stability: implement audit findings remediation plan

.github/chainguard/github.rules_test_optimization_tests.sts.yaml

@@ -1,13 +1,13 @@
 # Docs: https://datadoghq.atlassian.net/wiki/spaces/SECENG/pages/5138645099/User+guide+dd-octo-sts
 issuer: https://token.actions.githubusercontent.com
 
-subject_pattern: "repo:DataDog/rules_test_optimization_tests:.*"
+subject_pattern: "repo:DataDog/rules_test_optimization:.*"
 claim_pattern:
   event_name: (push|schedule|workflow_dispatch|pull_request|pull_request_target)
 #  ref: refs/heads/main
 #  ref_protected: "true"
-#  job_workflow_ref: DataDog/rules_test_optimization_tests/\.github/workflows/.*
-  repository: DataDog/rules_test_optimization_tests
+#  job_workflow_ref: DataDog/rules_test_optimization/\.github/workflows/.*
+  repository: DataDog/rules_test_optimization
 
 permissions:
   contents: read

.github/workflows/ci.yml

@@ -163,7 +163,7 @@ jobs:
 
       - name: Install Python tooling dependencies
         shell: bash
-        run: python3 -m pip install -r tools/requirements.txt
+        run: python3 -m pip install --require-hashes -r tools/requirements.txt
 
       - name: Verify Python tooling tests through Bazel
         shell: bash
@@ -376,12 +376,20 @@ jobs:
 
       - name: Install Python tooling dependencies
         shell: bash
-        run: python3 -m pip install -r tools/requirements.txt
+        run: python3 -m pip install --require-hashes -r tools/requirements.txt
 
       - name: Verify core/go module versions are aligned
         shell: bash
         run: python3 tools/dev/check_module_versions.py
 
+      - name: Verify .bazelversion parity
+        shell: bash
+        run: python3 tools/dev/check_bazelversion_sync.py
+
+      - name: Verify findings ledger coverage
+        shell: bash
+        run: python3 tools/dev/check_findings_ledger.py
+
       - name: Validate integration fixture and snapshot JSON
         shell: bash
         run: |

.github/workflows/release.yml

@@ -31,12 +31,20 @@ jobs:
 
       - name: Install Python tooling dependencies
         shell: bash
-        run: python3 -m pip install -r tools/requirements.txt
+        run: python3 -m pip install --require-hashes -r tools/requirements.txt
 
       - name: Verify core/go module versions are aligned
         shell: bash
         run: python3 tools/dev/check_module_versions.py
 
+      - name: Verify .bazelversion parity
+        shell: bash
+        run: python3 tools/dev/check_bazelversion_sync.py
+
+      - name: Verify findings ledger coverage
+        shell: bash
+        run: python3 tools/dev/check_findings_ledger.py
+
       - name: Verify schema files are in sync
         shell: bash
         run: python3 tools/core/schemas/sync_agentless_schema.py --check
@@ -68,3 +76,197 @@ jobs:
         run: |
           echo "Release validation completed."
           echo "Before publishing, follow CONTRIBUTING.md release runbook steps."
+
+  release-hermetic:
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Run Bazel tests (hermetic lane)
+        timeout-minutes: 25
+        shell: bash
+        run: |
+          ./bazelw test //tools/... \
+          --spawn_strategy=sandboxed \
+          --strategy=TestRunner=sandboxed \
+          --incompatible_strict_action_env \
+          --sandbox_default_allow_network=false \
+          --modify_execution_info=TestRunner=+block-network \
+          --test_env=TZ=UTC \
+          --test_env=LANG=C \
+          --test_env=LC_ALL=C \
+          --enable_runfiles
+
+      - name: Run Bazel tests (go companion hermetic lane)
+        timeout-minutes: 25
+        shell: bash
+        run: |
+          cd modules/go &&
+          ../../bazelw test //... \
+          --override_module=datadog-rules-test-optimization=../.. \
+          --spawn_strategy=sandboxed \
+          --strategy=TestRunner=sandboxed \
+          --incompatible_strict_action_env \
+          --sandbox_default_allow_network=false \
+          --modify_execution_info=TestRunner=+block-network \
+          --test_env=TZ=UTC \
+          --test_env=LANG=C \
+          --test_env=LC_ALL=C \
+          --enable_runfiles
+
+  release-shell-lint:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install shellcheck
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: Lint repository shell scripts
+        shell: bash
+        run: |
+          shellcheck --severity=error \
+            bazelw \
+            examples/single_service/runtests.sh \
+            examples/multi_service/runtests.sh \
+            tools/tests/integration/*.sh \
+            tools/tests/python/run_python_tools_test.sh \
+            tools/tests/python/run_bazelw_wrapper_test.sh
+
+      - name: Lint uploader templates (bash parser)
+        shell: bash
+        run: python3 tools/dev/lint_uploader_templates.py --skip-powershell-parse
+
+  release-powershell-lint:
+    timeout-minutes: 20
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install PSScriptAnalyzer
+        shell: pwsh
+        run: |
+          if (-not (Get-Module -ListAvailable -Name PSScriptAnalyzer)) {
+            if (-not (Get-PackageProvider -ListAvailable -Name NuGet -ErrorAction SilentlyContinue)) {
+              Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
+            }
+            Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
+            Install-Module -Name PSScriptAnalyzer -Scope CurrentUser -Force -AllowClobber
+          }
+
+      - name: Lint integration PowerShell scripts
+        shell: pwsh
+        run: |
+          $results = Invoke-ScriptAnalyzer -Path "tools/tests/integration/*.ps1" -Severity Error
+          if ($results) {
+            $results | Format-Table -AutoSize
+            throw "PSScriptAnalyzer found lint errors."
+          }
+
+      - name: Lint uploader templates (PowerShell parser)
+        shell: pwsh
+        run: python tools/dev/lint_uploader_templates.py --skip-shellcheck
+
+  release-gofmt-check:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Verify Go files are gofmt formatted
+        shell: bash
+        run: |
+          mapfile -t go_files < <(git ls-files '*.go')
+          if (( ${#go_files[@]} == 0 )); then
+            exit 0
+          fi
+          unformatted="$(gofmt -l "${go_files[@]}")"
+          if [[ -n "${unformatted}" ]]; then
+            echo "error: gofmt found unformatted files:"
+            echo "${unformatted}"
+            exit 1
+          fi
+
+  release-docs-links:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Check markdown links
+        uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2.4.1
+        with:
+          args: >-
+            --glob
+            --no-progress
+            --verbose
+            --exclude-mail
+            --accept 429
+            --max-retries 2
+            --retry-wait-time 2
+            README.md
+            CONTRIBUTING.md
+            AGENTS.md
+            CHANGELOG.md
+            SECURITY.md
+            docs/**/*.md
+            examples/**/*.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  release-platform-smoke:
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Ensure jq is available (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if (Get-Command jq -ErrorAction SilentlyContinue) {
+            jq --version
+            exit 0
+          }
+          choco install jq --no-progress -y
+          jq --version
+
+      - name: Run mock server integration tests (macOS)
+        if: runner.os == 'macOS'
+        shell: bash
+        run: ./tools/tests/integration/run_mock_server_tests.sh
+
+      - name: Run mock server integration tests (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./tools/tests/integration/run_mock_server_tests.ps1

