v2.0.0 — Role-based restructure, /v2 module, and five new SDK-compat services

.github/workflows/ci.yml

@@ -0,0 +1,111 @@
+name: CI
+
+# Public repo → GitHub-hosted Actions are free. Kept fast: Build and Vet share
+# one job so `go vet` reuses the compile cache `go build` just populated
+# (standalone `go vet ./...` recompiles everything and is slow). Test runs in
+# parallel; the quick checks (Tidy/Format) give sub-minute feedback. Every job
+# restores the Go build+module cache. One run per PR (+ push to master);
+# superseded runs cancel.
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-vet:
+    name: Build & Vet
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: false
+      # Manual cache with restore-keys so a changed go.sum still restores the
+      # previous build+module cache (only the changed deps recompile) instead
+      # of a full cold compile of the whole cloud-SDK dependency tree.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            go-${{ runner.os }}-
+      - name: go build
+        run: go build ./...
+      - name: go vet (reuses the build cache)
+        run: go vet ./...
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: false
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            go-${{ runner.os }}-
+      - run: go test ./...
+
+  tidy:
+    name: Tidy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - name: go mod tidy is clean
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - name: gofmt (report-only)
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "::warning::gofmt needed on the following files (advisory):"
+            echo "$unformatted"
+          else
+            echo "all files gofmt-clean"
+          fi
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - name: install golangci-lint v2
+        run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "$(go env GOPATH)/bin"
+      - name: golangci-lint run (report-only)
+        run: "$(go env GOPATH)/bin/golangci-lint run --timeout=9m ./... || echo '::warning::golangci-lint reported findings (advisory)'"

.github/workflows/security.yml

@@ -0,0 +1,83 @@
+name: Security
+
+# Security scanning, separate from CI so it runs in parallel and is easy to
+# read. Each scanner is its own cached job. Runs on PRs, on push to master, and
+# weekly (so newly-disclosed CVEs are caught even without a push).
+on:
+  pull_request:
+  push:
+    branches: [master]
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  govulncheck:
+    name: Vulnerabilities (govulncheck)
+    runs-on: ubuntu-latest
+    # Advisory to start: flags known CVEs in dependencies the code reaches.
+    # Flip to blocking once the baseline is confirmed clean.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - name: install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: govulncheck (report-only)
+        run: "$(go env GOPATH)/bin/govulncheck ./... || echo '::warning::govulncheck reported findings (advisory)'"
+
+  gosec:
+    name: SAST (gosec)
+    runs-on: ubuntu-latest
+    # Advisory to start: static security analysis (hardcoded creds, weak crypto,
+    # unsafe patterns). Reports without blocking until the baseline is triaged.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - name: install gosec
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+      - name: gosec (report-only)
+        run: "$(go env GOPATH)/bin/gosec -exclude-generated ./... || echo '::warning::gosec reported findings (advisory)'"
+
+  codeql:
+    name: CodeQL (SAST)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache: true
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: go
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3
+
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Review dependency changes for known vulnerabilities
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

README.md

@@ -8,8 +8,8 @@
 </p>
 
 <p align="center">
-  <a href="https://pkg.go.dev/github.com/stackshy/cloudemu"><img src="https://pkg.go.dev/badge/github.com/stackshy/cloudemu.svg" alt="Go Reference"></a>
-  <a href="https://goreportcard.com/report/github.com/stackshy/cloudemu"><img src="https://goreportcard.com/badge/github.com/stackshy/cloudemu" alt="Go Report Card"></a>
+  <a href="https://pkg.go.dev/github.com/stackshy/cloudemu/v2"><img src="https://pkg.go.dev/badge/github.com/stackshy/cloudemu/v2.svg" alt="Go Reference"></a>
+  <a href="https://goreportcard.com/report/github.com/stackshy/cloudemu/v2"><img src="https://goreportcard.com/badge/github.com/stackshy/cloudemu/v2" alt="Go Report Card"></a>
   <a href="https://github.com/stackshy/cloudemu/blob/development/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License"></a>
   <img src="https://img.shields.io/badge/Go-1.25+-00ADD8?logo=go&logoColor=white" alt="Go Version">
   <img src="https://img.shields.io/badge/providers-AWS_|_Azure_|_GCP-orange" alt="Providers">
@@ -30,7 +30,7 @@ It ships two surfaces you can mix and match:
 ## Install
 
 ```bash
-go get github.com/stackshy/cloudemu
+go get github.com/stackshy/cloudemu/v2
 ```
 
 Requires Go 1.25+.
@@ -45,8 +45,8 @@ import (
 
     "github.com/aws/aws-sdk-go-v2/aws"
     "github.com/aws/aws-sdk-go-v2/service/s3"
-    "github.com/stackshy/cloudemu"
-    awsserver "github.com/stackshy/cloudemu/server/aws"
+    "github.com/stackshy/cloudemu/v2"
+    awsserver "github.com/stackshy/cloudemu/v2/server/aws"
 )
 
 cloud := cloudemu.NewAWS()

cloudemu.go

@@ -1,10 +1,10 @@
 package cloudemu
 
 import (
-	"github.com/stackshy/cloudemu/config"
-	"github.com/stackshy/cloudemu/providers/aws"
-	"github.com/stackshy/cloudemu/providers/azure"
-	"github.com/stackshy/cloudemu/providers/gcp"
+	"github.com/stackshy/cloudemu/v2/config"
+	"github.com/stackshy/cloudemu/v2/providers/aws"
+	"github.com/stackshy/cloudemu/v2/providers/azure"
+	"github.com/stackshy/cloudemu/v2/providers/gcp"
 )
 
 // NewAWS creates a new AWS mock provider.

cloudemu_test.go

@@ -7,34 +7,34 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stackshy/cloudemu/compute"
-	computedriver "github.com/stackshy/cloudemu/compute/driver"
-	"github.com/stackshy/cloudemu/config"
-	"github.com/stackshy/cloudemu/cost"
-	"github.com/stackshy/cloudemu/database/driver"
-	dnsdriver "github.com/stackshy/cloudemu/dns/driver"
-	cerrors "github.com/stackshy/cloudemu/errors"
-	iamdriver "github.com/stackshy/cloudemu/iam/driver"
-	"github.com/stackshy/cloudemu/inject"
-	mqdriver "github.com/stackshy/cloudemu/messagequeue/driver"
-	"github.com/stackshy/cloudemu/metrics"
-	mondriver "github.com/stackshy/cloudemu/monitoring/driver"
-	netdriver "github.com/stackshy/cloudemu/networking/driver"
-	"github.com/stackshy/cloudemu/ratelimit"
-	"github.com/stackshy/cloudemu/recorder"
-	serverlessdriver "github.com/stackshy/cloudemu/serverless/driver"
-	"github.com/stackshy/cloudemu/storage"
-	storagedriver "github.com/stackshy/cloudemu/storage/driver"
-
-	lbdriver "github.com/stackshy/cloudemu/loadbalancer/driver"
-
-	cachedriver "github.com/stackshy/cloudemu/cache/driver"
-	crdriver "github.com/stackshy/cloudemu/containerregistry/driver"
-	ebdriver "github.com/stackshy/cloudemu/eventbus/driver"
-	loggingdriver "github.com/stackshy/cloudemu/logging/driver"
-	notifdriver "github.com/stackshy/cloudemu/notification/driver"
-	secretsdriver "github.com/stackshy/cloudemu/secrets/driver"
-	"github.com/stackshy/cloudemu/topology"
+	"github.com/stackshy/cloudemu/v2/config"
+	cerrors "github.com/stackshy/cloudemu/v2/errors"
+	"github.com/stackshy/cloudemu/v2/features/inject"
+	"github.com/stackshy/cloudemu/v2/features/metrics"
+	"github.com/stackshy/cloudemu/v2/features/ratelimit"
+	"github.com/stackshy/cloudemu/v2/features/recorder"
+	"github.com/stackshy/cloudemu/v2/services/compute"
+	computedriver "github.com/stackshy/cloudemu/v2/services/compute/driver"
+	"github.com/stackshy/cloudemu/v2/services/cost"
+	"github.com/stackshy/cloudemu/v2/services/database/driver"
+	dnsdriver "github.com/stackshy/cloudemu/v2/services/dns/driver"
+	iamdriver "github.com/stackshy/cloudemu/v2/services/iam/driver"
+	mqdriver "github.com/stackshy/cloudemu/v2/services/messagequeue/driver"
+	mondriver "github.com/stackshy/cloudemu/v2/services/monitoring/driver"
+	netdriver "github.com/stackshy/cloudemu/v2/services/networking/driver"
+	serverlessdriver "github.com/stackshy/cloudemu/v2/services/serverless/driver"
+	"github.com/stackshy/cloudemu/v2/services/storage"
+	storagedriver "github.com/stackshy/cloudemu/v2/services/storage/driver"
+
+	lbdriver "github.com/stackshy/cloudemu/v2/services/loadbalancer/driver"
+
+	"github.com/stackshy/cloudemu/v2/features/topology"
+	cachedriver "github.com/stackshy/cloudemu/v2/services/cache/driver"
+	crdriver "github.com/stackshy/cloudemu/v2/services/containerregistry/driver"
+	ebdriver "github.com/stackshy/cloudemu/v2/services/eventbus/driver"
+	loggingdriver "github.com/stackshy/cloudemu/v2/services/logging/driver"
+	notifdriver "github.com/stackshy/cloudemu/v2/services/notification/driver"
+	secretsdriver "github.com/stackshy/cloudemu/v2/services/secrets/driver"
 )
 
 func TestStorageLifecycle(t *testing.T) {
@@ -8229,6 +8229,7 @@ func testGSIOperations(t *testing.T, ctx context.Context, d driver.Database) {
 		t.Errorf("expected NotFound for missing table, got %v", err)
 	}
 }
+
 // Event Source Mapping Tests
 func testEventSourceMapping(t *testing.T, ctx context.Context, d serverlessdriver.Serverless) {
 	t.Helper()
@@ -8423,6 +8424,7 @@ func TestEventSourceMappingGCP(t *testing.T) {
 	p := NewGCP()
 	testEventSourceMapping(t, ctx, p.CloudFunctions)
 }
+
 // ─── VPC Endpoints ────────────────────────────────────────────
 
 func TestVPCEndpointAWS(t *testing.T) {

doc.go

@@ -1,19 +1,24 @@
 // Package cloudemu provides zero-cost, in-memory cloud emulation of
 // AWS, Azure, and GCP cloud services for Go.
 //
-// cloudemu follows a three-layer architecture:
+// The repository is organized by role so new services and features slot into
+// predictable places:
 //
-//   - Portable API: High-level types (storage.Bucket, compute.Compute, etc.)
-//     that wrap drivers with cross-cutting concerns like recording, metrics,
-//     rate limiting, and error injection.
+//   - services/<name>: the emulated cloud services. Each holds the Portable API
+//     type (e.g. services/storage's storage.Bucket) plus its driver interface
+//     under services/<name>/driver.
 //
-//   - Driver Interfaces: Minimal contracts (storage/driver, compute/driver, etc.)
-//     that each provider must implement.
+//   - providers/{aws,azure,gcp}: in-memory backends implementing the drivers.
 //
-//   - Provider Implementations: In-memory backends (providers/aws/s3, providers/azure/blobstorage,
-//     providers/gcp/gcs, etc.) powered by a generic memstore.
+//   - server/{aws,azure,gcp}: SDK-compat HTTP servers that speak each cloud's
+//     real wire protocol, so unmodified SDK clients drive the backends.
 //
-// 10 cloud services are covered across all three providers: Storage, Compute,
-// Database, Serverless, Networking, Monitoring, IAM, DNS, Load Balancer,
-// and Message Queue.
+//   - features/<name>: cross-cutting capabilities you wrap drivers with —
+//     chaos, recorder, metrics, inject, ratelimit, and topology.
+//
+//   - config, errors: foundational options and the canonical error type.
+//
+// The three surfaces build on the same drivers: the SDK-compat server (the
+// primary entrypoint), the Portable API (services/<name>), and the cross-cutting
+// features, so a behavior implemented in a driver lights up across all of them.
 package cloudemu