Prepare private Beta security roadmap and least-privilege manual CI

.github/workflows/tests.yml

@@ -1,26 +1,51 @@
-name: tests
-on: [push, pull_request, workflow_dispatch]
+name: Private Beta acceptance
+on:
+  workflow_dispatch:
 permissions:
   contents: read
+concurrency:
+  group: private-beta-${{ github.ref }}
+  cancel-in-progress: false
 jobs:
   ubuntu:
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-22.04
+          - os: Ubuntu 22.04
+            label: vpsmaster-ubuntu22
             python: '3.10'
-          - os: ubuntu-24.04
+          - os: Ubuntu 24.04
+            label: vpsmaster-ubuntu24
             python: '3.12'
-    runs-on: ${{ matrix.os }}
+    runs-on: [self-hosted, Linux, X64, '${{ matrix.label }}']
+    env:
+      PYTHONDONTWRITEBYTECODE: '1'
+      PIP_DISABLE_PIP_VERSION_CHECK: '1'
+      EXPECTED_PYTHON: '${{ matrix.python }}'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
-        with:
-          python-version: ${{ matrix.python }}
-      - run: python -m pip install pytest 'setuptools>=77' wheel
-      - run: python -m pytest -q
-      - run: python -m pip wheel --no-build-isolation --no-deps . --wheel-dir work/wheels
-      - run: python -m proxydoctor suite --offline --lang en
+      - name: Verify interpreter and prepare isolated CI tools
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -B -c 'import os,sys; assert sys.version_info[:2] == tuple(map(int,os.environ["EXPECTED_PYTHON"].split("."))); print(sys.version.split()[0])'
+          python3 -B -m venv "$RUNNER_TEMP/vpsmaster-ci-venv"
+          "$RUNNER_TEMP/vpsmaster-ci-venv/bin/python" -B -m pip install --timeout 15 --retries 1 'pytest>=8,<10' 'setuptools>=77,<100' 'wheel>=0.45,<1'
+      - name: Complete regression tests
+        shell: bash
+        run: '"$RUNNER_TEMP/vpsmaster-ci-venv/bin/python" -B -m pytest tests -q -p no:cacheprovider --junitxml="$RUNNER_TEMP/vpsmaster-unit.xml"'
+      - name: Wheel build
+        shell: bash
+        run: '"$RUNNER_TEMP/vpsmaster-ci-venv/bin/python" -B -m pip wheel --no-build-isolation --no-deps . --wheel-dir "$RUNNER_TEMP/wheels"'
+      - name: Offline CLI lifecycle without publishing raw host details
+        shell: bash
+        run: |
+          set -euo pipefail
+          status=0
+          "$RUNNER_TEMP/vpsmaster-ci-venv/bin/python" -B -m proxydoctor suite --offline --lang en --json-output "$RUNNER_TEMP/offline.json" > "$RUNNER_TEMP/offline.log" 2>&1 || status=$?
+          if [ "$status" -gt 1 ]; then echo "CLI lifecycle failed, exit $status"; exit 1; fi
+          "$RUNNER_TEMP/vpsmaster-ci-venv/bin/python" -B -c 'import json,os,pathlib; d=json.loads((pathlib.Path(os.environ["RUNNER_TEMP"])/"offline.json").read_text()); assert d["summary"]["failed_modules"]==0; print("Offline CLI completed with zero failed modules; raw report retained only in temporary runner storage.")'