chore: converge CountryService protected branches

.dockerignore

@@ -0,0 +1,13 @@
+**/bin/
+**/obj/
+.git/
+.github/
+.vs/
+.vscode/
+.idea/
+.specify/
+TestResults/
+coverage/
+temp/
+*.user
+*.suo

.github/dependabot.yml

@@ -1,16 +1,34 @@
-version: 2
+version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      nuget-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "docker"
     directory: "/Maliev.CountryService.Api"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      docker-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      github-actions-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/_validate.yml

@@ -0,0 +1,107 @@
+name: Reusable Validation
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      IMAGE_TAG: maliev-countryservice:validation-${{ github.run_id }}-${{ github.run_attempt }}
+      UsePackageReferences: "false"
+    steps:
+      - name: Checkout CountryService
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          path: CountryService
+          persist-credentials: false
+
+      - name: Checkout pinned public ServiceDefaults source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          repository: MALIEV-Co-Ltd/Maliev.Aspire
+          ref: 25a5c3b2d3d6b5ce8ed485d2d44a28f4dc4c9b51
+          path: Maliev.Aspire
+          persist-credentials: false
+
+      - name: Checkout pinned public MessagingContracts source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        with:
+          repository: MALIEV-Co-Ltd/Maliev.MessagingContracts
+          ref: 559a00db0c7920a5247fdff60d4476ad23a9a501
+          path: Maliev.MessagingContracts
+          persist-credentials: false
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Restore locked dependencies
+        run: dotnet restore Maliev.CountryService.slnx --configfile nuget.config --locked-mode
+        working-directory: CountryService
+
+      - name: Audit dependencies
+        run: dotnet list Maliev.CountryService.slnx package --vulnerable --include-transitive --no-restore
+        working-directory: CountryService
+
+      - name: Verify formatting
+        run: dotnet format Maliev.CountryService.slnx --verify-no-changes --no-restore
+        working-directory: CountryService
+
+      - name: Build
+        run: dotnet build Maliev.CountryService.slnx --configuration Release --no-restore
+        working-directory: CountryService
+
+      - name: Test
+        run: dotnet test Maliev.CountryService.slnx --configuration Release --no-build --no-restore --verbosity normal
+        working-directory: CountryService
+
+      - name: Scan repository for secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="gitleaks_8.30.1_linux_x64.tar.gz"
+          curl --fail --location --silent --show-error \
+            --output "$archive" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/$archive"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $archive" | sha256sum --check
+          tar --extract --gzip --file "$archive" gitleaks
+          ./gitleaks dir CountryService --no-banner --redact
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
+
+      - name: Build local production image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        with:
+          context: CountryService
+          file: CountryService/Maliev.CountryService.Api/Dockerfile
+          build-contexts: |
+            aspire=./Maliev.Aspire
+            messaging=./Maliev.MessagingContracts
+          load: true
+          push: false
+          tags: ${{ env.IMAGE_TAG }}
+
+      - name: Validate runtime image metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          metadata="$(docker image inspect "$IMAGE_TAG")"
+          test "$(jq -r '.[0].Config.User' <<< "$metadata")" = "app"
+          test "$(jq -c '.[0].Config.Entrypoint' <<< "$metadata")" = '["dotnet","Maliev.CountryService.Api.dll"]'
+
+      - name: Scan image for high-severity vulnerabilities
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          image-ref: ${{ env.IMAGE_TAG }}
+          format: table
+          scanners: vuln
+          severity: HIGH,CRITICAL
+          exit-code: "1"

