feat: complete iteration 0 RIE-free contract and tooling work

.github/workflows/ci-cd.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: |
       !contains(github.event.head_commit.message, '[skip ci]') &&
       !contains(github.event.head_commit.message, '[ci skip]') &&
@@ -27,15 +27,15 @@ jobs:
     env:
       NUGET_PACKAGES: ${{ format('{0}/.nuget/packages', github.workspace) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
 
       - name: "Cache NuGet packages"
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ${{ format('{0}/.nuget/packages', github.workspace) }}
           key: nuget-${{ hashFiles('**/Directory.Packages.props') }}-${{ hashFiles('**/*.csproj') }}-${{ hashFiles('**/packages.lock.json') }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Publish Test Results
         id: test-results
-        uses: dorny/test-reporter@v1
+        uses: dorny/test-reporter@v3
         if: success() || failure()
         with:
           name: 'Test Results (Linux)'
@@ -81,7 +81,7 @@ jobs:
           run_id: '${{ github.run_id }}'
           repository: '${{ github.repository }}'
           server_url: '${{ github.server_url }}'
-          api_domain: 'api.localstackfor.net'
+          api_base_url: 'https://api.localstackfor.net'
           hmac_secret: '${{ secrets.TESTDATASECRET }}'
 
   continuous-deployment:
@@ -97,19 +97,26 @@ jobs:
       !contains(github.event.head_commit.message, '***NO_CD***')
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build Lambda ZIP for ARM64
+        env:
+          BADGESMITH_TOOL_PATH: ${{ github.workspace }}/tools/badgesmith.cs
         run: |
-          ./scripts/build-lambda.sh --target zip --rid linux-arm64 --clean --verbose
+          "$BADGESMITH_TOOL_PATH" lambda build --target zip --rid linux-arm64 --clean --verbose
 
       - name: Upload Lambda artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: ${{ github.ref == 'refs/heads/master' && 'lambda-zip-latest' || format('lambda-zip-{0}', github.head_ref || github.ref_name) }}
+          name: ${{ github.ref == 'refs/heads/master' && 'lambda-zip-latest' || format('lambda-zip-pr-{0}', github.event.pull_request.number) }}
           path: artifacts/badge-lambda-linux-arm64.zip
           retention-days: 30
           overwrite: true

.github/workflows/deploy.yml

@@ -36,7 +36,7 @@ env:
 
 jobs:
   deploy:
-    runs-on: ${{ inputs.build_lambda && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
+    runs-on: ${{ inputs.build_lambda && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     environment: ${{ inputs.environment }}
     permissions:
       id-token: write   # Required for OIDC authentication
@@ -45,48 +45,48 @@ jobs:
     env:
       NUGET_PACKAGES: ${{ format('{0}/.nuget/packages', github.workspace) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           role-session-name: github-actions-badge-smith-deploy
           aws-region: ${{ env.AWS_REGION }}
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
-          dotnet-version: '10.0.x'
+          global-json-file: global.json
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: '24'
 
       - name: "Cache NuGet packages"
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: ${{ format('{0}/.nuget/packages', github.workspace) }}
           key: nuget-${{ hashFiles('**/Directory.Packages.props') }}-${{ hashFiles('**/*.csproj') }}-${{ hashFiles('**/packages.lock.json') }}
           restore-keys: |
               nuget-
 
       - name: Install AWS CDK
-        run: npm install -g aws-cdk
+        run: npm install --global aws-cdk@2.1135.1
 
       - name: Set up Docker Buildx
         if: inputs.build_lambda
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build Lambda ZIP for ARM64
         if: inputs.build_lambda
         run: |
-          ./scripts/build-lambda.sh --target zip --rid linux-arm64 --clean --verbose
+          "${{ github.workspace }}/tools/badgesmith.cs" lambda build --target zip --rid linux-arm64 --clean --verbose
 
       - name: Download Lambda artifact
         if: ${{ !inputs.build_lambda }}
-        uses: dawidd6/action-download-artifact@v6
+        uses: dawidd6/action-download-artifact@v21
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           workflow: ci-cd.yml
@@ -102,21 +102,21 @@ jobs:
 
       - name: CDK synth
         working-directory: build
-        run: cdk synth --all
+        run: cdk synth BadgeSmithStack
 
       - name: CDK diff
         if: inputs.show_diff
         working-directory: build
         run: |
           echo "🔍 CDK Diff - Infrastructure changes:"
-          cdk diff --all || true
+          cdk diff BadgeSmithStack || true
         continue-on-error: true
 
       - name: CDK deploy
         working-directory: build
         run: |
           echo "🚀 Deploying BadgeSmith to ${{ inputs.environment }}..."
-          cdk deploy --all --require-approval never
+          cdk deploy BadgeSmithStack --require-approval never
 
