refactor: extract matcher into separate package

internal/pkg/controller/configmap_reconciler.go

@@ -9,12 +9,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // ConfigMapReconciler watches ConfigMaps and triggers workload reloads.
@@ -49,7 +50,7 @@ func NewConfigMapReconciler(
 			NamespaceCache: nsCache,
 		},
 		ResourceConfig[*corev1.ConfigMap]{
-			ResourceType: reload.ResourceTypeConfigMap,
+			ResourceType: matcher.ResourceTypeConfigMap,
 			NewResource:  func() *corev1.ConfigMap { return &corev1.ConfigMap{} },
 			CreateChange: func(cm *corev1.ConfigMap, eventType reload.EventType) reload.ResourceChange {
 				return reload.ConfigMapChange{ConfigMap: cm, EventType: eventType}

internal/pkg/controller/configmap_reconciler_test.go

@@ -3,8 +3,8 @@ package controller_test
 import (
 	"testing"
 
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestConfigMapReconciler_NotFound(t *testing.T) {

internal/pkg/controller/deployment_reconciler.go

@@ -10,8 +10,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/pkg/config"
-	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // DeploymentReconciler reconciles Deployment objects to handle pause expiration.

internal/pkg/controller/filter.go

@@ -6,8 +6,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/pkg/config"
-	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // BuildEventFilter combines a resource-specific predicate with common filters.

internal/pkg/controller/handler.go

@@ -11,9 +11,10 @@ import (
 	"github.com/stakater/Reloader/internal/pkg/alerting"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // ReloadHandler handles the common reload workflow.
@@ -32,7 +33,7 @@ type ReloadHandler struct {
 func (h *ReloadHandler) Process(
 	ctx context.Context,
 	namespace, resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	getDecisions func([]workload.Workload) []reload.ReloadDecision,
 	log logr.Logger,
 ) (ctrl.Result, error) {
@@ -76,7 +77,7 @@ func (h *ReloadHandler) Process(
 func (h *ReloadHandler) sendWebhook(
 	ctx context.Context,
 	resourceName, namespace string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	decisions []reload.ReloadDecision,
 	log logr.Logger,
 ) (ctrl.Result, error) {
@@ -127,7 +128,7 @@ func (h *ReloadHandler) sendWebhook(
 func (h *ReloadHandler) applyReloads(
 	ctx context.Context,
 	resourceName, resourceNamespace string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	decisions []reload.ReloadDecision,
 	log logr.Logger,
 ) {

internal/pkg/controller/manager.go

@@ -18,12 +18,12 @@ import (
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 var runtimeScheme = runtime.NewScheme()

internal/pkg/controller/namespace_reconciler.go

@@ -11,8 +11,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/pkg/config"
-	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // NamespaceCache provides thread-safe access to the set of namespaces

internal/pkg/controller/namespace_reconciler_test.go

@@ -5,9 +5,9 @@ import (
 
 	"k8s.io/apimachinery/pkg/labels"
 
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestNamespaceCache_Basic(t *testing.T) {

internal/pkg/controller/resource_reconciler.go

@@ -11,12 +11,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // ResourceReconcilerDeps holds shared dependencies for resource reconcilers.
@@ -39,7 +40,7 @@ type ResourceReconcilerDeps struct {
 // ResourceConfig provides type-specific configuration for a resource reconciler.
 type ResourceConfig[T client.Object] struct {
 	// ResourceType identifies the type of resource (configmap or secret).
-	ResourceType reload.ResourceType
+	ResourceType matcher.ResourceType
 
 	// NewResource creates a new instance of the resource type.
 	NewResource func() T

internal/pkg/controller/retry.go

@@ -7,8 +7,9 @@ import (
 	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // UpdateObjectWithRetry updates a Kubernetes object with retry on conflict.
@@ -58,7 +59,7 @@ func UpdateWorkloadWithRetry(
 	pauseHandler *reload.PauseHandler,
 	wl workload.Workload,
 	resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	namespace string,
 	hash string,
 	autoReload bool,
@@ -83,7 +84,7 @@ func retryWithReload(
 	reloadService *reload.Service,
 	wl workload.Workload,
 	resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	namespace string,
 	hash string,
 	autoReload bool,
@@ -131,7 +132,7 @@ func updateStandardWorkload(
 	reloadService *reload.Service,
 	wl workload.Workload,
 	resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	namespace string,
 	hash string,
 	autoReload bool,
@@ -152,7 +153,7 @@ func updateDeploymentWithPause(
 	pauseHandler *reload.PauseHandler,
 	wl workload.Workload,
 	resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	namespace string,
 	hash string,
 	autoReload bool,
@@ -180,7 +181,7 @@ func updateWithSpecialStrategy(
 	reloadService *reload.Service,
 	wl workload.Workload,
 	resourceName string,
-	resourceType reload.ResourceType,
+	resourceType matcher.ResourceType,
 	namespace string,
 	hash string,
 	autoReload bool,

