Implement APS render fix and TSJS resilience

.github/workflows/aps-real-gam.yml

@@ -0,0 +1,106 @@
+name: "APS real-GAM attestation"
+run-name: >-
+  APS real-GAM / ${{ inputs.evidence_id }} / ${{ inputs.release_id }}
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      release_id:
+        description: Exact TSJS release id deployed to the protected test network
+        required: true
+        type: string
+      evidence_id:
+        description: Unique cutover evidence identifier
+        required: true
+        type: string
+      previous_artifact_id:
+        description: Immutable artifact identifier used for rollback
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      release_id:
+        description: Exact TSJS release id deployed to the protected test network
+        required: true
+        type: string
+      evidence_id:
+        description: Unique cutover evidence identifier
+        required: true
+        type: string
+      previous_artifact_id:
+        description: Immutable artifact identifier used for rollback
+        required: true
+        type: string
+
+jobs:
+  attest:
+    name: Chromium, Firefox, and WebKit attestation
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    environment: aps-real-gam
+    env:
+      TS_REAL_GAM_PAGE_URL: ${{ secrets.TS_REAL_GAM_PAGE_URL }}
+      TS_REAL_GAM_AUTH_HEADER: ${{ secrets.TS_REAL_GAM_AUTH_HEADER }}
+      TS_REAL_GAM_EXPECTED_RELEASE_ID: ${{ vars.TS_REAL_GAM_EXPECTED_RELEASE_ID }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate protected inputs and release binding
+        env:
+          DISPATCH_EVIDENCE_ID: ${{ inputs.evidence_id }}
+          DISPATCH_PREVIOUS_ARTIFACT_ID: ${{ inputs.previous_artifact_id }}
+          DISPATCH_RELEASE_ID: ${{ inputs.release_id }}
+        run: bash scripts/ci/aps-real-gam.sh validate-inputs
+
+      - name: Read repository toolchain pins
+        id: toolchains
+        run: bash scripts/ci/read-toolchains.sh
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ steps.toolchains.outputs.node }}
+          cache: npm
+          cache-dependency-path: crates/trusted-server-integration-tests/browser/package-lock.json
+
+      - name: Install isolated browser-test dependencies
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: npm ci
+
+      - name: Install all required browsers
+        working-directory: crates/trusted-server-integration-tests/browser
+        run: npx playwright install --with-deps chromium firefox webkit
+
+      - name: Run protected real-GAM contract
+        id: real-gam
+        run: bash scripts/ci/aps-real-gam.sh run
+
+      - name: Write release attestation
+        if: always()
+        env:
+          EVIDENCE_ID: ${{ inputs.evidence_id }}
+          PREVIOUS_ARTIFACT_ID: ${{ inputs.previous_artifact_id }}
+          RELEASE_ID: ${{ inputs.release_id }}
+          TEST_OUTCOME: ${{ steps.real-gam.outcome }}
+        run: node scripts/ci/aps-tsjs-evidence.mjs write-real-gam
+
+      - name: Scrub browser evidence before upload
+        if: always()
+        env:
+          TEST_OUTCOME: ${{ steps.real-gam.outcome }}
+        run: node scripts/ci/aps-tsjs-evidence.mjs scrub-real-gam
+
+      - name: Upload real-GAM evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: aps-real-gam-${{ github.run_id }}
+          path: |
+            crates/trusted-server-integration-tests/browser/real-gam-evidence/
+            crates/trusted-server-integration-tests/browser/playwright-report/
+            crates/trusted-server-integration-tests/browser/test-results/
+          if-no-files-found: error
+          retention-days: 30