Operationalization Release P0: release integrity and trust hardening

.github/CODEOWNERS

@@ -1,7 +1,4 @@
-/specs/                         @program-governance @scientific-review
-/schemas/                       @data-architecture
-/src/weather_platform/scientific/ @probabilistic-modeling @independent-verification
-/deploy/                        @platform-sre @security-architecture
-/apps/operator-console/         @platform-sre @product-security
-/.github/workflows/             @platform-sre @product-security
-/docs/NETWORK_BOUNDARY.md       @security-architecture
+# The repository is currently owned by a personal account, so organization
+# team handles cannot enforce reviews here. Replace this fallback with real
+# organization teams after repository migration.
+* @Protonmatter

.github/PULL_REQUEST_TEMPLATE/default.md

@@ -2,6 +2,9 @@
 
 ## Requirement IDs
 
+- Specifications:
+- Requirements:
+
 ## Scientific impact
 
 - Baseline:

.github/dependabot.yml

@@ -0,0 +1,59 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: America/New_York
+    open-pull-requests-limit: 10
+    groups:
+      python-production:
+        dependency-type: production
+        update-types: [minor, patch]
+      python-development:
+        dependency-type: development
+        update-types: [minor, patch]
+    ignore:
+      - dependency-name: "*"
+        update-types: [version-update:semver-major]
+
+  - package-ecosystem: npm
+    directory: /apps/operator-console
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:20"
+      timezone: America/New_York
+    open-pull-requests-limit: 10
+    groups:
+      operator-console-production:
+        dependency-type: production
+        update-types: [minor, patch]
+      operator-console-development:
+        dependency-type: development
+        update-types: [minor, patch]
+    ignore:
+      - dependency-name: "*"
+        update-types: [version-update:semver-major]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:40"
+      timezone: America/New_York
+    groups:
+      github-actions:
+        patterns: ["*"]
+
+  - package-ecosystem: docker
+    directory: /deploy/docker
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: America/New_York
+

.github/workflows/build-image.yml

@@ -1,34 +1,65 @@
 name: build-image
 
 on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
 
+concurrency:
+  group: release-image-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: [self-hosted, linux, weather-build]
+    environment: release
     timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
-      - name: Require internal registry configuration
+      - name: Require internal release configuration
         run: |
           test -n "${{ vars.INTERNAL_REGISTRY }}"
           test -n "${{ vars.PYTHON_BASE_IMAGE }}"
+          test -n "${{ vars.PYPI_MIRROR_URL }}"
+          test -n "${{ vars.PYPI_MIRROR_ORIGIN }}"
+          test -n "${INTERNAL_RELEASE_ATTEST_COMMAND:-}"
+          test -f requirements/production.lock
+          test -f requirements/ci.lock
       - name: Build wheelhouse from the internal mirror
         env:
           PIP_INDEX_URL: ${{ vars.PYPI_MIRROR_URL }}
+          PYPI_MIRROR_ORIGIN: ${{ vars.PYPI_MIRROR_ORIGIN }}
           IMAGE: ${{ vars.INTERNAL_REGISTRY }}/weather/platform:${{ github.sha }}
           BASE_IMAGE: ${{ vars.PYTHON_BASE_IMAGE }}
+          INTERNAL_REGISTRY: ${{ vars.INTERNAL_REGISTRY }}
         run: ./scripts/build_image.sh
-      - name: Run internal artifact policy and signing
+      - name: Push, scan, sign, and attest internally
         env:
           IMAGE: ${{ vars.INTERNAL_REGISTRY }}/weather/platform:${{ github.sha }}
+          RELEASE_IMAGE_REF_FILE: release/image-ref.txt
         run: |
-          test -n "${INTERNAL_RELEASE_ATTEST_COMMAND:-}"
+          mkdir -p release
           bash -lc "$INTERNAL_RELEASE_ATTEST_COMMAND"
+          test -s "$RELEASE_IMAGE_REF_FILE"
+      - name: Render immutable release evidence
+        run: |
+          PYTHONPATH=src python -m scripts.render_release_manifest \
+            --source deploy/k8s/weather-acquisition.yaml \
+            --output release/weather-acquisition.yaml \
+            --image-reference-file release/image-ref.txt \
+            --expected-repository "${{ vars.INTERNAL_REGISTRY }}/weather/platform" \
+            --metadata release/release-metadata.json \
+            --git-sha "${GITHUB_SHA}" \
+            --production-lock requirements/production.lock \
+            --ci-lock requirements/ci.lock
+          ! grep -q 'sha256:0000000000000000000000000000000000000000000000000000000000000000' \
+            release/weather-acquisition.yaml
+      - name: Upload release evidence
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: weather-release-${{ github.sha }}
+          path: release/
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/ci-bootstrap.yml

@@ -4,9 +4,8 @@
 name: ci-bootstrap
 
 on:
+  workflow_call:
   pull_request:
-  push:
-    branches: [main]
 
 permissions:
   contents: read
@@ -21,12 +20,22 @@ jobs:
       - name: Install Python 3.12
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
-          python-version: '3.12'
+          python-version-file: '.python-version'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install (with the ecCodes decode extra)
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Lint
         run: PATH="$PWD/.venv/bin:$PATH" make lint
       - name: Type check

