diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 00000000..5345aab5
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,21 @@
+# Validate this file:
+#   curl --data-binary @.codecov.yml https://codecov.io/validate
+
+comment:
+  behavior: default
+
+coverage:
+  precision: 2
+  round: down
+  range: "50...70"
+  status:
+    project:
+      default:
+        threshold: 1.0
+    patch:
+      default:
+        threshold: 1.0
+
+ignore:
+- ".github"
+- "hack"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2dac9e8b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml
new file mode 100644
index 00000000..9640b59f
--- /dev/null
+++ b/.github/workflows/gosec.yml
@@ -0,0 +1,26 @@
+name: Gosec
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "45 11 * * 0"
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    env:
+      GO111MODULE: on
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Read Go version
+      id: go_version
+      run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+    - name: Install Go (${{ steps.go_version.outputs.go_version }})
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ steps.go_version.outputs.go_version }}
+        cache: true
+    - name: Run Gosec Security Scanner
+      run: make gosec
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..d39d18ef
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,65 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+name: Lint
+jobs:
+  golangci-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Read Go version
+        id: go_version
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+      - name: Get date
+        id: get-date
+        shell: bash
+        run: |
+          echo "::set-output name=date::$(date -u "+%Y-%m")"
+      - name: Restore golangci-lint cache
+        uses: actions/cache@v4
+        timeout-minutes: 10
+        continue-on-error: true
+        with:
+          path: ${{ runner.temp }}/golangci-lint-cache
+          key: ${{ runner.os }}-golangci-lint-cache-${{ steps.get-date.outputs.date }}
+          restore-keys: |
+            ${{ runner.os }}-golangci-lint-cache-
+      - name: Run golangci-lint
+        run: make lint
+        env:
+          GOLANGCI_LINT_CACHE: ${{ runner.temp }}/golangci-lint-cache
+  golines:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Read Go version
+        id: go_version
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+      - name: Run golines
+        run: make golines
+  shfmt:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Read Go version
+        id: go_version
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+      - name: Run shfmt
+        run: make shfmt
diff --git a/.github/workflows/mod.yml b/.github/workflows/mod.yml
new file mode 100644
index 00000000..80210f32
--- /dev/null
+++ b/.github/workflows/mod.yml
@@ -0,0 +1,43 @@
+on:
+  pull_request:
+  push:
+    branches:
+    - main
+name: Mod
+jobs:
+  mod:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Read Go version
+      id: go_version
+      run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+    - name: Install Go (${{ steps.go_version.outputs.go_version }})
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ steps.go_version.outputs.go_version }}
+    - name: Check go.mod
+      run: |
+        go mod download
+        go mod tidy
+        if [ ! -z "$(git status --porcelain go.mod)" ]; then
+          printf "go.mod has modifications\n"
+          git diff go.mod
+          exit 1
+        fi
+        if [ ! -z "$(git status --porcelain go.sum)" ]; then
+          printf "go.sum has modifications\n"
+          git diff go.sum
+          exit 1
+        fi
+        if [ ! -z "$(git status --porcelain go.work)" ]; then
+          printf "go.work has modifications\n"
+          git diff go.work
+          exit 1
+        fi
+        if [ ! -z "$(git status --porcelain go.work.sum)" ]; then
+          printf "go.work.sum has modifications\n"
+          git diff go.work.sum
+          exit 1
+        fi
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
new file mode 100644
index 00000000..f4fec8f8
--- /dev/null
+++ b/.github/workflows/nightly.yml
@@ -0,0 +1,26 @@
+name: Nightly
+
+on:
+  workflow_dispatch: {}
+  schedule:
+    # Daily, at 1pm UTC / 6am PST.
+    - cron: "0 13 * * *"
+
+jobs:
+  govulncheck:
+    name: Go vulnerability check
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Read Go version
+        id: go_version
+        run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: Execute govulncheck
+        run: govulncheck ./...
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 00000000..1aa6ab7b
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,45 @@
+on:
+  pull_request:
+  push:
+    branches:
+    - main
+name: Test
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Read Go version
+      id: go_version
+      run: echo "go_version=$(cat .go-version)" >> $GITHUB_OUTPUT
+    - name: Install Go (${{ steps.go_version.outputs.go_version }})
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ steps.go_version.outputs.go_version }}
+        cache: true
+    - name: Test
+      run: make test-ci
+    - name: Determine skip-codecov
+      uses: actions/github-script@v7
+      id: skip-codecov
+      with:
+        script: |
+          // Sets `ref` to the SHA of the current pull request's head commit,
+          // or, if not present, to the SHA of the commit that triggered the
+          // event.
