@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/_nightly.yml.ejs

@@ -0,0 +1,826 @@
+name: Nightly jobs (reusable)
+
+<%
+// #1723: serviceBucket/isService are injected by withServiceBucket
+// (src/utils/render.ts), the single canonical archetype->bucket resolver — do not
+// re-declare the archetype map here.
+const _bucket = serviceBucket;
+const _isService = isService;
+// #2628: arbiter's own render (enableNativeBakeE2E) at L2+ takes coverage from
+// the Full Gate instead of a duplicate standalone job; consumers are unchanged.
+const _selfL2Coverage = Boolean(locals.enableNativeBakeE2E) && governanceLevel !== 'L1';
+%>
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+  issues: write
+  actions: write
+
+jobs:
+  shared-security:
+    uses: ./.github/workflows/_shared-security.yml
+
+<% if (_isService) { %>
+  load-smoke:
+    name: Load smoke (k6 — service, nightly cadence)
+    # E4 (#1502): the PR-path load-smoke (02-pr-extended) moved here at nightly
+    # cadence — load testing needs a running app and adds minutes to every extended
+    # PR. deploy-test's post-deploy-smoke covers the post-deploy gate; this is the
+    # standalone nightly load run.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install k6
+        run: |
+          curl -sSL https://github.com/grafana/k6/releases/download/v0.52.0/k6-v0.52.0-linux-amd64.tar.gz \
+            | tar -xz -C /usr/local/bin --strip-components=1 k6-v0.52.0-linux-amd64/k6
+      - name: Start application
+        run: docker compose up -d --wait
+      - name: k6 load smoke (120 s)
+        run: k6 run --duration 120s --vus 20 scripts/k6-smoke.js
+      - name: Stop application
+        if: always()
+        run: docker compose down
+
+<% } %>
+  semgrep-sast:
+    name: Semgrep SAST (2nd SAST — covers Rust + trunk-solo)
+    # PORT A2 (#1502): Semgrep is a second SAST alongside CodeQL (15-codeql). It
+    # covers the two cases CodeQL misses: Rust (unsupported by CodeQL) and any
+    # config that never emits CodeQL. Semgrep is language-agnostic — it scans the
+    # source tree directly, so no per-language toolchain branch is needed. Run via
+    # the pinned CLI rather than an unverified third-party action (INV-76 / the
+    # fabricated-pin lesson). Ruleset configurable via the SEMGREP_RULES variable.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install Semgrep (pinned CLI)
+        run: pip install semgrep
+      - name: Semgrep SAST (configurable ruleset)
+        env:
+          SEMGREP_RULES: ${{ vars.SEMGREP_RULES || 'auto' }}
+          # Informational by default; set repo/org var SEMGREP_STRICT=true to block.
+          SEMGREP_STRICT: ${{ vars.SEMGREP_STRICT }}
+        run: |
+          set -uo pipefail
+          ARGS="--config ${SEMGREP_RULES} --sarif --output semgrep.sarif --metrics=off"
+          if [ "${SEMGREP_STRICT:-}" = "true" ]; then
+            semgrep scan ${ARGS} --error
+          else
+            semgrep scan ${ARGS} || echo "::warning::Semgrep reported findings (informational; set SEMGREP_STRICT=true to block)"
+          fi
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: semgrep-sarif
+          path: semgrep.sarif
+          retention-days: 30
+
+<% if (locals.runnerProfile !== 'solo') { -%>
+<%- include('_partials/scheduled-heavy-jobs.ejs') -%>
+<%_ } _%>
+
+<% if (locals.enableNativeBakeE2E) { %>
+  bake-e2e-native:
+    name: Native fixture smoke (${{ matrix.stack }})
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - stack: ts
+            fixture: ts-library
+          - stack: python
+            fixture: python-library
+          - stack: go
+            fixture: go-library
+          - stack: java
+            fixture: java-library-gradle
+          - stack: rust
+            fixture: rust-library
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-node-pnpm
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        if: matrix.stack == 'python'
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        if: matrix.stack == 'go'
+        with:
+          go-version-file: __tests__/fixtures/real-projects/go-library/go.mod
+          cache-dependency-path: __tests__/fixtures/real-projects/go-library/go.mod
+
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        if: matrix.stack == 'java'