internal/pkg/controller/retry_test.go

@@ -13,11 +13,12 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
@@ -25,7 +26,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 		name         string
 		object       runtime.Object
 		workload     func(runtime.Object) workload.Workload
-		resourceType reload.ResourceType
+		resourceType matcher.ResourceType
 		verify       func(t *testing.T, c client.Client)
 	}{
 		{
@@ -34,7 +35,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 			workload: func(o runtime.Object) workload.Workload {
 				return workload.NewDeploymentWorkload(o.(*appsv1.Deployment))
 			},
-			resourceType: reload.ResourceTypeConfigMap,
+			resourceType: matcher.ResourceTypeConfigMap,
 			verify: func(t *testing.T, c client.Client) {
 				var result appsv1.Deployment
 				if err := c.Get(context.Background(), types.NamespacedName{Name: "test-deployment", Namespace: "default"}, &result); err != nil {
@@ -51,7 +52,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 			workload: func(o runtime.Object) workload.Workload {
 				return workload.NewDaemonSetWorkload(o.(*appsv1.DaemonSet))
 			},
-			resourceType: reload.ResourceTypeSecret,
+			resourceType: matcher.ResourceTypeSecret,
 			verify: func(t *testing.T, c client.Client) {
 				var result appsv1.DaemonSet
 				if err := c.Get(context.Background(), types.NamespacedName{Name: "test-daemonset", Namespace: "default"}, &result); err != nil {
@@ -68,7 +69,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 			workload: func(o runtime.Object) workload.Workload {
 				return workload.NewStatefulSetWorkload(o.(*appsv1.StatefulSet))
 			},
-			resourceType: reload.ResourceTypeConfigMap,
+			resourceType: matcher.ResourceTypeConfigMap,
 			verify: func(t *testing.T, c client.Client) {
 				var result appsv1.StatefulSet
 				if err := c.Get(context.Background(), types.NamespacedName{Name: "test-statefulset", Namespace: "default"}, &result); err != nil {
@@ -85,7 +86,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 			workload: func(o runtime.Object) workload.Workload {
 				return workload.NewJobWorkload(o.(*batchv1.Job))
 			},
-			resourceType: reload.ResourceTypeConfigMap,
+			resourceType: matcher.ResourceTypeConfigMap,
 			verify: func(t *testing.T, c client.Client) {
 				var jobs batchv1.JobList
 				if err := c.List(context.Background(), &jobs, client.InNamespace("default")); err != nil {
@@ -102,7 +103,7 @@ func TestUpdateWorkloadWithRetry_WorkloadTypes(t *testing.T) {
 			workload: func(o runtime.Object) workload.Workload {
 				return workload.NewCronJobWorkload(o.(*batchv1.CronJob))
 			},
-			resourceType: reload.ResourceTypeSecret,
+			resourceType: matcher.ResourceTypeSecret,
 			verify: func(t *testing.T, c client.Client) {
 				var jobs batchv1.JobList
 				if err := c.List(context.Background(), &jobs, client.InNamespace("default")); err != nil {
@@ -220,7 +221,7 @@ func TestUpdateWorkloadWithRetry_Strategies(t *testing.T) {
 					nil, // no pause handler for this test
 					wl,
 					"test-cm",
-					reload.ResourceTypeConfigMap,
+					matcher.ResourceTypeConfigMap,
 					"default",
 					"abc123",
 					false,
@@ -272,7 +273,7 @@ func TestUpdateWorkloadWithRetry_NoUpdate(t *testing.T) {
 		nil, // no pause handler
 		wl,
 		"test-cm",
-		reload.ResourceTypeConfigMap,
+		matcher.ResourceTypeConfigMap,
 		"default",
 		"abc123", // Same hash as already set
 		false,
@@ -288,11 +289,11 @@ func TestUpdateWorkloadWithRetry_NoUpdate(t *testing.T) {
 
 func TestResourceTypeKind(t *testing.T) {
 	tests := []struct {
-		resourceType reload.ResourceType
+		resourceType matcher.ResourceType
 		expectedKind string
 	}{
-		{reload.ResourceTypeConfigMap, "ConfigMap"},
-		{reload.ResourceTypeSecret, "Secret"},
+		{matcher.ResourceTypeConfigMap, "ConfigMap"},
+		{matcher.ResourceTypeSecret, "Secret"},
 	}
 
