initial commit

Change-Id: I8e318861a258686ddc53dda08858f74c573a6520

.gitea/workflows/ci.yml

@@ -0,0 +1,41 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch: {}
+
+jobs:
+  build-and-test:
+    name: Build and Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Echo build info
+        run: |
+          echo "Building otel-demo from commit "
+          echo "Event: "
+          echo "Branch: "
+
+      - name: Run smoke tests
+        run: |
+          echo "Running smoke tests..."
+          echo "✓ Syntax check passed"
+          echo "✓ Linting passed"
+          echo "✓ Unit tests passed"
+
+      - name: Build artifact
+        run: |
+          echo "Building application..."
+          mkdir -p build
+          echo "Build completed at $(date)" > build/build-info.txt
+          echo "Commit: " >> build/build-info.txt
+
+      - name: CI Success
+        run: |
+          echo "✓ CI Pipeline completed successfully!"
+          echo "Ready for deployment to Kubernetes via ArgoCD"

.gitea/workflows/security-scan.yml

@@ -0,0 +1,151 @@
+name: Security Scanning
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch: {}
+
+env:
+  TRIVY_VERSION: "0.51.1"
+  GITLEAKS_VERSION: "8.18.4"
+  COMPONENT_ID: otel-demo
+
+jobs:
+  # ─────────────────────────────────────────────
+  # 1. FILESYSTEM & DEPENDENCY SCAN
+  #    Trivy auto-detects lockfiles (pom.xml,
+  #    package-lock.json, go.sum, requirements.txt, etc.)
+  #    and scans for vulns, secrets, and misconfigs.
+  # ─────────────────────────────────────────────
+  trivy-scan:
+    name: Trivy — Filesystem & Dependency Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+            | sh -s -- -b /usr/local/bin v
+
+      - name: Run Trivy filesystem scan
+        run: |
+          trivy fs \
+            --exit-code 0 \
+            --severity HIGH,CRITICAL \
+            --format sarif \
+            --output trivy-results.sarif \
+            --scanners vuln,secret,misconfig \
+            --dependency-tree \
+            .
+
+      - name: Upload SARIF report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: trivy-sarif
+          path: trivy-results.sarif
+          retention-days: 30
+
+      - name: Print human-readable summary
+        run: |
+          trivy fs \
+            --exit-code 0 \
+            --severity MEDIUM,HIGH,CRITICAL \
+            --format table \
+            --scanners vuln,secret,misconfig \
+            .
+
+      - name: Enforce quality gate (CRITICAL fails build)
+        run: |
+          trivy fs \
+            --exit-code 1 \
+            --severity CRITICAL \
+            --scanners vuln,misconfig \
+            .
+
+  # ─────────────────────────────────────────────
+  # 2. SECRET SCAN — detect leaked credentials
+  #    across full git history.
+  # ─────────────────────────────────────────────
+  gitleaks-scan:
+    name: Gitleaks — Secret Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout source (full history)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Install Gitleaks binary directly — the GitHub Action
+      # relies on GITHUB_TOKEN which is unavailable on Gitea Act runners.
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v/gitleaks__linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Run Gitleaks
+        run: |
+          gitleaks detect \
+            --source . \
+            --report-format sarif \
+            --report-path gitleaks-results.sarif \
+            --exit-code 1 \
+            --log-level warn
+
+      - name: Upload SARIF report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: gitleaks-sarif
+          path: gitleaks-results.sarif
+          retention-days: 30
+
+  # ─────────────────────────────────────────────
+  # 3. SUMMARY — aggregate all SARIF reports
+  # ─────────────────────────────────────────────
+  security-summary:
+    name: Security Summary
+    needs:
+      - trivy-scan
+      - gitleaks-scan
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Download all SARIF artefacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: "*-sarif"
+          merge-multiple: true
+          path: sarif-reports/
+
+      - name: List collected reports
+        run: ls -lh sarif-reports/
+
+      - name: Generate summary
+        run: |
+          echo "## Security Scan Results — " >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Report | Size |" >> $GITHUB_STEP_SUMMARY
+          echo "|--------|------|" >> $GITHUB_STEP_SUMMARY
+          for f in sarif-reports/*.sarif; do
+            name=$(basename "$f")
+            size=$(du -sh "$f" | cut -f1)
+            echo "| $name | $size |" >> $GITHUB_STEP_SUMMARY
+          done
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Commit: \`\`" >> $GITHUB_STEP_SUMMARY
+          echo "Branch: \`\`" >> $GITHUB_STEP_SUMMARY
+
+      - name: Bundle all SARIF reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: all-sarif-reports
+          path: sarif-reports/
+          retention-days: 90

.gitea/workflows/techdocs.yml

@@ -0,0 +1,104 @@
+name: Build and Publish TechDocs
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+env:
+  TECHDOCS_AZURE_BLOB_CONTAINER_NAME: 
+  AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token
+  AZURE_ACCOUNT_NAME: "bstagecjotdevsttechdocs"
+  ENTITY_NAMESPACE: default
+  ENTITY_KIND: component
+  ENTITY_NAME: otel-demo
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: read and set output
+        id: read_env
+        run: |
+          echo "$AZURE_FEDERATED_TOKEN_FILE"
+          env | grep AZURE
+          echo "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
+
+      # act-based Gitea runners run as root — sudo is not available.
+      # apt-get is called directly; works whether root or not.
+      - name: Bootstrap pip
+        run: |
+          python3 --version
+          if python3 -m pip --version 2>/dev/null; then
+            echo "pip already available"
+          elif python3 -m ensurepip --version 2>/dev/null; then
+            python3 -m ensurepip --upgrade
+          else
+            apt-get update -qq
+            apt-get install -y python3-pip
+          fi
+          python3 -m pip install --upgrade pip
+          python3 -m pip --version
+
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install \
+            mkdocs-techdocs-core==1.* \
+            mkdocs-git-revision-date-localized-plugin \
+            mkdocs-awesome-pages-plugin
+
+          npm install -g @techdocs/cli
+          npm cache clean --force
+
+      # mkdocs has no dry-run flag — build into a temp dir to validate config
+      # and catch any broken links or missing pages early.
+      - name: Validate MkDocs config
+        run: mkdocs build --strict --site-dir /tmp/mkdocs-validate
+
+      - name: Build TechDocs site
+        run: |
+          techdocs-cli generate \
+            --source-dir . \
+            --output-dir ./site \
+            --no-docker \
+            --verbose
+
+      # act runners don't include az by default — install via Microsoft's
+      # official script which works on Debian/Ubuntu without sudo.
+      - name: Install Azure CLI
+        run: |
+          if command -v az &>/dev/null; then
+            echo "Azure CLI already installed: $(az version --query '"azure-cli"' -o tsv)"
+          else
+            curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+          fi
+
+      - name: Azure login (OIDC)
+        run: |
+          az login \
+            --service-principal \
+            --username "$AZURE_CLIENT_ID" \
+            --tenant "$AZURE_TENANT_ID" \
+            --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
+
+          echo "✓ Azure login successful"
+
+      - name: Publish TechDocs site
+        run: |
+          echo "$AZURE_ACCOUNT_NAME"
+          echo "$ENTITY_NAMESPACE"
+          echo "$ENTITY_KIND"
+          echo "$ENTITY_NAME"
+          techdocs-cli publish \
+            --publisher-type azureBlobStorage \
+            --storage-name "techdocs" \
+            --azureAccountName "$AZURE_ACCOUNT_NAME" \
+            --entity "$ENTITY_NAMESPACE/$ENTITY_KIND/$ENTITY_NAME"