ci: wildcard listeners for develop and production, and the S3 checksum setting for production

.github/workflows/bitween-api-cicd-gateway.yml

@@ -85,9 +85,12 @@ jobs:
       # here too - previously only /api and /swagger did, leaving the root on the retired
       # legacy Bitween-UI deployment and making every deploy look like the UI never changed.
       gateway-paths: '/,/api,/swagger'
-      # app-dev.bitween.io is not *.sf9.io, so the deploy auto-onboards a
-      # dedicated listener + cert-manager Certificate on the parent gateway
-      # (public-gateway · s9-dev-edge · cilium · letsencrypt-production-gateway).
+      # Attach to the dev gateway's *.bitween.io wildcard listener (public-gateway · s9-dev-edge),
+      # certificate included, instead of onboarding a listener and certificate for the host. The
+      # deploy fails before helm runs if the listener is missing. An app-dev.bitween.io listener on
+      # that gateway would take the host from the wildcard and answer 404, since this route no
+      # longer attaches to it.
+      gateway-section-name: 'https-wildcard-bitween-io'
 
       # Non-routing chart values (routing itself is generated by gateway-api mode). Every line is
       # handed to helm --set as it stands, so no comments inside. replicaCount=2: the lab's phase 6
@@ -182,14 +185,20 @@ jobs:
       # The production cluster's gateway. The default, s9-dev-edge, does not exist there, and
       # the deploy would create a second public-gateway in it instead of failing.
       gateway-parent-namespace: 's9-prod-edge'
+      # The production gateway's *.bitween.io wildcard listener, as on develop.
+      gateway-section-name: 'https-wildcard-bitween-io'
       # Every line is handed to helm --set as it stands, so no comments inside.
+      # AWS_*_CHECKSUM_*=when_required: production stores files in DigitalOcean Spaces too, so it
+      # carries develop's checksum setting (see the note there) until the fix lands in SW-CloudFiles.
       helm-set-values: |
         global.environment=Production
         replicaCount=2
         resources.requests.cpu=25m
         resources.requests.memory=704Mi
         resources.limits.memory=1408Mi
         environmentVariables.Bitween__BusProvidersEnabled=true
+        environmentVariables.AWS_REQUEST_CHECKSUM_CALCULATION=when_required
+        environmentVariables.AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
     secrets:
       registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
       registry-password: ${{ secrets.DOCKERHUB_TOKEN }}

docs/deployment.md

@@ -122,8 +122,8 @@ Run several replicas behind a load balancer for throughput and availability, and
 
 | Pipeline | Trigger | What it does |
 |---|---|---|
-| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`). Publishes no NuGet packages. |
-| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. |
+| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`, on the gateway's `*.bitween.io` wildcard listener). Publishes no NuGet packages. |
+| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`, on the gateway's `*.bitween.io` wildcard listener). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. |
 | `.github/workflows/cli-release.yml` | Called by the CI/CD workflow, never run by hand or by a tag: after the release from `releases/r10.0`, and after each develop build | Publishes the [bitween CLI](cli.md) at the version that run computed, as self-contained single-file binaries for `linux-x64`, `linux-arm64`, `linux-musl-x64`, `linux-musl-arm64`, `osx-x64`, `osx-arm64` and `win-x64`, with a `SHA256SUMS` file. From the release it is `cli-v<version>`, the latest release; from develop, the pre-release `cli-v<version>-dev.<run>`. `scripts/install-cli.sh` installs the latest release, a pre-release only when named. |
 | `.github/workflows/sdk-release.yml` | Called by the CI/CD workflow after the release from `releases/r10.0` | Publishes the adapter contract packages at Bitween's version: `simplyworks-bitween` to PyPI and `@simplyworks/bitween` to npm, each tested first against SW-Serverless's SDK. Uses the `PYPI_API_TOKEN` and `NPM_TOKEN` secrets; a version already published is left alone. |
 | `.github/workflows/dotnet-pr-checks.yml` | Pull requests to `releases/**` | Builds the solution and runs the .NET unit tests |