Implement ledger metrics for observability and add tests for Ruby packages endpoints

- Added `LedgerMetrics` class to record write latency and total events for ledger operations.
- Created comprehensive tests for Ruby packages endpoints, covering scenarios for missing inventory, successful retrieval, and identifier handling.
- Introduced `TestSurfaceSecretsScope` for managing environment variables during tests.
- Developed `ProvenanceMongoExtensions` for attaching DSSE provenance and trust information to event documents.
- Implemented `EventProvenanceWriter` and `EventWriter` classes for managing event provenance in MongoDB.
- Established MongoDB indexes for efficient querying of events based on provenance and trust.
- Added models and JSON parsing logic for DSSE provenance and trust information.

src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/AdvisoryMergeService.cs

@@ -6,13 +6,14 @@ using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
-using StellaOps.Concelier.Core;
-using StellaOps.Concelier.Core.Events;
-using StellaOps.Concelier.Models;
-using StellaOps.Concelier.Storage.Mongo.Advisories;
-using StellaOps.Concelier.Storage.Mongo.Aliases;
-using StellaOps.Concelier.Storage.Mongo.MergeEvents;
-using System.Text.Json;
+using StellaOps.Concelier.Core;
+using StellaOps.Concelier.Core.Events;
+using StellaOps.Concelier.Models;
+using StellaOps.Concelier.Storage.Mongo.Advisories;
+using StellaOps.Concelier.Storage.Mongo.Aliases;
+using StellaOps.Concelier.Storage.Mongo.MergeEvents;
+using System.Text.Json;
+using StellaOps.Provenance.Mongo;
 
 namespace StellaOps.Concelier.Merge.Services;
 
@@ -139,39 +140,45 @@ public sealed class AdvisoryMergeService
         return new AdvisoryMergeResult(seedAdvisoryKey, canonicalKey, component, inputs, before, merged, conflictSummaries);
     }
 
-    private async Task<IReadOnlyList<MergeConflictSummary>> AppendEventLogAsync(
-        string vulnerabilityKey,
-        IReadOnlyList<Advisory> inputs,
-        Advisory merged,
-        IReadOnlyList<MergeConflictDetail> conflicts,
-        CancellationToken cancellationToken)
+    private async Task<IReadOnlyList<MergeConflictSummary>> AppendEventLogAsync(
+        string vulnerabilityKey,
+        IReadOnlyList<Advisory> inputs,
+        Advisory merged,
+        IReadOnlyList<MergeConflictDetail> conflicts,
+        CancellationToken cancellationToken)
     {
         var recordedAt = _timeProvider.GetUtcNow();
         var statements = new List<AdvisoryStatementInput>(inputs.Count + 1);
         var statementIds = new Dictionary<Advisory, Guid>(ReferenceEqualityComparer.Instance);
 
-        foreach (var advisory in inputs)
-        {
-            var statementId = Guid.NewGuid();
-            statementIds[advisory] = statementId;
-            statements.Add(new AdvisoryStatementInput(
-                vulnerabilityKey,
-                advisory,
-                DetermineAsOf(advisory, recordedAt),
-                InputDocumentIds: Array.Empty<Guid>(),
-                StatementId: statementId,
-                AdvisoryKey: advisory.AdvisoryKey));
-        }
-
-        var canonicalStatementId = Guid.NewGuid();
-        statementIds[merged] = canonicalStatementId;
-        statements.Add(new AdvisoryStatementInput(
-            vulnerabilityKey,
-            merged,
-            recordedAt,
-            InputDocumentIds: Array.Empty<Guid>(),
-            StatementId: canonicalStatementId,
-            AdvisoryKey: merged.AdvisoryKey));
+        foreach (var advisory in inputs)
+        {
+            var statementId = Guid.NewGuid();
+            statementIds[advisory] = statementId;
+            var (provenance, trust) = ResolveDsseMetadata(advisory);
+            statements.Add(new AdvisoryStatementInput(
+                vulnerabilityKey,
+                advisory,
+                DetermineAsOf(advisory, recordedAt),
+                InputDocumentIds: Array.Empty<Guid>(),
+                StatementId: statementId,
+                AdvisoryKey: advisory.AdvisoryKey,
+                Provenance: provenance,
+                Trust: trust));
+        }
+
+        var canonicalStatementId = Guid.NewGuid();
+        statementIds[merged] = canonicalStatementId;
+        var (canonicalProvenance, canonicalTrust) = ResolveDsseMetadata(merged);
+        statements.Add(new AdvisoryStatementInput(
+            vulnerabilityKey,
+            merged,
+            recordedAt,
+            InputDocumentIds: Array.Empty<Guid>(),
+            StatementId: canonicalStatementId,
+            AdvisoryKey: merged.AdvisoryKey,
+            Provenance: canonicalProvenance,
+            Trust: canonicalTrust));
 
         var conflictMaterialization = BuildConflictInputs(conflicts, vulnerabilityKey, statementIds, canonicalStatementId, recordedAt);
         var conflictInputs = conflictMaterialization.Inputs;
@@ -198,15 +205,22 @@ public sealed class AdvisoryMergeService
             }
         }
 
-        return conflictSummaries.Count == 0
-            ? Array.Empty<MergeConflictSummary>()
-            : conflictSummaries.ToArray();
-    }
-
-    private static DateTimeOffset DetermineAsOf(Advisory advisory, DateTimeOffset fallback)
-    {
-        return (advisory.Modified ?? advisory.Published ?? fallback).ToUniversalTime();
-    }
+        return conflictSummaries.Count == 0
+            ? Array.Empty<MergeConflictSummary>()
+            : conflictSummaries.ToArray();
+    }
+
+    private static (DsseProvenance?, TrustInfo?) ResolveDsseMetadata(Advisory advisory)
+    {
+        return AdvisoryDsseMetadataResolver.TryResolve(advisory, out var dsse, out var trust)
+            ? (dsse, trust)
+            : (null, null);
+    }
+
+    private static DateTimeOffset DetermineAsOf(Advisory advisory, DateTimeOffset fallback)
+    {
+        return (advisory.Modified ?? advisory.Published ?? fallback).ToUniversalTime();
+    }
 
     private static ConflictMaterialization BuildConflictInputs(
         IReadOnlyList<MergeConflictDetail> conflicts,