chore(ci): keep workflow orchestration locally reproducible

[yordis]

• CI orchestration embedded in hosted workflow YAML made important failure paths difficult to reproduce and review locally.
• A shared Mise task contract keeps local and hosted execution aligned while GitHub Actions retains platform responsibilities such as permissions, services, matrices, artifacts, and secrets.
• Pinned Mise and Protobuf tooling prevents runner package drift from changing ARM build behavior.

[cursor]

PR Summary

Medium Risk
Touches release image tagging/push logic and the full build/test/archive recovery paths; behavior should be equivalent but any script drift could break CI or publishing.

Overview
Moves CI shell logic out of GitHub Actions YAML into phase-based Mise tasks under .config/mise/tasks/github-actions/ (dotnet build/test, NuGet auth, vulnerability scan, container lifecycle, archive S3 contract/recovery, Docker Compose smoke, image publish tags, and C# quality comparison refs). Workflows now mostly install pinned Mise 2026.8.2 and invoke mise run --skip-tools github-actions:…, while Actions still owns checkout, matrices, services, artifacts, and secrets.

mise.toml adds protoc = "35.1"; the reusable build workflow installs protoc via Mise instead of apt-get on ARM64, and dotnet-build points Protobuf_ProtocFullPath at that binary. Semantic-conventions and some cleanup steps use --skip-tools and stricter if guards when Mise setup fails.

^{Reviewed by Cursor Bugbot for commit f869afb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 832a4050-d184-49b8-b2a5-cd11e6cc1ad4

📥 Commits

Reviewing files that changed from the base of the PR and between 9f4605b and f869afb.

📒 Files selected for processing (13)

• .config/mise/tasks/github-actions/archive-storage-contract
• .config/mise/tasks/github-actions/container
• .config/mise/tasks/github-actions/docker-compose-smoke
• .config/mise/tasks/github-actions/dotnet-build
• .config/mise/tasks/github-actions/nuget-authenticate
• .config/mise/tasks/github-actions/publish-container
• .config/mise/tasks/github-actions/resolve-comparison-refs
• .config/mise/tasks/github-actions/vulnerability-scan
• .github/workflows/build-container-reusable.yml
• .github/workflows/build-reusable.yml
• .github/workflows/common.yml
• .github/workflows/tag-docker-images.yml
• mise.toml

---

Walkthrough

The pull request adds reusable Mise tasks for CI operations and updates GitHub Actions workflows to invoke them. The tasks cover builds, containers, archive recovery, Compose smoke tests, authentication, vulnerability scans, ref resolution, and image publication.

Changes

CI task migration

Layer / File(s)	Summary
Shared task primitives .config/mise/tasks/github-actions/nuget-authenticate, .config/mise/tasks/github-actions/resolve-comparison-refs, .config/mise/tasks/github-actions/vulnerability-scan, mise.toml, .github/workflows/common.yml	Adds shared tasks for NuGet authentication, comparison SHA resolution, vulnerability scanning, and pinned protoc setup.
Build and container execution .config/mise/tasks/github-actions/dotnet-build, .config/mise/tasks/github-actions/container, .github/workflows/build-reusable.yml, .github/workflows/build-container-reusable.yml, .github/workflows/tag-docker-images.yml	Moves build, verification, testing, image export, image loading, and result handling into Mise task phases.
Archive and Compose lifecycle .config/mise/tasks/github-actions/archive-storage-contract, .config/mise/tasks/github-actions/docker-compose-smoke, .github/workflows/common.yml	Adds archive recovery and storage lifecycle phases, certificate validation, HTTPS readiness checks, and cleanup handling.
Container publication .config/mise/tasks/github-actions/publish-container, .github/workflows/tag-docker-images.yml	Derives image tags from Git references and tags and pushes the eventstore image.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

I’m a rabbit with tasks in a row,
Mise helps each workflow go.
Build, scan, recover, and push,
Certificates check with a careful hush.
CI hops cleanly through the brush.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/chore-centralize-github-actions-tasks

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}