Release develop to r10.0

.dockerignore

@@ -13,7 +13,7 @@
 **/*.jfm
 **/azds.yaml
 **/bin
-**/charts
+charts
 **/docker-compose*
 **/Dockerfile*
 **/node_modules

.github/workflows/bitween-api-cicd-gateway.yml

@@ -109,10 +109,11 @@ jobs:
         nameOverride=bitween
         global.environment=Development
         replicaCount=2
-        resources.requests.cpu=25m
-        resources.requests.memory=704Mi
-        resources.limits.memory=1408Mi
+        resources.requests.cpu=310m
+        resources.requests.memory=1024Mi
+        resources.limits.memory=2048Mi
         environmentVariables.Bitween__BusProvidersEnabled=true
+        environmentVariables.Bitween__CircuitBreakerPerEndpoint=true
         environmentVariables.AWS_REQUEST_CHECKSUM_CALCULATION=when_required
         environmentVariables.AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
     secrets:
@@ -137,7 +138,13 @@ jobs:
       # holding it can mint a token for any identity, so the app refuses to start on it.
       # Set the TokenKey secret to a long random string unique to this environment
       # (openssl rand -base64 48). Changing it signs out everyone holding an older token.
-      helm-set-secret-values: 'global.token.key=${{ secrets.TokenKey }},db=${{ secrets.dbConnection }},global.bus.rabbitUrl=${{ secrets.rabbitUrl }},global.cloudFiles.secretAccessKey=${{ secrets.SecretAccessKey }},global.cloudFiles.accessKeyId=${{ secrets.AccessKeyId }},global.cloudFiles.serviceUrl=${{ secrets.ServiceUrl }},global.cloudFiles.bucketName=${{ secrets.BucketName }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.RabbitMqManagementUrl }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.RabbitMqManagementPassword }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.RabbitMqManagementUsername }}'
+      #
+      # Bitween__SettingsEncryptionKey encrypts stored credentials (partner, adapter and connection
+      # secrets, the mail server password). Without it they are stored in plain text and secret
+      # settings can't be saved in the UI. Set the SettingsEncryptionKey secret once
+      # (openssl rand -base64 32) and never change or lose it: what it encrypted can't be read
+      # without it.
+      helm-set-secret-values: 'global.token.key=${{ secrets.TokenKey }},db=${{ secrets.dbConnection }},global.bus.rabbitUrl=${{ secrets.rabbitUrl }},global.cloudFiles.secretAccessKey=${{ secrets.SecretAccessKey }},global.cloudFiles.accessKeyId=${{ secrets.AccessKeyId }},global.cloudFiles.serviceUrl=${{ secrets.ServiceUrl }},global.cloudFiles.bucketName=${{ secrets.BucketName }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.RabbitMqManagementUrl }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.RabbitMqManagementPassword }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.RabbitMqManagementUsername }},secrets.Bitween__SettingsEncryptionKey=${{ secrets.SettingsEncryptionKey }}'
 
   Prod:
     # Release: build and publish for clients, deploy production. releases/r10.0 is the
@@ -223,31 +230,33 @@ jobs:
 
       # Production's own configuration, the same settings as the develop job's above. PROD_TOKENKEY
       # is its own random string (openssl rand -base64 48), never the develop key.
-      helm-set-secret-values: 'global.token.key=${{ secrets.PROD_TOKENKEY }},db=${{ secrets.PROD_DBCONNECTION }},global.bus.rabbitUrl=${{ secrets.PROD_RABBITURL }},global.cloudFiles.secretAccessKey=${{ secrets.PROD_SECRETACCESSKEY }},global.cloudFiles.accessKeyId=${{ secrets.PROD_ACCESSKEYID }},global.cloudFiles.serviceUrl=${{ secrets.PROD_SERVICEURL }},global.cloudFiles.bucketName=${{ secrets.PROD_BUCKETNAME }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.PROD_RABBITMQMANAGEMENTURL }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.PROD_RABBITMQMANAGEMENTPASSWORD }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.PROD_RABBITMQMANAGEMENTUSERNAME }}'
+      # PROD_SETTINGSENCRYPTIONKEY is production's own too (openssl rand -base64 32), and like develop's
+      # it must never change or be lost.
+      helm-set-secret-values: 'global.token.key=${{ secrets.PROD_TOKENKEY }},db=${{ secrets.PROD_DBCONNECTION }},global.bus.rabbitUrl=${{ secrets.PROD_RABBITURL }},global.cloudFiles.secretAccessKey=${{ secrets.PROD_SECRETACCESSKEY }},global.cloudFiles.accessKeyId=${{ secrets.PROD_ACCESSKEYID }},global.cloudFiles.serviceUrl=${{ secrets.PROD_SERVICEURL }},global.cloudFiles.bucketName=${{ secrets.PROD_BUCKETNAME }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.PROD_RABBITMQMANAGEMENTURL }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.PROD_RABBITMQMANAGEMENTPASSWORD }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.PROD_RABBITMQMANAGEMENTUSERNAME }},secrets.Bitween__SettingsEncryptionKey=${{ secrets.PROD_SETTINGSENCRYPTIONKEY }}'
 