+          const ref = '${{ github.event.pull_request.head.sha || github.event.after }}';
+          const { repo, owner } = context.repo;
+          const { data: commit } = await github.rest.repos.getCommit({ owner, repo, ref });
+          const commitMessage = commit.commit.message;
+          const skip = commitMessage.includes("[skip codecov]") || commitMessage.includes("[skip-codecov]");
+          core.setOutput("skip", skip);
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      if: ${{ steps.skip-codecov.outputs.skip != 'true' }}
+      with:
+        file: covreport
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/tilt-ci.yml b/.github/workflows/tilt-ci.yml
new file mode 100644
index 00000000..b9794d5a
--- /dev/null
+++ b/.github/workflows/tilt-ci.yml
@@ -0,0 +1,28 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+name: Tilt CI
+jobs:
+  tilt-ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Create k8s cluster
+        uses: AbsaOSS/k3d-action@v2.4.0
+        with:
+          cluster-name: preprocessing-ci
+          args: >-
+            --registry-create preprocessing-ci-registry
+            --no-lb
+            --k3s-arg "--no-deploy=traefik,servicelb,metrics-server@server:*"
+      - name: Install Tilt
+        uses: yokawasa/action-setup-kube-tools@v0.9.3
+        with:
+          setup-tools: |
+            tilt
+          tilt: v0.30.2
+      - name: Check tilt ci
+        run: timeout 600 tilt ci
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 00000000..93c68e6c
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,49 @@
+run:
+  deadline: 60s
+  skip-dirs:
+    - .github
+    - hack
+
+linters:
+  enable:
+    - gci
+    - gofumpt
+    - gosec
+    - importas
+    - misspell
+    - unparam
+
+issues:
+  exclude-rules:
+    - path: _test\.go
+      linters:
+        - errcheck
+
+linters-settings:
+  gci:
+    no-inline-comments: true
+    no-prefix-comments: false
+    sections:
+      - standard
+      - default
+      - prefix(github.com/artefactual-sdps/preprocessing-sfa)
+    section-separators:
+      - newLine
+  gofumpt:
+    extra-rules: true
+  importas:
+    no-unaliased: true
+    no-extra-aliases: false
+    alias:
+      - pkg: go.temporal.io/sdk/contrib/(\w+)
+        alias: temporalsdk_contrib_$1
+      - pkg: go.temporal.io/sdk/(\w+)
+        alias: temporalsdk_$1
+      - pkg: go.temporal.io/api/(\w+)
+        alias: temporalapi_$1
+  gosec:
+    exclude-generated: false
+    severity: low
+    confidence: low
+    excludes:
+      - G601 # Implicit memory aliasing of items (only for Go 1.21 or lower)
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..119f7519
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,138 @@
+PROJECT := preprocessing-sfa
+MAKEDIR := hack/make
+SHELL   := /bin/bash
+
+.DEFAULT_GOAL := help
+.PHONY: *
+
+DBG_MAKEFILE ?=
+ifeq ($(DBG_MAKEFILE),1)
+    $(warning ***** starting Makefile for goal(s) "$(MAKECMDGOALS)")
+    $(warning ***** $(shell date))
+else
+    # If we're not debugging the Makefile, don't echo recipes.
+    MAKEFLAGS += -s
+endif
+
+include hack/make/bootstrap.mk
+include hack/make/dep_golangci_lint.mk
+include hack/make/dep_golines.mk
+include hack/make/dep_gomajor.mk
+include hack/make/dep_gosec.mk
+include hack/make/dep_gotestsum.mk
+include hack/make/dep_shfmt.mk
+include hack/make/dep_tparse.mk
+
+# Lazy-evaluated list of tools.
+TOOLS = $(GOLANGCI_LINT) \
+	$(GOMAJOR) \
+	$(GOSEC) \
+	$(GOTESTSUM) \
+	$(SHFMT) \
+	$(TPARSE)
+
+define NEWLINE
+
+
+endef
+
+IGNORED_PACKAGES := \
+	github.com/artefactual-sdps/preprocessing-sfa/hack/%
+PACKAGES := $(shell go list ./...)
+TEST_PACKAGES := $(filter-out $(IGNORED_PACKAGES),$(PACKAGES))
+TEST_IGNORED_PACKAGES := $(filter $(IGNORED_PACKAGES),$(PACKAGES))
+
+export PATH:=$(GOBIN):$(PATH)
+
+env: # @HELP Print Go env variables.
+env:
+	go env
+
+deps: # @HELP List available module dependency updates.
