Persistent drive leases, reconciliation, NAS persistence, protocol rig, compat capture, MFA pending, capacity budget

.github/actionlint.yaml

@@ -0,0 +1,4 @@
+self-hosted-runner:
+  labels:
+    - i3
+    - openblade-production

.github/workflows/_emulator-boot-test.yml

@@ -0,0 +1,112 @@
+# Reusable: boot the mock-backend emulator API on 127.0.0.1:8000, wait for
+# /health, then run pytest against it. Callers: emulator-change-gates.yml,
+# i3-emulator-compliance.yml. Check names become "<caller job> / boot-test".
+name: _emulator-boot-test
+
+on:
+  workflow_call:
+    inputs:
+      timing_profile:
+        description: I3_TIMING_PROFILE for both the server and pytest.
+        type: string
+        default: instant
+      pytest_args:
+        description: >-
+          Space-separated pytest arguments (paths, -m, -q ...). Word-split by
+          the shell on purpose; must not contain quotes.
+        type: string
+        required: true
+      followup_pytest_args:
+        description: Optional second pytest run against the same booted API.
+        type: string
+        default: ""
+      python_version:
+        type: string
+        default: "3.12"
+      emulator_profile:
+        description: EMULATOR_PROFILE for the booted server and pytest ("" = default shape).
+        type: string
+        default: ""
+      validate_contract:
+        description: Run tools/emulator_spec/validate_cross_repo_contract.py first.
+        type: boolean
+        default: true
+      db_name:
+        description: Basename of the throwaway sqlite DB under /tmp.
+        type: string
+        default: openblade-emulator
+      artifact_name:
+        description: Upload test-results/ + the API log under this name ("" = no upload).
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  boot-test:
+    name: boot-test
+    runs-on: ubuntu-latest
+    env:
+      I3_TEST_MODE: emulator
+      I3_TIMING_PROFILE: ${{ inputs.timing_profile }}
+      I3_AML_URL: http://127.0.0.1:8000
+      PYTEST_ARGS: ${{ inputs.pytest_args }}
+      FOLLOWUP_PYTEST_ARGS: ${{ inputs.followup_pytest_args }}
+      DB_PATH: /tmp/${{ inputs.db_name }}.db
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      # Job-wide EMULATOR_PROFILE only when one was given: an empty value must
+      # mean "unset" (default shape) for every later step, not "profile named ''".
+      - name: Export EMULATOR_PROFILE
+        env:
+          PROFILE: ${{ inputs.emulator_profile }}
+        run: |
+          if [ -n "$PROFILE" ]; then echo "EMULATOR_PROFILE=$PROFILE" >> "$GITHUB_ENV"; fi
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: ${{ inputs.python_version }}
+          cache: "pip"
+      - run: pip install -e '.[dev]'
+      - if: ${{ inputs.validate_contract }}
+        run: python3 tools/emulator_spec/validate_cross_repo_contract.py
+      - run: python3 tools/emulator_spec/generate_matrix_endpoint_catalog.py
+      - name: Boot emulator API
+        run: |
+          rm -f "$DB_PATH"
+          OPENBLADE_BACKEND=mock OPENBLADE_DB_URL="sqlite:///$DB_PATH" \
+            nohup uvicorn openblade.api.main:app --host 127.0.0.1 --port 8000 >/tmp/openblade-api.log 2>&1 &
+      - name: Wait for API health
+        run: |
+          python - <<'PY'
+          import time
+          import urllib.request
+          for _ in range(60):
+              try:
+                  with urllib.request.urlopen("http://127.0.0.1:8000/health", timeout=2) as response:
+                      if response.status == 200:
+                          raise SystemExit(0)
+              except Exception:
+                  time.sleep(1)
+          raise SystemExit("API did not become healthy in time")
+          PY
+      - run: mkdir -p test-results
+      - name: Run pytest against the booted emulator
+        run: |
+          # shellcheck disable=SC2086 # PYTEST_ARGS is a word list by contract
+          python -m pytest $PYTEST_ARGS
+      - name: Follow-up pytest run
+        if: ${{ inputs.followup_pytest_args != '' }}
+        run: |
+          # shellcheck disable=SC2086 # word list by contract
+          python -m pytest $FOLLOWUP_PYTEST_ARGS
+      - name: Upload artifacts
+        if: ${{ always() && inputs.artifact_name != '' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: |
+            test-results/
+            /tmp/openblade-api.log

