ci: post test results to BadgeSmith and serve README badges from it

.github/workflows/ci-cd.yml

@@ -29,11 +29,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     env:
       NUGET_PACKAGES: ${{ contains(matrix.os, 'windows') && format('{0}\.nuget\packages', github.workspace) || format('{0}/.nuget/packages', github.workspace) }}
-      BADGE_GIST_ID: "472c59b7c2a1898c48a29f3c88897c5a"
       LOCALSTACK_AUTH_TOKEN_MISSING: ${{ secrets.LOCALSTACK_AUTH_TOKEN == '' }}
 
-    # dorny/test-reporter publishes a check run. The badge step authenticates with its own
-    # PAT (secrets.GIST_SECRET), so it needs nothing from GITHUB_TOKEN.
+    # dorny/test-reporter publishes a check run. The badge step signs its request with the
+    # organization's BadgeSmith HMAC key, so it needs nothing from GITHUB_TOKEN.
     permissions:
       contents: read
       actions: read
@@ -46,17 +45,14 @@ jobs:
           - os: windows-latest
             name: "Windows"
             script: "./build.ps1"
-            filename: "test-results-windows.json"
 
           - os: ubuntu-22.04
             name: "Linux"
             script: "./build.sh"
-            filename: "test-results-linux.json"
 
           - os: macos-latest
             name: "macOS"
             script: "./build.sh"
-            filename: "test-results-macos.json"
 
     steps:
       - name: "Checkout"
@@ -102,15 +98,25 @@ jobs:
           fail-on-error: true
           max-annotations: 50
 
-      - name: "Update Test Results Badge"
-        if: always() # Run even if tests failed or were skipped
-        continue-on-error: true # Don't fail workflow if badge update fails
-        uses: ./.github/actions/update-test-badge
+      # BadgeSmith's update action lives under .github/workflows/ in its repository, so a step
+      # cannot reference it remotely; check it out at the commit api.localstackfor.net runs and
+      # use it by local path, as opencode-sdk-dotnet does. The HMAC key is the organization's
+      # TESTDATASECRET.
+      - name: "Checkout BadgeSmith action"
+        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/master'
+        continue-on-error: true
+        uses: actions/checkout@v7
+        with:
+          repository: localstack-dotnet/badge-smith
+          ref: bc7ed07860ec4b0e702add6370c2636daccb2adf
+          path: .badge-smith
+
+      - name: "Update test badge via BadgeSmith API"
+        if: always() && github.event_name == 'push' && github.ref == 'refs/heads/master'
+        continue-on-error: true
+        uses: ./.badge-smith/.github/workflows/update-test-badge
         with:
           platform: ${{ matrix.name }}
-          gist_id: ${{ env.BADGE_GIST_ID }}
-          filename: ${{ matrix.filename }}
-          gist_token: ${{ secrets.GIST_SECRET }}
           test_passed: ${{ steps.test-results.outputs.passed || 0 }}
           test_failed: ${{ steps.test-results.outputs.failed || 0 }}
           test_skipped: ${{ steps.test-results.outputs.skipped || 0 }}
@@ -119,6 +125,8 @@ jobs:
           run_id: ${{ github.run_id }}
           repository: ${{ github.repository }}
           server_url: ${{ github.server_url }}
+          api_base_url: "https://api.localstackfor.net"
+          hmac_secret: ${{ secrets.TESTDATASECRET }}
 
       - name: "Upload Test Artifacts"
         uses: actions/upload-artifact@v7

README.md

@@ -1,6 +1,6 @@
 # LocalStack.NET
 
-[![LocalStack.Client](https://img.shields.io/endpoint?url=https%3A%2F%2Fyvfdbfas85.execute-api.eu-central-1.amazonaws.com%2Flive%2Fbadge%2Fpackages%2Flocalstack.client%3Fsource%3Dnuget%26label%3DLocalStack.Client)](https://www.nuget.org/packages/LocalStack.Client/) [![LocalStack.Client.Extensions](https://img.shields.io/endpoint?url=https%3A%2F%2Fyvfdbfas85.execute-api.eu-central-1.amazonaws.com%2Flive%2Fbadge%2Fpackages%2Flocalstack.client.extensions%3Fsource%3Dnuget%26label%3DLocalStack.Client.Extensions)](https://www.nuget.org/packages/LocalStack.Client.Extensions/) [![Downloads](https://img.shields.io/nuget/dt/LocalStack.Client)](https://www.nuget.org/packages/LocalStack.Client/) [![CI/CD Pipeline](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/ci-cd.yml/badge.svg)](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/ci-cd.yml) [![Security](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/github-code-scanning/codeql) [![Tests](https://img.shields.io/endpoint?url=https://yvfdbfas85.execute-api.eu-central-1.amazonaws.com/live/badge/tests/linux?label=Tests)](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/ci-cd.yml)
+[![LocalStack.Client](https://img.shields.io/endpoint?url=https%3A%2F%2Fapi.localstackfor.net%2Fbadges%2Fpackages%2Fnuget%2FLocalStack.Client&label=LocalStack.Client)](https://www.nuget.org/packages/LocalStack.Client/) [![LocalStack.Client.Extensions](https://img.shields.io/endpoint?url=https%3A%2F%2Fapi.localstackfor.net%2Fbadges%2Fpackages%2Fnuget%2FLocalStack.Client.Extensions&label=LocalStack.Client.Extensions)](https://www.nuget.org/packages/LocalStack.Client.Extensions/) [![Downloads](https://img.shields.io/nuget/dt/LocalStack.Client)](https://www.nuget.org/packages/LocalStack.Client/) [![CI/CD Pipeline](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/ci-cd.yml/badge.svg)](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/ci-cd.yml) [![Security](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/localstack-dotnet/localstack-dotnet-client/actions/workflows/github-code-scanning/codeql) [![Tests](https://img.shields.io/endpoint?url=https%3A%2F%2Fapi.localstackfor.net%2Fbadges%2Ftests%2Flinux%2Flocalstack-dotnet%2Flocalstack-dotnet-client%2Fmaster&label=Tests)](https://api.localstackfor.net/redirect/test-results/linux/localstack-dotnet/localstack-dotnet-client/master)
 
 ![LocalStack](https://github.com/localstack-dotnet/localstack-dotnet-client/blob/master/assets/localstack-dotnet.png?raw=true)
 

docs/engineering/quality-gates.md

@@ -31,4 +31,4 @@ In the main CI workflow only the Linux leg runs functional tests. Its test step
 
 CI's separate `native-aot-tests` job publishes/runs both targets on `windows-latest` (`win-x64`) and `ubuntu-22.04` (`linux-x64`). Linux waits for LocalStack 4.14.0 health and sets `LOCALSTACK_NATIVE_AOT_HOST`; live cases otherwise skip. The [project](../../tests/LocalStack.Client.NativeAot.Tests/LocalStack.Client.NativeAot.Tests.csproj) and pinned xUnit v3 AOT package define the runner; this lane qualifies the [Native AOT boundary](../architecture/platform-and-packaging.md#native-aot-and-trimming), not every service/deployment. The same job then packs both libraries into `artifacts/packages` and publishes [`LocalStack.Client.PackageConsumer.Tests`](../../tests/LocalStack.Client.PackageConsumer.Tests/) from those packages for every modern target framework with a fresh NuGet cache; that project is outside the solution and isolated from the repository's build props, so it proves the generator reaches a consumer through the package's `buildTransitive` target on both operating systems.
 
-The badge-update step is `continue-on-error`, and its action logs a non-200 Gist response without turning that response into a failed step. Neither a badge nor a fixed test count in prose proves that the current revision passed. Report the actual command, target frameworks, result, and any tests deliberately not run. Do not infer NuGet publication, Native AOT support, or full LocalStack service behavior from a successful build or client-construction test.
+On pushes to `master`, each `build-and-test` leg posts its counts to [BadgeSmith](https://github.com/localstack-dotnet/badge-smith) (`api.localstackfor.net`), signed with the organization's `TESTDATASECRET`; the step is `continue-on-error`, so a rejected post does not fail CI. Neither a badge nor a fixed test count in prose proves that the current revision passed. Report the actual command, target frameworks, result, and any tests deliberately not run. Do not infer NuGet publication, Native AOT support, or full LocalStack service behavior from a successful build or client-construction test.