release: promote demo-ready dev for v0.3.0-beta.5

.github/workflows/ci.yml

@@ -18,9 +18,11 @@ env:
   GOLANGCI_VERSION: "v2.12.2"
   GOVULNCHECK_VERSION: "v1.6.0"
   GORELEASER_VERSION: "v2.17.0"
-  HELM_VERSION: "v4.2.2"
-  HELM_LINUX_AMD64_SHA256: "9adafecab4d406853bba163a70e9f104f47dbbf65ce24b7653bae7e36150bcb6"
-  SYFT_VERSION: "v1.46.0"
+  HELM_VERSION: "v4.2.3"
+  HELM_LINUX_AMD64_SHA256: "e9b88b4ee95b18c706839c28d3a0220e5bc470e9cd9262410c90793c45ff8b7c"
+  PROMETHEUS_VERSION: "v3.13.1"
+  PROMETHEUS_LINUX_AMD64_SHA256: "962b812371aff838d152b6ff2d56fdb7a6396f5542f48ebf73421b9721f0d103"
+  SYFT_VERSION: "v1.49.0"
 
 jobs:
   build-test-lint:
@@ -31,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: false
@@ -75,6 +77,9 @@ jobs:
       - name: Unit tests with race detector
         run: go test -race -count=1 -coverprofile=coverage.out ./...
 
+      - name: Operator safety policy tests
+        run: make test-scripts
+
       - name: Multi-layer tenant-isolation suite
         run: make e2e-isolation
 
@@ -84,6 +89,20 @@ jobs:
       - name: Binary integration smoke test
         run: go test -race -count=1 -tags=e2e ./tests/e2e
 
+      - name: Install pinned promtool
+        run: |
+          set -euo pipefail
+          version="${PROMETHEUS_VERSION#v}"
+          archive="$RUNNER_TEMP/prometheus.tar.gz"
+          curl --fail --silent --show-error --location --proto '=https' --tlsv1.2 --retry 3 --retry-all-errors \
+            --output "$archive" "https://github.com/prometheus/prometheus/releases/download/${PROMETHEUS_VERSION}/prometheus-${version}.linux-amd64.tar.gz"
+          echo "${PROMETHEUS_LINUX_AMD64_SHA256}  ${archive}" | sha256sum --check --status
+          tar -xzf "$archive" -C "$RUNNER_TEMP"
+          install -m 0755 "$RUNNER_TEMP/prometheus-${version}.linux-amd64/promtool" "$RUNNER_TEMP/promtool"
+
+      - name: Portable Prometheus alert contract
+        run: make test-alert-rules PROMTOOL="$RUNNER_TEMP/promtool"
+
       - name: Immutable OCI image contract
         run: make e2e-oci
 
@@ -115,7 +134,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: false

.github/workflows/release.yml

@@ -15,8 +15,8 @@ concurrency:
 env:
   GO_VERSION: "1.26.5"
   GORELEASER_VERSION: "v2.17.0"
-  SYFT_VERSION: "v1.46.0"
-  COSIGN_VERSION: "v3.0.6"
+  SYFT_VERSION: "v1.49.0"
+  COSIGN_VERSION: "v3.1.2"
   HUB_IMAGE: ghcr.io/ardurai/sith-hub
 
 jobs:
@@ -58,7 +58,7 @@ jobs:
           echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
           echo "RELEASE_KIND=${release_kind}" >> "$GITHUB_ENV"
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: false
@@ -112,13 +112,13 @@ jobs:
           test -x "$IMAGE_CONTEXT/bin/linux/arm64/sith"
 
       - name: Set up QEMU for hub image platforms
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Buildx for hub image platforms
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Authenticate to the GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -143,7 +143,7 @@ jobs:
 
       - name: Publish immutable multi-platform hub image
         id: hub_image
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ runner.temp }}/sith-hub-image
           file: ${{ runner.temp }}/sith-hub-image/Containerfile
@@ -184,15 +184,15 @@ jobs:
 
