cleanup: fix broken CI/CD jobs and prune redundant pipeline checks

- ci: declare crd-drift in docker job needs (fixes invalid needs ref)
- chaos: load operator-image.tar.gz produced by build-operator action
- perf: export and load image tarball correctly across build/benchmark
- link-check: gate issue creation on steps.lychee.outputs.exit_code
- stale-docs: drop leftover dup dtolnay toolchain install after setup-rust
- maintenance: keep only stale-artifact regression (drop duplicated audit/docs jobs)
- dependency-review: remove cargo-audit job duplicated by ci/security-audit
- ci: drop cli-examples, backup-restore, upgrade-test, reconciler-benchmark (covered by make test)
- check-cache-keys: fix unclosed if (repo-hygiene gate always failed)

Author: OtowoSamuel

.github/workflows/chaos-tests.yml

@@ -83,7 +83,7 @@ jobs:
           name: chaos-operator-image
 
       - name: Load Docker image
-        run: gunzip -c stellar-operator-chaos.tar.gz | docker load
+        run: gunzip -c operator-image.tar.gz | docker load
 
       - name: Setup kind cluster
         uses: ./.github/actions/setup-kind-cluster
@@ -243,7 +243,7 @@ jobs:
           name: chaos-operator-image
 
       - name: Load Docker image
-        run: gunzip -c stellar-operator-chaos.tar.gz | docker load
+        run: gunzip -c operator-image.tar.gz | docker load
 
       - name: Setup kind cluster
         uses: ./.github/actions/setup-kind-cluster
@@ -415,7 +415,7 @@ jobs:
           name: chaos-operator-image
 
       - name: Load Docker image
-        run: gunzip -c stellar-operator-chaos.tar.gz | docker load
+        run: gunzip -c operator-image.tar.gz | docker load
 
       - name: Setup kind cluster
         uses: ./.github/actions/setup-kind-cluster

.github/workflows/ci.yml

@@ -804,52 +804,6 @@ jobs:
       - name: Run tests
         run: make test
 
-  # ── 9.5. CLI Examples Validation ──────────────────────────────────────────────
-  # Validates that all documented CLI examples parse correctly and are executable.
-  # Ensures documentation stays in sync with the actual CLI interface.
-  # Related: #1154 - Add pipeline stage that validates every documented CLI example command
-  cli-examples-test:
-    name: CLI Examples Validation
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    needs: [test]
-    if: >-
-      always() &&
-      needs.test.result == 'success'
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-cli-examples"
-
-      - name: Run CLI examples tests
-        run: cargo test --test cli_examples_test -- --nocapture
-
-  # ── 9.6. Backup & Restore Smoke Tests ─────────────────────────────────────────
-  # Command-level smoke tests for backup and restore workflows.
-  # Validates that backup/restore CLI commands work end-to-end with the file backend.
-  # Related: #1149 - Add command-level smoke tests for backup and restore workflows
-  backup-restore-smoke-test:
-    name: Backup & Restore Smoke Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: [test]
-    if: >-
-      always() &&
-      needs.test.result == 'success'
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-backup-restore"
-
-      - name: Run backup/restore smoke tests
-        run: cargo test --test backup_restore_smoke_test -- --nocapture
-
   # ── 10. Code coverage ─────────────────────────────────────────────────────────
   coverage:
     name: Code Coverage
@@ -901,7 +855,7 @@ jobs:
       (needs.crd-drift.result == 'success' || needs.crd-drift.result == 'skipped')
     runs-on: ubuntu-latest
     timeout-minutes: 20
-    needs: [changes, helm-test, api-docs]
+    needs: [changes, helm-test, api-docs, crd-drift]
     env:
       DOCKER_PLATFORMS: linux/amd64
     permissions:
@@ -981,64 +935,7 @@ jobs:
         with:
           image-ref: ${{ env.REGISTRY }}/${{ steps.setup-docker.outputs.image-name }}:sha-${{ github.sha }}
 
