[STAC-25420] Upgrade OTel and refresh BCI packages

[LouisLotter]

Summary

• align OpenTelemetry Go modules on 1.44.0
• upgrade github.com/klauspost/compress to 1.18.7, which fixes GO-2026-5841
• refresh the BCI micro chroot before package installation so patched libudev1, libgcrypt20, gpg2 and other installed packages are selected
• replace disabled package signature checks with automatic trusted-key import
• migrate the archived GitLab build, test, image, and scan pipeline to GitHub Actions
• remove the invalid generated-workdir gitlink that prevented clean GitHub checkouts
• update OCI source labels to the GitHub repository
• retain the canonical Quay image identity during local CI scans

VEX analysis

GO-2026-5932 applies to the deprecated golang.org/x/crypto/openpgp packages and has no fixed x/crypto version. go mod why can trace optional OpenPGP source through the Datadog/Trivy/Rekor module graph, but the actual Linux cmd/agent dependency graph contains neither OpenPGP nor that Trivy/Rekor path. The scanner reports the parent module because other x/crypto packages are linked.

The same VEX PR also makes the three existing containerd v2 false-positive statements package-scoped to github.com/containerd/containerd@v1.7.33. This accurately captures that the affected /v2 module is distinct and makes the statements reliable for locally built, pre-publish images.

Reviewed VEX PR: StackVista/vexhub#29

Official OpenPGP advisory: https://pkg.go.dev/vuln/GO-2026-5932

GitHub CI

Process-agent CI now:

• prebuilds the Datadog eBPF/Go artifacts for amd64 and arm64
• builds the process-agent and rejects stale generated code
• runs unit tests
• builds and smoke-tests the final BCI image
• scans all severities with VEX-aware Trivy and Grype through StackVista/image-pipeline
• publishes signed per-architecture images and the immutable multi-architecture commit-SHA tag after master merges

Repository controls and the existing Agent Quay robot are managed by companion PR https://github.com/StackVista/pulumi-infra/pull/245. Merge/apply that PR first so branch protection requires Process-agent CI instead of the retired ci/gitlab/gitlab.com status.

Validation

• go mod verify
• go test ./pkg/telemetry
• go list -m github.com/klauspost/compress resolves 1.18.7
• go list -deps ./cmd/agent excludes OpenPGP, Trivy, and Rekor
• shellcheck packaging/oci-labels.sh
• actionlint
• uvx zizmor --collect=workflows,actions,dependabot . (no findings; existing suppressions remain)
• python3 tools/build_index.py --check in the VEX Hub PR
• Grype 0.112.0 suppresses all three containerd findings using the package-scoped VEX document
• git diff --check

Jira: https://stackstate.atlassian.net/browse/STAC-25420

[LouisLotter]

Latest validation: run 30340992193 built and smoke-tested the amd64 and arm64 BCI images successfully. GO-2026-5841 is gone after the klauspost/compress upgrade. The scan now reports only CVE-2026-50195, CVE-2026-53489, CVE-2026-53492, and GO-2026-5932; all four are covered by the approved, green StackVista/vexhub#29. The obsolete required GitLab status is addressed by StackVista/pulumi-infra#245, which still needs infra review and apply. After those two PRs land, rerun this PR CI; no further process-agent code changes are expected.

[Andreagit97]

Not clear why do we need this job 🤔 cannot we just use the Github Action UI to understand what is going on?

[LouisLotter]

I am keeping this aggregate job because branch protection needs one stable required status name. The matrix job names vary by architecture, and the publish jobs are intentionally skipped for some events. This final job reduces the complete dependency graph to the single Process-agent CI context configured by pulumi-infra, while the Actions UI still provides the detailed per-job diagnosis.

[Andreagit97]

Should we remove all .gitlab CI files? if i understand well, we don't need them anymore

[LouisLotter]

Addressed the GitLab cleanup in 47efb12b: removed the archived GitLab pipeline files and GitLab-only Cerberus hooks. The environment helper was still referenced by DEVELOPMENT.md, so it has been retained as scripts/set_environment.sh and the documentation now points there.

[LouisLotter]

Review changes are applied and validated in run 30353115824. Both amd64 and arm64 passed the combined generated-code/build/test job, BCI image build and smoke test, Trivy secret scan, and VEX-aware Trivy + Grype vulnerability scan. GO-2026-5932 is now recorded as a scoped, expiring repository exception for the unpublished-image scan; released-image scans continue to use the reviewed VEX hub statement. The only remaining failures are the two publish jobs reporting Username and password required. StackVista/pulumi-infra#245 provisions those Quay credentials and replaces the obsolete GitLab required status; it remains open and review-required, and must be merged and applied before this PR can become fully green.