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        if: matrix.stack == 'java'
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        if: matrix.stack == 'rust'
+        with:
+          toolchain: stable
+
+      - name: Native smoke (${{ matrix.stack }})
+        env:
+          FIXTURE: ${{ matrix.fixture }}
+        run: VITEST_NATIVE=1 npx vitest run --config vitest.integration.config.ts __tests__/integration/e2e/native/ -t "$FIXTURE"
+
+<% } %>
+<% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>
+  generated-gate-e2e:
+    # B5 (arbiter audit, gate-thesis reliability) / #1491 / #1042 — THE core
+    # promise of a governance installer: run `arbiter init` and execute the
+    # GENERATED project's own gate to green. Was a single monolithic job serially
+    # installing all 5 stack toolchains + running every functional-tier fixture in
+    # one `vitest run` — the single most important assertion in the framework
+    # sharing one 45-min job-level timeout with 4 unrelated languages, so
+    # contention/slowness in ANY one stack could starve or fail the others
+    # (confirmed root cause of the ts-backend-web-db 60s-vs-64s near-miss, #1904).
+    # Split into a per-language matrix (mirrors generator-matrix.yml's proven DEEP-
+    # cell pattern) — each stack gets its OWN toolchain install, OWN build, OWN
+    # timeout-minutes, and runs ONLY its own fixture-functional.test.ts cell via
+    # `-t <language>`. A slow/contended Java runner can no longer affect the
+    # TypeScript cell's budget. The other three functional-tier suites (virgin-
+    # init-matrix, packaged-artifact, fixture-functional-offline-guard — none of
+    # which need the full 5-toolchain matrix) moved to the sibling
+    # `generated-gate-e2e-misc` job below. Downstream-generated projects do not
+    # ship this harness, so it renders only for arbiter itself.
+    name: Generated-gate e2e (${{ matrix.stack }}, init → run generated gate green)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        stack: [typescript, python, go, rust, java]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-node-pnpm
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        if: matrix.stack == 'python'
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        if: matrix.stack == 'go'
+        with:
+          go-version-file: __tests__/fixtures/real-projects/go-library/go.mod
+          cache-dependency-path: __tests__/fixtures/real-projects/go-library/go.mod
+
+      # golangci-lint is the only pinned Go tool the L1 gate this cell exercises
+      # invokes (staticcheck/govulncheck are L2-only — not reached by
+      # fixture-functional.test.ts, which always runs the generated gate at L1;
+      # same pin/rationale as generator-matrix.yml's identical Go cell).
+      - name: Install Go lint toolchain (golangci-lint — L1 gate dependency)
+        if: matrix.stack == 'go'
+        run: |
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        if: matrix.stack == 'java'
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        if: matrix.stack == 'java'
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        if: matrix.stack == 'rust'
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - name: Build
+        run: npm run build
+
+      - name: Generated-gate e2e (${{ matrix.stack }}, VITEST_L2=1)
+        # generated-check-all is intentionally NOT included here: it renders
+        # check-all.mjs in isolation (without the supporting governance scripts),
+        # so its missing-script FAILs are a fixture artifact, not a
+        # generated-output defect.
+        env:
+          VITEST_L2: "1"
+        run: |
+          npx vitest run --config vitest.integration.config.ts \
+            __tests__/integration/e2e/functional/fixture-functional.test.ts \
+            -t "${{ matrix.stack }}"
+
+  generated-gate-e2e-misc:
+    # Sibling of generated-gate-e2e (split above): the three functional-tier e2e
+    # suites that do NOT need the full 5-stack toolchain matrix — virgin-init
+    # (TS + Go only, #1321), packaged-artifact (TS-only outsider npm-pack install,
+    # #1770 T8) and the always-on offline-install-classifier guard (#1491/#1042).