BUILD.bazel

@@ -1,2 +1,5 @@
 # Root package exists to expose repository-level utility files to tests.
-exports_files(["bazelw"])
+exports_files([
+    ".bazelversion",
+    "bazelw",
+])

CONTRIBUTING.md

@@ -30,7 +30,7 @@
 - Python tooling tests:
   - `./bazelw test //tools/tests/python:python_tools_test`
 - Optional Python tooling dependencies (for local script execution):
-  - `python3 -m pip install -r tools/requirements.txt`
+  - `python3 -m pip install --require-hashes -r tools/requirements.txt`
 - Local lint prerequisites (match CI tooling):
   - `shellcheck` (shell lint lane)
   - `buildifier` (Starlark formatting lane)
@@ -40,7 +40,7 @@
 - Optional Python syntax smoke check when editing tooling:
   - `python3 -m py_compile tools/core/validate_payload_schema.py tools/core/schemas/sync_agentless_schema.py tools/tests/integration/mock_dd_server.py`
 - Integration harness:
-  - Prerequisites: `jq` (Linux/macOS) and Git Bash available in PATH on Windows.
+  - Prerequisites: `jq` (Linux/macOS). Windows harness is PowerShell-only.
   - Linux/macOS: `tools/tests/integration/run_mock_server_tests.sh`
   - Windows primary entrypoint: `tools/tests/integration/run_mock_server_tests.ps1`
   - Windows convenience wrapper: `tools/tests/integration/run_mock_server_tests.cmd`
@@ -71,6 +71,8 @@
   - scope policy: Linux-only by design today; non-Linux hermetic expansion is tracked separately to keep CI runtime bounded
 - Utility/lint lanes:
   - module version alignment check (`tools/dev/check_module_versions.py`)
+  - `.bazelversion` parity check (`tools/dev/check_bazelversion_sync.py`)
+  - findings-ledger coverage check (`tools/dev/check_findings_ledger.py`)
   - shell scripts, PowerShell, Buildifier, gofmt, schema sync checks, fixture JSON checks, and Python tooling tests
 - Workflow dependency pinning:
   - Keep GitHub Actions pinned by commit SHA and preserve the `# vX.Y.Z` comment.

