sonupreetam · sonupreetam · May 8, 2026 · May 25, 2026
diff --git a/.github/workflows/ci_local.yml b/.github/workflows/ci_local.yml
@@ -15,17 +15,30 @@ permissions:
   security-events: none
 
 env:
-  GO_VERSION: 1.25
-  GOLANGCI_LINT_VERSION: v2.5
+  GO_VERSION: 1.26
+  GOLANGCI_LINT_VERSION: v2.12
   WEAVER_VERSION: v0.21.2
+  UBI_BASE_PACKAGES: git-core
 
 jobs:
   detect-modules:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
     outputs:
       modules: "${{ steps.set-modules.outputs.modules }}"
     steps:
+      - name: Install prerequisites
+        run: dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }} jq
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      # Workaround: actions/checkout set-safe-directory does not reliably
+      # persist in container jobs — the gitconfig it writes can land in a
+      # HOME that subsequent tools don't read.
+      # See: https://github.com/actions/checkout/issues/1048
+      #      https://github.com/actions/runner/issues/2033
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -44,11 +57,25 @@ jobs:
   golangci-lint:
     needs: detect-modules
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
     strategy:
       matrix:
         modules: "${{ fromJSON(needs.detect-modules.outputs.modules) }}"
+    env:
+      # Each module is linted independently via the matrix; disable workspace
+      # mode so golangci-lint does not pass -mod=mod (forbidden in workspace).
+      GOWORK: "off"
+      # VCS stamping is irrelevant for linting; disable it so golangci-lint
+      # never shells out to git for build metadata.
+      GOFLAGS: "-buildvcs=false"
     steps:
+      - name: Install prerequisites
+        run: dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }}
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -60,8 +87,15 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
     steps:
+      - name: Install prerequisites
+        run: dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }}
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -77,11 +111,22 @@ jobs:
 
   weave-check:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
     permissions:
       contents: read
     steps:
+      - name: Install prerequisites
+        run: dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }} xz
+
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "${{ env.GO_VERSION }}"
 
       - name: Install Task
         uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
@@ -90,15 +135,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install weaver
-        run: |
-          echo "Installing weaver ${{ env.WEAVER_VERSION }}"
-          curl -fL -o /tmp/weaver.tar.xz "https://github.com/open-telemetry/weaver/releases/download/${{ env.WEAVER_VERSION }}/weaver-x86_64-unknown-linux-gnu.tar.xz"
-          mkdir -p "${HOME}/bin"
-          tar -xJf /tmp/weaver.tar.xz
-          mv weaver-x86_64-unknown-linux-gnu/weaver "${HOME}/bin/weaver"
-          chmod +x "${HOME}/bin/weaver"
-          echo "${HOME}/bin" >> "${GITHUB_PATH}"
-          rm -rf "weaver-x86_64-unknown-linux-gnu/"
+        run: task tools:install-weaver
 
       - name: Setup Go workspace
         run: task workspace
@@ -111,8 +148,15 @@ jobs:
 
   verify-codegen:
     runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
     steps:
+      - name: Install prerequisites
+        run: dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }} xz
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: "${{ env.GO_VERSION }}"
@@ -124,15 +168,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install weaver
-        run: |
-          echo "Installing weaver ${{ env.WEAVER_VERSION }}"
-          curl -fL -o /tmp/weaver.tar.xz "https://github.com/open-telemetry/weaver/releases/download/${{ env.WEAVER_VERSION }}/weaver-x86_64-unknown-linux-gnu.tar.xz"
-          mkdir -p "${HOME}/bin"
-          tar -xJf /tmp/weaver.tar.xz
-          mv weaver-x86_64-unknown-linux-gnu/weaver "${HOME}/bin/weaver"
-          chmod +x "${HOME}/bin/weaver"
-          echo "${HOME}/bin" >> "${GITHUB_PATH}"
-          rm -rf weaver-x86_64-unknown-linux-gnu/
+        run: task tools:install-weaver
 
       - name: Install oapi-codegen
         run: go install github.com/oapi-codegen/oapi-codegen/v2/cmd/oapi-codegen@v2.5.0
@@ -168,3 +204,56 @@ jobs:
           else
             echo "SUCCESS: No diffs detected. Code generation is up to date."
           fi
+
+  integration-test:
+    runs-on: ubuntu-latest
+    container:
+      image: registry.access.redhat.com/ubi10/ubi:10.2@sha256:f56ffeed0a79e53594be6164adfb199a4c4ed8925098f5905b0875f0edb46aa1
+      # SECURITY: --privileged required for container-in-container scenario
+      # GitHub Actions containers use overlayfs which conflicts with Podman's
+      # default overlay driver. VFS storage + privileged mode enables Podman
+      # to manage container networking and storage inside the CI container.
+      options: --privileged
+    needs: [test]
+    steps:
+      - name: Install prerequisites
+        run: |
+          dnf install -y --nodocs ${{ env.UBI_BASE_PACKAGES }} podman openssl python3-pip python3-pyyaml perl
+          pip install --require-hashes --no-deps -r /dev/stdin <<'EOF'
+          python-dotenv==1.2.2 --hash=sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a
+          podman-compose==1.5.0 --hash=sha256:f0b9d35f4da1b309172adf208a5cb7a882b532a834c2202666c1988b6f147546
+          EOF
+
+      # Podman's default overlay driver cannot stack on the overlayfs
+      # backing the GitHub Actions container job — use vfs instead.
+      - name: Configure Podman storage for nested containers
+        run: |
+          mkdir -p /etc/containers
+          printf '[storage]\ndriver = "vfs"\n' > /etc/containers/storage.conf
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trust workspace directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "${{ env.GO_VERSION }}"
+
+      - name: Install Task
+        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0
+        with:
+          version: 3.x
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup workspace
+        run: task workspace
+
+      - name: Run integration tests
+        run: task integration:test
+
+      - name: Upload test results
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: integration-test-results
+          path: .test-output/integration/
+          retention-days: 7
diff --git a/.github/workflows/ci_version_sync.yml b/.github/workflows/ci_version_sync.yml
@@ -1,19 +1,23 @@
 # Version Synchronization Check
 # =============================
-# Ensures beacon-distro manifest.yaml stays in sync with truthbeam OTel versions
+# Ensures Go and OTel versions are aligned across all modules,
+# Containerfiles, manifest, and CI workflows.
 
 name: Version Sync Check
 
 on:
   pull_request:
     paths:
-      - 'truthbeam/go.mod'
+      - 'go.work'
+      - '**/go.mod'
       - 'beacon-distro/manifest.yaml'
       - 'beacon-distro/Containerfile.collector'
+      - 'tests/integration/mock-compass/Containerfile'
   push:
     branches: [main]
     paths:
-      - 'truthbeam/go.mod'
+      - 'go.work'
+      - '**/go.mod'
       - 'beacon-distro/manifest.yaml'
 
 # Minimal permissions at workflow level
@@ -32,23 +36,5 @@ jobs:
           version: 3.x
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Check Go version alignment
-        run: task version:check-go-version
-
-      - name: Check OTel version alignment
-        run: task version:check-otel-versions
-
-      - name: Verify manifest can be synced
-        run: |
-          # Run sync in dry-run mode (save original first)
-          cp beacon-distro/manifest.yaml /tmp/manifest.yaml.orig
-          task version:sync-otel-versions
-
-          # Check if there are differences
-          if ! diff -q beacon-distro/manifest.yaml /tmp/manifest.yaml.orig; then
-            echo "ERROR: manifest.yaml is out of sync with truthbeam"
-            echo "Run 'task version:sync-otel-versions' locally and commit the changes"
-            exit 1
-          fi
-
-          echo "✓ manifest.yaml is in sync"
+      - name: Check version alignment
+        run: task version:check
diff --git a/.github/workflows/verify-ubi-build.yml b/.github/workflows/verify-ubi-build.yml
@@ -0,0 +1,29 @@
+name: Verify UBI Build
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-collector:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Build collector image with UBI Containerfile
+        run: |
+          echo "=== Building collector with UBI10 Containerfile ==="
+          podman build -f beacon-distro/Containerfile.collector \
+            -t complybeacon/collector:verify \
+            beacon-distro/ 2>&1
+
+      - name: Verify image
+        run: |
+          echo "=== Image details ==="
+          podman inspect complybeacon/collector:verify --format '{{.Os}}/{{.Architecture}}'
+          echo "=== Check CA bundle exists ==="
+          podman run --rm complybeacon/collector:verify \
+            ls -la /etc/pki/tls/certs/ca-bundle.crt
+          echo "=== Collector version ==="
+          podman run --rm complybeacon/collector:verify --version
diff --git a/.gitignore b/.gitignore
@@ -17,6 +17,7 @@ coverage.*
 *.coverprofile
 profile.cov
 .test-output/
+*.log
 
 # Dependency directories (remove the comment below to include it)
 vendor/
@@ -41,9 +42,8 @@ megalinter-reports/
 bin/
 data/
 
-# self-signed certificate
-hack/self-signed-cert/compass*
-hack/self-signed-cert/truthbeam*
+# self-signed certificates (generated by task infra:generate-self-signed-cert)
+certs/
 