+    # Kept as one job (none of the three is individually toolchain-heavy).
+    name: Generated-gate e2e (virgin-init + packaged-artifact + offline-guard)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-node-pnpm
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: __tests__/fixtures/real-projects/go-library/go.mod
+          cache-dependency-path: __tests__/fixtures/real-projects/go-library/go.mod
+
+      # virgin-init-matrix's go-library smoke cell runs the generated gate at L2
+      # (SMOKE_CELLS: level 'L2'), which — unlike fixture-functional's always-L1
+      # cells — DOES reach staticcheck/govulncheck; keep all three pinned tools.
+      - name: Install Go lint toolchain (golangci-lint, staticcheck, govulncheck)
+        run: |
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+          go install honnef.co/go/tools/cmd/staticcheck@2025.1.1
+          go install golang.org/x/vuln/cmd/govulncheck@v1.5.0
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Build
+        run: npm run build
+
+      - name: Generated-gate e2e — virgin-init + packaged-artifact + offline-guard (VITEST_L2=1)
+        env:
+          VITEST_L2: "1"
+        run: |
+          npx vitest run --config vitest.integration.config.ts \
+            __tests__/integration/e2e/functional/virgin-init-matrix.test.ts \
+            __tests__/integration/e2e/functional/packaged-artifact.test.ts \
+            __tests__/integration/e2e/functional/fixture-functional-offline-guard.test.ts
+
+  generated-gate-e2e-greenfield:
+    # #2257 — the 3 functional-tier e2e suites that were wired into NO CI workflow
+    # and NO gate script (grep of .github/workflows + scripts/check-all.mjs found
+    # nothing): greenfield-first-run (the file FEATURE_MATRIX's own tier table
+    # names as THE e2e exemplar — RED, invisible, because nothing ran it),
+    # go-debt-node-modules (#1950) and record-red-runner (#1951). Own job (not
+    # folded into generated-gate-e2e-misc above) because it needs Rust + Python
+    # toolchains neither sibling installs.
+    name: Generated-gate e2e (greenfield-first-run + go-debt-node-modules + record-red-runner)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-node-pnpm
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: __tests__/fixtures/real-projects/go-library/go.mod
+          cache-dependency-path: __tests__/fixtures/real-projects/go-library/go.mod
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Install pytest (record-red-runner Python cell, #1951)
+        run: pip install "pytest>=8.0"
+
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - name: Install gitleaks
+        # #2257 — the default-level (L2) first-run cell drives the REAL generated
+        # gate, which runs gitleaks at L2 (see virgin-init-matrix.test.ts's own
+        # CELL_BINARIES comment: absent gitleaks + CI=true FAILs, does not SKIP).
+        # Same install as gate-full-nightly above.
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.27.2/gitleaks_8.27.2_linux_x64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" gitleaks
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Build
+        run: npm run build
+
+      - name: Generated-gate e2e — greenfield-first-run + go-debt-node-modules + record-red-runner (VITEST_L2=1)
+        env:
+          VITEST_L2: "1"
+          # #2314 — greenfield-first-run's useGitHub cell drives `init --github`,
+          # and `--github` is honoured only when `detectGithubAccess()` finds an
+          # AUTHENTICATED gh (src/detectors/github.ts). Unauthenticated, init
+          # silently emits no .github/workflows and the cell's workflow-gate
+          # assertions fail — green on a dev box, red here, for want of a token.
+          # Same shape as the gh steps in cleanup-expired-artifacts / nightly-required.
+          # (The silent-ignore itself is the separate product defect #2315.)
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          npx vitest run --config vitest.integration.config.ts \
+            __tests__/integration/e2e/functional/greenfield-first-run.test.ts \
+            __tests__/integration/e2e/functional/go-debt-node-modules.test.ts \
+            __tests__/integration/e2e/functional/record-red-runner.test.ts
+
+<% } %>
+<% if (_isService) { %>
+  toxiproxy-resilience:
+    name: Toxiproxy resilience (service only)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]"
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+<% } %>
+      - name: Start Toxiproxy
+        # #1086: the upstream Toxiproxy GitHub Action was deleted (repo 404s), so
+        # the action reference failed at runtime. Pin + run the official
+        # toxiproxy-server release binary directly instead.