       - name: Attest hub image build provenance
         id: hub_provenance
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-name: ${{ env.HUB_IMAGE }}
           subject-digest: ${{ steps.hub_image.outputs.digest }}
           push-to-registry: true
 
       - name: Attest hub image SBOM
         id: hub_sbom
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-name: ${{ env.HUB_IMAGE }}
           subject-digest: ${{ steps.hub_image.outputs.digest }}
@@ -210,34 +210,34 @@ jobs:
 
       - name: Generate SLSA build provenance
         id: provenance
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-checksums: dist/checksums.txt
 
       - name: Attest darwin amd64 SBOM
         id: sbom_darwin_amd64
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz
           sbom-path: dist/sith_${{ env.VERSION }}_darwin_amd64.tar.gz.spdx.json
 
       - name: Attest darwin arm64 SBOM
         id: sbom_darwin_arm64
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz
           sbom-path: dist/sith_${{ env.VERSION }}_darwin_arm64.tar.gz.spdx.json
 
       - name: Attest linux amd64 SBOM
         id: sbom_linux_amd64
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz
           sbom-path: dist/sith_${{ env.VERSION }}_linux_amd64.tar.gz.spdx.json
 
       - name: Attest linux arm64 SBOM
         id: sbom_linux_arm64
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
         with:
           subject-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz
           sbom-path: dist/sith_${{ env.VERSION }}_linux_arm64.tar.gz.spdx.json

Makefile

@@ -7,11 +7,12 @@ CMD      := ./cmd/sith
 BIN_DIR  := bin
 GOLANGCI ?= golangci-lint
 GOVULNCHECK ?= govulncheck
+PROMTOOL ?= promtool
 KIND     ?= kind
 HELM     ?= helm
 GORELEASER ?= goreleaser
 WAILS      ?= wails
-WAILS_VERSION ?= v2.12.0
+WAILS_VERSION ?= v2.13.0
 CODESIGN   ?= codesign
 PLISTBUDDY ?= /usr/libexec/PlistBuddy
 LIPO       ?= lipo
@@ -34,7 +35,7 @@ LDFLAGS := -s -w \
 	-X $(PKG)/internal/buildinfo.Commit=$(COMMIT) \
 	-X $(PKG)/internal/buildinfo.Date=$(DATE)
 
-.PHONY: all build desktop-build test test-scripts perf e2e e2e-helm e2e-oci e2e-kind e2e-ocm e2e-postgres e2e-isolation lint vuln fmt fmt-check vet tidy clean run ci release-check help
+.PHONY: all build desktop-build test test-scripts test-alert-rules perf e2e e2e-helm e2e-oci e2e-kind e2e-ocm e2e-postgres e2e-isolation lint vuln fmt fmt-check vet tidy clean run ci release-check help
 
 all: build
 
@@ -43,8 +44,7 @@ build: ## Build the sith binary into bin/
 	go build -trimpath -ldflags '$(LDFLAGS)' -o $(BIN_DIR)/$(BINARY) $(CMD)
 
 desktop-build: ## Build the ad-hoc-signed macOS arm64 Sith.app development bundle
-	@command -v "$(WAILS)" >/dev/null || { echo "Wails $(WAILS_VERSION) is required" >&2; exit 1; }
-	@"$(WAILS)" version | grep -q '$(WAILS_VERSION)' || { echo "Wails $(WAILS_VERSION) is required" >&2; exit 1; }
+	@hack/verify-wails-version.sh "$(WAILS)" "$(WAILS_VERSION)"
 	cd cmd/sith-desktop && "$(WAILS)" build -clean -m -nosyncgomod -s -trimpath -platform darwin/arm64
 	@set -euo pipefail; \
 		app='cmd/sith-desktop/build/bin/Sith.app'; \
@@ -59,11 +59,21 @@ test: ## Run unit tests with the race detector and report coverage
 	go test -race -count=1 -coverprofile=coverage.out ./...
 