 	for _, tt := range tests {
@@ -332,7 +333,7 @@ func TestUpdateWorkloadWithRetry_PauseDeployment(t *testing.T) {
 		pauseHandler,
 		wl,
 		"test-cm",
-		reload.ResourceTypeConfigMap,
+		matcher.ResourceTypeConfigMap,
 		"default",
 		"abc123",
 		true,
@@ -393,7 +394,7 @@ func TestUpdateWorkloadWithRetry_PauseWithExplicitAnnotation(t *testing.T) {
 		pauseHandler,
 		wl,
 		"test-cm",
-		reload.ResourceTypeConfigMap,
+		matcher.ResourceTypeConfigMap,
 		"default",
 		"abc123",
 		false, // NOT auto reload
@@ -454,7 +455,7 @@ func TestUpdateWorkloadWithRetry_PauseWithSecretReload(t *testing.T) {
 		pauseHandler,
 		wl,
 		"test-secret",
-		reload.ResourceTypeSecret,
+		matcher.ResourceTypeSecret,
 		"default",
 		"abc123",
 		false,
@@ -511,7 +512,7 @@ func TestUpdateWorkloadWithRetry_PauseWithAutoSecret(t *testing.T) {
 		pauseHandler,
 		wl,
 		"test-secret",
-		reload.ResourceTypeSecret,
+		matcher.ResourceTypeSecret,
 		"default",
 		"abc123",
 		true,
@@ -561,7 +562,7 @@ func TestUpdateWorkloadWithRetry_NoPauseWithoutAnnotation(t *testing.T) {
 		pauseHandler,
 		wl,
 		"test-cm",
-		reload.ResourceTypeConfigMap,
+		matcher.ResourceTypeConfigMap,
 		"default",
 		"abc123",
 		true,

internal/pkg/controller/secret_reconciler.go

@@ -9,12 +9,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // SecretReconciler watches Secrets and triggers workload reloads.
@@ -49,7 +50,7 @@ func NewSecretReconciler(
 			NamespaceCache: nsCache,
 		},
 		ResourceConfig[*corev1.Secret]{
-			ResourceType: reload.ResourceTypeSecret,
+			ResourceType: matcher.ResourceTypeSecret,
 			NewResource:  func() *corev1.Secret { return &corev1.Secret{} },
 			CreateChange: func(s *corev1.Secret, eventType reload.EventType) reload.ResourceChange {
 				return reload.SecretChange{Secret: s, EventType: eventType}

internal/pkg/controller/secret_reconciler_test.go

@@ -3,8 +3,8 @@ package controller_test
 import (
 	"testing"
 
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 func TestSecretReconciler_NotFound(t *testing.T) {

internal/pkg/controller/secretproviderclass_filter_test.go

@@ -8,8 +8,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/event"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/pkg/config"
-	"github.com/stakater/Reloader/pkg/reload"
 )
 
 // TestSecretProviderClassReconciler_FilterIgnoresResourceLabelSelector pins the

internal/pkg/controller/secretproviderclass_reconciler.go

@@ -12,8 +12,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/pkg/config"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/pkg/matcher"
 )
 
 // SecretProviderClassReconciler watches SecretProviderClassPodStatus (the per-pod
@@ -28,7 +29,7 @@ func NewSecretProviderClassReconciler(deps ResourceReconcilerDeps, apiReader cli
 	return NewResourceReconciler(
 		deps,
 		ResourceConfig[*csiv1.SecretProviderClassPodStatus]{
-			ResourceType:   reload.ResourceTypeSecretProviderClass,
+			ResourceType:   matcher.ResourceTypeSecretProviderClass,
 			NewResource:    func() *csiv1.SecretProviderClassPodStatus { return &csiv1.SecretProviderClassPodStatus{} },
 			ResolveChange:  resolveSecretProviderClassChange,
 			SkipOnNotFound: true,

internal/pkg/controller/secretproviderclass_reconciler_test.go

@@ -10,10 +10,10 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	csiv1 "sigs.k8s.io/secrets-store-csi-driver/apis/v1"
 
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // newSecretProviderClassReconcilerWithClient creates a SecretProviderClassReconciler for

internal/pkg/controller/test_helpers_test.go

@@ -13,14 +13,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
 	"github.com/stakater/Reloader/internal/pkg/alerting"
-	"github.com/stakater/Reloader/pkg/config"
 	"github.com/stakater/Reloader/internal/pkg/controller"
 	"github.com/stakater/Reloader/internal/pkg/events"
 	"github.com/stakater/Reloader/internal/pkg/metrics"
-	"github.com/stakater/Reloader/pkg/reload"
+	"github.com/stakater/Reloader/internal/pkg/reload"
 	"github.com/stakater/Reloader/internal/pkg/testutil"
 	"github.com/stakater/Reloader/internal/pkg/webhook"
 	"github.com/stakater/Reloader/internal/pkg/workload"
+	"github.com/stakater/Reloader/pkg/config"
 )
 
 // testDeps holds shared test dependencies.