+        run: |
+          curl -fsSL https://github.com/Shopify/toxiproxy/releases/download/v2.12.0/toxiproxy-server-linux-amd64 \
+            -o /usr/local/bin/toxiproxy-server
+          chmod +x /usr/local/bin/toxiproxy-server
+          /usr/local/bin/toxiproxy-server &
+          for i in $(seq 1 30); do
+            curl -sf http://localhost:8474/version && break
+            sleep 1
+          done
+      - name: DB stall + network partition resilience test
+        run: |
+<% if (language === 'typescript') { %>
+          npm run --if-present test:resilience
+<% } else if (language === 'java' && buildTool === 'gradle') { %>
+          ./gradlew test -Dgroups='resilience'
+<% } else if (language === 'java') { %>
+          mvn test -Dgroups='resilience'
+<% } else if (language === 'go') { %>
+          go test -tags resilience ./...
+<% } else if (language === 'python') { %>
+          pytest -m resilience
+<% } else if (language === 'rust') { %>
+          cargo test --test resilience
+<% } %>
+
+<% } %>
+  gitleaks-history:
+    name: Secret scan (full history)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      # gitleaks-action downloads to a HARDCODED /tmp/gitleaks.tmp. On a self-hosted
+      # runner /tmp survives between jobs, so a leftover from an interrupted download
+      # fails every later install after both internal retries ("Destination file path
+      # /tmp/gitleaks.tmp already exists" then "parameter 'file' is required") — the
+      # cause of #2100.
+      # ponytail: unconditional delete — one gitleaks job per workflow run, so nothing
+      # else is mid-download. If gitleaks ever runs in parallel jobs on one runner,
+      # switch to the curl -> $RUNNER_TEMP/bin install shape used in 01-pr-fast.
+      - name: Clear stale gitleaks download temp
+        run: rm -f /tmp/gitleaks.tmp
+      - name: Gitleaks full history scan
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
+        with:
+          args: detect --source . --log-opts="--all --full-history"
+
+<% if (governanceLevel !== 'L1') { %>
+  gate-full-nightly:
+    name: Full Gate nightly (L2+, INV-59)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'typescript') { -%>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+      - run: npm ci
+<% } else { -%>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } -%>
+      - name: Install gitleaks
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.27.2/gitleaks_8.27.2_linux_x64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" gitleaks
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - name: Install actionlint
+        run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          curl -sSfL https://github.com/rhysd/actionlint/releases/download/v1.7.3/actionlint_1.7.3_linux_amd64.tar.gz | tar -xz -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+<% if (language === 'typescript') { -%>
+      - name: Build
+        run: npm run build<% if (locals.ciPreTestBuild) { %> && node scripts/build-kit.mjs<% } %>
+<% } -%>
+      - name: Run full L2 gate (== pre-push, nightly)
+        run: node scripts/check-all.mjs L2 --json gate-result-nightly.json
+      - name: Upload nightly gate-result artifact
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the L2 gate above) already passed (#2058-class).
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: gate-result-nightly
+          path: gate-result-nightly.json
+          retention-days: 30
+<% if (_selfL2Coverage) { -%>
+      - name: Upload L2 coverage reports
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the L2 gate above) already passed (#2058-class).
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-${{ github.run_id }}
+          path: coverage/
+          retention-days: 30
+<% } -%>
+<% } %>
+
+<%# E1 (#1502): heavy tools moved off the PR path land here at nightly cadence. %>
+<% const _covThreshold = isL3Plus ? 85 : 80; %>
+<%# #2628: arbiter's own L2 gate already runs the full coverage corpus at its
+    90% floor, so the self render must not rerun `vitest --coverage` at 80 in a
+    sibling job (measured duplicate: 316 s overlapping the 446 s Full Gate).
