Why pure Go

go-puppet-bolt is part of the pure-Go Puppet stack — a family of engines (alongside go-facter, go-hiera, go-pcore and go-puppet) that provide Puppet-ecosystem capabilities as ordinary Go libraries, with CGO_ENABLED=0 and no runtime dependency on Ruby or on a C toolchain.

Static, portable, embeddable

Because it is pure Go — imports the Go standard library and a few pure-Go dependencies (go-ruby-yaml/yaml for inventory/plan YAML, golang.org/x/crypto/ssh for the SSH transport, go-ntlmssp for WinRM NTLM, and go-puppet/puppet for .pp plans and catalog compilation) — go-puppet-bolt compiles with cgo disabled, cross-compiles to every 64-bit Go target (amd64, arm64, riscv64, loong64, ppc64le, s390x) and to WebAssembly, and links into a single static binary. There is nothing to install alongside it — no shared library, no interpreter, no external process it must shell out to.

Testability by construction

Every interaction with the outside world — file access, the environment, the network — flows through an injectable seam. That means both the happy path and every error branch are exercised deterministically against in-memory fixtures, which is how the project holds 100% coverage across operating systems and architectures from a single test suite, without special privileges.

An engine, not a framework

go-puppet-bolt exposes a small, stable Go API and does one thing well — inventory, tasks & plans — as a dependency-light library you embed, not a service or CLI you must stand up.