.github/workflows/continuous-delivery.yml

@@ -0,0 +1,22 @@
+name: continuous-delivery
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: continuous-delivery-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  continuous-integration:
+    uses: ./.github/workflows/continuous-integration.yml
+  immutable-release:
+    needs: continuous-integration
+    uses: ./.github/workflows/build-image.yml
+

.github/workflows/continuous-integration.yml

@@ -0,0 +1,30 @@
+name: continuous-integration
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  specification:
+    uses: ./.github/workflows/spec-validation.yml
+  dependency-locks:
+    uses: ./.github/workflows/python-lock.yml
+  python-quality:
+    uses: ./.github/workflows/ci-bootstrap.yml
+  python-fast:
+    uses: ./.github/workflows/pr-fast.yml
+  schema-contract:
+    uses: ./.github/workflows/schema-contract.yml
+  weather-contract:
+    uses: ./.github/workflows/weather-contract.yml
+  scientific-validation:
+    uses: ./.github/workflows/scientific-validation.yml
+  weather-integration:
+    uses: ./.github/workflows/weather-integration.yml
+  operator-console:
+    uses: ./.github/workflows/operator-console.yml
+  end-to-end:
+    uses: ./.github/workflows/end-to-end.yml
+

.github/workflows/end-to-end.yml

@@ -0,0 +1,80 @@
+name: end-to-end
+
+on:
+  workflow_call:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'apps/operator-console/**'
+      - 'requirements/ci.lock'
+      - 'pyproject.toml'
+      - 'specs/**'
+      - 'scripts/validate_dependency_policy.py'
+      - '.github/dependabot.yml'
+      - '.github/workflows/end-to-end.yml'
+      - '.github/workflows/continuous-integration.yml'
+      - '.github/workflows/continuous-delivery.yml'
+      - '.github/workflows/build-image.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: end-to-end-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - name: Install Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version-file: '.python-version'
+          cache: pip
+          cache-dependency-path: requirements/ci.lock
+      - name: Install hash-pinned Python graph
+        run: |
+          python -m venv .venv
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
+      - name: Validate specifications and dependency policy
+        run: PATH="$PWD/.venv/bin:$PATH" make validate
+      - name: Install Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version-file: apps/operator-console/.nvmrc
+          cache: npm
+          cache-dependency-path: apps/operator-console/package-lock.json
+      - name: Install locked operator-console graph
+        working-directory: apps/operator-console
+        run: npm run install:ci
+      - name: Build deployable operator-console worker
+        working-directory: apps/operator-console
+        run: npm run build
+      - name: Run process-boundary end-to-end verification
+        working-directory: apps/operator-console
+        env:
+          PYTHON_BIN: ${{ github.workspace }}/.venv/bin/python
+        run: |
+          mkdir -p ../../artifacts
+          node --test --test-reporter=junit tests/control-plane.e2e.test.mjs \
+            > ../../artifacts/end-to-end-junit.xml
+      - name: Upload end-to-end evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: end-to-end-${{ github.sha }}
+          path: artifacts/end-to-end-junit.xml
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/operator-console.yml

@@ -1,18 +1,12 @@
 name: operator-console
 
 on:
+  workflow_call:
   pull_request:
     paths:
       - 'apps/operator-console/**'
       - 'Makefile'
       - '.github/workflows/operator-console.yml'
-  push:
-    branches: [main]
-    paths:
-      - 'apps/operator-console/**'
-      - 'Makefile'
-      - '.github/workflows/operator-console.yml'
-
 permissions:
   contents: read
 
@@ -29,7 +23,7 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
-          node-version: '22.13.1'
+          node-version-file: apps/operator-console/.nvmrc
           cache: npm
           cache-dependency-path: apps/operator-console/package-lock.json
       - name: Install locked dependencies

.github/workflows/pr-fast.yml

@@ -1,9 +1,8 @@
 name: pr-fast
 
 on:
+  workflow_call:
   pull_request:
-  push:
-    branches: [main]
 
 permissions:
   contents: read
@@ -18,12 +17,22 @@ jobs:
       - name: Install Python 3.12
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
-          python-version: '3.12'
+          python-version-file: '.python-version'
           cache: pip
+          cache-dependency-path: requirements/ci.lock
       - name: Create isolated environment
         run: python -m venv .venv
-      - name: Install
-        run: .venv/bin/python -m pip install -e '.[dev,eccodes]'
+      - name: Install hash-pinned dependencies
+        run: |
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --require-hashes \
+            --requirement requirements/ci.lock
+          .venv/bin/python -m pip install \
+            --disable-pip-version-check \
+            --no-build-isolation \
+            --no-deps \
+            --editable .
       - name: Lint
         run: PATH="$PWD/.venv/bin:$PATH" make lint
       - name: Type check