+    Consumer renders keep this lane. -%>
+<% if (!_selfL2Coverage) { -%>
+  coverage-report:
+    name: Coverage report + threshold (full suite)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The full suite includes TDD-evidence checks that resolve an older
+          # commit; reachability needs history, not a shallow clone (#2100).
+          fetch-depth: 0
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (locals.ciPreTestBuild) { %>      - run: npm run build && node scripts/build-kit.mjs
+<% } %>      - run: npx vitest run --coverage --coverage.thresholds.lines=<%= _covThreshold %>
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - run: cargo install cargo-tarpaulin --locked
+      - run: cargo tarpaulin --fail-under <%= _covThreshold %> --out Html --out Xml --out Lcov --output-dir coverage/
+<% } else if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+      - run: ./gradlew jacocoTestCoverageVerification
+      - name: Copy JaCoCo reports to coverage/
+        if: always()
+        run: |
+          mkdir -p coverage
+          cp -r build/coverage/html/. coverage/ 2>/dev/null || true
+          cp build/coverage/coverage.xml coverage/coverage.xml 2>/dev/null || true
+<% } else { %>
+      - run: mvn verify -Pjacoco
+      - name: Copy JaCoCo reports to coverage/
+        if: always()
+        run: |
+          mkdir -p coverage
+          cp -r target/coverage/. coverage/ 2>/dev/null || true
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - run: go test -coverprofile=coverage.out -covermode=atomic ./...
+      - name: Check coverage threshold
+        run: |
+          PCT=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | tr -d '%')
+          if (( $(echo "$PCT < <%= _covThreshold %>" | bc -l) )); then
+            echo "Coverage ${PCT}% is below <%= _covThreshold %>%"
+            exit 1
+          fi
+          echo "Coverage ${PCT}% >= <%= _covThreshold %>%"
+      - name: Generate HTML coverage report
+        run: |
+          mkdir -p coverage
+          go tool cover -html=coverage.out -o coverage/coverage.html
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]"
+      - run: pytest --cov --cov-fail-under=<%= _covThreshold %> --cov-report=html:coverage/html --cov-report=xml:coverage/coverage.xml
+<% } %>
+      - name: Upload coverage reports
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail the
+        # job whose actual signal (the coverage run above) already passed (#2058-class).
+        continue-on-error: true
+        with:
+          name: coverage-${{ github.run_id }}
+          path: coverage/
+          retention-days: 30
+<% } -%>
+
+<%# E1 (#1502): jscpd is a TS/JS clone detector — check-duplication.mjs is emitted
+    only for the typescript stack (other stacks get duplication via native CPD,
+    e.g. PMD-CPD for Java). The full-repo baseline job therefore renders for TS only. -%>
+<% if (language === 'typescript') { %>
+  duplication-baseline:
+    name: Full-repo duplication baseline (jscpd)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+      # E1 (#1502): the absolute full-repo CPD baseline runs here at nightly cadence.
+      # The PR path keeps only the diff-aware duplication ratchet (debt-ratchet),
+      # which flags NEW duplication vs the committed baseline.
+      - name: Full-repo duplication scan
+        run: node scripts/check-duplication.mjs
+<% } %>
+  sonar-deep-scan:
+    name: SonarCloud deep scan (full branch analysis)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      # #1311: self-hosted persistent workspaces can keep a stale
+      # .git/refs/**/*.lock from an interrupted run, which makes the
+      # deep checkout below fail with "cannot lock ref". No-op on
+      # ephemeral runners.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'java') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+<% } %>
+<% } else if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } %>
+      # E1 (#1502): the full deep scan moved off the PR path (which now does only
+      # incremental PR decoration). Best-effort — gated on SONAR_TOKEN being set.
