ci: cross-platform plugin build, Codecov PR comments, docs deploy

.github/workflows/ci.yaml

@@ -299,6 +299,7 @@ jobs:
         with:
           files: coverage.out
           fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   test-bench:
     name: Benchmark Tests (${{ matrix.pkg }})
@@ -717,6 +718,19 @@ jobs:
           go build -o bin/manager ./cmd/manager/
           go build -o bin/kubectl-attune ./cmd/kubectl-attune/
 
+      - name: Cross-compile kubectl plugin
+        shell: bash -Eeuo pipefail -x {0}
+        run: |
+          platforms=("linux/amd64" "linux/arm64" "darwin/amd64" "darwin/arm64" "windows/amd64")
+          for platform in "${platforms[@]}"; do
+            os="${platform%/*}"
+            arch="${platform#*/}"
+            ext=""; if [ "$os" = "windows" ]; then ext=".exe"; fi
+            echo "::group::${os}/${arch}"
+            GOOS="$os" GOARCH="$arch" go build -o "bin/kubectl-attune-${os}-${arch}${ext}" ./cmd/kubectl-attune/
+            echo "::endgroup::"
+          done
+
       - name: Build container image (no push)
         shell: bash -Eeuo pipefail -x {0}
         run: |

.github/workflows/docs.yaml

@@ -23,6 +23,9 @@ jobs:
     runs-on: ${{ vars.RUNNER || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
+      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install MkDocs

codecov.yml

@@ -0,0 +1,14 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 80%
+        threshold: 2%
+    patch:
+      default:
+        target: 80%
+
+comment:
+  layout: "reach,diff,flags,files"
+  behavior: default
+  require_changes: true