Centralize Goss tests for use across multiple projects

[!NOTE]
Moved from rstudio/platform-team#411

Context

Each product image repo has its own goss test templates that follow similar patterns — user/group checks, file permissions, process/port assertions, package verification. These patterns are duplicated across repos with no shared test library.

Proposed Approach: goss.d/ with shared include files

Goss supports a gossfile directive that includes other goss files using local paths with glob patterns:

# goss.yaml
gossfile:
    goss.d/*.yaml: {}

This is the pattern used in rstudio/marketplaces, where tests are split into modular files per concern:

tests/
├── goss.yaml              # 3 lines — just the gossfile include
└── goss.d/
    ├── apt-packages.yaml
    ├── apt-dpkg-lock.yaml
    ├── r-versions.yaml
    ├── python-versions.yaml
    ├── posit-connect.yaml
    └── ...

Shared files for the images ecosystem

Reusable goss test files would live in images-shared and be copied into each product repo's test path before dgoss runs. Organized as:

goss.d/
├── shared/
│   ├── users.yaml           # Common user/group assertions
│   ├── apt-locks.yaml       # No held apt/dpkg locks
│   └── file-permissions.yaml
├── r.yaml                   # R version checks
├── python.yaml              # Python version checks
├── quarto.yaml              # Quarto installation verification
└── tinytex.yaml             # TinyTeX installation verification

Goss supports Go templates natively with {{ .Env.VAR }} for environment variables and {{ .Vars.key }} for variables passed via --vars. This means shared files can be parameterized without Jinja2:

# goss.d/r.yaml
command:
  "R version installed":
    exec: "/opt/R/{{ .Env.BUILD_ARG_R_VERSION }}/bin/R --version"
    exit-status: 0

Each product repo's goss.yaml includes shared files plus product-specific tests:

# images-connect goss.yaml
gossfile:
    goss.d/shared/*.yaml: {}
    goss.d/connect/*.yaml: {}

Integration with bakery

The shared goss files need to be available in the test path when bakery run dgoss executes. Options:

1. setup-bakery copies shared goss files into the image's test directory as a setup step
2. bakery itself copies them during run dgoss if a shared goss path is configured
3. Symlinks or git submodules in each product repo pointing to images-shared

Option 1 is simplest and matches the existing setup-bakery / setup-goss action pattern.

Current State

Shared infrastructure:

• setup-goss/ — GitHub Action that installs goss/dgoss
• goss.j2 — 6-line Jinja2 macro (build-arg env var helper only)
• bakery run dgoss — CLI command to execute goss tests, sets GOSS_FILES_PATH to the image's test directory

Per-repo goss templates:

• images-connect: 3 templates (connect, connect-content, connect-content-init)
• images-workbench: 4 templates (workbench, workbench-session, workbench-session-init, workbench-positron-init)
• images-package-manager: 1 template (package-manager)

Reference implementation:

• rstudio/marketplaces/tests/ — uses goss.d/ pattern with per-concern test files

Start by reviewing setup-goss/, the goss.j2 macro, and the bakery run dgoss entry point, then compare the existing product-repo templates with rstudio/marketplaces/tests/. Done means shared goss.d files are organized in images-shared, made available in the test path, and usable across the listed product repositories.