Extract connector from butter_stack with full history

.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  connector-go:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version: '1.25'
+          cache-dependency-path: go.sum
+      - name: go vet
+        run: go vet ./...
+      - name: go test
+        run: go test ./...
+      - name: go build
+        run: go build ./cmd/butterstack-connector

.gitignore

@@ -0,0 +1,2 @@
+/build/
+/butterstack-connector

Dockerfile

@@ -0,0 +1,47 @@
+# Multi-stage build for the butterstack-connector UAT/drill image
+# (connector.spec.js, issue #1574/#1575).
+#
+# The daemon itself is a static Go binary with no runtime dependencies. The
+# final stage is Ruby-based anyway because the UAT "studio LAN" stands the
+# real `p4` CLI up with test/support/fake_p4 -- a Ruby script bind-mounted at
+# /usr/local/bin/p4 by docker-compose.uat-connector.yml -- and the connector
+# execs whatever binary connector.yml names, argv-only, no shell.
+#
+# NOT hardened for production (issue #1575 survival conditions 1/4/5: no
+# Sigstore keyless signing, no SBOM, no digest-pinned base image, no
+# reproducible-build docs -- see connector/README.md "what this does not
+# prove"). This image exists for the UAT drill environment only.
+
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# -trimpath drops build-machine file paths from the binary; -s -w strips the
+# symbol table and DWARF debug info. CGO_ENABLED=0 keeps the binary static, so
+# the runtime stage needs no libc compatibility shim.
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/butterstack-connector ./cmd/butterstack-connector
+
+FROM ruby:3.3-alpine
+
+RUN apk add --no-cache ca-certificates \
+ && addgroup -g 10001 connector \
+ && adduser -D -u 10001 -G connector -h /home/connector -s /sbin/nologin connector \
+ && mkdir -p /etc/butterstack /var/log/connector /tls \
+ && chown -R connector:connector /etc/butterstack /var/log/connector /tls /home/connector
+
+COPY --from=build /out/butterstack-connector /usr/local/bin/butterstack-connector
+COPY test/uat/entrypoint.sh /usr/local/bin/uat-entrypoint.sh
+RUN chmod 0755 /usr/local/bin/butterstack-connector /usr/local/bin/uat-entrypoint.sh
+
+# No EXPOSE: the connector never listens on anything. It opens exactly one
+# outbound TLS connection and never accepts an inbound one.
+
+USER connector:connector
+WORKDIR /home/connector
+
+# Production entrypoint: reads connector.yml from the path a studio wrote.
+# The UAT compose service overrides this with uat-entrypoint.sh, which
+# renders that file from UAT_CONNECTOR_* env vars first (see that script's
+# header for why that is a UAT-only pattern, not a protocol exception).
+ENTRYPOINT ["/usr/local/bin/butterstack-connector", "-config", "/etc/butterstack/connector.yml"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ButterStack
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,45 @@
+# butterstack-connector (issue #1575 spike)
+#
+# Go is run in a container by default so no host toolchain is required.
+# Set GO=go to use a host Go instead.
+
+GO          ?= docker
+GO_IMAGE    ?= golang:1.23-alpine
+RUBY        ?= ruby
+BIN         := build/butterstack-connector
+VERSION     ?= 0.1.0-spike
+
+ifeq ($(GO),docker)
+GORUN = docker run --rm -v "$(CURDIR)":/w -w /w \
+	-v /tmp/butterstack-connector-gocache:/root/.cache/go-build \
+	-v /tmp/butterstack-connector-gomod:/go/pkg/mod $(GO_IMAGE) sh -c
+else
+GORUN = sh -c
+endif
+
+.PHONY: all build test drills check vocabulary fmt clean
+
+all: build
+
+build:
+	@mkdir -p build
+	$(GORUN) 'go build -ldflags "-X main.Version=$(VERSION)" -o $(BIN) ./cmd/butterstack-connector'
+	@echo "built $(BIN)"
+
+fmt:
+	$(GORUN) 'gofmt -l -w .'
+
+test:
+	$(GORUN) 'gofmt -l . && go vet ./... && go test ./...'
+
+# The seven drills from the design note section 4.3, against the mock broker.
+drills: build
+	CONNECTOR_BIN=$(CURDIR)/$(BIN) $(RUBY) test/drills.rb
+
+check: test drills
+
+vocabulary: build
+	@$(BIN) -print-vocabulary
+
+clean:
+	rm -rf build