Run acceptance tests against a FIPS build in CI

[ilyakuz-db]

Changes

Adds a test (linux, fips) CI job that builds the CLI with GOFIPS140=v1.0.0 and runs the acceptance suite against it, plus a test that reads the built binary's build info to confirm it really was built with the validated module.

No production code changes. The regular test jobs are untouched, and the new test skips unless GOFIPS140 is set.

Why

Go selects its cryptographic module at build time via GOFIPS140, so the module a binary uses is a property of the build rather than of the code. Every existing job builds without it, which means the FIPS module is never exercised: FIPS mode narrows the cipher suites the TLS client offers, so a passing suite today says nothing about whether the same code still works once the validated module is linked.

The binary-inspection test exists because the job would otherwise still pass if GOFIPS140 stopped reaching the compiler — the suite would run against an ordinary build and report that FIPS works.

Linux only: the module is platform-independent, so adding a second OS would spend wall-clock time re-testing the same crypto.

Tests

Locally, GOFIPS140=v1.0.0 go test ./acceptance -run "^TestAccept$/bundle/resources" fails only model_serving_endpoints/drift/recreated_same_name, which fails the same way without GOFIPS140 (and on main) — so the FIPS build introduces no new failures.

go version -m on the acceptance-built binary reports:

build	-tags=fips140v1.0
build	DefaultGODEBUG=fips140=on
build	GOFIPS140=v1.0.0-c2097c7c

The new test was checked in all three states: it skips on a default build, passes with GOFIPS140=v1.0.0, and fails with GOFIPS140=latest (an unvalidated module version).

This PR was written by Claude Code.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @pietern -- recent work in .github/workflows/, acceptance/

Eligible reviewers: @andrewnester, @anton-107, @denik, @janniklasrose, @lennartkats-db, @renaudhartert-db, @shreyas-goenka, @simonfaltum

_{Suggestions based on git history. See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: 8b08765

Run: 31378151224

	Env	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux	4	4	291	1120	5:36
💚​	aws windows	4	4	293	1118	4:58
💚​	azure linux	4	4	290	1120	5:47
💚​	azure windows	4	4	292	1118	4:50
💚​	gcp linux	1	5	291	1120	5:58
💚​	gcp windows	1	5	293	1118	5:54

8 interesting tests: 4 RECOVERED, 4 SKIP

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	🙈​S	🙈​S
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R

Top 3 slowest tests (at least 2 minutes):

duration	env	testname
4:34	gcp windows	TestAccept
3:16	aws windows	TestAccept
2:58	azure windows	TestAccept