[major] Isolate cloud providers and harden smoke cleanup

.github/workflows/cloud-smoke-cleanup.yml

@@ -49,20 +49,33 @@ jobs:
       cancel-in-progress: false
     env:
       CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.event.workflow_run.id }}
-      DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
-      LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Build trusted cloud CI runner
+        run: make cloud-compose-ci
 
       - name: Sweep provider smoke resources
         if: matrix.kind == 'app'
+        env:
+          DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
+          LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
         run: ci/cloud-smoke.sh sweep-${{ matrix.provider }}-${{ matrix.template }}
 
       - name: Sweep config-management smoke resources
         if: matrix.kind == 'config-management'
+        env:
+          LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
         run: ci/config-management-cloud-smoke.sh sweep-${{ matrix.method }}-drupal
 
   gcp-cleanup:
@@ -87,6 +100,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Check GCP cleanup configuration
         run: |

.github/workflows/cloud-smoke.yml

@@ -52,6 +52,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Run Ansible and Salt smoke checks
         run: make config-management-smoke
@@ -79,10 +81,20 @@ jobs:
       CLOUD_COMPOSE_SMOKE_DESTROY_TIMEOUT: "1800"
       CLOUD_COMPOSE_SMOKE_SWEEP_ORPHANS: "true"
       CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.run_id }}
-      LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Build provider cloud CI runner
+        run: make cloud-compose-ci
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
@@ -91,10 +103,14 @@ jobs:
           terraform_wrapper: false
 
       - name: Run Linode config-management smoke test
+        env:
+          LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
         run: make config-management-cloud-smoke METHOD=${{ matrix.method }}
 
       - name: Destroy Linode config-management smoke resources
         if: always()
+        env:
+          LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
         run: ci/config-management-cloud-smoke.sh destroy-${{ matrix.method }}-drupal
 
   smoke:
@@ -125,12 +141,21 @@ jobs:
       CLOUD_COMPOSE_SMOKE_SWEEP_ORPHANS: "true"
       CLOUD_COMPOSE_SMOKE_RUN_ID: ${{ github.run_id }}
       CLOUD_COMPOSE_SOURCE_REF: ${{ github.event.pull_request.head.sha }}
-      DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
-      LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version: "1.26.x"
+          cache: false
+
+      - name: Build provider cloud CI runner
+        run: make cloud-compose-ci
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4
@@ -142,10 +167,16 @@ jobs:
         run: ci/install-sitectl-apt.sh
 
       - name: Run smoke test
+        env:
+          DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
+          LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
         run: make smoke-test PROVIDER=${{ matrix.provider }} TEMPLATE=${{ matrix.template }}
 
       - name: Destroy smoke resources
         if: always()
+        env:
+          DIGITALOCEAN_TOKEN: ${{ matrix.provider == 'digitalocean' && secrets.DIGITALOCEAN_TOKEN || '' }}
+          LINODE_TOKEN: ${{ matrix.provider == 'linode' && secrets.LINODE_TOKEN || '' }}
         run: ci/cloud-smoke.sh destroy-${{ matrix.provider }}-${{ matrix.template }}
 
   gcp-smoke:

Makefile

@@ -117,13 +117,13 @@ artifact-install-contract:
 	bash ci/docker-plugin-install-contract.sh
 	bash ci/cos-bootstrap-contract.sh
 
-hosted-cleanup-retry-contract:
+hosted-cleanup-retry-contract: go-contracts
 	bash ci/hosted-cleanup-retry-contract.sh
 
 config-management-smoke: runtime-config-contract artifact-install-contract
 	ci/config-management-smoke.sh
 
-config-management-cloud-smoke:
+config-management-cloud-smoke: cloud-compose-ci
 	@test -n "$(METHOD)" || { echo "METHOD is required"; exit 2; }
 	ci/config-management-cloud-smoke.sh $(METHOD)-drupal
 
@@ -133,7 +133,7 @@ config-management-cloud-smoke-ansible-drupal:
 config-management-cloud-smoke-salt-drupal:
 	$(MAKE) config-management-cloud-smoke METHOD=salt
 
-destroy-config-management-cloud-smoke:
+destroy-config-management-cloud-smoke: cloud-compose-ci
 	@test -n "$(METHOD)" || { echo "METHOD is required"; exit 2; }
 	ci/config-management-cloud-smoke.sh destroy-$(METHOD)-drupal
 
@@ -152,10 +152,9 @@ terraform-docs-check:
 smoke-test-clouds: cloud-compose-ci
 	ci/cloud-smoke.sh all
 
-smoke-test:
+smoke-test: cloud-compose-ci
 	@test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
 	@test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
-	@if [ "$(PROVIDER)" = "gcp" ]; then $(MAKE) --no-print-directory cloud-compose-ci; fi
 	ci/cloud-smoke.sh $(PROVIDER)-$(TEMPLATE)
 
 smoke-test-digitalocean-isle:
@@ -167,10 +166,9 @@ smoke-test-linode-wp:
 smoke-test-gcp-wp:
 	$(MAKE) smoke-test PROVIDER=gcp TEMPLATE=wp
 
-destroy-smoke:
+destroy-smoke: cloud-compose-ci
 	@test -n "$(PROVIDER)" || { echo "PROVIDER is required"; exit 2; }
 	@test -n "$(TEMPLATE)" || { echo "TEMPLATE is required"; exit 2; }
-	@if [ "$(PROVIDER)" = "gcp" ]; then $(MAKE) --no-print-directory cloud-compose-ci; fi
 	ci/cloud-smoke.sh destroy-$(PROVIDER)-$(TEMPLATE)
 
 destroy-smoke-digitalocean-isle: