merge: integrate object storage production capability

.github/ci-gate-matrix.yml

@@ -164,3 +164,31 @@ gates:
     workflow: link-check.yml
     job: lychee
     execution: job
+  - id: object-storage-minio-managed-contract
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: objectStorageMinioContractTest
+    workflow: object-storage-qualification.yml
+    job: minio-managed-contract
+    execution: explicit
+  - id: poster-image-v7-migration
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: posterImageMigrationTest
+    workflow: object-storage-qualification.yml
+    job: poster-image-v7-migration
+    execution: explicit
+  - id: object-storage-minio-managed-fault
+    release_blocking: conditional
+    mechanism: gradle-custom-task
+    ref: objectStorageMinioFaultTest
+    workflow: object-storage-qualification.yml
+    job: minio-managed-fault
+    execution: explicit
+  - id: object-storage-aws-protected-qualification
+    release_blocking: conditional
+    mechanism: delegated-pending
+    ref: approval-gate-b
+    workflow: object-storage-qualification.yml
+    job: aws-managed-common-subset
+    execution: job

.github/scripts/verify-gate-matrix.sh

@@ -5,7 +5,7 @@ readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
 readonly REPO_ROOT="$(git -C "${SCRIPT_DIR}" rev-parse --show-toplevel)"
 readonly EXPECTED_SCRIPT_DIR="$(cd -- "${REPO_ROOT}/.github/scripts" && pwd -P)"
 readonly MATRIX="${REPO_ROOT}/.github/ci-gate-matrix.yml"
-readonly EXPECTED_GATE_COUNT=22
+readonly EXPECTED_GATE_COUNT=26
 
 if [[ "${SCRIPT_DIR}" != "${EXPECTED_SCRIPT_DIR}" ]]; then
   printf '::error::gate-matrix-lint: script resolved outside the repository .github/scripts directory\n' >&2

.github/workflows/object-storage-qualification.yml

@@ -0,0 +1,96 @@
+name: object-storage-qualification
+
+on:
+  pull_request:
+  schedule:
+    - cron: "23 3 * * 2"
+  workflow_dispatch:
+    inputs:
+      run_protected_aws:
+        description: Run the protected AWS sandbox qualification lane
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+env:
+  TESTCONTAINERS_REUSE_ENABLE: "false"
+
+jobs:
+  poster-image-v7-migration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Run non-skipping Poster image V7 migration qualification
+        working-directory: src
+        run: ./gradlew :sample-portfolio:posterImageMigrationTest --no-daemon --stacktrace
+
+  minio-managed-contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Run exact-release MinIO managed contract
+        working-directory: src
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioContractTest --no-daemon --stacktrace
+
+  minio-managed-fault:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Run digest-pinned MinIO and Toxiproxy fault contract
+        working-directory: src
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioFaultTest --no-daemon --stacktrace
+
+  aws-managed-common-subset:
+    if: github.event_name == 'workflow_dispatch' && inputs.run_protected_aws
+    environment: object-storage-aws-qualification
+    runs-on: ubuntu-latest
+    env:
+      OBJECT_STORAGE_AWS_QUALIFICATION_ENABLED: "true"
+      OBJECT_STORAGE_AWS_BUCKET: ${{ secrets.OBJECT_STORAGE_AWS_BUCKET }}
+      OBJECT_STORAGE_AWS_REGION: ${{ secrets.OBJECT_STORAGE_AWS_REGION }}
+      OBJECT_STORAGE_AWS_EXPECTED_OWNER: ${{ secrets.OBJECT_STORAGE_AWS_EXPECTED_OWNER }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Run protected AWS common-subset qualification
+        working-directory: src
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTest --no-daemon --stacktrace