   # The bitween CLI and the SDKs carry the version the run above computed, so nothing is tagged by
   # hand. A develop build releases the CLI as a pre-release, cli-v<x.y.z>-dev.<run>; the release
   # from releases/r10.0 releases it as the latest, cli-v<x.y.z>, and publishes the SDKs. Each runs
   # only when the job it needs ran, so the branch is decided above.
   cli-develop:
-    needs: build-publish-deploy
+    needs: Dev
     uses: ./.github/workflows/cli-release.yml
     with:
-      version: ${{ needs.build-publish-deploy.outputs.version }}
+      version: ${{ needs.Dev.outputs.version }}
       prerelease: true
       run-number: ${{ github.run_number }}
 
   cli-release:
-    needs: publish-release
+    needs: Prod
     uses: ./.github/workflows/cli-release.yml
     with:
-      version: ${{ needs.publish-release.outputs.version }}
+      version: ${{ needs.Prod.outputs.version }}
 
   sdk-release:
-    needs: publish-release
+    needs: Prod
     permissions:
       contents: read
     uses: ./.github/workflows/sdk-release.yml
     with:
-      version: ${{ needs.publish-release.outputs.version }}
+      version: ${{ needs.Prod.outputs.version }}
     secrets: inherit

.github/workflows/cli-release.yml

@@ -0,0 +1,143 @@
+name: bitween CLI release
+
+# Publishes the bitween command as self-contained binaries on a GitHub release: nothing needs .NET
+# installed to run them. Never run by hand or by a tag: the CI run that publishes this repository
+# calls it with the version it computed (determine-semver: the next patch from the git tags), so the
+# CLI carries the version of the release it ships with. The computed version is the bare x.y.z on
+# develop too, so a develop build says so with prerelease and passes its run number.
+#   a release, 10.0.61                                  cli-v10.0.61          the latest release
+#   a prerelease, 10.0.61 with prerelease and run 121   cli-v10.0.61-dev.121  a pre-release, to try out
+# Called by bitween-api-cicd-gateway.yml: after the release from releases/r10.0, and after each develop build.
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "The version the calling run computed"
+        type: string
+        required: true
+      prerelease:
+        description: "Release as a pre-release, named after the run"
+        type: boolean
+        default: false
+      run-number:
+        description: "The calling run's number, for a pre-release"
+        type: string
+        default: ""
+
+permissions:
+  contents: write
+
+jobs:
+  channel:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.channel.outputs.version }}
+      prerelease: ${{ steps.channel.outputs.prerelease }}
+    steps:
+      - name: Channel
+        id: channel
+        env:
+          VERSION: ${{ inputs.version }}
+          PRERELEASE: ${{ inputs.prerelease }}
+          RUN_NUMBER: ${{ inputs.run-number }}
+        run: |
+          v="$VERSION"
+          if [ "$PRERELEASE" = "true" ]; then
+            # A pre-release names its run: 10.0.61 from run 121 is 10.0.61-dev.121.
+            v="${v%%-*}-dev.${RUN_NUMBER:-${GITHUB_RUN_NUMBER}}"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          elif [[ "$v" == *-* ]]; then
+            # A version that already carries its branch and run: 10.0.61-releases-r10-0-develop.121 is 10.0.61-dev.121.
+            v="${v%%-*}-dev.${v##*.}"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: channel
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        rid: [linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, osx-arm64, win-x64]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+      - name: Publish
+        run: >
+          dotnet publish SW.Bitween.Cli -c Release -r ${{ matrix.rid }} --self-contained
+          -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:DebugType=none
+          -p:Version=${{ needs.channel.outputs.version }} -o out
+      - name: Package
+        run: |
+          mkdir -p dist
+          cp docs/cli.md out/README.md 2>/dev/null || true
+          if [[ "${{ matrix.rid }}" == win-* ]]; then
+            (cd out && zip -q -r ../dist/bitween-${{ matrix.rid }}.zip .)
+          else
+            tar -czf dist/bitween-${{ matrix.rid }}.tar.gz -C out .