+deps: $(GOMAJOR)
+	gomajor list
+
+golines: # @HELP Run the golines formatter to fix long lines.
+golines: $(GOLINES)
+	golines \
+		--chain-split-dots \
+		--ignored-dirs="$(TEST_IGNORED_PACKAGES)" \
+		--max-len=120 \
+		--reformat-tags \
+		--shorten-comments \
+		--write-output \
+		.
+
+gosec: # @HELP Run gosec security scanner.
+gosec: $(GOSEC)
+	gosec \
+		-exclude-dir=hack \
+		./...
+
+help: # @HELP Print this message.
+help:
+	echo "TARGETS:"
+	grep -E '^.*: *# *@HELP' Makefile             \
+	    | awk '                                   \
+	        BEGIN {FS = ": *# *@HELP"};           \
+	        { printf "  %-30s %s\n", $$1, $$2 };  \
+	    '
+
+lint: # @HELP Lint the project Go files with golangci-lint.
+lint: OUT_FORMAT ?= colored-line-number
+lint: LINT_FLAGS ?= --timeout=5m --fix
+lint: $(GOLANGCI_LINT)
+	golangci-lint run --out-format $(OUT_FORMAT) $(LINT_FLAGS)
+
+list-tested-packages: # @HELP Print a list of packages being tested.
+list-tested-packages:
+	$(foreach PACKAGE,$(TEST_PACKAGES),@echo $(PACKAGE)$(NEWLINE))
+
+list-ignored-packages: # @HELP Print a list of packages ignored in testing.
+list-ignored-packages:
+	$(foreach PACKAGE,$(TEST_IGNORED_PACKAGES),@echo $(PACKAGE)$(NEWLINE))
+
+pre-commit: # @HELP Check that code is ready to commit.
+pre-commit:
+	ENDURO_PP_INTEGRATION_TEST=1 $(MAKE) -j \
+	golines \
+	gosec \
+	lint \
+	shfmt \
+	test-race
+
+shfmt: SHELL_PROGRAMS := $(shell find $(CURDIR)/hack -name *.sh)
+shfmt: $(SHFMT) # @HELP Run shfmt to format shell programs in the hack directory.
+	shfmt \
+		--list \
+		--write \
+		--diff \
+		--simplify \
+		--language-dialect=posix \
+		--indent=0 \
+		--case-indent \
+		--space-redirects \
+		--func-next-line \
+			$(SHELL_PROGRAMS)
+
+test: # @HELP Run all tests and output a summary using gotestsum.
+test: TFORMAT ?= short
+test: GOTEST_FLAGS ?=
+test: COMBINED_FLAGS ?= $(GOTEST_FLAGS) $(TEST_PACKAGES)
+test: $(GOTESTSUM)
+	gotestsum --format=$(TFORMAT) -- $(COMBINED_FLAGS)
+
+test-ci: # @HELP Run all tests in CI with coverage and the race detector.
+test-ci:
+	ENDURO_PP_INTEGRATION_TEST=1 $(MAKE) test GOTEST_FLAGS="-race -coverprofile=covreport -covermode=atomic"
+
+test-race: # @HELP Run all tests with the race detector.
+test-race:
+	$(MAKE) test GOTEST_FLAGS="-race"
+
+test-tparse: # @HELP Run all tests and output a coverage report using tparse.
+test-tparse: $(TPARSE)
+	go test -count=1 -json -cover $(TEST_PACKAGES) | tparse -follow -all -notests
+
+tools: # @HELP Install tools.
+tools: $(TOOLS)
diff --git a/README.md b/README.md
new file mode 100644
index 00000000..9ef15336
--- /dev/null
+++ b/README.md
@@ -0,0 +1,3 @@
+# preprocessing-sfa
+
+**preprocessing-sfa** is an Enduro preprocessing workflow for SFA SIPs.
