cloud-smoke-salt-drupal
 .PHONY: destroy-config-management-cloud-smoke destroy-config-management-cloud-smoke-ansible-drupal destroy-config-management-cloud-smoke-salt-drupal
@@ -11,6 +11,10 @@ DOCS_PORT ?= 8888
 DOCS_DOCKER_USER ?= $(shell id -u):$(shell id -g)
 ACTIONLINT_VERSION ?= v1.7.12
 TERRAFORM_DOCS_VERSION ?= v0.21.0
+CLOUD_COMPOSE_CI_BIN ?= $(CURDIR)/.bin/cloud-compose-ci
+export CLOUD_COMPOSE_CI_BIN
+GO_MODULE_FILES := $(wildcard go.mod go.sum)
+GO_SOURCES := $(shell find cmd internal -type f -name '*.go')
 
 lint: terraform-fmt actionlint shell-lint host-runtime-security cos-jq-portability-contract application-env-contract compose-runtime-contract backup-contract overlay-contract filesystem-prep-contract key-rotation-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract source-trust-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract sitectl-version-contract template-version-contract rollout-parity-contract rootfs-package-contract artifact-install-contract terraform-validate terraform-docs-check
 
@@ -75,11 +79,16 @@ systemd-contract:
 sitectl-version-contract:
 	bash ci/sitectl-version-contract.sh
 
-template-version-contract:
-	bash ci/template-version-contract.sh
+go-fmt-check:
+	@files="$$(gofmt -l .)"; test -z "$$files" || { echo "Go files require formatting:"; printf '%s\n' "$$files"; exit 1; }
 
-rollout-parity-contract:
-	bash ci/rollout-parity-contract.sh
+go-vet:
+	go vet ./...
+
+go-contracts: go-fmt-check go-vet
+	go test -count=1 ./...
+
+template-version-contract rollout-parity-contract: go-contracts
 
 rootfs-package-contract:
 	bash ci/rootfs-package-contract.sh
@@ -93,8 +102,13 @@ cos-jq-portability-contract:
 source-trust-contract:
 	bash ci/source-trust-contract.sh
 
-cloud-smoke-cleanup-contract:
-	bash ci/cloud-smoke-cleanup-contract.sh
+cloud-smoke-cleanup-contract: go-contracts
+
+cloud-compose-ci: $(CLOUD_COMPOSE_CI_BIN)
+
+$(CLOUD_COMPOSE_CI_BIN): $(GO_MODULE_FILES) $(GO_SOURCES)
+	@mkdir -p "$(dir $(CLOUD_COMPOSE_CI_BIN))"
+	go build -trimpath -o "$(CLOUD_COMPOSE_CI_BIN)" ./cmd/cloud-compose-ci
 
 gcp-upgrade-smoke-contract:
 	bash ci/gcp-upgrade-smoke-contract.sh
@@ -135,12 +149,13 @@ terraform-docs:
 terraform-docs-check:
 	go run github.com/terraform-docs/terraform-docs@$(TERRAFORM_DOCS_VERSION) markdown table --sort-by required --output-file README.md --output-check .
 
-smoke-test-clouds:
+smoke-test-clouds: cloud-compose-ci
 	ci/cloud-smoke.sh all
 
 smoke-test:
 	@test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
 	@test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
+	@if [ "$(PROVIDER)" = "gcp" ]; then $(MAKE) --no-print-directory cloud-compose-ci; fi
 	ci/cloud-smoke.sh $(PROVIDER)-$(TEMPLATE)
 
 smoke-test-digitalocean-isle:
@@ -155,6 +170,7 @@ smoke-test-gcp-wp:
 destroy-smoke:
 	@test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
 	@test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
+	@if [ "$(PROVIDER)" = "gcp" ]; then $(MAKE) --no-print-directory cloud-compose-ci; fi
 	ci/cloud-smoke.sh destroy-$(PROVIDER)-$(TEMPLATE)
 
 destroy-smoke-digitalocean-isle: