Fix/tflint and release ci gate

.github/workflows/ci.yml

@@ -2,9 +2,15 @@ name: Observability Platform CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - "fix/**"
+      - "feat/**"
+    tags:
+      - "v*"
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 permissions: read-all
 

.github/workflows/release.yml

@@ -4,21 +4,153 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing immutable SemVer tag to verify and release (for example v0.2.2)'
+        required: true
+        type: string
 
 permissions: read-all
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
-  release:
+  gate-ci-and-verify:
+    name: Gate Release on CI & Quality Verification
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve release tag
+        id: release
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          TAG="${INPUT_TAG:-${GITHUB_REF_NAME}}"
+          if ! [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "❌ Release tag must use vMAJOR.MINOR.PATCH[-PRERELEASE]: $TAG" >&2
+            exit 1
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout immutable release tag
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.release.outputs.tag }}
+          fetch-depth: 0
+
+      - name: Verify CI Check-Runs on Commit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "Verifying that commit ${{ github.sha }} has no failed CI check-runs..."
+          # Query GitHub API check-runs for this commit
+          FAILED_CHECKS=$(gh api "repos/${{ github.repository }}/commits/${{ github.sha }}/check-runs" \
+            --jq '.check_runs[] | select(.conclusion == "failure" and (.name | test("release|Release|gate-ci") | not)) | .name' || true)
+          if [ -n "$FAILED_CHECKS" ]; then
+            echo "❌ Cannot release: One or more CI check-runs failed on commit ${{ github.sha }}:" >&2
+            echo "$FAILED_CHECKS" >&2
+            exit 1
+          fi
+          echo "✅ No failed CI check-runs found on commit ${{ github.sha }}."
+
+      - name: Verify Version & Documentation Synchronization
+        env:
+          GIT_TAG: ${{ steps.release.outputs.tag }}
+        run: ./scripts/check_version.sh
+
+      - name: Install promtool and amtool
+        run: |
+          PROM_VERSION="2.51.0"
+          curl -fsSL "https://github.com/prometheus/prometheus/releases/download/v${PROM_VERSION}/prometheus-${PROM_VERSION}.linux-amd64.tar.gz" | tar -xz -C /tmp
+          echo "/tmp/prometheus-${PROM_VERSION}.linux-amd64" >> $GITHUB_PATH
+
+          AM_VERSION="0.27.0"
+          curl -fsSL "https://github.com/prometheus/alertmanager/releases/download/v${AM_VERSION}/alertmanager-${AM_VERSION}.linux-amd64.tar.gz" | tar -xz -C /tmp
+          echo "/tmp/alertmanager-${AM_VERSION}.linux-amd64" >> $GITHUB_PATH
+
+      - name: Validate Prometheus Alert Rules & Run Promtool Unit Tests
+        run: |
+          echo "Validating alert rules and running test suites..."
+          bash ./scripts/test_alerts.sh
+
+      - name: Validate Alertmanager Configuration
+        run: |
+          echo "Validating Alertmanager configuration..."
+          amtool check-config deploy/kubernetes/alerts/alertmanager.yaml
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          terraform_version: 1.7.5
+
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@90f302c255ef959cbfb4bd10581afecdb7ece3e6 # v4.1.1
+        with:
+          tflint_version: v0.51.1
+
+      - name: Validate Terraform Formatting, Syntax and TFLint
+        run: |
+          echo "Checking Terraform formatting..."
+          terraform -chdir=deploy/terraform fmt -check -recursive
+          echo "Validating Terraform modules and syntax..."
+          terraform -chdir=deploy/terraform init -backend=false
+          terraform -chdir=deploy/terraform validate
+          echo "Running TFLint..."
+          cd deploy/terraform
+          tflint --init
+          tflint --recursive
+
+      - name: Run End-to-End Telemetry Smoke Test
+        run: bash ./scripts/smoke_test.sh
+
+  publish:
+    name: Publish Release
+    needs: [gate-ci-and-verify]
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
+      - name: Resolve release tag
+        id: release
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          TAG="${INPUT_TAG:-${GITHUB_REF_NAME}}"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ steps.release.outputs.tag }}
+
+      - name: Check release status
+        id: release-status
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "Release $TAG already exists."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Create GitHub Release
+      - name: Create GitHub release
+        if: steps.release-status.outputs.exists == 'false'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ steps.release.outputs.tag }}
         run: |
-          gh release create "$TAG" --notes-file <(awk '/^## \[/{n++} n==1' CHANGELOG.md)
+          NOTES=$(mktemp)
+          awk -v ver="${TAG#v}" '
+            index($0, "## [" ver "]") == 1 { found=1; print; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' CHANGELOG.md > "$NOTES"
+          test -s "$NOTES" || {
+            echo "No CHANGELOG section found for $TAG" >&2
+            exit 1
+          }
+          gh release create "$TAG" --verify-tag --title "cloud-native-observability $TAG" --notes-file "$NOTES"

CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-[umesh0492@gmail.com](mailto:umesh0492@gmail.com).
+[security@abeta.dev](mailto:security@abeta.dev).
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Umesh Gupta (umesh0492)
+Copyright (c) 2026 Abeta.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -38,6 +38,18 @@ lint: ## Validate Kubernetes YAML and Helm values schemas
 	@echo "Linting Kubernetes and Alertmanager configurations..."
 	@which yamllint > /dev/null 2>&1 && yamllint -d relaxed deploy/ || echo "yamllint not installed, skipping syntax check"
 
+lint-terraform: ## Lint Terraform with TFLint and format check
+	@echo "Checking Terraform formatting..."
+	terraform -chdir=deploy/terraform fmt -check -recursive
+	@echo "Validating Terraform syntax..."
+	terraform -chdir=deploy/terraform init -backend=false
+	terraform -chdir=deploy/terraform validate
+	@echo "Running TFLint..."
+	cd deploy/terraform && tflint --init && tflint --recursive
+
+check-release-readiness: ## Verify repository readiness before tagging a release (usage: make check-release-readiness TAG=v0.2.2)
+	@./scripts/check_tag_readiness.sh $(TAG)
+
 clean: ## Remove temporary containers, networks, and volumes
 	docker compose -f $(COMPOSE_FILE) down -v --remove-orphans
 

README.md

@@ -2,7 +2,7 @@
 
 > **Note on Repository History**: History reconstructed on 2026-09-11; see [CHANGELOG.md](CHANGELOG.md) for the real feature timeline.
 
-[![CI](https://github.com/umesh0492/cloud-native-observability/actions/workflows/ci.yml/badge.svg)](https://github.com/umesh0492/cloud-native-observability/actions/workflows/ci.yml)
+[![CI](https://github.com/Abeta-dev/cloud-native-observability/actions/workflows/ci.yml/badge.svg)](https://github.com/Abeta-dev/cloud-native-observability/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Kubernetes](https://img.shields.io/badge/Kubernetes-v1.28+-326ce5.svg?logo=kubernetes&logoColor=white)](https://kubernetes.io)
 [![Prometheus](https://img.shields.io/badge/Prometheus-v2.51+-e6522c.svg?logo=prometheus&logoColor=white)](https://prometheus.io)
@@ -71,7 +71,7 @@ Experience the complete enterprise platform locally on your laptop with zero clo
 
 ```bash
 # Clone the repository
-git clone https://github.com/umesh0492/cloud-native-observability.git
+git clone https://github.com/Abeta-dev/cloud-native-observability.git
 cd cloud-native-observability
 
 # Spin up Prometheus, Loki, Tempo, OTel Collector, Grafana, Alertmanager, Demo App, and Traffic Generator
@@ -268,7 +268,7 @@ Read the full [Terraform Observability Guide](docs/TERRAFORM_GUIDE.md) for archi
 
 ## 🤝 Integration with `go-libs`
 
-Microservices built on [`github.com/umesh0492/go-libs`](https://github.com/umesh0492/go-libs) connect natively:
+Microservices built on [`github.com/Abeta-dev/go-libs`](https://github.com/Abeta-dev/go-libs) connect natively:
 1. **Metrics**: Scraped automatically via `ServiceMonitor` on `/metrics`.
 2. **APM & Traces**: Exported via `go-libs/apm` to OTel Collector on port `4317`.
 3. **Logs**: Structured JSON with `trace_id` fields auto-correlated in Grafana.
@@ -279,4 +279,4 @@ See the full [Integration Guide](docs/INTEGRATION_GUIDE.md) for copy-paste recip
 
 ## 📄 License
 
-MIT License. Copyright (c) 2026 Umesh Gupta ([umesh0492](https://github.com/umesh0492)).
+MIT License. Copyright (c) 2026 Abeta.

SECURITY.md

@@ -20,13 +20,13 @@ Instead, report vulnerabilities through one of the following confidential channe
 
 ### 1. GitHub Private Vulnerability Reporting (Preferred)
 Submit a confidential advisory directly via GitHub:
-- Navigate to the **Security** tab of `github.com/umesh0492/cloud-native-observability`.
+- Navigate to the **Security** tab of `github.com/Abeta-dev/cloud-native-observability`.
 - Click **"Report a vulnerability"** to open a private advisory draft.
 - Include a description, affected component(s) (e.g. Helm values, ArgoCD sync-waves, Terraform modules, or Docker Compose), reproduction steps, and potential impact.
 
 ### 2. Direct Security Contact
 If you cannot use GitHub Security Advisories, email the maintainer directly:
-- **Email**: [umesh0492@gmail.com](mailto:umesh0492@gmail.com)
+- **Email**: [security@abeta.dev](mailto:security@abeta.dev)
 - **Subject**: `[SECURITY] cloud-native-observability Vulnerability Report: <Component>`
 - Please include reproduction steps and deployment target details.
 

deploy/docker-compose/prometheus/alerts-test.yaml

@@ -27,7 +27,7 @@ tests:
             exp_annotations:
               summary: "Service instance cno-demo-app:8080 is down"
               description: "Service target cno-demo-app:8080 of job demo-app has been unreachable for more than 1 minute."
-              runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#servicedown"
+              runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#servicedown"
 
   # ---------------------------------------------------------------------------
   # Test 2: HighErrorRate Alert (>1% 5xx over 5m)
@@ -52,7 +52,7 @@ tests:
             exp_annotations:
               summary: "High HTTP 5xx error rate detected"
               description: "HTTP 5xx error rate exceeds 1% (0.01) over the last 5 minutes on demo-app (demo-app:8080)."
-              runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#higherrorrate"
+              runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#higherrorrate"
 
   # ---------------------------------------------------------------------------
   # Test 3: HighLatencyP99 Alert (>1.0s P99)
@@ -80,7 +80,7 @@ tests:
             exp_annotations:
               summary: "High P99 latency breach"
               description: "P99 HTTP request duration for service demo-app exceeds 1.0s over the last 5 minutes."
-              runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#highlatencyp99"
+              runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#highlatencyp99"
 
   # ---------------------------------------------------------------------------
   # Test 4: WorkerpoolQueueNearFull Alert (>85% capacity)
@@ -104,4 +104,4 @@ tests:
             exp_annotations:
               summary: "Worker pool queue near full capacity"
               description: "Worker pool queue depth exceeds 85% of total capacity on instance demo-app:8080."
-              runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#workerpoolqueuenearfull"
+              runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#workerpoolqueuenearfull"

deploy/docker-compose/prometheus/alerts.yml

@@ -15,7 +15,7 @@ groups:
         annotations:
           summary: "Service instance {{ $labels.instance }} is down"
           description: "Service target {{ $labels.instance }} of job {{ $labels.job }} has been unreachable for more than 1 minute."
-          runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#servicedown"
+          runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#servicedown"
 
       # -------------------------------------------------------------------------
       # 2. Errors: High Error Rate (> 1% 5xx over 5 minutes)
@@ -28,7 +28,7 @@ groups:
         annotations:
           summary: "High HTTP 5xx error rate detected"
           description: "HTTP 5xx error rate exceeds 1% (0.01) over the last 5 minutes on {{ $labels.service }} ({{ $labels.instance }})."
-          runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#higherrorrate"
+          runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#higherrorrate"
 
       # -------------------------------------------------------------------------
       # 3. Latency: High P99 Duration (> 1.0s over 5 minutes)
@@ -41,7 +41,7 @@ groups:
         annotations:
           summary: "High P99 latency breach"
           description: "P99 HTTP request duration for service {{ $labels.service }} exceeds 1.0s over the last 5 minutes."
-          runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#highlatencyp99"
+          runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#highlatencyp99"
 
       # -------------------------------------------------------------------------
       # 4. Saturation: Worker Pool Queue Near Full (> 85% capacity)
@@ -54,4 +54,4 @@ groups:
         annotations:
           summary: "Worker pool queue near full capacity"
           description: "Worker pool queue depth exceeds 85% of total capacity on instance {{ $labels.instance }}."
-          runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#workerpoolqueuenearfull"
+          runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#workerpoolqueuenearfull"

deploy/kubernetes/alerts/k8s-node-alerts.yaml

@@ -18,7 +18,7 @@ spec:
           annotations:
             summary: "Kubernetes node is not ready"
             description: "Node {{ $labels.node }} has been unready for more than 5 minutes."
-            runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodenotready"
+            runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodenotready"
 
         - alert: KubeNodeMemoryPressure
           expr: kube_node_status_condition{condition="MemoryPressure",status="true"} == 1
@@ -28,7 +28,7 @@ spec:
           annotations:
             summary: "Node is experiencing memory pressure"
             description: "Node {{ $labels.node }} has memory pressure condition active."
-            runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodememorypressure"
+            runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodememorypressure"
 
         - alert: KubeNodeDiskPressure
           expr: kube_node_status_condition{condition="DiskPressure",status="true"} == 1
@@ -38,7 +38,7 @@ spec:
           annotations:
             summary: "Node is experiencing disk pressure"
             description: "Node {{ $labels.node }} has low available disk space (<10% free)."
-            runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodediskpressure"
+            runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubenodediskpressure"
 
         - alert: KubePodCrashLooping
           expr: rate(kube_pod_container_status_restarts_total[5m]) * 60 > 2
@@ -48,7 +48,7 @@ spec:
           annotations:
             summary: "Pod is CrashLooping"
             description: "Pod {{ $labels.namespace }}/{{ $labels.pod }} container {{ $labels.container }} is restarting frequently (>2 restarts/min)."
-            runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubepodcrashlooping"
+            runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubepodcrashlooping"
 
         - alert: KubeDeploymentReplicasMismatch
           expr: kube_deployment_status_replicas_available != kube_deployment_spec_replicas
@@ -58,4 +58,4 @@ spec:
           annotations:
             summary: "Deployment available replicas mismatch"
             description: "Deployment {{ $labels.namespace }}/{{ $labels.deployment }} has fewer replicas available than desired for >10 minutes."
-            runbook_url: "https://github.com/umesh0492/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubedeploymentreplicasmismatch"
+            runbook_url: "https://github.com/Abeta-dev/cloud-native-observability/blob/main/docs/RUNBOOKS.md#kubedeploymentreplicasmismatch"