From d8edcba11f58a5e7acc7e61faf2c5424b61abfc9 Mon Sep 17 00:00:00 2001
From: Robin Breathe <robin@isometry.net>
Date: Wed, 1 Jul 2026 17:11:46 +0200
Subject: [PATCH] fix: enable cloud providers by default

---
 internal/ghapp/providers.go      | 18 ++++++++++++++++++
 internal/ghapp/providers_test.go | 25 +++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100644 internal/ghapp/providers.go
 create mode 100644 internal/ghapp/providers_test.go

diff --git a/internal/ghapp/providers.go b/internal/ghapp/providers.go
new file mode 100644
index 0000000..82a4e85
--- /dev/null
+++ b/internal/ghapp/providers.go
@@ -0,0 +1,18 @@
+package ghapp
+
+// Enable all KMS providers in the default build. Each provider self-registers
+// via its init() when compiled in, so published images support aws, azure,
+// gcp, and vault out of the box without extra Go build tags. Individual
+// providers can still be excluded at build time with opt-out tags
+// (ghait.no_aws, ghait.no_azure, ghait.no_gcp, ghait.no_vault); each
+// provider package ships a disabled.go stub for that tag, so these imports
+// keep compiling to an empty package rather than failing the build.
+//
+// The file provider needs no import here: ghait registers it by default
+// unless built with ghait.no_file.
+import (
+	_ "github.com/isometry/ghait/v84/provider/aws"
+	_ "github.com/isometry/ghait/v84/provider/azure"
+	_ "github.com/isometry/ghait/v84/provider/gcp"
+	_ "github.com/isometry/ghait/v84/provider/vault"
+)
diff --git a/internal/ghapp/providers_test.go b/internal/ghapp/providers_test.go
new file mode 100644
index 0000000..0b231a3
--- /dev/null
+++ b/internal/ghapp/providers_test.go
@@ -0,0 +1,25 @@
+package ghapp
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/isometry/ghait/v84/provider"
+)
+
+// TestDefaultBuildRegistersAllProviders guards against the default (tagless)
+// build silently dropping cloud KMS providers. Published images are built
+// with no Go build tags, so every provider that should work out of the box
+// must self-register via an init() pulled in by an underscore import
+// somewhere in this package's dependency graph.
+func TestDefaultBuildRegistersAllProviders(t *testing.T) {
+	want := []string{"aws", "azure", "gcp", "vault", "file"}
+
+	registered := provider.Registered()
+
+	for _, name := range want {
+		if !slices.Contains(registered, name) {
+			t.Errorf("provider %q not registered in default build; registered: %v", name, registered)
+		}
+	}
+}