[major] Harden the modular cloud runtime foundation

.github/workflows/cloud-smoke.yml

@@ -7,7 +7,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 concurrency:
   group: cloud-compose-smoke
@@ -20,15 +19,29 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install contract tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes ripgrep
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
         with:
           terraform_version: 1.14.6
           terraform_wrapper: false
 
-      - name: Run Terraform lint
-        run: make terraform-lint-check
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Run repository lint
+        run: make lint-check
 
       - name: Validate fallback cleanup behavior
         run: bash ci/cloud-smoke-cleanup-contract.sh
@@ -51,6 +64,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 150
     if: github.event.pull_request.head.repo.full_name == github.repository
+    environment: cloud-smoke-linode
     strategy:
       fail-fast: false
       matrix:
@@ -91,6 +105,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 150
     if: github.event.pull_request.head.repo.full_name == github.repository
+    environment: cloud-smoke-${{ matrix.provider }}
     strategy:
       fail-fast: false
       matrix:
@@ -101,9 +116,6 @@ jobs:
           - name: Linode WordPress
             provider: linode
             template: wp
-          - name: GCP WordPress
-            provider: gcp
-            template: wp
     concurrency:
       group: cloud-compose-smoke-${{ matrix.provider }}-${{ matrix.template }}
       cancel-in-progress: false
@@ -113,52 +125,115 @@ jobs:
       CLOUD_COMPOSE_SMOKE_SWEEP_ORPHANS: "true"
       CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.run_id }}
       CLOUD_COMPOSE_SOURCE_REF: ${{ github.event.pull_request.head.sha }}
-      DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+      DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
+      LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Install Terraform
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
+        with:
+          terraform_version: 1.14.6
+          terraform_wrapper: false
+
+      - name: Install sitectl
+        run: ci/install-sitectl-apt.sh
+
+      - name: Run smoke test
+        run: make smoke-test PROVIDER=${{ matrix.provider }} TEMPLATE=${{ matrix.template }}
+
+      - name: Destroy smoke resources
+        if: always()
+        run: ci/cloud-smoke.sh destroy-${{ matrix.provider }}-${{ matrix.template }}
+
+  gcp-smoke:
+    name: GCP WordPress
+    needs:
+      - terraform-lint
+      - config-management-lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 210
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    environment: cloud-smoke-gcp
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: cloud-compose-smoke-gcp-wp
+      cancel-in-progress: false
+    env:
+      CLOUD_COMPOSE_SMOKE_AUTO_APPROVE: "true"
+      CLOUD_COMPOSE_SMOKE_DESTROY_TIMEOUT: "1800"
+      CLOUD_COMPOSE_SMOKE_SWEEP_ORPHANS: "true"
+      CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.run_id }}
+      CLOUD_COMPOSE_SOURCE_REF: ${{ github.event.pull_request.head.sha }}
+      CLOUD_COMPOSE_UPGRADE_BASE_SHA: f33117cdbbf4a9c7d59006a4db986baef118e6bb
+      CLOUD_COMPOSE_UPGRADE_CURRENT_REF: ${{ github.sha }}
       GCLOUD_OIDC_POOL: ${{ vars.GCLOUD_OIDC_POOL || secrets.GCLOUD_OIDC_POOL }}
       GCLOUD_PROJECT: ${{ vars.GCLOUD_PROJECT || secrets.GCLOUD_PROJECT }}
       GCLOUD_REGION: ${{ vars.GCLOUD_REGION || secrets.GCLOUD_REGION }}
+      GCLOUD_NETWORK_PROJECT_ID: ${{ vars.GCLOUD_NETWORK_PROJECT_ID || secrets.GCLOUD_NETWORK_PROJECT_ID }}
+      GCLOUD_NETWORK_NAME: ${{ vars.GCLOUD_NETWORK_NAME || secrets.GCLOUD_NETWORK_NAME }}
+      GCLOUD_SUBNETWORK_NAME: ${{ vars.GCLOUD_SUBNETWORK_NAME || secrets.GCLOUD_SUBNETWORK_NAME }}
+      GCLOUD_POWER_START_ROLE: ${{ vars.GCLOUD_POWER_START_ROLE || secrets.GCLOUD_POWER_START_ROLE }}
+      GCLOUD_POWER_SUSPEND_ROLE: ${{ vars.GCLOUD_POWER_SUSPEND_ROLE || secrets.GCLOUD_POWER_SUSPEND_ROLE }}
       GSA: ${{ vars.GSA || secrets.GSA }}
-      LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
         with:
           terraform_version: 1.14.6
           terraform_wrapper: false
 
