ci(installer): run trusted SSH E2E matrix

.github/workflows/test-ssh.yml

@@ -0,0 +1,94 @@
+name: SSH Source-Install E2E
+
+# Work package 5 of docs/source-installation.md: run the Alpine/Ubuntu/Arch
+# OpenSSH source-install E2E matrix (make test-ssh) in CI.
+#
+# Trust boundary. This job builds and runs privileged Docker containers from
+# repository code (the distro fixtures execute the checked-out source), so it
+# runs ONLY on trusted refs: pushes to the default branch (master) and manual
+# workflow_dispatch. It deliberately does NOT trigger on pull_request: a PR
+# can carry untrusted code into a privileged Docker environment, and Gitea's
+# fork-PR read-only token clamp does not change what the containers can do on
+# the runner host. The ordinary unit `make test` CI run (ci.yml) stays
+# Docker-free and still covers pull requests.
+#
+# Runner requirement. The job inherits whatever Docker access `docker.yml`
+# already relies on. The harness dials fixture SSH ports published on the
+# Docker daemon loopback, so the runner must expose Docker with loopback port
+# publishing reachable from the job; scripts/ci/test-ssh.sh fails fast when
+# that is not the case.
+#
+# External network: fixture images (alpine from the reg.rsxx.ru mirror,
+# ubuntu/arch overridable via RSMON_TEST_IMAGE_*), the pinned Go toolchain
+# from go.dev, the public source repo from rocketgit.ru, and distro package
+# repos are fetched live. Operators can pin a resolver for flaky CI DNS via
+# the RSMON_TEST_DOCKER_DNS repository variable (comma-separated nameservers).
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+# Per-ref scoping: master pushes cancel a superseded in-flight run on the same
+# ref instead of stacking; a manual dispatch on another branch has its own
+# group and never cancels the master run.
+concurrency:
+  group: test-ssh-${{ gitea.ref }}
+  cancel-in-progress: true
+
+# Least privilege: the job only needs to read the repository (actions/checkout
+# and the harness's SSH-free operations). contents:read is supported by Gitea
+# Actions (the GITEA_TOKEN scope for code/releases).
+permissions:
+  contents: read
+
+jobs:
+  test-ssh:
+    name: Alpine/Ubuntu/Arch source-install E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    env:
+      # All empty by default (harness defaults / Docker embedded DNS).
+      # Override in repo/organization variables:
+      #   RSMON_TEST_IMAGE_ALPINE / _UBUNTU / _ARCH - pin a mirror or a
+      #     specific distro snapshot for the fixture base image;
+      #   RSMON_TEST_DOCKER_DNS - comma-separated nameservers applied as
+      #     `docker run --dns ...` for flaky CI resolvers.
+      RSMON_TEST_IMAGE_ALPINE: ${{ vars.RSMON_TEST_IMAGE_ALPINE }}
+      RSMON_TEST_IMAGE_UBUNTU: ${{ vars.RSMON_TEST_IMAGE_UBUNTU }}
+      RSMON_TEST_IMAGE_ARCH: ${{ vars.RSMON_TEST_IMAGE_ARCH }}
+      RSMON_TEST_DOCKER_DNS: ${{ vars.RSMON_TEST_DOCKER_DNS }}
+    steps:
+      # Actions are pinned to immutable full commit SHAs (not moving tags).
+      # Verified 2026-08-13 against the GitHub API that the commit the tag
+      # points to is a commit object:
+      #   actions/checkout@v4 -> 11d5960a326750d5838078e36cf38b85af677262
+      #   actions/setup-go@v5 -> 40f1582b2485089dde7abd97c1529aa768e1baff
+      # Other workflows (ci.yml, docker.yml) still use moving tags; see the
+      # repo-wide convention note in docs/source-installation.md.
+      - name: Check out code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
+        with:
+          go-version: '1.26.x'
+          # Caches the Go module/build cache used to compile the harness test
+          # binary. Safe: only public dependencies, no credentials.
+          cache: true
+
+      - name: Run Alpine/Ubuntu/Arch OpenSSH source-install E2E
+        run: bash scripts/ci/test-ssh.sh
+
+      # Belt-and-suspenders: the harness and test-ssh.sh already tear down
+      # everything they create; this guarantees a killed job leaves no
+      # rsmon-worker-test-* resources behind on the runner. Filters are
+      # anchored to the harness's own prefix and image repository so cleanup
+      # never touches a shared base image or unrelated resources.
+      - name: Clean up leftover harness resources
+        if: always()
+        run: |
+          docker ps -aq --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker rm -f >/dev/null 2>&1 || true
+          docker network ls -q --filter "name=^rsmon-worker-test-" 2>/dev/null | xargs -r docker network rm >/dev/null 2>&1 || true
+          docker images -q --filter "reference=rsmon-worker-test/*" 2>/dev/null | xargs -r docker image rm -f >/dev/null 2>&1 || true