README.md

@@ -211,11 +211,11 @@ For a generic wrapper pattern, see [Other languages (without companion macro)](#
 - **Bazel 5.0+ minimum capability** - Earliest Bazel line with required `TEST_UNDECLARED_OUTPUTS_DIR` payload support
 - **Tracer/runtime with DD Test Optimization file-mode support** - Must honor `DD_TEST_OPTIMIZATION_MANIFEST_FILE` and `DD_TEST_OPTIMIZATION_PAYLOADS_IN_FILES`
 - **rules_go v0.51.0+** (for Go importpath inference) - This repository reads `GoInfo`/`GoArchive` providers when selecting per-module payloads
-- **DD_SITE format** - Accepts bare host, app/api-prefixed host, or full URL; normalized to `https://api.<site>`
+- **DD_SITE format** - Accepts bare host, app/api-prefixed host, or full URL; leading/trailing ASCII whitespace is trimmed, then normalized to `https://api.<site>`
 - **Uploader tooling (per platform)** - Required for `bazel run //:dd_upload_payloads`
   - **Linux**: `bash`, `curl`, `find`, `stat` (GNU), `awk`, and one of `md5sum` or `shasum`
   - **macOS**: `bash` (3.2+), `curl`, `find`, `stat` (BSD), `awk`, and one of `md5` or `shasum`
-  - **Windows**: `powershell.exe` (Windows PowerShell 5.1+ or PowerShell 7+); the uploader uses .NET `HttpClient`
+  - **Windows**: `powershell.exe` (Windows PowerShell 5.1+ or PowerShell 7+); the uploader uses .NET `HttpClient` and is intentionally PowerShell-only (no Git Bash dependency)
 
 Optional tooling:
 - **jq** (Linux/macOS) - Used to enrich test payloads with `context.json`. If missing, uploads proceed without enrichment.
@@ -535,6 +535,7 @@ Fast checks before diving deep:
 - Full troubleshooting playbook: [`docs/Troubleshooting.md`](docs/Troubleshooting.md)
 - Configuration and fetch behavior reference: [`docs/Configuration_Reference.md`](docs/Configuration_Reference.md)
 - Uploader runtime reference: [`docs/Uploader_Reference.md`](docs/Uploader_Reference.md)
+- External-link provenance note: repository behavior is source-of-truth in this repo's code/tests; external docs are informative and may lag temporarily.
 
 ## Tips
 

bazelw

@@ -7,6 +7,37 @@ set -euo pipefail
 
 now_ts="$(date +%s)"
 ttl_seconds="${FETCH_SALT_TTL:-0}"
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+bazelversion_file="${script_dir}/.bazelversion"
+wanted_version=""
+if [[ -f "${bazelversion_file}" ]]; then
+  wanted_version="$(tr -d '[:space:]' < "${bazelversion_file}")"
+fi
+if [[ -z "${wanted_version}" ]]; then
+  echo "error: unable to read expected Bazel version from ${bazelversion_file}" >&2
+  exit 127
+fi
+
+extract_semver() {
+  local raw="${1:-}"
+  if [[ "${raw}" =~ ([0-9]+\.[0-9]+\.[0-9]+) ]]; then
+    printf '%s' "${BASH_REMATCH[1]}"
+    return 0
+  fi
+  return 1
+}
+
+detect_system_bazel_version() {
+  local raw=""
+  local parsed=""
+  raw="$(bazel --version 2>/dev/null || true)"
+  parsed="$(extract_semver "${raw}" || true)"
+  if [[ -z "${parsed}" ]]; then
+    raw="$(bazel version 2>/dev/null | awk -F': ' '/Build label:/ { print $2; exit }')"
+    parsed="$(extract_semver "${raw}" || true)"
+  fi
+  printf '%s' "${parsed}"
+}
 
 if [[ "${ttl_seconds}" =~ ^[0-9]+$ ]] && [[ "${ttl_seconds}" -gt 0 ]]; then
   salt=$(( now_ts / ttl_seconds ))
@@ -16,8 +47,24 @@ fi
 
 if command -v bazelisk >/dev/null 2>&1; then
   bazel_cmd="bazelisk"
+elif command -v bazel >/dev/null 2>&1; then
+  system_bazel_version="$(detect_system_bazel_version)"
+  if [[ "${BAZELW_ALLOW_SYSTEM_BAZEL:-0}" == "1" ]]; then
+    echo "warning: bazelisk not found; using system bazel due to BAZELW_ALLOW_SYSTEM_BAZEL=1" >&2
+    bazel_cmd="bazel"
+  elif [[ -z "${system_bazel_version}" ]]; then
+    echo "error: bazelisk is required to enforce .bazelversion (unable to detect system bazel version)." >&2
+    exit 127
+  elif [[ "$system_bazel_version" == "$wanted_version" ]]; then
+    echo "warning: bazelisk not found; using system bazel version $system_bazel_version (matches .bazelversion)" >&2
+    bazel_cmd="bazel"
+  else
+    echo "error: bazelisk is required to enforce .bazelversion (wanted $wanted_version, found system bazel $system_bazel_version)." >&2
+    exit 127
+  fi
 else
-  bazel_cmd="bazel"
+  echo "error: bazelisk is required to enforce .bazelversion (set BAZELW_ALLOW_SYSTEM_BAZEL=1 to override)." >&2
+  exit 127
 fi
 
 sanitize_repository_url() {