CD/CD consolidation

devops/services/signals-ops/Dockerfile

@@ -0,0 +1,22 @@
+# syntax=docker/dockerfile:1.7
+
+ARG DOTNET_VERSION=10.0
+ARG RUNTIME_IMAGE=mcr.microsoft.com/dotnet/aspnet:${DOTNET_VERSION}-rc-alpine
+ARG SDK_IMAGE=mcr.microsoft.com/dotnet/sdk:${DOTNET_VERSION}-rc-alpine
+
+FROM ${SDK_IMAGE} AS build
+WORKDIR /src
+COPY nuget.config nuget.config
+COPY src/Signals/StellaOps.Signals/StellaOps.Signals.csproj src/Signals/StellaOps.Signals/
+COPY src/Signals/StellaOps.Signals.sln src/Signals/
+RUN dotnet restore src/Signals/StellaOps.Signals/StellaOps.Signals.csproj --configfile nuget.config
+COPY src/Signals/ src/Signals/
+RUN dotnet publish src/Signals/StellaOps.Signals/StellaOps.Signals.csproj -c Release -o /app/publish --no-restore
+
+FROM ${RUNTIME_IMAGE} AS final
+WORKDIR /app
+ENV ASPNETCORE_URLS=http://+:5088
+ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
+COPY --from=build /app/publish .
+EXPOSE 5088
+ENTRYPOINT ["dotnet", "StellaOps.Signals.dll"]

devops/services/signals-ops/README.md

@@ -0,0 +1,38 @@
+# Signals CI/CD & Local Stack (DEVOPS-SIG-26-001)
+
+Artifacts:
+- Compose stack: `ops/devops/signals/docker-compose.signals.yml` (Signals API + Mongo + Valkey + artifact volume).
+- Sample config: `ops/devops/signals/signals.yaml` (mounted into the container at `/app/signals.yaml` if desired).
+- Dockerfile: `ops/devops/signals/Dockerfile` (multi-stage build on .NET 10 RC).
+- Build/export helper: `scripts/signals/build.sh` (saves image tar to `out/signals/signals-image.tar`).
+- Span sink stack: `ops/devops/signals/docker-compose.spansink.yml` + `otel-spansink.yaml` to collect OTLP traces (Excititor `/v1/vex/observations/**`) and write NDJSON to `spansink-data` volume. Run via `scripts/signals/run-spansink.sh`.
+- Grafana dashboard stub: `ops/devops/signals/dashboards/excititor-vex-traces.json` (import into Tempo-enabled Grafana).
+
+Quick start (offline-friendly):
+```bash
+# build image
+scripts/signals/build.sh
+
+# run stack
+COMPOSE_FILE=ops/devops/signals/docker-compose.signals.yml docker compose up -d
+
+# hit health
+curl -s http://localhost:5088/health
+
+# run span sink collector
+scripts/signals/run-spansink.sh
+```
+
+Configuration (ENV or YAML):
+- `Signals__Mongo__ConnectionString` default `mongodb://signals-mongo:27017/signals`
+- `Signals__Cache__ConnectionString` default `signals-valkey:6379`
+- `Signals__Storage__RootPath` default `/data/artifacts`
+- Authority disabled by default for local; enable with `Signals__Authority__Enabled=true` and issuer settings.
+
+CI workflow:
+- `.gitea/workflows/signals-ci.yml` restores, builds, tests, builds container, and uploads `signals-image.tar` artifact.
+
+Dependencies:
+- Mongo 7 (wiredTiger)
+- Valkey 8 (cache, BSD-3 licensed Redis fork)
+- Artifact volume `signals_artifacts` for callgraph blobs.