+      - name: SonarCloud deep scan
+        if: env.SONAR_TOKEN != ''
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: <%= (language === 'java' && buildTool === 'gradle') ? './gradlew sonarqube' : (language === 'java') ? 'mvn sonar:sonar' : 'npx sonar-scanner' %> -Dsonar.token="$SONAR_TOKEN"
+
+  evidence-collect:
+    name: Upload nightly evidence artifacts
+    needs:
+      - shared-security
+<%_ if (locals.runnerProfile !== 'solo') { _%>
+      - fuzz
+      - soak-e2e
+<%_ } _%>
+      - gitleaks-history
+<% if (!_selfL2Coverage) { -%>
+      - coverage-report
+<% } -%>
+<% if (language === 'typescript') { %>
+      - duplication-baseline
+<% } %>
+      - sonar-deep-scan
+<% if (governanceLevel !== 'L1') { %>
+      - gate-full-nightly
+<% } %>
+<% if (locals.enableNativeBakeE2E) { %>
+      - bake-e2e-native
+<% } %>
+<% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>
+      - generated-gate-e2e
+      - generated-gate-e2e-misc
+      - generated-gate-e2e-greenfield
+<% } %>
+    if: always()
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<%_ /* #2256/#2259: the scrub step shells out to node unconditionally. Every
+     CI-enabled project now emits .nvmrc, while the composite action keeps npm
+     cache/install TypeScript-only, so this is safe for every stack. */ -%>
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% } else { %>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+<% } %>
+      - name: Collect evidence summary
+        run: |
+          mkdir -p nightly-evidence
+          echo "Nightly run: $(date -u +%Y-%m-%dT%H:%M:%SZ)" > nightly-evidence/summary.txt
+          echo "Ref: ${{ github.sha }}" >> nightly-evidence/summary.txt
+      - name: Scrub repo evidence before it leaves the repo (#2018)
+        # The artifact used to carry a timestamp and nothing else: the evidence
+        # the repo actually holds (.arbiter/evidence/**) never travelled with it.
+        # publish-evidence-snapshot strips tokens/keys/JWTs/PII and FAILS CLOSED
+        # if any pattern survives its re-scan, so a leak blocks the upload instead
+        # of shipping inside it. No-op where that scrubber is not present.
+        run: |
+          if [ ! -d .arbiter/evidence ]; then
+            echo "no evidence to publish (no .arbiter/evidence)"
+          elif [ -f scripts/publish-evidence-snapshot.mjs ]; then
+            node scripts/publish-evidence-snapshot.mjs \
+              --input .arbiter/evidence \
+              --output nightly-evidence/evidence
+          elif node --input-type=module -e '
+            import { existsSync, readFileSync } from "node:fs";
+            const path = "scripts/publish-evidence-snapshot.mjs";
+            const manifestPath = ".arbiter-generated-manifest.json";
+            if (!existsSync(manifestPath)) process.exit(0);
+            let manifest;
+            try { manifest = JSON.parse(readFileSync(manifestPath, "utf8")); }
+            catch (err) { console.error(`invalid ${manifestPath}: ${err.message}`); process.exit(2); }
+            if (manifest?.$schemaVersion !== 1 || !manifest.files || typeof manifest.files !== "object") {
+              console.error(`invalid ${manifestPath} shape`); process.exit(2);
+            }
+            process.exit(Object.hasOwn(manifest.files, path) ? 1 : 0);
+          '; then
+            echo "no evidence scrubber emitted for this project"
+          else
+            echo "ERROR: scripts/publish-evidence-snapshot.mjs was emitted by arbiter but is now missing"
+            exit 1
+          fi
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        # Supplementary artifact — never let an Artifacts-quota hiccup fail this
+        # best-effort evidence job (#2058-class).
+        continue-on-error: true
+        with:
+          name: nightly-evidence-${{ github.run_id }}
+          path: nightly-evidence/
+          retention-days: 90
+
+  cleanup-expired-artifacts:
+    name: Cleanup expired Actions artifacts
+    # GitHub's own artifact-expiry sweep does not always reliably reclaim
+    # storage — an artifact can sit resident (and billed) well past its
+    # retention-days cutoff. Best-effort safety net, never blocking:
+    # standalone (no `needs`), not part of `nightly-required`'s aggregation —
+    # a failure here must never red the actual nightly gate.
