feat: implement crud operators for builder templates (#6)

* feat: implement crud operators for builder templates

* chore: bump lib deps + update ci and dockerfile

* chore: update ci trigger

Author: zachspar

.github/workflows/on-push.yaml

@@ -1,28 +1,28 @@
+---
 name: On Push
 
-on:
+"on":
   push:
     branches:
       - main
-      - master
   pull_request:
     branches:
       - main
-      - master
 
 jobs:
   build-and-push:
     permissions:
       contents: read
       packages: write
-    uses: builderhub/actions-internal/.github/workflows/build-push-image.yaml@main
+    uses: BuilderHub/actions/.github/workflows/buildah-build-push-workflow.yaml@v0.1.0-beta.2
     with:
-      image-name: build-api
-      dockerfile: Dockerfile
+      image: build-api
+      tags: ${{ github.sha }}
+      containerfiles: Dockerfile
       context: .
-      buildx-args: --secret id=netrc,env=SECRET_SLOT_0
-      push-to-registry: ${{ github.event_name == 'push' }}
+      registry: ghcr.io/builderhub
+      push: ${{ github.event_name == 'push' }}
     secrets:
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
-      secret-slot-0: |
-        machine github.com login x-access-token password ${{ secrets.ORG_REPO_READ_ONLY }}
+      REGISTRY_USERNAME: ${{ github.actor }}
+      REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+

Dockerfile

@@ -1,18 +1,14 @@
 # BuilderHub Build API - multi-stage, distroless, multi-arch
-# Requires netrc for go mod download (private build-operator): --secret id=netrc,env=SECRET_SLOT_0
-# Build from build-api repo: docker buildx build --secret id=netrc,env=SECRET_SLOT_0 .
 
 FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
 WORKDIR /workspace
 
 RUN apk add --no-cache git ca-certificates tzdata
 
 COPY go.mod go.sum ./
-COPY . .
+RUN go mod download
 
-# go mod download fetches build-operator from github.com/builderhub/build-operator (netrc for private repo auth)
-ENV GOPRIVATE=github.com/builderhub/*
-RUN --mount=type=secret,id=netrc,target=/root/.netrc go mod download
+COPY . .
 
 ARG TARGETARCH
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -ldflags="-w -s" -o build-api ./cmd/server

README.md

@@ -4,7 +4,7 @@ BuilderHub public-facing API. Manages BuildkitBuilder CRs via gRPC and REST.
 
 ## Features
 
-- **gRPC** on port 9090 (ListBuilders, GetBuilder, CreateBuilder, WakeBuilder, HealthCheck)
+- **gRPC** on port 9090 (builders, organizations, templates, auth, health)
 - **REST** via grpc-gateway on port 8080
 - **Swagger UI** at `/docs`, OpenAPI spec at `/openapi.json`
 - **Health** endpoints at `/health` and `/ready`
@@ -48,6 +48,11 @@ Set `GOPRIVATE=github.com/builderhub/*` and configure `~/.netrc` for private mod
 | GET | /v1/namespaces/{ns}/builders/{name} | Get builder |
 | POST | /v1/namespaces/{ns}/builders | Create builder |
 | POST | /v1/namespaces/{ns}/builders/{name}/wake | Wake sleepy builder |
+| GET | /v1/namespaces/{ns}/templates | List builder templates (org/namespace-scoped) |
+| GET | /v1/namespaces/{ns}/templates/{name} | Get builder template |
+| POST | /v1/namespaces/{ns}/templates | Create builder template |
+| PATCH | /v1/namespaces/{ns}/templates/{name} | Update builder template |
+| DELETE | /v1/namespaces/{ns}/templates/{name} | Delete builder template |
 | GET | /v1/health | Health check |
 | GET | /docs | Swagger UI |
 | GET | /openapi.json | OpenAPI spec |
@@ -57,11 +62,9 @@ Set `GOPRIVATE=github.com/builderhub/*` and configure `~/.netrc` for private mod
 ### Docker
 
 ```bash
-docker buildx build -f Dockerfile --secret id=netrc,env=SECRET_SLOT_0 .
+docker buildx build -f Dockerfile .
 ```
 
-Requires `SECRET_SLOT_0` env var with netrc content for private repo access.
-
 ### Helm
 
 ```bash
@@ -70,6 +73,16 @@ helm install build-api helm/build-api -n builderhub --create-namespace \
   --set image.tag=v0.0.0-beta.0
 ```
 
+## Scopes for API keys
+
+When creating API keys (via AuthService), the following scopes are available:
+
+- `builders:read`, `builders:write`
+- `organizations:read`, `organizations:write`
+- `templates:read`, `templates:write` (new — for managing BuildkitBuilderTemplates)
+
+JWT sessions from `auth login` have full access.
+
 ## License
 
 This project is licensed under the [MIT License](LICENSE).