staging for release v4.0.0

.github/workflows/build.yml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: build
+
+# Build check: GoReleaser snapshot build of everything, publishing nothing,
+# then package validation. The `build` job is the required status check.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  validate:
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          rpm-files:
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
+
+  build:
+    if: ${{ always() }}
+    needs: [goreleaser, validate]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/cleanup.yml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: cleanup
+
+# Deletes the pr-<N> images named in .goreleaser.yaml (testbed and
+# testbed-alt) when a PR closes.
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read   # checkout, to read .goreleaser.yaml
+  packages: write  # delete image versions
+
+jobs:
+  cleanup:
+    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@7af41e39e2270b711bd18385f1586df9f7bf98de # github-actions under test (seantronsen/feat/decouple-pr-cleanup)

.github/workflows/dependency-review.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: dependency-review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read        # baseline for checkout
+      pull-requests: write  # summary comment on the PR
+
+  dependency-review:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/govulncheck.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: govulncheck
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  govulncheck:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/lint.yml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: lint
+
+# All linters under one gate: the `lint` job is the required status check.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  lint-ci:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # zizmor SARIF upload to GHAS
+
+  lint-renovate:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-renovate.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  lint:
+    if: ${{ always() }}
+    needs: [lint-go, lint-ci, lint-renovate]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/release.yml

@@ -0,0 +1,94 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: release
+
+# PR images and releases; build-release-goreleaser picks the mode from the
+# event:
+# - pull_request: pushes ghcr.io/openchami/github-actions-testbed:pr-<N>.
+# - v* tag push: semver images, signed packages, draft release, validation,
+#   then publish. Safe to tag freely: nothing depends on this repo.
+
+on:
+  pull_request:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  # Throwaway signing key, regenerated each run. Not a secret (it travels as
+  # a job output); fine here, since the packages are only for testing.
+  test-key:
+    runs-on: ubuntu-slim
+    outputs:
+      gpg-key-b64: ${{ steps.key.outputs.gpg-key-b64 }}
+    steps:
+      - name: Generate throwaway GPG key
+        id: key
+        run: |
+          set -euo pipefail
+          GNUPGHOME=$(mktemp -d)
+          export GNUPGHOME
+          gpg --batch --quiet --passphrase '' \
+            --quick-gen-key 'github-actions testbed throwaway key <noreply@openchami.org>' rsa3072 sign 1d
+          echo "gpg-key-b64=$(gpg --batch --armor --export-secret-keys | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  goreleaser:
+    needs: test-key
+    permissions:
+      contents: write      # release creation, uploading assets
+      packages: write      # image push, container provenance
+      id-token: write      # Sigstore signing (attest-build-provenance)
+      attestations: write  # build provenance attestations
+    uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+    secrets:
+      gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }}
+
+  trivy:
+    # Scans the images named in .goreleaser.yaml (testbed and testbed-alt) at
+    # this run's tag (pr-<N> on PRs); fork PRs push nothing, so nothing matches.
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@3f4837668325e804c057a415e108d1393af3406a # github-actions under test (seantronsen/feat/decouple-trivy)
+    permissions:
+      contents: read          # baseline for checkout
+      packages: read          # read image versions
+      security-events: write  # SARIF upload to GHAS
+    with:
+      exit-code: '0'
+
+  validate:
+    # PR builds produce no packages (they're validated in build.yml).
+    if: ${{ github.event_name == 'push' }}
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          rpm-files:
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
+
+  publish:
+    if: ${{ github.event_name == 'push' }}
+    needs: [goreleaser, validate]
+    permissions:
+      contents: write   # publish the draft GitHub Release
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)

.github/workflows/reuse.yml

@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: reuse
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  reuse:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/scorecard.yml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: scorecard
+on:
+  branch_protection_rule:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '39 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # SARIF upload to GHAS
+      id-token: write         # publish results to the OpenSSF dashboard
+    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  scorecard:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }

.github/workflows/stale.yml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: stale
+on:
+  schedule:
+    - cron: '23 3 * * *'  # daily at 03:23 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      issues: write          # label, comment on, and close stale issues
+      pull-requests: write   # label, comment on, and close stale PRs

.github/workflows/test.yml

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: test
+
+# All tests under one gate: the `test` job is the required status check.
+# Unit tests also upload coverage to Coveralls (README badge); the repo must
+# be enrolled in Coveralls.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test-unit-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@94dcf268d84a4bf0396e2a93f56769199cd7cb7a # github-actions under test (seantronsen/feat/runner-selection)
+    with:
+      go-version-file: go.mod
+      coverage: true
+      runner: ubuntu-latest  # exercises the runner input (default: ubuntu-slim)
+
+  test:
+    if: ${{ always() }}
+    needs: [test-unit-go]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }