ci: add curl|bash smoke test and old-CLI compat job (Phase 4)

- scripts/mock-server.py: minimal Python HTTP server that serves a fixed
  RemoteConfig, packages catalog, and a dry-run install script so CI can
  run the full curl|bash flow without a live server.
- curl-bash-smoke job: builds the binary, starts the mock, runs
  `curl localhost/install | bash` with OPENBOOT_DRY_RUN=true on every PR.
- cli-compat job: downloads the previous stable release binary and runs
  it against the mock to catch breaking API contract changes.

Author: fullstackjam

.github/workflows/test.yml

@@ -92,3 +92,96 @@ jobs:
             coverage.out
             coverage.html
           retention-days: 7
+
+  curl-bash-smoke:
+    name: curl|bash smoke
+    runs-on: macos-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+
+      - name: Build
+        run: make build
+
+      - name: Start mock server
+        run: |
+          python3 scripts/mock-server.py 18888 ./openboot &
+          echo $! > /tmp/mock-pid
+          for i in $(seq 1 20); do
+            curl -sf http://localhost:18888/api/packages >/dev/null 2>&1 && break
+            sleep 0.3
+          done
+
+      - name: Run curl|bash install (dry-run)
+        run: curl -fsSL http://localhost:18888/testuser/test-config/install | bash
+
+      - name: Stop mock server
+        if: always()
+        run: kill $(cat /tmp/mock-pid) 2>/dev/null || true
+
+  cli-compat:
+    name: old-cli compat
+    runs-on: macos-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get previous release version
+        id: prev
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PREV=$(curl -sf https://api.github.com/repos/openbootdotdev/openboot/releases \
+            -H "Authorization: Bearer $GITHUB_TOKEN" | \
+            python3 -c "
+          import json, sys
+          releases = json.load(sys.stdin)
+          stable = [r for r in releases if not r.get('prerelease') and not r.get('draft')]
+          if len(stable) >= 2:
+              print(stable[1]['tag_name'])
+          elif len(stable) == 1:
+              print(stable[0]['tag_name'])
+          else:
+              sys.exit(1)
+          " 2>/dev/null) || true
+          echo "version=$PREV" >> $GITHUB_OUTPUT
+
+      - name: Download previous release binary
+        if: steps.prev.outputs.version != ''
+        run: |
+          VER="${{ steps.prev.outputs.version }}"
+          ARCH=$(uname -m)
+          if [ "$ARCH" = "arm64" ]; then
+            SUFFIX="darwin-arm64"
+          else
+            SUFFIX="darwin-amd64"
+          fi
+          curl -fsSL \
+            "https://github.com/openbootdotdev/openboot/releases/download/${VER}/openboot-${SUFFIX}" \
+            -o /tmp/openboot-prev
+          chmod +x /tmp/openboot-prev
+
+      - name: Start mock server for compat test
+        if: steps.prev.outputs.version != ''
+        run: |
+          python3 scripts/mock-server.py 18889 /tmp/openboot-prev &
+          echo $! > /tmp/compat-mock-pid
+          for i in $(seq 1 20); do
+            curl -sf http://localhost:18889/api/packages >/dev/null 2>&1 && break
+            sleep 0.3
+          done
+
+      - name: Run previous binary against current mock
+        if: steps.prev.outputs.version != ''
+        run: |
+          OPENBOOT_DRY_RUN=true OPENBOOT_API_URL=http://localhost:18889 \
+            /tmp/openboot-prev -s -u testuser/test-config
+
+      - name: Stop compat mock server
+        if: always()
+        run: kill $(cat /tmp/compat-mock-pid) 2>/dev/null || true

scripts/mock-server.py

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""Minimal HTTP mock server for OpenBoot CI smoke tests.
+
+Serves fixed config/packages responses so the CLI can run dry-run installs
+in CI without a live openboot.dev instance.
+
+Usage:
+  python3 scripts/mock-server.py <port> <binary-path>
+
+Example:
+  python3 scripts/mock-server.py 18888 ./openboot
+"""
+
+import json
+import sys
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import urlparse
+
+PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 18888
+BINARY = sys.argv[2] if len(sys.argv) > 2 else "./openboot"
+
+# Fixed RemoteConfig served at GET /<user>/<slug>/config
+CONFIG = {
+    "username": "testuser",
+    "slug": "test-config",
+    "name": "Test Config",
+    "preset": "minimal",
+    "packages": [{"name": "git", "desc": "Version control"}],
+    "casks": [],
+    "taps": [],
+    "npm": [],
+    "dotfiles_repo": "",
+    "post_install": [],
+    "shell": None,
+    "macos_prefs": [],
+}
+
+# Fixed packages catalog served at GET /api/packages
+PACKAGES = {
+    "packages": [
+        {"name": "git", "desc": "Distributed version control", "category": "essential", "type": "cli"},
+        {"name": "curl", "desc": "Transfer data via URLs", "category": "essential", "type": "cli"},
+    ]
+}
+
+# Install script template — runs the local binary in dry-run silent mode
+INSTALL_SCRIPT = """\
+#!/bin/bash
+set -e
+main() {{
+if [ ! -t 0 ] && [ -e /dev/tty ]; then
+  exec < /dev/tty || true
+fi
+export OPENBOOT_DRY_RUN=true
+export OPENBOOT_API_URL=http://localhost:{port}
+{binary} -s -u testuser/test-config
+exit 0
+}}
+main
+"""
+
+
+class MockHandler(BaseHTTPRequestHandler):
+    def log_message(self, fmt, *args):
+        pass  # suppress per-request logs; server start is printed to stderr
+
+    def _send_json(self, data, status=200):
+        body = json.dumps(data).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def _send_text(self, text, status=200):
+        body = text.encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        path = urlparse(self.path).path
+
+        if path in ("/testuser/test-config/config", "/test-user/test-config/config"):
+            self._send_json(CONFIG)
+        elif path == "/api/packages":
+            self._send_json(PACKAGES)
+        elif path in ("/testuser/test-config/install", "/test-user/test-config/install"):
+            self._send_text(INSTALL_SCRIPT.format(port=PORT, binary=BINARY))
+        else:
+            self._send_json({"error": "not found"}, 404)
+
+    def do_POST(self):
+        self._send_json({"error": "not found"}, 404)
+
+
+if __name__ == "__main__":
+    server = HTTPServer(("localhost", PORT), MockHandler)
+    sys.stderr.write(f"Mock server listening on http://localhost:{PORT}\n")
+    server.serve_forever()