Add daemon-check-output program and tw/daemon-check-output pipeline.

daemon-check-output/Makefile

@@ -0,0 +1,18 @@
+PROJECT = daemon-check-output
+MELANGE_CONTEXTDIR ?= /tmp/melange-context/$(PROJECT)
+MELANGE_INSTALL_PATH = $(MELANGE_CONTEXTDIR)/usr/bin
+
+.PHONY: build test clean melange-install
+
+build:
+	go build -o $(PROJECT)
+
+test:
+	go test -v ./...
+
+clean:
+	rm -f $(PROJECT)
+
+melange-install: build
+	mkdir -p $(MELANGE_INSTALL_PATH)
+	install -Dm755 $(PROJECT) $(MELANGE_INSTALL_PATH)/$(PROJECT)

daemon-check-output/README.md

@@ -0,0 +1,70 @@
+# daemon-check-output
+
+Starts a daemon, waits for expected log output, optionally runs setup/post
+scripts, then terminates the daemon and reports the result. This is the tool
+behind the `test/tw/daemon-check-output` melange pipeline; it replaces the
+~220-line inline shell that pipeline used to carry.
+
+## Usage
+
+```
+daemon-check-output \
+    --start-file=FILE \
+    --expected-file=FILE \
+    [--error-strings-file=FILE] \
+    [--setup-file=FILE] \
+    [--post-file=FILE] \
+    [--timeout=SECONDS]
+```
+
+Inputs are passed as files rather than command-line strings so the melange
+wrapper can hand user-provided content over via quoted heredocs, avoiding shell
+expansion/injection of that content.
+
+- `--start-file` (required): the daemon start command, run via `/bin/sh -c`.
+- `--expected-file` (required): newline-separated regex patterns; **all** must
+  appear in the daemon's combined stdout/stderr within `--timeout`.
+- `--error-strings-file`: newline-separated regex patterns; **any** match fails
+  the check. Empty/absent disables error checking.
+- `--setup-file`: commands run before the daemon starts. A failure aborts before
+  the daemon is started. `#!/bin/sh -ex` is prepended if there is no shebang.
+- `--post-file`: commands run after the daemon is ready (same shebang handling).
+- `--check-url-file`: YAML declarative HTTP check(s) run after the daemon is
+  ready (see below).
+- `--timeout`: seconds to wait for all expected patterns (default 30); also the
+  ceiling for retrying each URL check.
+
+## Declarative URL checks
+
+`--check-url-file` replaces the common "curl in a post script" pattern. It is
+YAML describing one check or a list of them:
+
+```yaml
+- url: http://localhost:8080/health
+  method: GET                     # optional, default GET
+  headers:                        # optional
+    Authorization: "Bearer TOKEN"
+  expected:
+    code: 200                     # optional; if omitted, any status < 400 passes
+    body-contains: "hello world"  # optional; a string or a list of strings
+- url: http://localhost:8080/metrics
+```
+
+Each check is retried once per second until it passes or `--timeout` elapses, so
+a connection refused while the port is still coming up is tolerated (like
+`curl --retry`). Only `http`/`https` URLs are allowed. Advanced cases (JSON
+assertions with jq, POST bodies, digest auth, dynamic tokens) still belong in a
+`post` script.
+
+## Behavior notes
+
+- The daemon runs in its own process group; on cleanup the whole group receives
+  SIGTERM, then SIGKILL after 30s, so forked workers are not left running.
+- Exit code is `1` if any expected pattern is missing or any error string
+  matched; otherwise the post script's exit code; otherwise `0`.
+
+## Testing
+
+```
+make test   # hermetic go tests using small /bin/sh fake daemons
+```

daemon-check-output/go.mod

@@ -0,0 +1,5 @@
+module chainguard.dev/tw/daemon-check-output
+
+go 1.26.0
+
+require gopkg.in/yaml.v3 v3.0.1

daemon-check-output/go.sum

@@ -0,0 +1,4 @@
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=