fix: enable cloud providers by default

internal/ghapp/providers.go

@@ -0,0 +1,18 @@
+package ghapp
+
+// Enable all KMS providers in the default build. Each provider self-registers
+// via its init() when compiled in, so published images support aws, azure,
+// gcp, and vault out of the box without extra Go build tags. Individual
+// providers can still be excluded at build time with opt-out tags
+// (ghait.no_aws, ghait.no_azure, ghait.no_gcp, ghait.no_vault); each
+// provider package ships a disabled.go stub for that tag, so these imports
+// keep compiling to an empty package rather than failing the build.
+//
+// The file provider needs no import here: ghait registers it by default
+// unless built with ghait.no_file.
+import (
+	_ "github.com/isometry/ghait/v84/provider/aws"
+	_ "github.com/isometry/ghait/v84/provider/azure"
+	_ "github.com/isometry/ghait/v84/provider/gcp"
+	_ "github.com/isometry/ghait/v84/provider/vault"
+)

internal/ghapp/providers_test.go

@@ -0,0 +1,25 @@
+package ghapp
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/isometry/ghait/v84/provider"
+)
+
+// TestDefaultBuildRegistersAllProviders guards against the default (tagless)
+// build silently dropping cloud KMS providers. Published images are built
+// with no Go build tags, so every provider that should work out of the box
+// must self-register via an init() pulled in by an underscore import
+// somewhere in this package's dependency graph.
+func TestDefaultBuildRegistersAllProviders(t *testing.T) {
+	want := []string{"aws", "azure", "gcp", "vault", "file"}
+
+	registered := provider.Registered()
+
+	for _, name := range want {
+		if !slices.Contains(registered, name) {
+			t.Errorf("provider %q not registered in default build; registered: %v", name, registered)
+		}
+	}
+}