up

ops/devops/README.md

@@ -0,0 +1,41 @@
+# DevOps Release Automation
+
+The **release** workflow builds and signs the StellaOps service containers,
+generates SBOM + provenance attestations, and emits a canonical
+`release.yaml`. The logic lives under `ops/devops/release/` and is invoked
+by the new `.gitea/workflows/release.yml` pipeline.
+
+## Local dry run
+
+```bash
+./ops/devops/release/build_release.py \
+  --version 2025.10.0-edge \
+  --channel edge \
+  --dry-run
+```
+
+Outputs land under `out/release/`. Use `--no-push` to run full builds without
+pushing to the registry.
+
+## Required tooling
+
+- Docker 25+ with Buildx
+- .NET 10 preview SDK (builds container stages and the SBOM generator)
+- Node.js 20 (Angular UI build)
+- Helm 3.16+
+- Cosign 2.2+
+
+Supply signing material via environment variables:
+
+- `COSIGN_KEY_REF` – e.g. `file:./keys/cosign.key` or `azurekms://…`
+- `COSIGN_PASSWORD` – password protecting the above key
+
+The workflow defaults to multi-arch (`linux/amd64,linux/arm64`), SBOM in
+CycloneDX, and SLSA provenance (`https://slsa.dev/provenance/v1`).
+
+## UI auth smoke (Playwright)
+
+As part of **DEVOPS-UI-13-006** the pipelines will execute the UI auth smoke
+tests (`npm run test:e2e`) after building the Angular bundle. See
+`docs/ops/ui-auth-smoke.md` for the job design, environment stubs, and
+offline runner considerations.