diff --git a/hack/make/base.mk b/hack/make/base.mk
new file mode 100644
index 00000000..83b937bd
--- /dev/null
+++ b/hack/make/base.mk
@@ -0,0 +1,19 @@
+$(call _assert_var,PROJECT)
+
+UNAME_OS := $(shell uname -s)
+UNAME_OS2 := $(shell echo $(UNAME_OS) | tr A-Z a-z)
+
+UNAME_ARCH := $(shell uname -m)
+UNAME_ARCH2 := $(UNAME_ARCH)
+ifeq ($(UNAME_ARCH),x86_64)
+UNAME_ARCH2 := amd64
+endif
+
+CACHE_BASE ?= $(HOME)/.cache/$(PROJECT)
+CACHE := $(CACHE_BASE)/$(UNAME_OS)/$(UNAME_ARCH)
+CACHE_BIN := $(CACHE)/bin
+CACHE_VERSIONS := $(CACHE)/versions
+CACHE_GOBIN := $(CACHE)/gobin
+CACHE_GOCACHE := $(CACHE)/gocache
+
+export PATH := $(abspath $(CACHE_BIN)):$(PATH)
diff --git a/hack/make/bootstrap.mk b/hack/make/bootstrap.mk
new file mode 100644
index 00000000..4897abf9
--- /dev/null
+++ b/hack/make/bootstrap.mk
@@ -0,0 +1,14 @@
+SHELL := /usr/bin/env bash -o pipefail
+
+MAKEFLAGS += --no-builtin-rules
+MAKEFLAGS += --no-print-directory
+
+define _assert
+	$(if $(1),,$(error Assertion failed: $(2)))
+endef
+define _assert_var
+	$(call _assert,$($(1)),$(1) is not set)
+endef
+define _conditional_include
+	$(if $(filter $(1),$(MAKEFILE_LIST)),,$(eval include $(1)))
+endef
diff --git a/hack/make/dep_golangci_lint.mk b/hack/make/dep_golangci_lint.mk
new file mode 100644
index 00000000..a7a8f3d8
--- /dev/null
+++ b/hack/make/dep_golangci_lint.mk
@@ -0,0 +1,28 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,UNAME_OS)
+$(call _assert_var,UNAME_ARCH)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+GOLANGCI_LINT_VERSION ?= 1.56.0
+
+ARCH := $(UNAME_ARCH)
+ifeq ($(UNAME_ARCH),x86_64)
+ARCH := amd64
+endif
+
+GOLANGCI_LINT := $(CACHE_VERSIONS)/golangci-lint/$(GOLANGCI_LINT_VERSION)
+$(GOLANGCI_LINT):
+	rm -f $(CACHE_BIN)/golangci-lint
+	mkdir -p $(CACHE_BIN)
+	$(eval TMP := $(shell mktemp -d))
+	$(eval OS := $(shell echo $(UNAME_OS) | tr A-Z a-z))
+	curl -sSL \
+		https://github.com/golangci/golangci-lint/releases/download/v$(GOLANGCI_LINT_VERSION)/golangci-lint-$(GOLANGCI_LINT_VERSION)-$(OS)-$(ARCH).tar.gz \
+		| tar xz --strip-components=1 -C $(TMP)
+	mv $(TMP)/golangci-lint $(CACHE_BIN)/
+	chmod +x $(CACHE_BIN)/golangci-lint
+	rm -rf $(dir $(GOLANGCI_LINT))
+	mkdir -p $(dir $(GOLANGCI_LINT))
+	touch $(GOLANGCI_LINT)
diff --git a/hack/make/dep_golines.mk b/hack/make/dep_golines.mk
new file mode 100644
index 00000000..4793e51d
--- /dev/null
+++ b/hack/make/dep_golines.mk
@@ -0,0 +1,16 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+GOLINES_VERSION ?= 0.12.2
+
+GOLINES := $(CACHE_VERSIONS)/golines/$(GOLINES_VERSION)
+$(GOLINES):
+	rm -f $(CACHE_BIN)/golines
+	mkdir -p $(CACHE_BIN)
+	env GOBIN=$(CACHE_BIN) go install github.com/segmentio/golines@v$(GOLINES_VERSION)
+	chmod +x $(CACHE_BIN)/golines
+	rm -rf $(dir $(GOLINES))
+	mkdir -p $(dir $(GOLINES))
+	touch $(GOLINES)
diff --git a/hack/make/dep_gomajor.mk b/hack/make/dep_gomajor.mk
new file mode 100644
index 00000000..813fc923
--- /dev/null
+++ b/hack/make/dep_gomajor.mk
@@ -0,0 +1,16 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+GOMAJOR_VERSION ?= 0.9.5
+
+GOMAJOR := $(CACHE_VERSIONS)/gomajor/$(GOMAJOR_VERSION)
+$(GOMAJOR):
+	rm -f $(CACHE_BIN)/gomajor
+	mkdir -p $(CACHE_BIN)
+	env GOBIN=$(CACHE_BIN) go install github.com/icholy/gomajor@v$(GOMAJOR_VERSION)
+	chmod +x $(CACHE_BIN)/gomajor
+	rm -rf $(dir $(GOMAJOR))
+	mkdir -p $(dir $(GOMAJOR))
+	touch $(GOMAJOR)
diff --git a/hack/make/dep_gosec.mk b/hack/make/dep_gosec.mk
new file mode 100644
index 00000000..b1137e22
--- /dev/null
+++ b/hack/make/dep_gosec.mk
@@ -0,0 +1,15 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+GOSEC := $(CACHE_VERSIONS)/gosec/latest
+.PHONY: $(GOSEC) # Ignored cached version, always download the latest.
