Add configurable button actions and Lua HTTP support (#16)

* feat(lua): add action HTTP runtime

* feat(executor): bridge Lua button actions

* feat(instance): dispatch button actions

* feat(ui): configure button press actions

* build: upgrade Go and dependencies

* ci: add dependency security scans

* fix: keep Stream Deck event loop responsive

Run press actions outside the synchronous SDK reader and separate lifecycle cancellation from polling restarts so settings updates do not cancel active actions.

* ci: repair checks and add test package

* ci: install Codecov prerequisites

* fix: harden API request handling

* fix: contain Stream Deck handler panics

* feat: docs

* chore: add repository code owners

Author: skynet2

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @ft-t/devs

.github/workflows/pull_request.yaml

@@ -1,5 +1,6 @@
 on:
   pull_request:
+  workflow_dispatch:
   push:
     branches:
       - master
@@ -9,18 +10,18 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
-    container: golang:1.25-alpine
+    container: golang:1.26.5-alpine
     env:
       ENVIRONMENT: ci
     steps:
-      - uses: actions/checkout@v4
-      - run: apk update && apk add curl openssl git openssh-client build-base && mkdir -p /root/.ssh
-      - run: wget -O /usr/bin/mockgen https://github.com/skynet2/mock/releases/latest/download/mockgen && chmod 777 /usr/bin/mockgen
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - run: apk update && apk add bash curl gnupg openssl git openssh-client build-base && mkdir -p /root/.ssh
+      - run: go install github.com/golang/mock/mockgen@v1.6.0
       - run: make generate
       - run: go test -json -coverprofile=/root/coverage_temp.txt -covermode=atomic ./... > /root/test.json
       - run: cat /root/coverage_temp.txt | grep  -v "_mock.go" | grep -v "_mocks.go" | grep  -v "_mocks_test.go" | grep -v "_mock_test.go" > /root/coverage.txt || true
       - name: Upload coverage report
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /root/coverage.txt
@@ -29,19 +30,58 @@ jobs:
         if: always()
       - run: wget https://github.com/mfridman/tparse/releases/latest/download/tparse_linux_x86_64 -O tparse && chmod 777 tparse && ./tparse -all -file=/root/test.json
         if: always()
-      - uses: guyarb/golang-test-annotations@v0.7.0
+      - uses: guyarb/golang-test-annotations@96fc379b171c49932041d6c789e73331a7bdeec1 # v0.9.0
         if: always()
         with:
           test-results: /root/test.json
   lint:
     runs-on: ubuntu-latest
-    container: golang:1.25-alpine
+    container: golang:1.26.5-alpine
     env:
       ENVIRONMENT: ci
     steps:
-      - uses: actions/checkout@v4
-      - uses: golangci/golangci-lint-action@v6.1.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         if: github.ref != 'refs/heads/master' && github.ref != 'refs/heads/qa' && github.ref != 'refs/heads/uat'
         with:
-          version: latest
+          version: v2.12.2
           args: --timeout=5m --tests=false ./...
+  trivy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL
+  govulncheck:
+    runs-on: ubuntu-latest
+    container: golang:1.26.5-alpine
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - run: apk update && apk add git make
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: make security-govulncheck
+  package:
+    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    env:
+      TARGET_VERSION: 1.0.${{ github.run_number }}.0
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set version in manifest
+        run: jq --arg ver "$TARGET_VERSION" '.Version = $ver' ./resources/manifest.json > temp.json && mv temp.json ./resources/manifest.json
+      - name: Build test package
+        run: |
+          docker build -t apimonkey-package .
+          docker run --rm -v "$PWD/tmpdist:/tmpdist" apimonkey-package sh -c "cp /dist/com.ftt.apimonkey.sdPlugin.zip /tmpdist/com.ftt.apimonkey.sdPlugin.zip"
+      - name: Upload test package
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          path: tmpdist/com.ftt.apimonkey.sdPlugin.zip
+          archive: false
+          if-no-files-found: error

.github/workflows/release.yaml

@@ -18,34 +18,26 @@ jobs:
         run: echo "semVersion=$MAJOR_VERSION.0.${{ github.run_number }}" >> "$GITHUB_OUTPUT"
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs:
       - version
     env:
       TARGET_VERSION: ${{needs.version.outputs.versionOut}}
       SEM_VERSION: ${{needs.version.outputs.versionSemVerOut}}
     steps:
       - run: sudo apt-get update && sudo apt-get install -y jq
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set version in manifest
         run: jq --arg ver "$TARGET_VERSION" '.Version = $ver' ./resources/manifest.json > temp.json && mv temp.json ./resources/manifest.json
       - run: docker build -t temp .
-      - run: docker run -v $(pwd)/tmpdist:/tmpdist temp sh -c "cp /dist/com.ftt.apimonkey.sdPlugin.zip /tmpdist/com.ftt.apimonkey.sdPlugin.zip"
+      - run: docker run --rm -v "$PWD/tmpdist:/tmpdist" temp sh -c "cp /dist/com.ftt.apimonkey.sdPlugin.zip /tmpdist/com.ftt.apimonkey.sdPlugin.zip"
       - name: release
-        uses: actions/create-release@v1
-        id: create_release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: false
           prerelease: false
-          release_name: ${{ env.TARGET_VERSION }}
+          name: ${{ env.TARGET_VERSION }}
           tag_name: ${{ env.SEM_VERSION }}
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-      - name: upload windows artifact
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: tmpdist/com.ftt.apimonkey.sdPlugin.zip
-          asset_name: com.ftt.apimonkey.sdPlugin.zip
-          asset_content_type: application/octet-stream
+          files: tmpdist/com.ftt.apimonkey.sdPlugin.zip
+          fail_on_unmatched_files: true

AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+Read and follow [CLAUDE.md](CLAUDE.md) before making any changes.

