Scaffold Go CLI application with stubbed auth command

.cspell.json

@@ -0,0 +1,58 @@
+{
+  "language": "en",
+  "dictionaries": ["companies", "filetypes", "fullstack", "softwareTerms"],
+  "words": [
+    "aquasecurity",
+    "artipacked",
+    "cimd",
+    "clidocs",
+    "coverprofile",
+    "cpuprof",
+    "ehthumbs",
+    "goarch",
+    "gofmt",
+    "golangci",
+    "goreleaser",
+    "kics",
+    "ldflags",
+    "lfx",
+    "lfxv",
+    "linuxfoundation",
+    "memprof",
+    "techdocs",
+    "urfave",
+    "zizmor"
+  ],
+  "flagWords": [
+    "abort",
+    "abortion",
+    "blackhat",
+    "black-hat",
+    "whitehat",
+    "white-hat",
+    "cripple",
+    "crippled",
+    "master",
+    "slave",
+    "tribe",
+    "sanity-check",
+    "whitelist",
+    "white-list",
+    "blacklist",
+    "black-list"
+  ],
+  "ignorePaths": [
+    ".cspell.json",
+    "CODEOWNERS",
+    "LICENSE",
+    "LICENSE-docs",
+    "megalinter-reports",
+    "styles"
+  ],
+  "languageSettings": [
+    {
+      "languageId": "markdown",
+      "ignoreRegExpList": ["/^\\s*```\\s*(mermaid)[\\s\\S]*?^\\s*```/gm"]
+    }
+  ]
+}

.github/workflows/build.yaml

@@ -0,0 +1,53 @@
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+---
+name: Build
+
+"on":
+  pull_request: null
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    # With GO_GOLANGCI_LINT disabled in MegaLinter, that workflow's
+    # revive-only run never compiles the Go packages, so this build/vet/test
+    # job is required to catch code that does not build.
+    name: Build and Test
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5.6.0
+        with:
+          go-version-file: go.mod
+
+      - name: Format check
+        # gofmt -l lists unformatted files without rewriting them; fail if
+        # any are found instead of silently reformatting like `go fmt`.
+        run: |
+          unformatted=$(gofmt -l .)
+          if [ -n "$unformatted" ]; then
+            echo "The following files are not gofmt-formatted:"
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...

.github/workflows/license-header-check.yml

@@ -13,6 +13,9 @@ permissions:
 jobs:
   license-header-check:
     name: License Header Check
-    uses: linuxfoundation/lfx-public-workflows/.github/workflows/license-header-check.yml@main
+    # Pinned to main as of 2026-07-14 (no tagged releases are published for
+    # this repo); bump the SHA periodically to pick up upstream fixes.
+    uses: >-
+      linuxfoundation/lfx-public-workflows/.github/workflows/license-header-check.yml@8313b4b18b95d750f99a78d5ea160d851afbc40b
     with:
       copyright_line: "Copyright The Linux Foundation and each contributor to LFX."

.github/workflows/mega-linter.yml

@@ -0,0 +1,47 @@
+---
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+
+name: MegaLinter
+
+"on":
+  pull_request: null
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  megalinter:
+    name: MegaLinter
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      # Git Checkout
+      - name: Checkout Code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      # MegaLinter
+      - name: MegaLinter
+        id: ml
+        # Use the Go flavor. Keep this version in sync with the
+        # `megalinter` target in the Makefile.
+        uses: oxsecurity/megalinter/flavors/go@ef3e84b8b836d76db562d0f3ed7da61e8fd538bc  # v9.6.0
+        env:
+          # All available variables are described in documentation
+          # https://megalinter.io/latest/configuration/
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Allow GITHUB_TOKEN for working around rate limits (aquasecurity/trivy#7668).
+          REPOSITORY_TRIVY_UNSECURED_ENV_VARIABLES: GITHUB_TOKEN
+          # zizmor's "artipacked" audit needs the GitHub API (to verify
+          # SHA-pinned action tags), which requires GITHUB_TOKEN.
+          ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES: GITHUB_TOKEN

.github/workflows/release-tag.yml

@@ -0,0 +1,45 @@
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+---
+name: Publish Tagged Release
+
+"on":
+  push:
+    tags:
+      - "v*"
+
+permissions: {}
+
+jobs:
+  goreleaser:
+    name: GoReleaser
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff  # v5.6.0
+        with:
+          go-version-file: go.mod
+          # Disable caching: this workflow publishes runtime artifacts on
+          # tag push, so a poisoned cache from an earlier run could leak
+          # into a release build (zizmor cache-poisoning audit).
+          cache: false
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a  # v6.4.0
+        with:
+          # Constrained to v2 (the action's documented default) so a
+          # future GoReleaser v3 release doesn't silently break old tags.
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,122 @@
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+
+# Binaries and executables
+/bin/
+/dist/
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+/lfx
+
+# Go build artifacts
+*.test
+*.prof
+*.pprof
+
+# Go coverage files
+coverage.out
+coverage.html
+coverage.txt
+*.coverage
+c.out
+
+# Go module cache (when using vendor)
+/vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db
+
+# Claude AI assistant
+.claude
+
+# Environment and configuration files
+.env
+.env.local
+.env.*.local
+*.env
+config.local.yaml
+config.local.yml
+secrets.yaml
+secrets.yml
+
+# Log files
+*.log
+logs/
+*.log.*
+
+# Temporary files
+*.tmp
+*.temp
+/tmp/
+.cache/
+
+# OS generated files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Security and sensitive files
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+ca-certificates.crt
+tls.crt
+tls.key
+
+# Backup files
+*.bak
+*.backup
+*.old
+*~
+
+# Profiling and debugging
+*.pprof
+pprof/
+*.memprof
+*.cpuprof
+
+# Database files
+*.db
+*.sqlite
+*.sqlite3
+
+# Archive files
+*.tar
+*.tar.gz
+*.zip
+*.rar
+*.7z
+
+# CI/CD temporary files
+.github/workflows/*.tmp
+.gitlab-ci.tmp
+.travis.tmp
+
+# Local development overrides
+Makefile.local
+
+# Generated documentation
+docs/_build/
+site/
+
+# Lint files
+megalinter-reports

.goreleaser.yaml

@@ -0,0 +1,52 @@
+# Copyright The Linux Foundation and each contributor to LFX.
+# SPDX-License-Identifier: MIT
+
+version: 2
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - id: lfx
+    main: ./cmd/lfx
+    binary: lfx
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64
+    ldflags:
+      - -s -w -X main.version={{.Version}}
+
+archives:
+  - id: lfx
+    formats: [tar.gz]
+    format_overrides:
+      - goos: windows
+        formats: [zip]
+    name_template: >-
+      {{ .ProjectName }}_{{ .Os }}_{{ .Arch }}
+
+checksum:
+  name_template: "checksums.txt"
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+      - "^ci:"
+
+release:
+  github:
+    owner: linuxfoundation
+    name: lfx-cli