ci: run tests and tag-only publish through the shared workflows

[singlerider]

Summary

Moves blasthttp CI onto the org's shared workflows and publishes only on a human-pushed version tag.

Shared workflows

Calls the reusable workflows in blacklanternsecurity/CLA, pinned to e532142ee9e7322888f6edc80d9a89e2f8c0d96d (branch feat/shared-workflows, blacklanternsecurity/CLA#3). No repo-local copies of test, wheel, crates, release, or SBOM steps remain.

• tests.yml (pull_request, push to stable, workflow_call) calls rust-tests.yml (fmt, clippy, cargo test on the rust-toolchain channel) and python-tests.yml (ruff, then pytest on every CPython minor satisfying requires-python, maturin develop detected from the build backend).
• publish.yml (v* tags only) calls release-check.yml (refuses anything but vMAJOR.MINOR.PATCH / vMAJOR.MINOR.PATCH-rc.N and any tag differing from the Cargo.toml version), tests.yml, maturin-wheels.yml (interpreters from requires-python, no more hardcoded -i list), crates.yml, then publish.yml (GitHub release, SPDX SBOM, wheels attached, --prerelease for rc tags, same run). PyPI stays a top-level job because trusted publishing does not match reusable workflows.
• Nothing publishes or tags on a branch push. No workflow runs git tag.
• README ## Releasing documents the procedure and links the shared release.sh.
• Vendored OpenSSL: scripts/build-openssl.sh is the setup script for tests and crates; the wheel container setup lives in scripts/wheel-container-setup.sh. Wheels build for the linux and musllinux families, as before.
• pyproject.toml reads its version from Cargo.toml, lets uv manage the project, and adds maturin to the dev group so the shared python workflow can sync and build.
• release.toml (cargo-release) removed: one release tool, the shared release.sh.
• README examples ruff formatted (enforced by ruff format --check).
• CLA calls the shared reusable workflow.

Required checks for governance: rust / passed, python / passed.

Admin steps

• Register a PyPI trusted publisher for workflow publish.yml, environment pypi, then delete PYPI_API_TOKEN.

Validation

$ uvx --from actionlint-py==1.7.12.24 actionlint .github/workflows/*.yml
(no findings)
$ grep -rnE 'uses: [^.].*@' .github | grep -vE '@[0-9a-f]{40}'
(none)
$ grep -rn 'ubuntu-latest\|actions-rs' .github
(none)
$ cargo clippy --all-targets --all-features --locked -- -D warnings
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 19.42s
$ cargo test --all-features --locked
test result: ok. 223 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.00s
$ uv run pytest
162 passed in 17.58s
$ gh pr checks 120 -R blacklanternsecurity/blasthttp
CLAAssistant	pass
python / lint	pass
python / matrix / read	pass
python / passed	pass
python / test (3.10)	pass
python / test (3.11)	pass
python / test (3.12)	pass
python / test (3.13)	pass
python / test (3.14)	pass
rust / lint	pass
rust / passed	pass
rust / test	pass

Closes blacklanternsecurity/bbot-enterprise#139, blacklanternsecurity/bbot-enterprise#140, blacklanternsecurity/bbot-enterprise#149, blacklanternsecurity/bbot-enterprise#155, blacklanternsecurity/bbot-enterprise#156 (blasthttp part)

[en0f]

1. PRs into stable will be stuck. The default ruleset on stable requires checks named rust-tests and python-tests (3.10) through (3.14). This PR deletes the workflows that produce those checks. The new shared workflows report under different names (rust / passed, python / passed, python / test (3.x), and so on). Once this reaches dev, the next dev → stable PR will wait forever on checks that never run. Before merging, change the required checks in that ruleset to rust / passed and python / passed. The dev ruleset has no required checks, so this PR itself can merge.

2. The pins point at a branch that hasn't been merged. publish.yml and tests.yml pin blacklanternsecurity/CLA@e532142…, a commit on feat/shared-workflows. That CLA PR is still open. If it's squash-merged and the branch is deleted, that commit may stop being fetchable, and tests and releases would fail to resolve the workflows. Merge the CLA PR first, then update the pins (and the README link) to the matching commit on CLA main.

Check before the first tag: the PyPI job now publishes with trusted publishing (environment: pypi) instead of PYPI_API_TOKEN. Unless PyPI already has a trusted publisher registered for blacklanternsecurity/blasthttp, workflow publish.yml, environment pypi, the first release will fail at the PyPI step. I can't see PyPI settings from here, so I couldn't confirm it.

[liquidsec]

Please do not remove the rust tests here. They have highly customized tests that will not apply to any other repository (for example, custom openssl build)

[en0f]

I found two blocking issues: one is already live, the other will hit as soon as Python 3.15.0 ships. Everything else checks out.

1. PRs into stable will hang (still open from your earlier review). The default ruleset on stable still requires python-tests (3.10) through (3.14). This PR deletes python-tests.yml, and the shared workflow reports those results under different names (python / test (3.x) and python / passed), so the old check names never appear. Every dev → stable PR would wait on them forever. rust-tests is fine because the repo's own workflow is kept. Fix: swap those five required checks for python / passed before this lands.

2. Python 3.15 will break PR CI and the wheel builds.

How: The shared python-versions.yml picks the Python versions from requires-python = ">=3.10" and whatever versions uv can download. Once uv ships 3.15.0 final, 3.15 joins both the test matrix and the wheel -i list.
Why it fails: The locked PyO3 (pyo3-ffi 0.27.2) caps CPython at 3.14. Both old workflows set PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 to get past that cap, and the new calls don't pass it.
What breaks: python / test (3.15) fails, which fails python / passed on every PR, and the publish run fails at wheels.
Timing: It isn't failing yet, because the latest uv (0.12.23) still lists only 3.15.0rc3, which the shared script skips.
Fix: In tests.yml and in the wheels job of publish.yml, pass env: '{"PYO3_USE_ABI3_FORWARD_COMPATIBILITY": "1"}'. Bumping PyO3 to a release that supports 3.15 would also work.

[en0f]

Approved, but @singlerider see comment on repo settings:

PRs into stable will hang. I checked the live default ruleset on stable. It still requires these checks:

rust-tests (still produced, because the repo keeps its own workflow)
python-tests (3.10) through python-tests (3.14)

This PR deletes python-tests.yml. The shared workflow reports under python / test (3.x) and python / passed instead. Once this reaches dev, the next dev → stable PR will wait forever on five checks that never run. The fix is in repo settings, not the code: swap those five required checks for python / passed before or right as this merges. The dev ruleset has no required checks, so this PR itself can merge.