up

.gitea/workflows/aoc-guard.yml

@@ -32,6 +32,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Set up .NET SDK
         uses: actions/setup-dotnet@v4
         with:
@@ -75,6 +78,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Set up .NET SDK
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/build-test-deploy.yml

@@ -84,6 +84,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Verify binary layout
         run: scripts/verify-binaries.sh
 

.gitea/workflows/docs.yml

@@ -29,6 +29,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.gitea/workflows/evidence-locker.yml

@@ -0,0 +1,27 @@
+name: evidence-locker
+on:
+  workflow_dispatch:
+    inputs:
+      retention_target:
+        description: "Retention days target"
+        required: false
+        default: "180"
+
+jobs:
+  check-evidence-locker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Emit retention summary
+        env:
+          RETENTION_TARGET: ${{ github.event.inputs.retention_target }}
+        run: |
+          echo "target_retention_days=${RETENTION_TARGET}" > out/evidence-locker/summary.txt
+
+      - name: Upload evidence locker summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: evidence-locker
+          path: out/evidence-locker/**

.gitea/workflows/export-ci.yml

@@ -31,6 +31,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
       - name: Set up .NET SDK
         uses: actions/setup-dotnet@v4
         with:

.gitea/workflows/obs-slo.yml

@@ -0,0 +1,28 @@
+name: obs-slo
+on:
+  workflow_dispatch:
+    inputs:
+      prom_url:
+        description: "Prometheus base URL"
+        required: true
+        default: "http://localhost:9090"
+
+jobs:
+  slo-eval:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run SLO evaluator
+        env:
+          PROM_URL: ${{ github.event.inputs.prom_url }}
+        run: |
+          chmod +x scripts/observability/slo-evaluator.sh
+          scripts/observability/slo-evaluator.sh
+
+      - name: Upload SLO results
+        uses: actions/upload-artifact@v4
+        with:
+          name: obs-slo
+          path: out/obs-slo/**

.gitea/workflows/obs-stream.yml

@@ -0,0 +1,34 @@
+name: obs-stream
+on:
+  workflow_dispatch:
+    inputs:
+      nats_url:
+        description: "NATS server URL"
+        required: false
+        default: "nats://localhost:4222"
+
+jobs:
+  stream-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install nats CLI
+        run: |
+          curl -sSL https://github.com/nats-io/natscli/releases/download/v0.1.4/nats-0.1.4-linux-amd64.tar.gz -o /tmp/natscli.tgz
+          tar -C /tmp -xzf /tmp/natscli.tgz
+          sudo mv /tmp/nats /usr/local/bin/nats
+
+      - name: Validate streaming knobs
+        env:
+          NATS_URL: ${{ github.event.inputs.nats_url }}
+        run: |
+          chmod +x scripts/observability/streaming-validate.sh
+          scripts/observability/streaming-validate.sh
+
+      - name: Upload stream validation
+        uses: actions/upload-artifact@v4
+        with:
+          name: obs-stream
+          path: out/obs-stream/**

.gitea/workflows/provenance-check.yml

@@ -0,0 +1,21 @@
+name: provenance-check
+on:
+  workflow_dispatch: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Emit provenance summary
+        run: |
+          mkdir -p out/provenance
+          echo "run_at=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > out/provenance/summary.txt
+
+      - name: Upload provenance summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: provenance-summary
+          path: out/provenance/**

.gitea/workflows/scanner-determinism.yml

@@ -0,0 +1,26 @@
+name: scanner-determinism
+on:
+  workflow_dispatch: {}
+
+jobs:
+  determinism:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.100-rc.2.25502.107"
+
+      - name: Run determinism harness
+        run: |
+          chmod +x scripts/scanner/determinism-run.sh
+          scripts/scanner/determinism-run.sh
+
+      - name: Upload determinism artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: scanner-determinism
+          path: out/scanner-determinism/**

.gitea/workflows/symbols-ci.yml

@@ -0,0 +1,44 @@
+name: Symbols Server CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'ops/devops/symbols/**'
+      - 'scripts/symbols/**'
+      - '.gitea/workflows/symbols-ci.yml'
+  pull_request:
+    branches: [ main, develop ]
+    paths:
+      - 'ops/devops/symbols/**'
+      - 'scripts/symbols/**'
+      - '.gitea/workflows/symbols-ci.yml'
+  workflow_dispatch: {}
+
+jobs:
+  symbols-smoke:
+    runs-on: ubuntu-22.04
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/artifacts/symbols-ci
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Run Symbols.Server smoke
+        run: |
+          set -euo pipefail
+          mkdir -p "$ARTIFACT_DIR"
+          PROJECT_NAME=symbolsci ARTIFACT_DIR="$ARTIFACT_DIR" scripts/symbols/smoke.sh
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: symbols-ci
+          path: ${{ env.ARTIFACT_DIR }}
+          retention-days: 7

.gitea/workflows/symbols-release.yml

@@ -0,0 +1,38 @@
+name: Symbols Release Smoke
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch: {}
+
+jobs:
+  symbols-release-smoke:
+    runs-on: ubuntu-22.04
+    env:
+      ARTIFACT_DIR: ${{ github.workspace }}/artifacts/symbols-release
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Export OpenSSL 1.1 shim for Mongo2Go
+        run: scripts/enable-openssl11-shim.sh
+
+      - name: Run Symbols.Server smoke
+        env:
+          PROJECT_NAME: symbolsrelease
+          ARTIFACT_DIR: ${{ env.ARTIFACT_DIR }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$ARTIFACT_DIR"
+          PROJECT_NAME="${PROJECT_NAME:-symbolsrelease}" ARTIFACT_DIR="$ARTIFACT_DIR" scripts/symbols/smoke.sh
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: symbols-release
+          path: ${{ env.ARTIFACT_DIR }}
+          retention-days: 14