test: certify zed-cli #388 with GitHub-only outage recovery

.github/workflows/zed-cli-388-github-only-outage.yml

@@ -0,0 +1,161 @@
+name: zed-cli 388 GitHub-only outage certification
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/zed-cli-388-github-only-outage.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  ZED_CLI_SHA: f3123ebebadaede30da97a31a586288c3b15609d
+  DEAD_REGISTRY: https://zed-control-plane-intentionally-unavailable.invalid
+  DEAD_R2: http://127.0.0.1:1
+  ZED_PKG_SOURCE_FALLBACK: 'true'
+  ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1
+
+jobs:
+  github-only-five-language:
+    name: five ecosystems restore without Zed infrastructure
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out test repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check out exact zed-cli candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install pinned Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: '1.98.1'
+
+      - name: Build and verify exact candidate
+        working-directory: product/zed-cli
+        run: |
+          set -Eeuo pipefail
+          test "$(git rev-parse HEAD)" = "$ZED_CLI_SHA"
+          cargo build --locked --release --bin zed
+          cargo test --locked source_fallback::tests::smart_http_refs_recover_default_branch_and_peeled_tags -- --nocapture
+          cargo test --locked source_fallback::tests::github_rest_quota_and_server_failures_are_degradable -- --nocapture
+          cargo test --locked source_fallback::tests::github_sources_precede_zed_owned_r2_during_fallback -- --nocapture
+
+      - name: Create five-language consumer
+        run: |
+          set -Eeuo pipefail
+          mkdir -p consumer
+          cat > consumer/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "zed-cli-388-github-only-consumer"
+          version = "0.0.0"
+          description = "Independent GitHub-only recovery certification"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/go-lib" = "=1.0.0"
+          "zed-pkg-test/python-lib" = "=1.0.0"
+          "zed-pkg-test/dart-lib" = "=1.0.0"
+          "zed-pkg-test/node-lib" = "=1.0.0"
+          "zed-pkg-test/gleam-lib" = "=1.0.0"
+          EOF
+
+      - name: Resolve and materialize from GitHub with Zed control plane down
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-a" install \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/github-a.log"
+          test -s consumer/.zpkg.lock
+          for name in go-lib python-lib dart-lib node-lib gleam-lib; do
+            grep -R -q "name = \"$name\"" consumer/zed_modules
+          done
+          cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-a"
+          grep -E -q 'using GitHub(-first)? fallback' "$RUNNER_TEMP/github-a.log"
+
+      - name: Re-resolve from an independent empty home
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-b"
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-b" install \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/github-b.log"
+          cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock
+
+      - name: Frozen replay from a third empty home
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-frozen"
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/github-frozen.log"
+          cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock
+          test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 5
+
+      - name: Fail closed when source fallback is disabled
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-disabled"
+          set +e
+          (
+            cd consumer
+            ZED_PKG_SOURCE_FALLBACK=false "$ZED" --registry "$DEAD_REGISTRY" \
+              --home "$RUNNER_TEMP/zed-home-disabled" install --frozen \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) >"$RUNNER_TEMP/fallback-disabled.log" 2>&1
+          status=$?
+          set -e
+          cat "$RUNNER_TEMP/fallback-disabled.log"
+          test "$status" -ne 0
+
+      - name: Retain outage evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zed-cli-388-github-only-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: warn
+          retention-days: 14
+          path: |
+            ${{ runner.temp }}/lock-a
+            ${{ runner.temp }}/github-a.log
+            ${{ runner.temp }}/github-b.log
+            ${{ runner.temp }}/github-frozen.log
+            ${{ runner.temp }}/fallback-disabled.log
+            consumer/.zpkg.lock