ci: add a builder-api workflow

[eliteprox]

First of a five-PR split. The Go builder-api is not exercised by CI today: the openmeter-collector job only runs the Benthos suite and never builds it. PR #57 shows green on identity-webhook (22)/(24) and nothing else; PR #33 reports zero checks.

One file, .github/workflows/builder-api.yml: gofmt gate, go vet, build, test.

Its own workflow, and ci.yml untouched

GitHub path filters are workflow-level, not per-job. A job added to ci.yml becomes part of every run that workflow triggers, so it would surface as a check on unrelated PRs — including before the service it tests exists. A separate workflow with its own paths: filter does not run at all, so no check appears until the code is there and a PR touches it.

ci.yml is not modified by this PR, or by any PR in the stack. No existing job changes behaviour, which makes this about as low-risk a merge as the repo allows.

No konnect-credentials workflow

That service is parked pending the shared-tenant vs per-tenant-org decision (see #81), and nothing in this stack adds it. Its CI should land with the service rather than sit here as dead config.

Trade-off worth knowing

The workflow does not trigger on its own file path. That is what keeps the check off PRs with no service code — including this one, which shows no checks at all. The cost is that a later edit to this workflow is not exercised until service files change in the same PR. Reversing it is one line, at the price of the check reappearing on config-only PRs.

It still guards on the service directory after checkout: a PR that deletes the service matches the path filter, and the run should report that rather than fail on a missing directory.

Verification

actionlint clean. The behaviour is visible across the stack: no checks here, a real ~1m15s Go build and test on #79 and #81, and correctly absent on #80 and #82, which touch no builder-api files.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds CI coverage scaffolding for two additional services by expanding workflow path triggers and introducing guarded jobs that no-op (and stay green) until the corresponding directories land in subsequent PRs.

Changes:

• Expand CI workflow triggers to include auth0-provisioner/** and konnect-credentials/**.
• Add a guarded builder-api Go job (format check, go vet, build, tests) that runs only when openmeter-collector/builder-api/go.mod exists.
• Add a guarded konnect-credentials Node job (Node 22/24, npm ci, npm test) that runs only when konnect-credentials/package.json exists.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/builder-api.yml:12

• The workflow is path-filtered only to openmeter-collector/builder-api/**, so it will not run (and therefore cannot “skip green”) on PRs that only add/change this workflow file. That contradicts the PR description’s goal of stable check names from the first PR in the stack. Include the workflow file itself in the path filters so updates to the workflow get exercised and the check can appear even before the service directory lands.

on:
  pull_request:
    paths:
      - "openmeter-collector/builder-api/**"
  push:

.github/workflows/konnect-credentials.yml:12

• The workflow is path-filtered only to konnect-credentials/**, so it will not run (and therefore cannot “skip green”) on PRs that only add/change this workflow file. If you want stable check names from the first PR in the stack (as described), add the workflow file itself to the path filters so changes to this workflow are also validated.

on:
  pull_request:
    paths:
      - "konnect-credentials/**"
  push:
    branches: [main]
    paths:
      - "konnect-credentials/**"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/builder-api.yml:13

• PR metadata says this change adds per-service workflows for both builder-api and konnect-credentials, but this PR only introduces .github/workflows/builder-api.yml and there is no konnect-credentials workflow file under .github/workflows/. Either add the missing .github/workflows/konnect-credentials.yml in this PR, or update the PR title/description to match what’s actually being changed.

name: builder-api

on:
  pull_request:
    paths:
      - "openmeter-collector/builder-api/**"
  push:
    branches: [main]
    paths:
      - "openmeter-collector/builder-api/**"