internal/

Package api exposes manent as an HTTP API (Gin) with JSON descriptors.

Package apiclient implements service.Service on top of the manent HTTP API.

Package app wires all manent components from the configuration.

Package artifact fetches deploy artifacts into a local working directory.

Package audit records who did what: deploy requests, cancellations, schedule changes, denied accesses and final deploy outcomes.

Package auth identifies who uses manent: OIDC users and static tokens on the API, the operating system user on the CLI.

Package authz applies permissions (RBAC) per application and environment.

Package azurefake emulates, at protocol level, the Azure services used by manent's plugins: the Microsoft Entra ID token, the Resource Manager API of App Service (web apps, slots, site configuration, app settings, tags, swap) and of Container Apps (apps, revisions, traffic), Kudu (OneDeploy and deployment records), the web apps and container apps themselves (they serve the released files or the version of the image) and the Log Analytics query API.

Package callback notifies the HTTP endpoints named in the descriptor of the outcome of steps and deploy.

Package change opens and closes the change management tickets of deploys in an ITSM (ServiceNow, Jira) and reads their approval state.

Package chat sends deploy and approval notifications to Slack and Microsoft Teams and receives the decisions taken with the buttons of Slack messages.

Package clientcli implements the manent client CLI (cmd/manent): it reads YAML descriptors and talks only to the server's HTTP API, so authentication, permissions and audit always apply.

Package cliutil holds helpers shared by the client and server CLIs.

Package cluster keeps the registry of manent executors (workers): heartbeats, shutdown, claiming the workflows of a lost node and leases for the tasks only one worker at a time must perform (automatic recovery, retention, reconciliation).

Package config handles manent's static application configuration.

Package customspec defines the spec of custom steps (pipeline.steps with type), its validation, the canonical form captured in the plan and the signature the worker verifies.

Package customstep runs the custom steps defined in manent.yml: commands on the targets over SSH and HTTP requests.

Package deploylog collects the logs of every deploy in a durable DBOS stream of its workflow, readable from API and CLI even when the deploy runs on another worker.

Package descriptor defines the deploy descriptor and its parsing from YAML (CLI) and JSON (API).

Package engine orchestrates the deploy pipeline as a durable DBOS workflow.

Package envconfig fetches from a configuration management system (e.g.

Package extplugin starts and manages external deploy plugins: separate binaries that talk to manent over gRPC (pkg/plugin/external) and look like a normal plugin.Deployer to the rest of the engine.

Package gitsrc reads files at a commit of a Git repository: it keeps a bare copy on disk, resolves refs into commit SHAs, checks that a SHA is reachable from the allowed refs and verifies commit signatures (OpenPGP or SSH).

Package glob matches strings against simple patterns, used in configuration policies.

Package governance applies the release rules per application and environment: mandatory promotion from other environments, approvals and freeze windows.

Package labels parses the selectors on target labels, for example "region=eu-1, az in (eu-1a, eu-1b), canary!=true".

Package logging provides the application logger and log forwarding to the SIEM in RFC 5424 format.

Package pipeline defines the step contract and the resolution of the execution plan.

Package policy evaluates the governance policy written in Rego with OPA embedded in the process, and keeps the policy in force up to date from a source (manent's store, a local directory, an OPA bundle, Consul) without restarting: Runtime implements engine.Governance and engine.PolicyAdmin.

Package rbac is the model of the permissions: actions, roles, bindings, the grants of an identity and the Authorizer that decides them (bindings of manent.yml or a Rego policy).

Package rollback applies the automatic rollback policies to the deploy descriptor.

Package rollout computes the plan of a wave release and checks target health between passes.

Package secrets resolves the secret references declared in the descriptor.

Package servercli implements the manent-server CLI: API, workers and platform operations on the system database.

Package service is the contract between manent clients and server: service interfaces, requests, responses and errors.

Package steps holds the standard implementations of the pipeline steps.

Package telemetry exposes manent's Prometheus metrics and OpenTelemetry tracing.

Package tenant models the tenants: the internal teams that own the applications.

Package testdb gives tests an isolated DBOS system database: SQLite in a temporary directory or, if MANENT_TEST_DATABASE_URL points to a Postgres server, a new database created for the single test and dropped at the end.

Package traffic integrates manent with load balancers and traffic routers: it drains the targets from a pool before updating them and puts them back in service afterwards (Pool), and it shifts traffic between two groups of targets, the slots, in percentage rollouts (Router).

Package version identifies the manent binary.

Package webui serves the manent web interface, built from web/ (make web) and embedded in the binary with go:embed.