Add signed model catalog updates and weekly review automation

.gitattributes

@@ -0,0 +1 @@
+.github/workflows/*.lock.yml linguist-generated=true

.github/aw/actions-lock.json

@@ -0,0 +1,9 @@
+{
+  "entries": {
+    "github/gh-aw-actions/setup@v1.2.2": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v1.2.2",
+      "sha": "53d0749e19424a918acd82b4d140264ce48f2f14"
+    }
+  }
+}

.github/workflows/cosmos-response-contract-check.yml

@@ -20,7 +20,7 @@ permissions:
 jobs:
   cosmos-contracts:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     env:
       PYTHONPATH: application/single_app:functional_tests
       PYTHONDONTWRITEBYTECODE: '1'

.github/workflows/model-catalog-check.yml

@@ -0,0 +1,41 @@
+name: Model catalog publication contracts
+
+on:
+  pull_request:
+    paths:
+      - application/single_app/model_catalog_*.py
+      - application/single_app/static/json/model_capabilities.json
+      - application/single_app/static/json/model_catalog*trusted_keys.json
+      - application/single_app/static/json/schemas/model_capabilities.schema.json
+      - model-catalog/**
+      - scripts/publish_model_catalog.py
+      - scripts/requirements-model-catalog*.txt
+      - functional_tests/test_model_catalog_publication_lifecycle.py
+      - .github/workflows/*model-catalog*
+      - .github/aw/actions-lock.json
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publication-contracts:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -r scripts/requirements-model-catalog-tests.txt
+      - name: Verify isolation and promotion contracts
+        run: python -m pytest -q functional_tests/test_model_catalog_publication_lifecycle.py
+      - name: Verify compiled weekly workflow is current
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh extension install github/gh-aw --pin v1.2.2
+          gh aw compile refresh-model-catalog --no-check-update --no-logo
+          git diff --exit-code -- .github/workflows/refresh-model-catalog.lock.yml .github/aw/actions-lock.json

.github/workflows/publish-model-catalog.yml

@@ -0,0 +1,143 @@
+name: Publish model catalog
+
+on:
+  push:
+    branches: [Development, Staging, main]
+    paths:
+      - application/single_app/static/json/model_capabilities.json
+      - application/single_app/static/json/model_catalog_trusted_keys.json
+      - application/single_app/static/json/model_catalog_development_trusted_keys.json
+      - model-catalog/release.json
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-model-catalog-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    if: github.repository == 'microsoft/simplechat' && contains(fromJSON('["Development", "Staging", "main"]'), github.ref_name)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      channel: ${{ steps.policy.outputs.channel }}
+      environment: ${{ steps.policy.outputs.environment }}
+      app_version: ${{ steps.policy.outputs.app_version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+      - run: python -m pip install -r scripts/requirements-model-catalog.txt
+      - name: Select fixed publishing policy
+        id: policy
+        env:
+          SOURCE_BRANCH: ${{ github.ref_name }}
+        run: |
+          case "$SOURCE_BRANCH" in
+            main) echo "channel=production" >> "$GITHUB_OUTPUT"; echo "environment=model-catalog-publishing" >> "$GITHUB_OUTPUT" ;;
+            Development) echo "channel=development" >> "$GITHUB_OUTPUT"; echo "environment=model-catalog-development" >> "$GITHUB_OUTPUT" ;;
+            Staging) echo "channel=development" >> "$GITHUB_OUTPUT"; echo "environment=model-catalog-validation" >> "$GITHUB_OUTPUT" ;;
+            *) exit 1 ;;
+          esac
+          version="$(python -c 'import ast,pathlib; t=ast.parse(pathlib.Path("application/single_app/config.py").read_text()); print(next(ast.literal_eval(n.value) for n in t.body if isinstance(n,ast.Assign) and any(isinstance(v,ast.Name) and v.id=="VERSION" for v in n.targets)))')"
+          echo "app_version=$version" >> "$GITHUB_OUTPUT"
+      - name: Validate and prepare reviewed source
+        env:
+          SOURCE_COMMIT: ${{ github.sha }}
+          GH_TOKEN: ${{ github.token }}
+          CHANNEL: ${{ steps.policy.outputs.channel }}
+        run: |
+          python scripts/publish_model_catalog.py prepare --channel "$CHANNEL" --source-commit "$SOURCE_COMMIT" --output candidate
+          cat candidate/candidate.json >> "$GITHUB_STEP_SUMMARY"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: catalog-candidate
+          path: candidate/
+          retention-days: 7
+          if-no-files-found: error
+
+  sign-and-publish:
+    needs: prepare
+    if: github.ref_name == 'Development' || github.ref_name == 'main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: ${{ needs.prepare.outputs.environment }}
+    permissions:
+      id-token: write
+      contents: write
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: catalog-candidate
+          path: candidate
+      - name: Require publishing configuration
+        env:
+          KEY_ID: ${{ vars.CATALOG_KEY_ID }}
+          KEY_URL: ${{ vars.CATALOG_VAULT_KEY_URL }}
+        run: |
+          test -n "$KEY_ID" && test -n "$KEY_URL"
+      - uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+        with:
+          client-id: ${{ vars.CATALOG_AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.CATALOG_AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.CATALOG_AZURE_SUBSCRIPTION_ID }}
+      - run: python -m pip install -r scripts/requirements-model-catalog.txt
+      - name: Sign, verify and publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CATALOG_KEY_ID: ${{ vars.CATALOG_KEY_ID }}
+          CATALOG_VAULT_KEY_URL: ${{ vars.CATALOG_VAULT_KEY_URL }}
+          CATALOG_APP_VERSION: ${{ needs.prepare.outputs.app_version }}
+          CHANNEL: ${{ needs.prepare.outputs.channel }}
+        run: |
+          python scripts/publish_model_catalog.py sign-publish --channel "$CHANNEL" --output candidate
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: signed-model-catalog-${{ needs.prepare.outputs.channel }}
+          path: candidate/catalog-*.json
+          retention-days: 30
+          if-no-files-found: error
+
+  validate-for-production:
+    needs: prepare
+    if: github.ref_name == 'Staging'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: model-catalog-validation
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: catalog-candidate
+          path: candidate
+      - run: python -m pip install -r scripts/requirements-model-catalog-tests.txt
+      - name: Exercise channel and promotion contracts
+        run: python -m pytest -q functional_tests/test_model_catalog_publication_lifecycle.py
+      - name: Attest the approved Staging test
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CATALOG_APP_VERSION: ${{ needs.prepare.outputs.app_version }}
+        run: python scripts/publish_model_catalog.py record-validation --channel development --output candidate