.github/workflows/auto-merge-trusted.yml

@@ -1,23 +1,28 @@
 name: Auto-merge trusted PRs
 
-on:
+# dangerous-triggers is ignored on `on:` below: this workflow runs only the GitHub API via
+# github-script on the trusted-author allowlist; never checks out or executes
+# PR code, which is what makes workflow_run dangerous.
+on:  # zizmor: ignore[dangerous-triggers] -- see comment above
   workflow_run:
     workflows: ["CI"]
     types: [completed]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   merge-trusted-pr:
     if: >
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'pull_request'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Merge trusted PRs targeting master
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7.1.0
         with:
           script: |
             const owner = context.repo.owner;

.github/workflows/ci.yml

@@ -26,8 +26,10 @@ jobs:
       cicd: ${{ steps.filter.outputs.cicd }}
       wiki: ${{ steps.filter.outputs.wiki }}
     steps:
-      - uses: actions/checkout@v5
-      - uses: dorny/paths-filter@v3
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad  # v3.0.4
         id: filter
         with:
           filters: |
@@ -99,8 +101,10 @@ jobs:
     # goes red, the fix is `ruff check --fix` / `ruff format` with the PINNED
     # version, never a version bump in the same change.
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -122,8 +126,10 @@ jobs:
     # `# type: ignore` comments left in openblade/ (down from 18) carries its
     # justification at the site.
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -136,8 +142,10 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.backend == 'true' || needs.changes.outputs.api == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -162,8 +170,10 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.api == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -185,8 +195,10 @@ jobs:
     env:
       I3_TIMING_PROFILE: instant
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -216,8 +228,10 @@ jobs:
       run:
         working-directory: frontend
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: "20"
           cache: "npm"
@@ -234,17 +248,16 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.webflask == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
       - run: pip install -e '.[dev]'
-      # BLOCKING mypy, scoped to this package alone. `mypy openblade` in
-      # backend-typecheck has to stay advisory because of ~300 pre-existing errors
-      # in the god-file modules; openblade/web_flask is clean under strict mode
-      # today, and this job is what keeps it that way instead of letting it join
-      # the backlog.
+      # BLOCKING mypy, scoped to this package alone, so a web_flask-only change
+      # is gated here too (backend-typecheck is path-filtered to backend paths).
       - run: mypy openblade/web_flask
       # Redundant with backend-tests (tests/unit covers this file) but kept so the
       # job is a complete gate on its own for a web_flask-only change. Seconds.
@@ -260,8 +273,10 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.wiki == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -278,8 +293,10 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.changes.outputs.cicd == 'true' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
       - run: python -m pip install --upgrade pip pyyaml yamllint
@@ -297,6 +314,26 @@ jobs:
       - name: yamllint workflows (real YAML errors — see .yamllint)
         run: yamllint -c .yamllint .github/workflows/
 
+  # Changed-path ownership: every changed openblade/** or tests/** path must map
+  # to a test category in tools/ci_ownership.toml, so a new module can't land
+  # outside every CI lane unnoticed. Always runs (not path-filtered).
+  ownership:
+    name: ownership
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Check changed paths have an owning test category
+        env:
+          # PRs diff against their target branch; pushes/dispatch against master.
+          BASE_REF: ${{ github.base_ref || 'master' }}
+        run: python tools/ci_ownership.py --base "origin/$BASE_REF"
+
   # Single always-running aggregation gate. Make THIS the only required
   # branch-protection check (plus operability-gate). It understands a valid
   # `skipped` result from path-filtered jobs and fails on any real failure or
@@ -305,6 +342,7 @@ jobs:
   ci-gate:
     name: ci-gate
     needs:
+      - ownership
       - backend-lint
       - backend-typecheck
       - backend-tests
@@ -326,6 +364,7 @@ jobs:
               *) echo "FAIL  $1=$2"; fail=1 ;;
             esac
           }
+          check ownership            "${{ needs.ownership.result }}"
           check backend-tests        "${{ needs.backend-tests.result }}"
           check api-aml-integration  "${{ needs.api-aml-integration.result }}"
           check i3-smoke             "${{ needs.i3-smoke.result }}"
@@ -360,8 +399,10 @@ jobs:
     env:
       I3_TIMING_PROFILE: instant
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"

.github/workflows/copilot-setup-steps.yml

@@ -9,6 +9,9 @@ on:
         paths:
             - .github/workflows/copilot-setup-steps.yml
 
+permissions:
+    contents: read
+
 jobs:
     copilot-setup-steps:
         runs-on: ubuntu-latest
@@ -18,4 +21,6 @@ jobs:
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v5
+              # zizmor: ignore[artipacked] -- the Copilot coding agent works in this
+              # checkout and may need its git credentials; nothing here uploads artifacts.
+              uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5.1.0