feat: add test suite, CI pipeline, and helmspray refactor (84% coverage)

[mirai-toto]

PR: Add test suite, CI pipeline, and codebase refactor

Summary

• Adds the first test suite to helm-spray (previously 0 test files), reaching 84.4% statement coverage across all 8 packages
• Wires tests into CI on both GitHub Actions and GitLab CI with a SonarQube quality gate
• Refactors the core helmspray package into focused helper functions to improve testability and readability

---

Changes

~156 test functions across 8 packages

Package	Tests	Key coverage
cmd	17	Full NewRootCmd validation, all flag-conflict guards, URL/local/repo fetch paths
internal/dependencies	20	100% — weight parsing, alias resolution, tag gating, target/exclude filtering
internal/log	13	100% — all log levels, WithNumberedLines padding
internal/values	30	~96% — all include directives, pick, indent, Merge, mergeMaps
pkg/helm	9	95% List, 100% UpgradeWithValues flag paths via fake helm binary
pkg/helmspray	51	~85% Spray, 100% of all pure helpers
pkg/kubectl	9	100% of generateTemplate, early-return paths for all Are*Ready functions
pkg/util	7	100% — all Duration branches

Fake helm binary test approach

Functions that exec the helm binary are tested by writing a shell script stub to a temp directory and prepending it to PATH. This enables full end-to-end coverage of Spray() → upgrade() → UpgradeWithValues() without a Kubernetes cluster.

Codebase refactor (pkg/helmspray)

The monolithic upgrade() function was split into focused helpers:

New function	Responsibility
writeTempValuesFile	Creates temp file for updated default values, returns cleanup func
computeReleasePrefix	Pure: resolves the release name prefix from Spray config
deployByWeight	Orchestrates the weight-by-weight upgrade loop
upgradeDependency	Handles one dependency: logs, calls helm, checks status
buildDepValuesSet	Pure: builds dep.enabled=true/false flags string
collectWorkloads	Parses upgrade manifest, populates deployment/statefulSet/job lists
logUpgradedWorkloads	Emits verbose summary of discovered workloads
checkReady	Checks readiness for one workload type via injected function
validateNames	Pure: validates target/exclude names against known deps

CI pipeline

GitHub Actions (ci.yaml): runs go vet + go test ./... on every push and PR. Updated github-release.yaml to use actions/checkout@v4, actions/setup-go@v5, and go-version-file: go.mod.

GitLab CI (.gitlab-ci.yml): build → test → scan → report pipeline with SonarQube quality gate. Excludes *_test.go from the coverage denominator via sonar.coverage.exclusions.

---

How to verify

go test ./...
go test ./... -coverprofile=coverage.txt -coverpkg=./...
go tool cover -func=coverage.txt | grep total
# total: (statements) 84.4%