Add `core go qa` command with subcommands:
- fmt: check/fix code formatting (gofmt)
- vet: run go vet
- lint: run golangci-lint
- test: run tests
- race: run tests with race detector
- vuln: check for vulnerabilities (govulncheck)
- sec: run security scanner (gosec)
- quick: fmt, vet, lint only
- full: all checks
Default (no subcommand) runs fmt, vet, lint, test.
All commands support --fix flag where applicable.
Also update Taskfile.yml to use core CLI commands throughout.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements defence in depth through build variants - only compiled code
exists in the binary. Commands now self-register via cli.RegisterCommands()
in their init() functions, mirroring the i18n.RegisterLocales() pattern.
Structure changes:
- cmd/{ai,build,ci,dev,docs,doctor,go,php,pkg,sdk,setup,test,vm}/ → pkg/*/cmd_*.go
- cmd/core_dev.go, cmd/core_ci.go → cmd/variants/{full,ci,php,minimal}.go
- Added pkg/cli/commands.go with RegisterCommands API
- Updated pkg/cli/runtime.go to attach registered commands
Build variants:
- go build → full (21MB, all 13 command groups)
- go build -tags ci → ci (18MB, build/ci/sdk/doctor)
- go build -tags php → php (14MB, php/doctor)
- go build -tags minimal → minimal (11MB, doctor only)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