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+<% if (language === 'typescript') { -%>
+          node-version-file: '.nvmrc'
+<% } else { -%>
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+<% } -%>
+      - name: Delete already-expired artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node scripts/gh-cleanup-expired-artifacts.mjs
+
+  nightly-required:
+    name: Nightly gate
+    needs:
+      - shared-security
+<%_ if (locals.runnerProfile !== 'solo') { _%>
+      - fuzz
+      - soak-e2e
+<%_ } _%>
+      - gitleaks-history
+<% if (!_selfL2Coverage) { -%>
+      - coverage-report
+<% } -%>
+<% if (governanceLevel !== 'L1') { -%>
+      - gate-full-nightly
+<% } -%>
+<% if (language === 'typescript') { %>
+      - duplication-baseline
+<% } %>
+<% if (_isService) { %>
+      - toxiproxy-resilience
+      - load-smoke
+<% } %>
+<% if (locals.enableNativeBakeE2E) { %>
+      - bake-e2e-native
+<% } %>
+<% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>
+      - generated-gate-e2e
+      - generated-gate-e2e-misc
+      - generated-gate-e2e-greenfield
+<% } %>
+    if: always()
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - name: Assert no hard failures
+        run: |
+<% if (governanceLevel !== 'L1') { -%>
+          # #2628: the Full Gate is the authoritative L2/coverage signal — only a
+          # real success counts; cancelled/skipped/missing is a red nightly.
+          GATE="${{ needs.gate-full-nightly.result }}"
+          if [ "$GATE" != "success" ]; then
+            echo "::error::Full Gate nightly did not succeed (result: ${GATE:-missing})."
+            exit 1
+          fi
+<% } -%>
+          RESULTS=(
+            "${{ needs.shared-security.result }}"
+<%_ if (locals.runnerProfile !== 'solo') { _%>
+            "${{ needs.fuzz.result }}"
+            "${{ needs.soak-e2e.result }}"
+<%_ } _%>
+            "${{ needs.gitleaks-history.result }}"
+<% if (!_selfL2Coverage) { -%>
+            "${{ needs.coverage-report.result }}"
+<% } -%>
+<% if (governanceLevel !== 'L1') { -%>
+            "${{ needs.gate-full-nightly.result }}"
+<% } -%>
+<% if (language === 'typescript') { %>
+            "${{ needs.duplication-baseline.result }}"
+<% } %>
+<% if (_isService) { %>
+            "${{ needs.toxiproxy-resilience.result }}"
+            "${{ needs.load-smoke.result }}"
+<% } %>
+<% if (locals.enableNativeBakeE2E) { %>
+            "${{ needs.bake-e2e-native.result }}"
+<% } %>
+<% if (language === 'typescript' && locals.enableNativeBakeE2E) { %>
+            "${{ needs.generated-gate-e2e.result }}"
+            "${{ needs.generated-gate-e2e-misc.result }}"
+            "${{ needs.generated-gate-e2e-greenfield.result }}"
+<% } %>
+          )
+          FAILED=0
+          for r in "${RESULTS[@]}"; do
+            if [ "$r" = "failure" ]; then
+              FAILED=1
+            fi
+          done
+          if [ "$FAILED" = "1" ]; then
+            echo "::error::One or more nightly hard-failure jobs failed."
+            exit 1
+          fi
+          echo "Nightly gate passed."
+
+      - name: File issue on failure
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          EXISTING=$(gh issue list \
+            --label nightly-regression \
+            --state open \
+            --limit 1 \
+            --json number \
+            --repo "$GH_REPO" \
+            --jq '.[0].number // empty')
+          if [ -z "$EXISTING" ]; then
+            gh issue create \
+              --title "[nightly] regression detected (${{ github.run_id }})" \
+              --body "Nightly workflow failed. Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --label nightly-regression \
+              --repo "$GH_REPO"
+          fi