+$(GOSEC):
+	rm -f $(CACHE_BIN)/gosec
+	mkdir -p $(CACHE_BIN)
+	echo Downloading github.com/securego/gosec/v2/cmd/gosec@latest
+	env GOBIN=$(CACHE_BIN) go install github.com/securego/gosec/v2/cmd/gosec@latest
+	rm -rf $(dir $(GOSEC))
+	mkdir -p $(dir $(GOSEC))
+	touch $(GOSEC)
diff --git a/hack/make/dep_gotestsum.mk b/hack/make/dep_gotestsum.mk
new file mode 100644
index 00000000..5b44a9e8
--- /dev/null
+++ b/hack/make/dep_gotestsum.mk
@@ -0,0 +1,22 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,UNAME_OS2)
+$(call _assert_var,UNAME_ARCH2)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+GOTESTSUM_VERSION ?= 1.11.0
+
+GOTESTSUM := $(CACHE_VERSIONS)/gotestsum/$(GOTESTSUM_VERSION)
+$(GOTESTSUM):
+	rm -f $(CACHE_BIN)/gotestsum
+	mkdir -p $(CACHE_BIN)
+	$(eval TMP := $(shell mktemp -d))
+	curl -sSL \
+		https://github.com/gotestyourself/gotestsum/releases/download/v$(GOTESTSUM_VERSION)/gotestsum_$(GOTESTSUM_VERSION)_$(UNAME_OS2)_$(UNAME_ARCH2).tar.gz \
+		| tar xz -C $(TMP)
+	mv $(TMP)/gotestsum $(CACHE_BIN)/
+	chmod +x $(CACHE_BIN)/gotestsum
+	rm -rf $(dir $(GOTESTSUM))
+	mkdir -p $(dir $(GOTESTSUM))
+	touch $(GOTESTSUM)
diff --git a/hack/make/dep_shfmt.mk b/hack/make/dep_shfmt.mk
new file mode 100644
index 00000000..ec5a3431
--- /dev/null
+++ b/hack/make/dep_shfmt.mk
@@ -0,0 +1,18 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,UNAME_OS2)
+$(call _assert_var,UNAME_ARCH2)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+SHFMT_VERSION ?= 3.7.0
+
+SHFMT := $(CACHE_VERSIONS)/shfmt/$(SHFMT_VERSION)
+$(SHFMT):
+	rm -f $(CACHE_BIN)/shfmt
+	mkdir -p $(CACHE_BIN)
+	curl -sSL https://github.com/mvdan/sh/releases/download/v$(SHFMT_VERSION)/shfmt_v$(SHFMT_VERSION)_$(UNAME_OS2)_$(UNAME_ARCH2) > $(CACHE_BIN)/shfmt
+	chmod +x $(CACHE_BIN)/shfmt
+	rm -rf $(dir $(SHFMT))
+	mkdir -p $(dir $(SHFMT))
+	touch $(SHFMT)
diff --git a/hack/make/dep_tparse.mk b/hack/make/dep_tparse.mk
new file mode 100644
index 00000000..7f2fc2c2
--- /dev/null
+++ b/hack/make/dep_tparse.mk
@@ -0,0 +1,19 @@
+$(call _assert_var,MAKEDIR)
+$(call _conditional_include,$(MAKEDIR)/base.mk)
+$(call _assert_var,UNAME_OS2)
+$(call _assert_var,UNAME_ARCH)
+$(call _assert_var,CACHE_VERSIONS)
+$(call _assert_var,CACHE_BIN)
+
+TPARSE_VERSION ?= 0.13.1
+
+TPARSE := $(CACHE_VERSIONS)/tparse/$(TPARSE_VERSION)
+$(TPARSE):
+	rm -f $(CACHE_BIN)/tparse
+	mkdir -p $(CACHE_BIN)
+	$(eval TMP := $(shell mktemp -d))
+	curl -sSL https://github.com/mfridman/tparse/releases/download/v$(TPARSE_VERSION)/tparse_$(UNAME_OS2)_$(UNAME_ARCH) > $(CACHE_BIN)/tparse
+	chmod +x $(CACHE_BIN)/tparse
+	rm -rf $(dir $(TPARSE))
+	mkdir -p $(dir $(TPARSE))
+	touch $(TPARSE)