-  # ── 13. Upgrade workflow test ─────────────────────────────────────────────────
-  upgrade-test:
-    name: Upgrade Workflow Test
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: [test]
-    if: >-
-      always() &&
-      needs.test.result == 'success'
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-upgrade-test"
-
-      - name: Run upgrade orchestrator unit tests
-          # Note: compilation runs with K8S_OPENAPI_ENABLED_VERSION=1.30
-        run: cargo test --locked upgrade_orchestrator -- --nocapture
-
-      - name: Run PVC autoscaler unit tests
-        run: cargo test --locked pvc_autoscaler -- --nocapture
-
-  # ── 14. Reconciler Benchmark ──────────────────────────────────────────────────
-  reconciler-benchmark:
-    name: Reconciler Benchmark
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-bench"
-
-      - name: Run reconciler benchmark
-        run: |
-          cargo test --release --lib -- --nocapture 2>&1 \
-            | tee bench-amd64.txt
-
-      - name: Write benchmark summary
-        if: always()
-        run: |
-          {
-            echo "## Reconciler Benchmark Summary"
-            echo ""
-            if [[ -f bench-amd64.txt ]]; then
-              echo '```'
-              cat bench-amd64.txt
-              echo '```'
-            else
-              echo "⚠️ Benchmark results not available"
-            fi
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  # ── 15. Chart Render Diff Check ───────────────────────────────────────────────
+  # ── 13. Chart Render Diff Check ───────────────────────────────────────────────
   # Detects unintended Helm chart template drift by comparing rendered output
   # against a stored baseline.
   # Related: #1145 - Implement chart render diff checks to catch unintended template drift

.github/workflows/dependency-review.yml

@@ -44,40 +44,6 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  # ── 1. cargo audit — known vulnerabilities ──────────────────────────────────
-  cargo-audit:
-    name: Cargo Audit (Vulnerabilities)
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-audit"
-          extra-tools: "cargo-audit"
-
-      - name: Run cargo audit
-        run: |
-          echo "── Security advisory audit ──────────────────────────────────────"
-          cargo audit
-
-      - name: Generate audit JSON report
-        if: always()
-        run: |
-          cargo audit --json 2>/dev/null > audit-report.json || true
-          echo "Audit report saved to audit-report.json"
-
-      - name: Upload audit report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: cargo-audit-report
-          path: audit-report.json
-          retention-days: 30
-
-  # ── 2. cargo deny — license + bans + advisories ─────────────────────────────
   # ── 1. cargo deny — license + bans + advisories ─────────────────────────────
   cargo-deny:
     name: Cargo Deny (Licenses + Bans)

.github/workflows/link-check.yml

@@ -25,9 +25,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: (optional) Restore lychee cache removed
-        run: echo "Skipping cache restore in scheduled link-check to satisfy repository hygiene checks. Lychee will run without cache."
-
       - name: Run lychee
         id: lychee
         uses: lycheeverse/lychee-action@v2
@@ -44,13 +41,11 @@ jobs:
           output: lychee-report.md
 
       - name: Open / update tracking issue on failure
-        if: env.lychee_exit_code != '0'
+        if: steps.lychee.outputs.exit_code != '0'
         uses: peter-evans/create-issue-from-file@v5
         with:
           title: "Link Check Report"
           content-filepath: lychee-report.md
           labels: |
             documentation
             ci
-        env:
-          lychee_exit_code: ${{ steps.lychee.outputs.exit_code }}

.github/workflows/maintenance.yml

@@ -27,36 +27,3 @@ jobs:
 
       - name: Run stale artifact cleanup regression tests
         run: cargo test stale_artifact_cleanup -- --nocapture
-
-  dependency-audit:
-    name: Dependency Audit
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: ./.github/actions/setup-rust
-        with:
-          cache-key: "ci-maintenance-audit"
-          extra-tools: "cargo-audit"
-          cache-key: "ci-audit-maintenance"
-          extra-tools: "cargo-audit"
-
-      - name: Run security audit
-        run: cargo audit
-
-  docs-health:
-    name: Docs Health Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
-
-      - name: Check documentation links
-        run: python3 scripts/check-links.py

.github/workflows/performance.yml

@@ -74,21 +74,20 @@ jobs:
 
       # Shared build-operator composite action consolidates Rust + Docker
       # bootstrap that was previously duplicated across workflows (issue #1136).
+      # upload-artifact: "true" exports operator-image.tar.gz as an artifact.
       - name: Build operator binary and Docker image
         uses: ./.github/actions/build-operator
         with:
           image-tag: ${{ steps.version.outputs.version }}
           artifact-name: perf-operator-image-${{ steps.version.outputs.version }}
           cache-key: "perf-build"
-          upload-artifact: "false"   # we upload together with the binary below
+          upload-artifact: "true"
 
-      - name: Upload artifacts
+      - name: Upload operator binary
         uses: actions/upload-artifact@v7
         with:
           name: perf-artifacts-${{ steps.version.outputs.version }}
-          path: |
-            target/release/stellar-operator
-            operator-image.tar.gz
+          path: target/release/stellar-operator
           retention-days: 7
 
   benchmark:
@@ -103,16 +102,22 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Download artifacts
+      - name: Download operator binary
         uses: actions/download-artifact@v8
         with:
           name: perf-artifacts-${{ needs.build.outputs.version }}
 
