feat: add packaging + experimental workflows for testing

.github/workflows/build.yml

@@ -0,0 +1,49 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: build
+
+# Build check: GoReleaser snapshot build of everything, publishing nothing,
+# then package validation. The `build` job is the required status check.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  validate:
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*.rpm
+          files:
+            - /etc/openchami
+            - /etc/openchami/configs
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+            - /usr/share/licenses/testbed-quadlet
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+        - name: testbed-quadlet*.deb
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+            - /usr/share/doc/testbed-quadlet/copyright
+
+  build:
+    if: ${{ always() }}
+    needs: [goreleaser, validate]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/cleanup.yml

@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: cleanup
+
+# Deletes the pr-<N> images when a PR closes.
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  packages: write
+
+jobs:
+  cleanup:
+    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)

.github/workflows/dependency-review.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: dependency-review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read        # baseline for checkout
+      pull-requests: write  # summary comment on the PR
+
+  dependency-review:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/govulncheck.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: govulncheck
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  govulncheck:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/lint.yml

@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: lint
+
+# All linters under one gate: the `lint` job is the required status check.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  lint-ci:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # zizmor SARIF upload to GHAS
+
+  lint:
+    if: ${{ always() }}
+    needs: [lint-go, lint-ci]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: release
+
+# PR images and releases; build-release-goreleaser picks the mode from the
+# event:
+# - pull_request: pushes ghcr.io/openchami/github-actions-testbed:pr-<N>.
+# - v* tag push: semver images, signed packages, draft release, validation,
+#   then publish. Safe to tag freely: nothing depends on this repo.
+
+on:
+  pull_request:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  # Throwaway signing key, regenerated each run. Not a secret (it travels as
+  # a job output); fine here, since the packages are only for testing.
+  test-key:
+    runs-on: ubuntu-slim
+    outputs:
+      gpg-key-b64: ${{ steps.key.outputs.gpg-key-b64 }}
+    steps:
+      - name: Generate throwaway GPG key
+        id: key
+        run: |
+          set -euo pipefail
+          GNUPGHOME=$(mktemp -d)
+          export GNUPGHOME
+          gpg --batch --quiet --passphrase '' \
+            --quick-gen-key 'github-actions testbed throwaway key <noreply@openchami.org>' rsa3072 sign 1d
+          echo "gpg-key-b64=$(gpg --batch --armor --export-secret-keys | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  goreleaser:
+    needs: test-key
+    permissions:
+      contents: write      # release creation, uploading assets
+      packages: write      # image push, container provenance
+      id-token: write      # Sigstore signing (attest-build-provenance)
+      attestations: write  # build provenance attestations
+    uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+      registry-subject-name: ghcr.io/openchami/github-actions-testbed
+    secrets:
+      gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }}
+
+  trivy:
+    # Fork PRs build but don't push, so there is no image to scan.
+    needs: goreleaser
+    if: ${{ needs.goreleaser.outputs.digest != '' }}
+    uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # SARIF upload to GHAS
+    with:
+      image-ref: ghcr.io/openchami/github-actions-testbed@${{ needs.goreleaser.outputs.digest }}
+      exit-code: '0'
+
+  validate:
+    # PR builds produce no packages (they're validated in build.yml).
+    if: ${{ github.event_name == 'push' }}
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*.rpm
+          files:
+            - /etc/openchami
+            - /etc/openchami/configs
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+            - /usr/share/licenses/testbed-quadlet
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+        - name: testbed-quadlet*.deb
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+            - /usr/share/doc/testbed-quadlet/copyright
+
+  publish:
+    if: ${{ github.event_name == 'push' }}
+    needs: [goreleaser, validate]
+    permissions:
+      contents: write   # publish the draft GitHub Release
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)

.github/workflows/reuse.yml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: reuse
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  reuse:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/scorecard.yml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: scorecard
+on:
+  branch_protection_rule:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '39 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # SARIF upload to GHAS
+      id-token: write         # publish results to the OpenSSF dashboard
+    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  scorecard:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/stale.yml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: stale
+on:
+  schedule:
+    - cron: '23 3 * * *'  # daily at 03:23 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      issues: write          # label, comment on, and close stale issues
+      pull-requests: write   # label, comment on, and close stale PRs

.github/workflows/test.yml

@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: test
+
+# All tests under one gate: the `test` job is the required status check.
+# Unit tests also upload coverage to Coveralls (README badge); the repo must
+# be enrolled in Coveralls.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test-unit-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+      coverage: true
+
+  test:
+    if: ${{ always() }}
+    needs: [test-unit-go]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }