added ci

scripts/ci/image-tags.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Validate Gitea publication inputs and emit literal, shell-safe image tags."""
+import os
+import re
+import tomllib
+from pathlib import Path
+
+
+def image_tags(env, version):
+    registry = env.get('GITEA_REGISTRY', '')
+    image = env.get('GITEA_IMAGE', '')
+    if not re.fullmatch(r'[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::[0-9]{1,5})?', registry):
+        raise ValueError('GITEA_REGISTRY must be a lowercase hostname[:port], without scheme or path')
+    if not re.fullmatch(r'[a-z0-9]+(?:[._-][a-z0-9]+)*(?:/[a-z0-9]+(?:[._-][a-z0-9]+)*)+', image):
+        raise ValueError('GITEA_IMAGE must be lowercase owner/image, without registry or tag')
+    if not env.get('REGISTRY_USER') or not env.get('REGISTRY_TOKEN'):
+        raise ValueError('Set GITEA_REGISTRY_USERNAME and GITEA_REGISTRY_TOKEN secrets')
+    sha = env['GITHUB_SHA']
+    if not re.fullmatch(r'[0-9a-f]{40}', sha):
+        raise ValueError('Invalid commit SHA')
+    base = f'{registry}/{image}'
+    tags = [f'{base}:sha-{sha}']
+    ref = env['GITHUB_REF']
+    if ref.startswith('refs/tags/'):
+        release = ref.removeprefix('refs/tags/')
+        if release != f'v{version}' or not re.fullmatch(r'v[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?', release):
+            raise ValueError('Release tag must be v<Cargo.toml package.version> (no build metadata)')
+        tags.append(f'{base}:{release.lower()}')
+    elif ref == 'refs/heads/' + env['DEFAULT_BRANCH']:
+        tags.append(f'{base}:latest')
+    else:
+        raise ValueError('Only default branch or version tags may publish')
+    return tags
+
+
+def main():
+    version = tomllib.loads(Path('Cargo.toml').read_text())['package']['version']
+    tags = image_tags(os.environ, version)
+    with open(os.environ['GITHUB_OUTPUT'], 'a', encoding='utf-8') as out:
+        out.write('tags<<IMAGE_TAGS\n' + '\n'.join(tags) + '\nIMAGE_TAGS\n')
+
+
+if __name__ == '__main__':
+    main()

scripts/ci/prepare-minio.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Unmodified upstream source; never apply the sandbox adapter in hosted CI.
+set -euo pipefail
+output=${1:?Usage: prepare-minio.sh ABSOLUTE_OUTPUT_BINARY}
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+curl --fail --location --retry 3 --connect-timeout 20 --max-time 300 \
+  https://github.com/minio/minio/archive/refs/tags/RELEASE.2025-04-22T22-12-26Z.tar.gz \
+  --output "$work/minio.tar.gz"
+printf '%s  %s\n' 1a63209927b9d1fb239b2a776b7b01d1902eff19379a108f4bc7005edcc0968c "$work/minio.tar.gz" | sha256sum --check --strict
+tar --no-same-owner -xzf "$work/minio.tar.gz" -C "$work"
+cd "$work/minio-RELEASE.2025-04-22T22-12-26Z"
+mkdir -p "$(dirname "$output")"
+GOTOOLCHAIN=local go build -mod=readonly -p 2 -o "$output" .
+"$output" --version

scripts/ci/prepare-reference.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
+reference_parent=${1:?Usage: prepare-reference.sh OUTPUT_DIRECTORY}
+mkdir -p "$reference_parent"
+reference_parent=$(cd -- "$reference_parent" && pwd)
+cd "$project_dir/scripts/ci/vendor"
+printf '%s\n' '1e558d3d2211ea0228596aced2b71306503190c454ec4cb44f172045b3513c34  prosody-cafd74b9c5ea.tar.gz' | sha256sum --check --strict
+tar --no-same-owner -xzf prosody-cafd74b9c5ea.tar.gz -C "$reference_parent"
+cd "$reference_parent/prosody-cafd74b9c5ea"
+./configure --ostype=debian --lua-version=5.4 --lua-suffix=5.4
+make -j2

scripts/ci/vendor/README.md

@@ -0,0 +1,11 @@
+# Native reference test source
+
+`prosody-cafd74b9c5ea.tar.gz` is the original, unmodified source archive supplied
+with this project. Revision: `cafd74b9c5ead46eb58910359eb266e1732b0aa1`.
+SHA-256: `1e558d3d2211ea0228596aced2b71306503190c454ec4cb44f172045b3513c34`.
+
+The source is bundled so CI cannot silently skip native oracle tests when a
+private upload URL expires. Prosody's MIT/X11 license and copyright notices
+are retained inside the archive (`COPYING`). No compiled shared objects are
+bundled. `prepare-reference.sh` checks the archive hash and builds native
+modules against the runner's Lua/OpenSSL/ICU installation.

scripts/ci/verify-all.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+: "${PROSODY_REFERENCE_SOURCE:?Build the bundled reference first}"
+: "${MINIO_BINARY:?Build genuine MinIO first}"
+export XMPP_LOAD_CHECK=1
+mkdir -p ci-results
+bash scripts/verify-local.sh
+# These two tests are deliberately ignored by the ordinary test command.
+cargo test --locked --test admin_socket --test archive_mam -- --ignored --nocapture
+python3 tests/upload_large_network.py --binary target/release/rust-xmpp --report ci-results/upload-local-10gib.json