Add self-healing TLS certificate lifecycle

.github/workflows/tls-lifecycle.yml

@@ -0,0 +1,61 @@
+name: TLS lifecycle tests
+
+on:
+  pull_request:
+    paths:
+      - "TruthGate-Web/TruthGate-Web/Configuration/**"
+      - "TruthGate-Web/TruthGate-Web/Services/ConfigWatchAndIssueService.cs"
+      - "TruthGate-Web/TruthGate-Web.Tests/**"
+      - ".github/workflows/tls-lifecycle.yml"
+  push:
+    branches:
+      - master
+    paths:
+      - "TruthGate-Web/TruthGate-Web/Configuration/**"
+      - "TruthGate-Web/TruthGate-Web/Services/ConfigWatchAndIssueService.cs"
+      - "TruthGate-Web/TruthGate-Web.Tests/**"
+      - ".github/workflows/tls-lifecycle.yml"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "9.0.x"
+
+      - name: Restore
+        run: dotnet restore TruthGate-Web/TruthGate-Web.Tests/TruthGate-Web.Tests.csproj
+
+      - name: Test
+        id: test
+        shell: bash
+        run: |
+          set +e
+          dotnet test \
+            TruthGate-Web/TruthGate-Web.Tests/TruthGate-Web.Tests.csproj \
+            --no-restore \
+            --configuration Release \
+            --logger "console;verbosity=normal" \
+            > tls-test-output.log 2>&1
+          status=$?
+          echo "status=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Upload test diagnostics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: tls-test-output
+          path: tls-test-output.log
+          if-no-files-found: error
+
+      - name: Report failure
+        if: steps.test.outputs.status != '0'
+        shell: bash
+        run: |
+          echo "TLS lifecycle tests failed. Download the tls-test-output artifact for the complete compiler/test diagnostics."
+          exit 1