-      - name: Check GCP smoke secrets
-        if: matrix.provider == 'gcp'
+      - name: Check GCP smoke configuration
+        run: |
+          test -n "$GCLOUD_OIDC_POOL" || { echo "GCLOUD_OIDC_POOL environment variable or secret is required for GCP smoke tests"; exit 1; }
+          test -n "$GSA" || { echo "GSA environment variable or secret is required for GCP smoke tests"; exit 1; }
+          test -n "$GCLOUD_PROJECT" || { echo "GCLOUD_PROJECT environment variable or secret is required for GCP smoke tests"; exit 1; }
+
+      - name: Check GCP upgrade configuration
+        if: ${{ startsWith(github.event.pull_request.title, '[major]') }}
         run: |
-          test -n "$GCLOUD_OIDC_POOL" || { echo "GCLOUD_OIDC_POOL Actions variable or secret is required for GCP smoke tests"; exit 1; }
-          test -n "$GSA" || { echo "GSA Actions variable or secret is required for GCP smoke tests"; exit 1; }
-          test -n "$GCLOUD_PROJECT" || { echo "GCLOUD_PROJECT Actions variable or secret is required for GCP smoke tests"; exit 1; }
+          test -n "$GCLOUD_NETWORK_PROJECT_ID" || { echo "GCLOUD_NETWORK_PROJECT_ID environment variable or secret is required for the GCP upgrade smoke test"; exit 1; }
+          test -n "$GCLOUD_NETWORK_NAME" || { echo "GCLOUD_NETWORK_NAME environment variable or secret is required for the GCP upgrade smoke test"; exit 1; }
+          test -n "$GCLOUD_SUBNETWORK_NAME" || { echo "GCLOUD_SUBNETWORK_NAME environment variable or secret is required for the GCP upgrade smoke test"; exit 1; }
+          test -n "$GCLOUD_POWER_START_ROLE" || { echo "GCLOUD_POWER_START_ROLE environment variable or secret is required for the GCP upgrade smoke test"; exit 1; }
+          test -n "$GCLOUD_POWER_SUSPEND_ROLE" || { echo "GCLOUD_POWER_SUSPEND_ROLE environment variable or secret is required for the GCP upgrade smoke test"; exit 1; }
+          test "$GCLOUD_NETWORK_PROJECT_ID" = "$GCLOUD_PROJECT" || { echo "GCLOUD_NETWORK_PROJECT_ID must equal GCLOUD_PROJECT for the 0.10.2 baseline"; exit 1; }
 
       - name: Authenticate to Google Cloud
-        if: matrix.provider == 'gcp'
         uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
         with:
           workload_identity_provider: ${{ env.GCLOUD_OIDC_POOL }}
           service_account: ${{ env.GSA }}
           project_id: ${{ env.GCLOUD_PROJECT }}
 
       - name: Install gcloud
-        if: matrix.provider == 'gcp'
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
 
       - name: Install sitectl
         run: ci/install-sitectl-apt.sh
 
-      - name: Run smoke test
-        run: make smoke-test PROVIDER=${{ matrix.provider }} TEMPLATE=${{ matrix.template }}
+      - name: Run fresh smoke test
+        if: ${{ !startsWith(github.event.pull_request.title, '[major]') }}
+        run: make smoke-test PROVIDER=gcp TEMPLATE=wp
 
-      - name: Destroy smoke resources
-        if: always() && (matrix.provider != 'gcp' || (env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != ''))
-        run: ci/cloud-smoke.sh destroy-${{ matrix.provider }}-${{ matrix.template }}
+      - name: Run 0.10.2 upgrade smoke test
+        if: ${{ startsWith(github.event.pull_request.title, '[major]') }}
+        run: ci/gcp-upgrade-smoke.sh run
+
+      - name: Destroy fresh smoke resources
+        if: ${{ always() && !startsWith(github.event.pull_request.title, '[major]') && env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != '' }}
+        run: ci/cloud-smoke.sh destroy-gcp-wp
 
-      - name: Skip GCP destroy
-        if: always() && matrix.provider == 'gcp' && (env.GCLOUD_OIDC_POOL == '' || env.GSA == '' || env.GCLOUD_PROJECT == '')
-        run: echo "Skipping GCP destroy because GCP smoke secrets are not configured and no GCP resources were applied."
+      - name: Destroy upgrade smoke resources
+        if: ${{ always() && startsWith(github.event.pull_request.title, '[major]') && env.GCLOUD_OIDC_POOL != '' && env.GSA != '' && env.GCLOUD_PROJECT != '' && env.GCLOUD_NETWORK_PROJECT_ID != '' && env.GCLOUD_NETWORK_NAME != '' && env.GCLOUD_SUBNETWORK_NAME != '' }}
+        run: ci/gcp-upgrade-smoke.sh destroy

.github/workflows/docs.yml

@@ -1,6 +1,13 @@
 name: "Build docs"
 
 on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "docs/**"
+      - ".github/workflows/docs.yml"
+      - "Makefile"
   push:
     branches:
       - main
@@ -11,12 +18,25 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
+  validate:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Build docs
+        run: make docs-build
+
   deploy:
+    if: github.event_name == 'push'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/github-release.yaml

@@ -8,7 +8,9 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/.github/.github/workflows/bump-release.yaml@main
+    uses: libops/.github/.github/workflows/bump-release.yaml@8dfaf9c854df71d9bbffde48c5676ff07c543c51
+    with:
+      workflow_file: publish-rootfs.yaml
     permissions:
       contents: write
       actions: write

.github/workflows/publish-rootfs.yaml

@@ -0,0 +1,30 @@
+name: Publish rootfs release asset
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout tagged source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Build and verify canonical rootfs asset
+        run: |
+          ci/rootfs-package-contract.sh
+          ci/package-rootfs.sh dist
+
+      - name: Upload rootfs asset and checksum
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release upload "$GITHUB_REF_NAME"
+          dist/cloud-compose-rootfs.tar.gz
+          dist/cloud-compose-rootfs.tar.gz.sha256
+          --clobber