refac!: explicit provider contract

[utkuerol]

The provider interface wasn't clear about what is custom to the provider and what is received from Codesphere. This PR makes the distinction explicit by separating Codesphere provided fields from custom provider types. Also removes the example types because they didn't add much value and mostly confused developers into believing they had to use those types.

[Copilot]

Pull request overview

This PR refactors the managed service provider contract to make Codesphere-defined fields explicit in provider method signatures, separating them from provider-specific schemas and removing example model types that could mislead implementers.

Changes:

• Redesign the provider.Provider and provider.Backups interfaces to pass contract fields explicitly and standardize status via ServiceStatus/NewServiceStatus.
• Update HTTP route handlers to decode/unpack contract envelopes (plan.parameters, msId) and forward contract fields as separate arguments.
• Add route-level unit tests for create/update/status/backup behavior; update Go toolchain and CI/security workflows to use go.mod.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates documentation to explain the explicit split between contract fields and provider-defined schemas.
provider/routes.go	Refactors Gin handlers to decode contract-defined fields/envelopes and call the new provider interfaces.
provider/routes_test.go	Adds tests covering the new decoding/unwrapping behavior and handler wiring.
provider/interface.go	Introduces the new provider contracts and ServiceStatus helper for the status envelope.
model/common.go	Removes example/common schema types to avoid implying they must be used by providers.
go.mod	Bumps Go toolchain patch version.
.github/workflows/ci.yml	Switches setup-go to go-version-file: go.mod for CI.
.github/workflows/security.yml	Switches setup-go to go-version-file: go.mod for security checks.
NOTICE	Updates dependency NOTICE entries to match updated indirect module versions.

Suppressed comments (1)

provider/routes.go:188

• Backup requests require msId (service ID) to be present in the JSON body, but parseBackup currently accepts a missing/empty value and passes it through. This will call the provider with an empty ServiceID, which is almost certainly invalid; returning a 400 here makes the contract enforcement explicit.

	var body backupBody[Config, Secrets]
	if err := c.ShouldBindJSON(&body); err != nil {
		return "", body, err
	}
	return model.BackupId(c.Param("id")), body, nil

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.