       - name: Get deployment outputs
         working-directory: build

.github/workflows/run-dotnet-tests/action.yml

@@ -13,20 +13,28 @@ inputs:
 runs:
   using: "composite"
   steps:
-    # Windows step -----------------------------------------------------------
     - if: runner.os == 'Windows'
       shell: pwsh
+      env:
+        BADGESMITH_TOOL_PATH: ${{ github.workspace }}/tools/badgesmith.cs
+        BADGESMITH_PROJECT_PATH: ${{ inputs.project-path }}
+        BADGESMITH_RESULTS_DIR: ${{ inputs.results-dir }}
+        BADGESMITH_CONFIGURATION: ${{ inputs.configuration }}
       run: |
-        & "${{ github.action_path }}\run-win.ps1" `
-            -ProjectPath "${{ inputs.project-path }}" `
-            -ResultsDir  "${{ inputs.results-dir }}" `
-            -Configuration "${{ inputs.configuration }}"
+        dotnet run --file "$env:BADGESMITH_TOOL_PATH" -- tests run `
+          --project-path "$env:BADGESMITH_PROJECT_PATH" `
+          --results-dir "$env:BADGESMITH_RESULTS_DIR" `
+          --configuration "$env:BADGESMITH_CONFIGURATION"
 
-    # Linux/macOS step -------------------------------------------------------
     - if: runner.os != 'Windows'
       shell: bash
+      env:
+        BADGESMITH_TOOL_PATH: ${{ github.workspace }}/tools/badgesmith.cs
+        BADGESMITH_PROJECT_PATH: ${{ inputs.project-path }}
+        BADGESMITH_RESULTS_DIR: ${{ inputs.results-dir }}
+        BADGESMITH_CONFIGURATION: ${{ inputs.configuration }}
       run: |
-        "${{ github.action_path }}/run-unix.sh" \
-            "${{ inputs.project-path }}" \
-            "${{ inputs.results-dir }}" \
-            "${{ inputs.configuration }}"
+        "$BADGESMITH_TOOL_PATH" tests run \
+          --project-path "$BADGESMITH_PROJECT_PATH" \
+          --results-dir "$BADGESMITH_RESULTS_DIR" \
+          --configuration "$BADGESMITH_CONFIGURATION"

.github/workflows/update-test-badge/README.md

@@ -0,0 +1,45 @@
+# Update Test Results Badge
+
+Reusable composite action that posts CI test results to BadgeSmith with HMAC
+authentication and writes badge markdown to the GitHub Actions step summary.
+
+## Inputs
+
+See [`action.yml`](./action.yml) for the canonical input list. Required inputs are
+`platform`, `test_passed`, `test_failed`, `test_skipped`, `commit_sha`, `run_id`,
+`repository`, `server_url`, `api_base_url`, and `hmac_secret`.
+`test_url_html` is optional. When supplied, the badge redirect targets that HTTPS
+test-report URL, such as `dorny/test-reporter`'s `url_html` output or a report hosted by
+another provider. When omitted, the action falls back to the current GitHub workflow-run
+URL. `api_base_url` must be an absolute HTTPS URL for public deployments and may include
+a port or path prefix. Plain HTTP is accepted only for loopback hosts (`localhost`,
+`127.0.0.0/8`, or `::1`) used by local development.
+
+## Usage
+
+External consumers use the maintained major action tag:
+
+```yaml
+- name: Update test badge
+  uses: localstack-dotnet/badge-smith/.github/workflows/update-test-badge@v1
+  with:
+    platform: 'Linux'
+    test_passed: '${{ steps.test-results.outputs.passed }}'
+    test_failed: '${{ steps.test-results.outputs.failed }}'
+    test_skipped: '${{ steps.test-results.outputs.skipped }}'
+    test_url_html: '${{ steps.test-results.outputs.url_html }}'
+    commit_sha: '${{ github.sha }}'
+    run_id: '${{ github.run_id }}'
+    repository: '${{ github.repository }}'
+    server_url: '${{ github.server_url }}'
+    api_base_url: 'https://api.localstackfor.net'
+    hmac_secret: '${{ secrets.TESTDATASECRET }}'
+```
+
+Consumers pin the supported major action tag. The action installs the SDK pinned by
+BadgeSmith's `global.json` and runs `tools/badgesmith.cs` from the downloaded action
+repository via `github.action_path`; the caller does not need to contain BadgeSmith's
+tool sources.
+
+The `TESTDATASECRET` repository secret must hold the HMAC shared secret
+configured for the organization through `badgesmith secrets seed`.