+      - name: Download operator image tarball
+        if: matrix.suite != 'webhook'
+        uses: actions/download-artifact@v8
+        with:
+          name: perf-operator-image-${{ needs.build.outputs.version }}
+
       - name: Load Docker image
         if: matrix.suite != 'webhook'
         run: |
-          gunzip stellar-operator-image.tar.gz
-          docker load < stellar-operator-image.tar
+          gunzip operator-image.tar.gz
+          docker load < operator-image.tar
 
       - name: Setup performance environment
         if: matrix.suite != 'webhook'

.github/workflows/stale-docs.yml

@@ -69,13 +69,6 @@ jobs:
         uses: ./.github/actions/setup-rust
         with:
           cache-key: "docs-stale"
-      # ── Rust toolchain ──────────────────────────────────────────────────────
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # ── Cargo cache step removed to satisfy repository-hygiene checks
-      - name: (optional) Cargo cache removed
-        run: echo "Skipping cargo cache restore to satisfy repository hygiene checks; building without cache."
 
       # ── Build the doc-check binary ──────────────────────────────────────────
       # Uses cargo directly; the binary is an internal tool that does not need

scripts/ci/check-cache-keys.sh

@@ -6,6 +6,8 @@ echo "Running Cache Key Consistency Checks..."
 echo "========================================"
 
 ERRORS=0
+KEY_REGEX='^(ci|perf|soak|release|chaos|docs|verify|image|dep)-[a-zA-Z0-9_-]+$'
+SCOPE_REGEX='^(stellar-k8s-docker|image-build-[a-zA-Z0-9_-]+|perf-docker)$'
 
 # Ensure raw actions/cache is avoided unless specific dimensions are included
 while IFS= read -r -d '' file; do
@@ -14,34 +16,22 @@ while IFS= read -r -d '' file; do
     ERRORS=$((ERRORS + 1))
   fi
 
-  # Extract cache-key or shared-key values (skip GitHub expressions).
+  # Validate cache-key / shared-key values (skip GitHub expressions).
   while IFS= read -r line; do
     key=$(echo "$line" | sed -E 's/^[^:]*:[[:space:]]*//; s/["'\'']//g; s/[[:space:]]*$//')
-    [[ -z "$key" || "$key" == default ]] && continue
-    # Allow GitHub Actions expressions (${{ ... }}) unchanged.
-    if [[ "$key" == *'${{'* ]]; then
-      continue
-    fi
-    if [[ ! "$key" =~ ^(ci|perf|soak|release|chaos|docs|verify|image|dep)-[a-zA-Z0-9_-]+$ ]]; then
+    [[ -z "$key" || "$key" == "default" ]] && continue
+    # Allow GitHub Actions expressions (${{ ... }) unchanged.
+    [[ "$key" == *'${{'* ]] && continue
+    if [[ ! "$key" =~ $KEY_REGEX ]]; then
       echo "::error file=$file::Invalid cache key format: $key. Expected format: <prefix>-<name> where prefix is ci, perf, soak, release, chaos, docs, verify, image, or dep."
-  # Extract cache-key or shared-key
-  keys=$(grep -E 'cache-key:|shared-key:' "$file" | awk -F':' '{print $2}' | tr -d ' "''' || true)
-  for key in $keys; do
-    # Skip GitHub Actions expression templates (e.g. release-${{ matrix.target }})
-    if [[ "$key" == *'${{'* ]]; then
-      continue
-    fi
-    # Valid prefixes
-    if [[ ! "$key" =~ ^(ci|perf|soak|release|chaos|docs|verify|image)-[a-zA-Z0-9_-]+$ ]] && [[ "$key" != "default" ]]; then
-      echo "::error file=$file::Invalid cache key format: $key. Expected format: <prefix>-<name> where prefix is ci, perf, soak, release, chaos, docs, verify, or image."
       ERRORS=$((ERRORS + 1))
     fi
   done < <(grep -E '^\s*(cache-key|shared-key):' "$file" || true)
 
   # Check Docker cache scopes
   while IFS= read -r scope; do
     [[ -z "$scope" ]] && continue
-    if [[ ! "$scope" =~ ^(stellar-k8s-docker|image-build-[a-zA-Z0-9_-]+|perf-docker)$ ]]; then
+    if [[ ! "$scope" =~ $SCOPE_REGEX ]]; then
       echo "::error file=$file::Invalid Docker cache scope: $scope"
       ERRORS=$((ERRORS + 1))
     fi