devops/services/signals-ops/dashboards/excititor-vex-traces.json

@@ -0,0 +1,50 @@
+{
+  "title": "Excititor VEX Observations Traces",
+  "tags": ["excititor", "traces", "vex"],
+  "timezone": "browser",
+  "schemaVersion": 38,
+  "version": 1,
+  "refresh": "30s",
+  "panels": [
+    {
+      "type": "stat",
+      "title": "Spans (last 15m)",
+      "gridPos": {"h": 4, "w": 6, "x": 0, "y": 0},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "expr": "sum by(service_name)(rate(traces_spanmetrics_calls_total{service_name=~\"excititor.*\"}[15m]))"
+        }
+      ]
+    },
+    {
+      "type": "stat",
+      "title": "Errors (last 15m)",
+      "gridPos": {"h": 4, "w": 6, "x": 6, "y": 0},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "expr": "sum by(status_code)(rate(traces_spanmetrics_calls_total{status_code=\"STATUS_CODE_ERROR\",service_name=~\"excititor.*\"}[15m]))"
+        }
+      ]
+    },
+    {
+      "type": "table",
+      "title": "Recent /v1/vex/observations spans",
+      "gridPos": {"h": 12, "w": 24, "x": 0, "y": 4},
+      "options": {
+        "showHeader": true
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "tempo", "uid": "tempo"},
+          "queryType": "traceql",
+          "expr": "{ service.name = \"excititor\" && http.target = \"/v1/vex/observations\" } | limit 50"
+        }
+      ]
+    }
+  ]
+}

devops/services/signals-ops/docker-compose.signals.yml

@@ -0,0 +1,52 @@
+version: "3.9"
+
+services:
+  signals-api:
+    build:
+      context: ../..
+      dockerfile: ops/devops/signals/Dockerfile
+    image: stellaops/signals:local
+    environment:
+      ASPNETCORE_URLS: "http://+:5088"
+      Signals__Mongo__ConnectionString: "mongodb://signals-mongo:27017/signals"
+      Signals__Mongo__Database: "signals"
+      Signals__Cache__ConnectionString: "signals-valkey:6379"
+      Signals__Storage__RootPath: "/data/artifacts"
+      Signals__Authority__Enabled: "false"
+      Signals__OpenApi__Enabled: "true"
+    ports:
+      - "5088:5088"
+    depends_on:
+      - signals-mongo
+      - signals-valkey
+    volumes:
+      - signals_artifacts:/data/artifacts
+      - ./signals.yaml:/app/signals.yaml:ro
+
+  signals-mongo:
+    image: mongo:7
+    command: ["mongod", "--quiet", "--storageEngine=wiredTiger"]
+    ports:
+      - "57027:27017"
+    volumes:
+      - signals_mongo:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  signals-valkey:
+    image: valkey/valkey:8-alpine
+    ports:
+      - "56379:6379"
+    command: ["valkey-server", "--save", "", "--appendonly", "no"]
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  signals_artifacts:
+  signals_mongo:

devops/services/signals-ops/docker-compose.spansink.yml

@@ -0,0 +1,17 @@
+version: '3.8'
+services:
+  otel-spansink:
+    image: otel/opentelemetry-collector-contrib:0.97.0
+    command: ["--config=/etc/otel/otel-spansink.yaml"]
+    volumes:
+      - ./otel-spansink.yaml:/etc/otel/otel-spansink.yaml:ro
+      - spansink-data:/var/otel
+    ports:
+      - "4317:4317"  # OTLP gRPC
+      - "4318:4318"  # OTLP HTTP
+    environment:
+      - OTEL_RESOURCE_ATTRIBUTES=service.name=excititor,telemetry.distro=stellaops
+    restart: unless-stopped
+volumes:
+  spansink-data:
+    driver: local

devops/services/signals-ops/otel-spansink.yaml

@@ -0,0 +1,31 @@
+receivers:
+  otlp:
+    protocols:
+      grpc:
+        endpoint: 0.0.0.0:4317
+      http:
+        endpoint: 0.0.0.0:4318
+
+processors:
+  batch:
+    timeout: 1s
+    send_batch_size: 512
+
+exporters:
+  file/traces:
+    path: /var/otel/traces.ndjson
+    rotation:
+      max_megabytes: 100
+      max_backups: 5
+      max_days: 7
+      localtime: true
+
+service:
+  telemetry:
+    logs:
+      level: info
+  pipelines:
+    traces:
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [file/traces]

devops/services/signals-ops/signals.yaml

@@ -0,0 +1,15 @@
+# Sample offline configuration for Signals
+
+Signals:
+  Mongo:
+    ConnectionString: "mongodb://signals-mongo:27017/signals"
+    Database: "signals"
+  Cache:
+    ConnectionString: "signals-valkey:6379"
+    DefaultTtlSeconds: 600
+  Storage:
+    RootPath: "/data/artifacts"
+  Authority:
+    Enabled: false
+  OpenApi:
+    Enabled: true