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bitween-${{ matrix.rid }}
+          path: dist/*
+
+  # The data source providers (RabbitMQ, SQS and the database engines) as adapter packages, with the
+  # release's version: installed like any adapter, with bitween adapter publish or apply's adapters
+  # section. Nothing else publishes them, and a Bitween runs no data source without them.
+  providers:
+    needs: channel
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+      - name: Build
+        env:
+          VERSION: ${{ needs.channel.outputs.version }}
+        run: |
+          dotnet build SW.Bitween.Cli -c Release -o cli
+          mkdir -p dist
+          for project in SW.Bitween.Adapters.Bus.RabbitMq SW.Bitween.Adapters.Bus.Sqs SW.Bitween.Adapters.Db.PostgreSql \
+                         SW.Bitween.Adapters.Db.MySql SW.Bitween.Adapters.Db.SqlServer SW.Bitween.Adapters.Db.Oracle; do
+            jq --arg v "$VERSION" '.version = $v' "$project/adapter.json" > adapter.json.tmp && mv adapter.json.tmp "$project/adapter.json"
+            dotnet cli/bitween.dll adapter build "$project" -o dist
+          done
+          ls -la dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bitween-providers
+          path: dist/*.zip
+
+  release:
+    needs: [channel, build, providers]
+    runs-on: ubuntu-latest
+    steps:
+      # Only the CLI builds' own artifacts. Without a pattern this fetched every artifact in the run,
+      # including the build record docker/build-push-action uploads in the deploy job, which can't be
+      # extracted and failed the release (and would have landed in SHA256SUMS if it could).
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: bitween-*
+          path: dist
+          merge-multiple: true
+      - name: Checksums
+        run: cd dist && sha256sum * > SHA256SUMS && cat SHA256SUMS
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          v="${{ needs.channel.outputs.version }}"
+          install="curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/releases/r10.0/scripts/install-cli.sh"
+          if [ "${{ needs.channel.outputs.prerelease }}" = "true" ]; then
+            gh release create "cli-v$v" dist/* --title "bitween CLI $v (pre-release)" --target "${{ github.sha }}" --prerelease \
+              --notes "A pre-release of the bitween command, built from ${{ github.ref_name }}, to try out. Install: $install | BITWEEN_CLI_VERSION=$v sh - or download the archive for your platform and check it against SHA256SUMS."
+          else
+            gh release create "cli-v$v" dist/* --title "bitween CLI $v" --target "${{ github.sha }}" --latest \
+              --notes "The bitween command, self-contained for each platform. Install: $install | sh - or download the archive for your platform and check it against SHA256SUMS."
+          fi

.github/workflows/critical-vuln-check.yml

@@ -1,19 +1,19 @@
 # =============================================================================
-# Critical Dependabot Vulnerability Check — Caller template
+# Critical Dependabot Vulnerability Check - Caller template
 # =============================================================================
 # USAGE:
 #   Copy this file to your repo at .github/workflows/critical-vuln-check.yml.
-#   No REPLACE values needed — this template requires no customization.
+#   No REPLACE values needed - this template requires no customization.
 #
 # WHAT IT DOES:
 #   Runs on every PR targeting main or develop. Fails if the repository has
 #   any open CRITICAL-severity Dependabot alert.
 #
 #   Enforcement differs by target branch via each repo's OWN branch
 #   protection settings (not by anything in this file):
-#     - On `main`:    mark this check REQUIRED in branch protection — merge
+#     - On `main`:    mark this check REQUIRED in branch protection - merge
 #                     is physically blocked while a critical alert is open.
-#     - On `develop`: leave this check NOT required — it still shows as a
+#     - On `develop`: leave this check NOT required - it still shows as a
 #                     failing/red check (a visible warning) without blocking
 #                     the merge.
 # =============================================================================