CLAUDE.md

@@ -0,0 +1,88 @@
+# CLAUDE.md
+
+## Project
+
+API Monkey is a Go 1.26 Stream Deck plugin. It sends configured HTTP requests, processes responses, and updates Stream Deck keys. Releases package Windows x64 and macOS arm64 binaries with `resources/` into `com.ftt.apimonkey.sdPlugin.zip`.
+
+Read [README.md](README.md), [docs/usage.md](docs/usage.md), and [docs/lua.md](docs/lua.md) before changing user-visible behavior.
+
+## Repository map
+
+- `main.go`: application wiring and Stream Deck event handlers.
+- `pkg/common`: saved configuration and validation.
+- `pkg/executor`: request templates, HTTP execution, JSON selection, and response Lua dispatch.
+- `pkg/instance`: per-key lifecycle, polling, actions, response mapping, and Stream Deck updates.
+- `pkg/scripts`: response Lua, action Lua, JSON module setup, and action HTTP API.
+- `pkg/sdk`: Stream Deck SDK adapter.
+- `pkg/utils`: browser, file, and Go template helpers.
+- `resources/manifest.json`: plugin metadata and supported platforms.
+- `resources/pi/pi.html`: Property Inspector fields and saved settings.
+- `docs/usage.md`: canonical user-facing feature and configuration guide.
+- `docs/lua.md`: canonical Lua scripting contract.
+
+## Required workflow
+
+- Run `gopls go_workspace` before working in this Go workspace.
+- Read a package's `interfaces.go` before modifying that package.
+- After first reading a Go file, inspect its `gopls go_file_context`.
+- Use `gopls` for Go symbols, references, renames, diagnostics, and package APIs.
+- Use Codebase Memory for architecture, call chains, change impact, and structural discovery.
+- Prefer repository Makefile targets over direct tool commands when a matching target exists.
+- Keep changes inside requested scope. Ask before changing public APIs, schemas, dependencies, or unrelated packages.
+- Do not delete or rename existing assets, configuration, or fixtures to fix a failure.
+
+## Code rules
+
+- Keep code explicit, small, and boring. Avoid unrelated refactors.
+- Public blocking or I/O methods accept `context.Context` first.
+- Define minimal interfaces where consumed.
+- Never pass dependencies as `nil` unless a constructor explicitly documents a nil sentinel.
+- Use `github.com/golang/mock/gomock`. Generate mocks; never hand-edit generated mock files.
+- Use the logger carried by `context.Context` through `zerolog.Ctx(ctx)`.
+- Preserve error identity with wrapping. Use `errors.Is` and `errors.As`; never compare error strings.
+- Handle every returned error. Log only documented best-effort cleanup failures.
+- Tests must not perform real network, filesystem, clock, or random I/O. Database tests are the only real-I/O exception.
+- Keep success and failure test tables separate. Do not branch on expected outcomes inside tests.
+
+## Commands
+
+```bash
+make generate
+make lint
+go test -p 1 -timeout 60s ./...
+go build ./...
+```
+
+Run `make generate` after interface changes. Before declaring work complete, `make lint`, tests for modified packages with `-p 1 -timeout 60s`, and `go build ./...` must pass.
+
+`make build-apimonkey-windows` builds a Windows development package in `dist/`. `Dockerfile` is the cross-platform release packaging source of truth.
+
+## Lua changes
+
+Response and action Lua are separate contracts:
+
+- Response Lua: `Lua.Execute`, globals `ResponseBody` and `ResponseStatusCode`.
+- Action Lua: `Lua.ExecuteAction`, globals `ButtonContextID`, `ButtonConfig`, and `http`.
+
+When changing Lua behavior:
+
+1. Read `pkg/scripts/interfaces.go` and `pkg/scripts/lua.go` with gopls context.
+2. Update `pkg/scripts/lua_test.go` without real HTTP calls.
+3. Update [docs/lua.md](docs/lua.md) in the same change.
+4. Update [docs/usage.md](docs/usage.md) when configuration or visible behavior changes.
+5. Update `README.md` only when the high-level feature list, install steps, platform support, or quick start changes.
+
+## Documentation rules
+
+- Treat current code, tests, Property Inspector, manifest, and release workflow as source of truth.
+- Keep README concise; link to detailed guides instead of duplicating them.
+- Put configuration and end-user examples in `docs/usage.md`.
+- Put all Lua globals, APIs, return rules, errors, and Lua examples in `docs/lua.md`.
+- Keep examples executable against the documented contract. Never document planned behavior as available.
+- Preserve existing images under `docs/` unless replacement is explicitly requested.
+
+## Git
+
+- Do not commit or push to `master`, `main`, `qa`, `uat`, or `Release/*` without explicit approval.
+- Sign every commit with `git commit -S`. Never bypass signing.
+- Do not add an AI co-author.

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24-bookworm
+FROM golang:1.26.5-bookworm
 RUN apt-get update && apt-get install zip git -y
 ADD . /src
 WORKDIR /src

Makefile

@@ -22,4 +22,13 @@ lint:
 
 .PHONY: generate
 generate:
-	go generate ./...
+	go generate ./...
+
+.PHONY: security security-trivy security-govulncheck
+security: security-trivy security-govulncheck
+
+security-trivy:
+	trivy fs --format table --exit-code 1 --ignore-unfixed --severity HIGH,CRITICAL .
+
+security-govulncheck:
+	govulncheck ./...