.github/workflows/ci-develop.yml

@@ -1,108 +1,12 @@
-name: CI - Develop
+name: Validate - Develop
 
 on:
   push:
-    branches:
-      - develop
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Switch to PackageReference for Docker build
-        run: |
-          # Use develop version format for shared libraries
-          VERSION_FORMAT="1.0.*-alpha*"
-          find . -name "*.csproj" -type f -exec sed -i             's|<ProjectReference Include=".*Maliev.Aspire.ServiceDefaults.*.csproj" />|<PackageReference Include="Maliev.Aspire.ServiceDefaults" Version="'$VERSION_FORMAT'" />|g'             {} +
-          find . -name "*.csproj" -type f -exec sed -i             's|<ProjectReference Include=".*Maliev.MessagingContracts.*.csproj" />|<PackageReference Include="Maliev.MessagingContracts" Version="'$VERSION_FORMAT'" />|g'             {} +
-          echo "Switched to PackageReference for ServiceDefaults and MessagingContracts"
-
-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v3
-        with:
-          credentials_json: ${{ secrets.GCP_SA_KEY }}
-
-      - name: Set up Google Cloud SDK
-        uses: google-github-actions/setup-gcloud@v3
-        with:
-          project_id: maliev-website
-
-      - name: Build and push Docker image
-        run: |
-          gcloud auth configure-docker asia-southeast1-docker.pkg.dev
-          NUGET_USERNAME=${{ github.actor }} \
-          NUGET_PASSWORD=${{ secrets.GITOPS_PAT }} \
-            docker build \
-            --secret id=nuget_username,env=NUGET_USERNAME \
-            --secret id=nuget_password,env=NUGET_PASSWORD \
-            -t asia-southeast1-docker.pkg.dev/maliev-website/maliev-website-artifact-dev/maliev-country-service:${{ github.sha }} \
-            -f Maliev.CountryService.Api/Dockerfile .
-          docker push asia-southeast1-docker.pkg.dev/maliev-website/maliev-website-artifact-dev/maliev-country-service:${{ github.sha }}
-
-      - name: Checkout maliev-gitops repository
-        uses: actions/checkout@v5
-        with:
-          repository: MALIEV-Co-Ltd/maliev-gitops
-          token: ${{ secrets.GITOPS_PAT }}
-          path: maliev-gitops
-
-      - name: Install Kustomize
-        uses: imranismail/setup-kustomize@v2
+    branches: [develop]
 
+permissions:
+  contents: read
 
-      - name: Update image tag in maliev-gitops using Kustomize
-        run: |
-          cd maliev-gitops/3-apps/maliev-country-service/overlays/development
-          kustomize edit set image \
-            asia-southeast1-docker.pkg.dev/maliev-website/maliev-website-artifact/maliev-country-service=\
-          asia-southeast1-docker.pkg.dev/maliev-website/maliev-website-artifact-dev/maliev-country-service:${{ github.sha }}
-
-      - name: Create Pull Request
-        env:
-          GH_TOKEN: ${{ secrets.GITOPS_PAT }}
-          PR_BODY: |
-            Automated GitOps Update
-
-            - **Service**: CountryService
-            - **Environment**: Development
-            - **Image Tag**: ${{ github.sha }}
-            - **Source Branch**: ${{ github.ref_name }}
-            - **Commit**: ${{ github.sha }}
-
-            Updates maliev-country-service image in development overlay.
-            This PR was automatically created by GitHub Actions.
-            Once merged, ArgoCD will automatically sync the changes to the maliev-dev namespace.
-
-            Triggered by: ${{ github.actor }}
-            Workflow: ${{ github.workflow }}
-            Run: [${{ github.run_id }}](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
-        run: |
-          cd maliev-gitops
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-
-          # Create a new branch for this update
-          BRANCH_NAME="country-service/dev-${{ github.sha }}"
-          git checkout -b $BRANCH_NAME
-
-          # Commit and push changes to the new branch
-          git add .
-          if git diff --staged --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-
-          git commit -m "chore(dev): Update CountryService image to ${{ github.sha }}"
-          git push origin $BRANCH_NAME
-
-          # Create pull request using GitHub CLI
-          gh pr create \
-            --title "chore(dev): Update country-service" \
-            --body "$PR_BODY" \
-            --base main \
-            --head $BRANCH_NAME \
-            --repo MALIEV-Co-Ltd/maliev-gitops
+jobs:
+  validate:
+    uses: ./.github/workflows/_validate.yml