.github/workflows/dependabot-auto-merge.yml

@@ -1,5 +1,5 @@
 # =============================================================================
-# Dependabot Auto-Merge — Caller template
+# Dependabot Auto-Merge - Caller template
 # =============================================================================
 # USAGE:
 #   Copy this file to your repo at .github/workflows/dependabot-auto-merge.yml.
@@ -10,13 +10,13 @@
 #     - The PR author is dependabot[bot]
 #     - The update is a semver PATCH bump (never minor/major)
 #     - The ecosystem is npm, nuget, pub, bundler, or github-actions
-#       (NEVER docker — base image bumps always need manual review)
+#       (NEVER docker - base image bumps always need manual review)
 #     - This repo currently has no open critical Dependabot alert (re-checked
-#       here explicitly — see workflow-templates/critical-vuln-check.yml's
+#       here explicitly - see workflow-templates/critical-vuln-check.yml's
 #       header for why this can't just `needs:` that file's job)
 #   "Auto-merge" here means GitHub's native auto-merge feature: it still
 #   waits for the repo's actual required status checks (build/test) to pass
-#   before merging — this workflow does not bypass those.
+#   before merging - this workflow does not bypass those.
 # =============================================================================
 name: Dependabot Auto-Merge
 
@@ -64,5 +64,5 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           set -euo pipefail
-          echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
+          echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} - patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
           gh pr merge --auto --squash "$PR_URL"

.github/workflows/dotnet-pr-checks.yml

@@ -0,0 +1,50 @@
+# Builds the solution and runs the .NET unit tests on every pull request into a release branch.
+#
+# The deploy pipeline runs the .NET tests only after a merge, so a change that broke them was
+# found once it had already landed on a release branch. Bitween runs at customer sites that
+# upgrade in place, so this check runs before the merge instead. The unit tests need no
+# database or broker and take seconds. The integration tests (Testcontainers) still run in the
+# deploy pipeline.
+name: .NET checks
+
+on:
+  pull_request:
+    branches: [releases/**]
+    paths-ignore:
+      # Covered by frontend-tests.yml; the .NET build does not compile the SPA.
+      - 'SW.Bitween.Web/ClientApp/**'
+      - 'docs/**'
+      - '**/*.md'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dotnet-pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-unit-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      # Pinned to commits, since a tag can be moved.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: '10.0.x'
+      - run: dotnet restore SW.Bitween.sln
+      # SkipClientBuild keeps MSBuild from building the SPA should any target pull in publish.
+      - run: dotnet build SW.Bitween.sln --no-restore --configuration Release -p:SkipClientBuild=true
+      - run: >
+          dotnet test SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj
+          --no-build --configuration Release
+          --logger "trx;LogFileName=unit-tests.trx"
+          --results-directory TestResults
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: failure()
+        with:
+          name: unit-test-results
+          path: TestResults

.github/workflows/frontend-tests.yml

@@ -3,7 +3,7 @@
 #
 # The deploy pipeline only runs the .NET test projects, and only after a merge, so until
 # this existed nothing ever ran the frontend tests outside someone's machine. These need
-# no backend or database — the component tests render pages against a mock network — so
+# no backend or database - the component tests render pages against a mock network - so
 # they take seconds. The Playwright e2e suite is not run here: it needs a running backend
 # with seeded data.
 name: Frontend tests
@@ -40,7 +40,7 @@ jobs:
           cache: yarn
           cache-dependency-path: SW.Bitween.Web/ClientApp/yarn.lock
       - run: yarn install --frozen-lockfile
-      # The same type-check the Docker build runs, which covers the tests too — so a test file
+      # The same type-check the Docker build runs, which covers the tests too - so a test file
       # that breaks it fails here rather than in the deploy after the merge.
       - run: npx tsc -b
       - run: yarn test