STAC-25142 Move the agent CI to GitHub Actions and retire the GitLab pipelines

[LouisParkin]

What

Ports the stackstate-agent GitLab pipeline to GitHub Actions, for amd64 and arm64.

Workflow	Covers
Lint and unit tests	filename linting, inv check-mod-tidy, branded + unbranded unit suites
Binary builds	agent and cluster-agent binaries, cluster-agent image build/publish/sign, multi-arch manifest
DEB package build	omnibus DEB, branding verification, agent image build/publish/sign, GPG signing, pre-release apt repository, install script
Go dependency cache image	reusable — bakes the module cache so the heavy jobs start warm instead of re-downloading
Cerberus notify	reusable — reports release-branch failures to Slack

Each top-level workflow ends in a CI success (...) aggregate, and those three are the required checks on the base branch. A matrix job cannot be required directly by name, so the aggregate is what branch protection can pin.

Nightly

GitLab schedule 20682 builds the release branch every weekday evening (22:00 Europe/Amsterdam; GitHub cron is UTC-only, so the trigger uses 20:00 UTC and drifts an hour in winter). The build and DEB workflows carry an equivalent schedule: trigger so archiving GitLab does not end nightly builds silently. The unit suites are excluded — two ~2h jobs that already run on the PR and on the push.

Publication is widened to schedule alongside push, otherwise the nightly would build and discard everything, and a nightly failure would reach nobody. Image tags are the commit SHA, so an unchanged branch republishes an identical tag; the signal is drift in base images and dependencies, not fresh artifacts.

GitLab pipelines are removed

The four StackState-owned GitLab pipeline files are deleted, since these workflows replace them. Scheduled runs were the only pipelines GitLab had executed since 27 July, so the nightly above is what was keeping it alive.

Left in place deliberately: .gitlab/ (129 upstream files that ~15 upstream tasks/*.py modules read), .gitlab-scripts/setup_artifact_registry.sh (called by the DEB build here, tasks/omnibus.py and an omnibus software definition), and .ci-builders/. Docs are repointed at the workflows.

Publication is push-only

Every publishing job is gated on github.event_name == 'push'. A PR builds, smoke-tests and scans the images and the DEB, then throws them away. Jobs needing registry credentials skip on fork PRs.

The 256 go.mod / go.sum files

One commit, STAC-25466. inv check-mod-tidy is now a gate and the workspace manifests did not survive it. No version was picked by hand; this is what go mod tidy produces.

Validation

All three required aggregates green on 3e2a23fe, including the first full arm64 run. Branch is up to date with the base.

Jira: https://stackstate.atlassian.net/browse/STAC-25142
Sub-tasks merged into this branch: STAC-24889, 25429, 25457, 25459, 25461, 25466, 25494, 25498, 25500, 25536, 25575, 25583

[LouisParkin]

Added commit: Cerberus bearer token (STAC-25536)

Heads-up for anyone who already reviewed — one commit added on top: ed1f889f.

StackVista/cerberus#4 (STAC-24889) adds authentication to the Cerberus Lambda. The endpoint was previously completely unauthenticated — anyone who knew the URL could lock/unlock a protected branch or post as the Cerberus Slack bot. Every non-Slack request must now carry Authorization: Bearer <ssm:/cerberus/api-token>, compared constant-time in internal/auth/auth.go → verifyBearer.

That PR is still open, so cerberus-notify.yml as reviewed works today. The moment it deploys, the unauthenticated POST gets a 401, curl --fail reddens the notify job, and no Slack message is sent — the exact silent-failure condition the job exists to remove.

Sending the header now is forward-compatible (the deployed Lambda ignores unknown headers), so this is correct either side of that deploy and needs no coordination. Fixing it here rather than as a follow-up PR because this branch hasn't merged yet.

Changes

• cerberus-notify.yml: CERBERUS_API_TOKEN added to workflow_call.secrets + step env; bearer header on the POST; guard extended to both secrets.
• The three callers (build-binaries, build-deb, lint-and-unit-tests) pass the secret through.
• Dropped curl --verbose — it echoes request headers, which now include the token. GitHub would mask it, but not emitting it beats relying on masking.

CERBERUS_API_TOKEN already exists as a repo-level secret alongside CERBERUS_LAMBDA_URL (both provisioned 2026-08-04), so no pulumi-infra change is needed — verified against the repo's secret list.

required: false is deliberate and unchanged in spirit from the URL: passing ${{ secrets.X }} for a secret the repo lacks yields an empty string, which GitHub rejects against a required secret and fails the call before the guard can warn.

Validation

• zizmor: clean on all four workflows.
• actionlint: no new findings (only pre-existing self-hosted runner-label noise).
• actionlint negative control: renaming the secret to CERBERUS_API_TOKENN made it report "secret CERBERUS_API_TOKEN is not defined in ./.github/workflows/cerberus-notify.yml" for all three callers — proving the reusable-workflow call is genuinely resolved, not silently passed.
• Execution harness: extracted the real run: body and ran it against a stubbed curl. Bearer header is a single argv element; a hostile commit message ("quoted" $(whoami) + backticks, multi-line) is JSON-escaped into commit.title, not executed, first line only; all three missing-secret combinations warn and exit 0 with no curl call; empty commit message is safe under set -u.

The identical fix shipped for stackstate-process-agent in #253 (merged).

[LouisParkin]

Removed the whole-line comments from the five workflow YAML files in this PR, per house convention.

Shell comments inside run: blocks are left in place: those are script content rather than YAML commentary. The SHA-pin tag comments and the # zizmor: ignore[...] directives also stay, since both are functional.

The change is behaviour-neutral by construction. I parsed every file before and after the removal and confirmed the loaded YAML documents are structurally identical, and re-ran actionlint and zizmor (no findings).

Where a comment was carrying information a reader genuinely needs, the surrounding YAML already expresses it, for example through name: and description: fields.

[LouisParkin]

Do not merge yet — the DEB signing credentials are only half-provisioned.

pulumi-infra #283 merged and its apply partially succeeded: stackstate-agent now has the agent-pre-release environment (correctly restricted to protected branches) and the AGENT_PRERELEASE_ROLE_ARN variable, but zero secrets in the environment. The pulumi-infrastructure App lacks the environments permission, so it created the environment and then got 403 writing secrets into it (run 31400655652). Tracked as STAC-25571, approved to fix.

sign-and-publish-deb and publish-install-script are gated if: github.event_name == 'push', so nothing here exercises them and this PR stays green — they would fail on the first push to stackstate-7.78.2 after merge.

Safe to merge once the permission is granted and the pulumi apply is re-run green.

[LouisParkin]

Hold cleared — credentials are provisioned.

`agent-pre-release` environment on this repo now has all four `SIGNING_*` secrets, with a protected-branches-only deployment policy, and `AGENT_PRERELEASE_ROLE_ARN` is set. pulumi-infra #283 is merged and applied (run 31400655652).

Remaining blocker on this PR is review only.

[LouisParkin]

Unblocked — this now needs only a review.

pulumi-infra#286 merged and applied, so the release-branch protection reads:

CI success (lint and unit tests)
CI success (DEB package build)
CI success (binary builds)

All three report success on head 3e2a23fe. The two contexts that could never report (the Build … binary names, stale since the build jobs became an arch matrix) are gone, so BLOCKED is now just the one required approving review — enforce_admins is on, so it cannot be bypassed.