[crisfiorini-oss]

Summary

Cloud-neutral CLI changes that hosted delivery needs. The CLI consumes infra-base outputs and knows nothing about a specific cloud: following review on 2026-10-28, all Azure-specific code was removed from this PR.

Changes

• codefly environment import: --configuration-source and --configuration-profiles let the product select its configuration profile when the coordinate contract from infra-base is placement-only. A value that conflicts with the contract is refused. infra-base#1494 and platform-obin#220 use these flags. Profile reads are confined with the standard library's os.Root, and pinned modules are resolved before validation.
• Module-qualified secret mappings: a <module>/<service> service-secrets entry is selected before the unqualified <service> one, matching service configuration and identity. Workspace validation checks the selected environment.
• Hosted builds: for an environment with a registry, image builds and frontend bundles use the environment's existing host-networked BuildKit builder.
• Image cache: the cache identity includes file permission bits, so a file the image's non-root user cannot read is not reused.
• docs/cli-reference.md is marked generated in .gitattributes.

Removed after review

• Azure Key Vault secret store, Azure Key Vault release signer, Azure credential helper and the Azure SDK.
• Planner-input export (deploy secrets --export-input/--input) and the publisher image, which existed only for the Azure store.
• Changes nothing consumes: the deploy gitops cell verb, deploy secrets --supplied/--mint and the related planner changes, draft promotion PRs, and a Cloud KMS error-classification change.

Build or reuse	Search result and choice
Reuse existing owners	Extends the existing importer, profile materialization, service-secrets selection, BuildKit builder provisioner and image cache. No new client, store, signer or dependency. Cloud-specific secret publication stays in infra-base.

Testing

Before merging main: go build ./..., go vet and golangci-lint (0 issues) on the changed packages; tests passed for cmd/environment, pkg/environments, and the projection, frontend, cache and builder tests in pkg/gitops and pkg/orchestration. The command reference was regenerated with go test ./cmd -run TestCLIReferenceIsCurrent -update-reference.

Main merged cleanly with the same diff. The local rebuild after the merge ran out of devbox disk, so CI covers it. Three pkg/solutionrun frontend tests fail only on the devbox ("not a git repository" in a temp directory); this PR does not change those tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GehdohoEWY15W4Vj1EBoox

Generator qualification follow-up

The review finding about --input --rotate is no longer applicable: the planner-input mode was removed in this PR. The generate qualification step now passes the workflow's read-only GitHub token to Core's existing agent release lookup and downloader. This addresses unauthenticated API rate limits without skipping tests or changing the qualification gates. A failed release lookup falls back to the test's isolated local agent directory, which can surface as a missing-file error.

Build or reuse	Search result and choice
Generator release access	Core's agent manager already supports GITHUB_TOKEN for release lookup and verified download. Reuse that mechanism; do not add an agent cache, downloader or alternate fixture.

After rebasing onto main: git diff --check and go test ./pkg/conformance -run 'Test.*(Generate|Workflow|Packages)' -count=1 passed. Full suites run in pull request CI.