 # Unbound Force — managed by uf init
 # Runtime data under .uf/ (databases, caches, locks, logs)
@@ -67,10 +67,3 @@ hack/self-signed-cert/truthbeam*
 .unbound-force/
 .muti-mind/
 .mx-f/
-
-# Unbound Force convention packs not applicable to this repository
-.opencode/uf/packs/typescript.md
-.opencode/uf/packs/typescript-custom.md
-
-# MegaLinter generated reports
-megalinter-reports/
diff --git a/.gitleaks.toml b/.gitleaks.toml
@@ -0,0 +1,2 @@
+[extend]
+useDefault = true
diff --git a/.taskfiles/dev.yml b/.taskfiles/dev.yml
@@ -25,9 +25,7 @@ tasks:
   test:
     desc: Run unit tests with coverage and version checks for all modules
     cmds:
-      - task: :version:check-go-version
-      - task: :version:check-go-mod-consistency
-      - task: :version:check-otel-versions
+      - task: :version:check
       - mkdir -p {{.TEST_DIR}}
       - bash {{.ROOT_DIR}}/.taskfiles/scripts/go-module-runner.sh test
 

diff --git a/.taskfiles/infra.yml b/.taskfiles/infra.yml
@@ -1,8 +1,8 @@
 version: '3'
 
 vars:
-  CERT_DIR: '{{.CERT_DIR | default (printf "%s/hack/self-signed-cert" .ROOT_DIR)}}'
-  OPENSSL_CNF: '{{.CERT_DIR}}/openssl.cnf'
+  CERT_DIR: '{{.CERT_DIR | default (printf "%s/certs" .ROOT_DIR)}}'
+  OPENSSL_CNF: '{{.ROOT_DIR}}/configs/openssl.cnf'
   IMAGE: '{{.IMAGE | default "complybeacon/collector"}}'
   TAG: '{{.TAG | default "latest"}}'
 
@@ -15,13 +15,53 @@ tasks:
     desc: Build the beacon collector container image
     cmds:
       - task: :dev:deps
-      - task: :version:sync-otel-versions
+      - task: :version:sync
       - podman build -f Containerfile.collector -t {{.IMAGE}}:{{.TAG}} {{.ROOT_DIR}}/beacon-distro
 
+  generate-self-signed-cert:
+    desc: Generate self-signed certificates for compass, truthbeam, and rustfs
+    cmds:
+      - rm -rf {{.CERT_DIR}} && mkdir -p {{.CERT_DIR}}
+      - echo "--- Generating self-signed certificates in {{.CERT_DIR}} ---"
+      - openssl genrsa -out {{.CERT_DIR}}/truthbeam.key 2048
+      - cmd: |
+          openssl req -x509 -new -nodes -key {{.CERT_DIR}}/truthbeam.key -sha256 -days 365 \
+            -subj "/CN=ComplyBeacon Root CA" \
+            -extensions v3_ca -config {{.OPENSSL_CNF}} \
+            -out {{.CERT_DIR}}/truthbeam.crt
+      - openssl genrsa -out {{.CERT_DIR}}/compass.key 2048
+      - openssl req -new -key {{.CERT_DIR}}/compass.key -out {{.CERT_DIR}}/compass.csr -config {{.OPENSSL_CNF}}
+      - cmd: |
+          openssl x509 -req -in {{.CERT_DIR}}/compass.csr -CA {{.CERT_DIR}}/truthbeam.crt -CAkey {{.CERT_DIR}}/truthbeam.key -CAcreateserial \
+            -out {{.CERT_DIR}}/compass.crt -days 365 -sha256 \
+            -extfile {{.OPENSSL_CNF}} -extensions v3_req
+      - openssl genrsa -out {{.CERT_DIR}}/rustfs.key 2048
+      - cmd: |
+          openssl req -new -key {{.CERT_DIR}}/rustfs.key -out {{.CERT_DIR}}/rustfs.csr \
+            -subj "/C=US/ST=California/L=San Francisco/O=ComplyBeacon/OU=Dev/CN=rustfs-tls"
+      - cmd: |
+          # Create temporary extension file for RustFS certificate
+          cat > {{.CERT_DIR}}/rustfs_ext.cnf << EOF
+          [v3_req]
+          subjectAltName = @alt_names
+          basicConstraints = CA:FALSE
+
+          [alt_names]
+          DNS.1 = rustfs-tls
+          DNS.2 = localhost
+          IP.1 = 127.0.0.1
+          EOF
+          openssl x509 -req -in {{.CERT_DIR}}/rustfs.csr -CA {{.CERT_DIR}}/truthbeam.crt -CAkey {{.CERT_DIR}}/truthbeam.key -CAcreateserial \
+            -out {{.CERT_DIR}}/rustfs.crt -days 365 -sha256 \
+            -extensions v3_req -extfile {{.CERT_DIR}}/rustfs_ext.cnf
+          rm {{.CERT_DIR}}/rustfs_ext.cnf
+      - chmod 644 {{.CERT_DIR}}/*.key
+      - echo "--- Certificates generated successfully ---"
+
   deploy:
     desc: Deploy infra (auto-syncs OTel versions first)
     cmds:
-      - task: :version:sync-otel-versions
+      - task: :version:sync
       - podman-compose -f compose.yaml up
 
   undeploy: