Update dependencies and recover build tooling from starter template

[fmartingr]

Summary

• Update Go dependencies: server/public v0.1.10 → v0.4.3 (and 4 other direct deps), bumping the go directive to 1.26.3.
• Recover build tooling from the mattermost-plugin-starter-template: replace the custom .mk build system, which shelled out to a separately-installed global pluginctl binary, with the template's self-contained build/manifest + build/pluginctl Go tools compiled in-repo. No external pluginctl install is required anymore. XMPP dev-server and mock targets are preserved in build/custom.mk.
• Adopt the starter template's .golangci.yml (bidichk, makezero, modernize, govet enable-all, gofumpt) and fix the resulting findings (unchecked error returns, shadowed variables, sync.WaitGroup.Go, maps.Copy, interface{} → any).
• Fix make mock, which was broken for two independent reasons: the Command interface declared an unexported method that Go only allows same-package types to implement (so no cross-package mock could ever satisfy it — removed since it was never invoked through the interface anyway), and mockgen's reflect mode can't resolve this module locally (switched to -source mode). This also let go mod tidy drop the golangci-lint v1.61.0/gotestsum dependency tree that had been orphaned since the tool directive was dropped.

Verified end-to-end: make all (check-style → test → dist) passes with 0 lint issues and all tests green; all other make targets not requiring a live Mattermost server, Docker daemon, or destructive git push were also exercised successfully.

Ticket Link

N/A

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a5d61589-20dd-4c3f-aba5-c5f1b8e686a9

📥 Commits

Reviewing files that changed from the base of the PR and between 75a32f7 and f045374.

📒 Files selected for processing (1)

• build/pluginctl/main.go

🚧 Files skipped from review as they are similar to previous changes (1)

• build/pluginctl/main.go

---

📝 Walkthrough

Walkthrough

This PR rewrites the build and release tooling around a new Makefile, setup/custom includes, a Go manifest generator, and a pluginctl CLI. It also updates CI, lint, Node, and dependency configuration, plus small Go cleanups in server, XMPP, and command code.

Changes

Build System Restructuring

Layer / File(s)	Summary
CI, lint, Node, and dependency configuration .github/workflows/ci.yml, .golangci.yml, .nvmrc, go.mod, plugin.json	CI permissions and reusable workflow usage were simplified, golangci-lint was reconfigured, Node was bumped, dependencies were refreshed, and plugin metadata was trimmed.
Go manifest generator tool build/manifest/main.go	A new CLI reads manifest.json, fills derived manifest fields, and writes generated server, webapp, and dist manifest outputs.
pluginctl CLI: deploy, lifecycle, and logs build/pluginctl/main.go, build/pluginctl/logs.go, build/pluginctl/logs_test.go	A new CLI handles deploy, enable/disable/reset, and log retrieval flows against Mattermost, with tests for log filtering helpers.
Makefile targets and setup.mk wiring Makefile, build/setup.mk	The top-level build entrypoints now include setup and custom fragments, version bumping, build/test/bundle/deploy, attach, lifecycle, log, help, and mock targets, with setup deriving plugin metadata from the new manifest tool.
Custom XMPP devserver targets build/custom.mk	New devserver start/stop/status/logs/clean/doctor/help targets manage a local Docker Compose XMPP server.

Estimated code review effort: 4 (Complex) | ~60 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the dependency updates and build-tooling recovery work.
Description check	✅ Passed	The description is clearly aligned with the code changes and explains the main refactor and dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dep-update-20260630

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (2)

build/pluginctl/main.go (1)

69-114: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Redundant shadowed client in the username/password branch.

Line 94 already assigns the outer client to model.NewAPIv4Client(siteURL). The client := model.NewAPIv4Client(siteURL) at line 103 shadows it with a duplicate, equivalent instance instead of reusing the one already created — unnecessary object creation and a shadowed variable the PR's own lint cleanup theme (shadowed variables) targets elsewhere.

♻️ Suggested fix

 	if adminUsername != "" && adminPassword != "" {
-		client := model.NewAPIv4Client(siteURL)
 		log.Printf("Authenticating as %s against %s.", adminUsername, siteURL)
 		_, _, err := client.Login(ctx, adminUsername, adminPassword)
 		if err != nil {
 			return nil, fmt.Errorf("failed to login as %s: %w", adminUsername, err)
 		}
 
 		return client, nil
 	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build/pluginctl/main.go` around lines 69 - 114, The username/password branch
in getClient is creating a second shadowed client instead of reusing the one
already initialized from model.NewAPIv4Client(siteURL). Remove the inner client
declaration in the adminUsername/adminPassword path and use the existing client
variable for Login so the function avoids unnecessary duplication and eliminates
the shadowed variable.

go.mod (1)

3-3: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Go patch version is one release behind.

go 1.26.3 is valid, but go1.26.4 (released 2026-06-02) is now out with additional security fixes to crypto/x509, mime, and net/textproto. Worth bumping alongside the other dependency refresh in this PR.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 3, The Go toolchain version in go.mod is one patch release
behind, so update the module’s go directive from the current 1.26.3 to the
latest 1.26.4 as part of this dependency refresh. Keep the change limited to the
version declaration in go.mod and ensure the project still builds with the
updated Go release.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 14-19: The reusable workflow call in the plugin-ci job is tracking
a mutable upstream ref, which should be pinned to a specific release tag or
commit SHA instead of `@main`. Update the uses reference for
mattermost/actions-workflows/.github/workflows/plugin-ci.yml to a fixed,
auditable ref while keeping the existing plugin-ci job and secrets: inherit
configuration intact.

In `@build/pluginctl/main.go`:
- Around line 18-24: The helpText usage block is incomplete because it omits the
logs and logs-watch subcommands that pluginctl() already supports. Update the
helpText constant in main.go to include documentation for those two commands
alongside deploy, disable, enable, and reset so the printed usage matches the
available command handling.

---

Nitpick comments:
In `@build/pluginctl/main.go`:
- Around line 69-114: The username/password branch in getClient is creating a
second shadowed client instead of reusing the one already initialized from
model.NewAPIv4Client(siteURL). Remove the inner client declaration in the
adminUsername/adminPassword path and use the existing client variable for Login
so the function avoids unnecessary duplication and eliminates the shadowed
variable.

In `@go.mod`:
- Line 3: The Go toolchain version in go.mod is one patch release behind, so
update the module’s go directive from the current 1.26.3 to the latest 1.26.4 as
part of this dependency refresh. Keep the change limited to the version
declaration in go.mod and ensure the project still builds with the updated Go
release.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 72262678-3926-4031-9405-696e1dbdd3fa

📥 Commits

Reviewing files that changed from the base of the PR and between 0442bd7 and 75a32f7.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (31)

• .github/workflows/ci.yml
• .golangci.yml
• .nvmrc
• Makefile
• build/build.mk
• build/custom.mk
• build/custom_xmpp_server.mk
• build/deploy.mk
• build/dev.mk
• build/manifest/main.go
• build/pluginctl/logs.go
• build/pluginctl/logs_test.go
• build/pluginctl/main.go
• build/setup.mk
• build/test.mk
• build/utils.mk
• build/versioning.mk
• cmd/xmpp-client-doctor/main.go
• go.mod
• plugin.json
• server/bridge/manager.go
• server/bridge/mattermost/bridge.go
• server/bridge/mattermost/message_handler.go
• server/bridge/messagebus.go
• server/command/command.go
• server/command/mocks/mock_commands.go
• server/config/config.go
• server/configuration.go
• server/plugin_test.go
• server/xmpp/client.go
• server/xmpp/xep_0077.go

💤 Files with no reviewable changes (9)

• server/command/command.go
• build/custom_xmpp_server.mk
• build/versioning.mk
• build/dev.mk
• build/test.mk
• build/utils.mk
• build/build.mk
• build/deploy.mk
• plugin.json