 test-scripts: ## Run focused safety tests for operator-facing shell harnesses
+	bash tests/scripts/wails_tooling_policy_test.sh
+	bash tests/scripts/release_tooling_policy_test.sh
+	bash tests/scripts/helm_tooling_policy_test.sh
 	bash tests/scripts/m0_ocm_falsification_safety_test.sh
 	bash tests/scripts/release_tag_identity_guide_test.sh
 	bash tests/scripts/release_tag_policy_test.sh
 	bash tests/scripts/release_pr_gate_policy_test.sh
 	bash tests/scripts/release_hub_image_policy_test.sh
+	bash tests/scripts/prometheus_tooling_policy_test.sh
+
+test-alert-rules: ## Validate and unit-test the portable Prometheus alert contract
+	@promtool_path="$$(command -v "$(PROMTOOL)")" || { echo "promtool is required" >&2; exit 1; }; \
+	case "$$promtool_path" in /*) ;; *) promtool_path="$$(pwd)/$$promtool_path" ;; esac; \
+	cd monitoring && "$$promtool_path" check rules sith-hub.rules.yml && \
+	"$$promtool_path" test rules sith-hub.rules.test.yml
 
 perf: ## Enforce the warm-cache TUI p95 latency budget without race overhead
 	go test -count=1 -run '^TestWarmViewP95UnderOneHundredMilliseconds$$' ./internal/tui
@@ -79,7 +89,7 @@ e2e-oci: ## Build and inspect the local immutable OCI image contract for linux/a
 
 e2e-kind: ## Exercise adapter and binary against two real kind clusters
 	KIND_BIN="$(KIND)" KIND_NODE_IMAGE="$(KIND_NODE_IMAGE)" \
-		go test -race -count=1 -timeout=15m -tags='e2e kind' -run '^Test(KindFleetFanout|KindOCIImageContract)$$' ./tests/e2e
+		go test -race -count=1 -timeout=15m -tags='e2e kind' -run '^Test(KindFleetFanout|KindOCIImageContract|KindArgoApplicationProjection)$$' ./tests/e2e
 
 e2e-ocm: ## Prove direct ClusterProxy transport in the pinned two-spoke M0 lab
 	@set -euo pipefail; \
@@ -114,6 +124,9 @@ e2e-isolation: ## Run signed-identity, scoped-query, and real PostgreSQL isolati
 	go test -run '^$$' -fuzz '^FuzzQueryScopedNeverLeaksForeignWorkspace$$' \
 		-fuzztime="$(ISOLATION_FUZZ_BUDGET)" -parallel="$(ISOLATION_FUZZ_WORKERS)" \
 		-timeout=2m ./internal/fleetcache
+	go test -run '^$$' -fuzz '^FuzzStoreForeignWorkspaceMutationCannotChangeEitherWorkspace$$' \
+		-fuzztime="$(ISOLATION_FUZZ_BUDGET)" -parallel="$(ISOLATION_FUZZ_WORKERS)" \
+		-timeout=2m ./internal/fleetcache
 
 lint: ## Run golangci-lint (v2)
 	$(GOLANGCI) run ./...
@@ -141,7 +154,7 @@ clean: ## Remove build and coverage artifacts
 run: build ## Build then run sith version
 	$(BIN_DIR)/$(BINARY) version
 
-ci: fmt-check vet lint vuln test test-scripts perf e2e build ## Run the full CI gate locally
+ci: fmt-check vet lint vuln test test-scripts test-alert-rules perf e2e build ## Run the full CI gate locally
 
 release-check: ## Build, verify, and package the reproducible multi-platform release snapshot twice
 	@command -v "$(GORELEASER)" >/dev/null || { echo "goreleaser is required" >&2; exit 1; }