feat: integrate embedded-cluster CLI lint into release lint pipeline

[emosbaugh]

Summary

• Adds EC lint as an opt-in linter (disabled by default) that runs the embedded-cluster CLI against manifest directories alongside existing Helm, Preflight, and Support Bundle linters
• New ECLinterConfig type with disabled-by-default IsEnabled() semantics — enable with repl-lint.linters.embedded-cluster.disabled: false
• Automatically discovers the EC version from the EmbeddedCluster/Config manifest (spec.version) in the manifests directory — no need to configure it separately
• Downloads the EC binary from S3 (https://tf-staging-embedded-cluster-bin.s3.us-east-1.amazonaws.com/releases/{version}-{os}.tgz) and caches it alongside other tools
• Supports binary-path config field and REPLICATED_EMBEDDED_CLUSTER_BINARY_PATH env var to bypass the resolver (useful for local dev/testing)
• Configurable disable-checks list with defaults (helmchart-archive, ecconfig-helmchart-archive)

Example config

repl-lint:
  linters:
    embedded-cluster:
      disabled: false
      # optional overrides:
      # binary-path: /path/to/cli
      # disable-checks:
      #   - preflight-v1beta2

Test plan

• Run replicated release lint without EC config — EC section shows as disabled
• Enable EC linting in .replicated, point at a manifests dir with an EmbeddedCluster/Config manifest — version is auto-discovered, binary is downloaded and linting runs
• Set REPLICATED_EMBEDDED_CLUSTER_BINARY_PATH to a local binary — resolver is bypassed
• JSON output includes embedded_cluster_results field
• EC lint errors cause overall linting failed exit code

🤖 Generated with Claude Code

[cursor]

Downloaded EC binary executed without integrity verification

Low Severity

The EC binary is downloaded from S3 and subsequently executed via exec.CommandContext without any checksum or signature verification. All other downloaded tools (Helm, Preflight, Support Bundle) perform checksum verification before execution. A compromised or tampered artifact on the S3 bucket would be silently accepted and run.

Additional Locations (1)

• pkg/tools/downloader.go#L355-L369

 

^{Reviewed by Cursor Bugbot for commit e5e82ff. Configure here.}

[emosbaugh]

we dont yet have checksums

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 15a52dd. Configure here.}

[cursor]

Redundant convertECResultToMessages duplicates generic troubleshoot converter

Low Severity

convertECResultToMessages is a near-exact copy of convertTroubleshootResultToMessages in troubleshoot_common.go. The only structural difference is that ecFileResult uses the JSON tag "info" instead of "infos". The conversion logic (iterating errors, warnings, infos and calling formatTroubleshootMessage) is identical. This duplication means any future changes to the message conversion pattern need to be applied in two places.

 

^{Reviewed by Cursor Bugbot for commit 15a52dd. Configure here.}