[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles (#826)

Extra changes:

- CI/CD: use shared workflow to pull server images (including RC's)
- Bump manylinux_2_28 base image from 2026.01.04-1 to 2026.04.25-0

Author: juliannguyen4

.github/actions/get-artifact-for-stage-tests/action.yml

@@ -0,0 +1,114 @@
+name: 'Run server and configure tests'
+description: 'Run server in a Docker container. Also configure python client dev tests'
+# NOTE: do not share this server container with others
+# since it's using the default admin / admin credentials
+outputs:
+  container-network:
+    description: Forwards the container's network name from setup-as-server
+    value: ${{ steps.setup-as-server.outputs.network-name }}
+  container-name:
+    description: Forwards the container name from setup-as-server
+    value: ${{ steps.setup-as-server.outputs.container-names }}
+inputs:
+  # All inputs in composite actions are strings
+  oidc-provider-name:
+    description: For pulling server images from JFrog
+    required: true
+  oidc-audience:
+    description: For pulling server images from JFrog
+    required: true
+  server-edition:
+    required: true
+    description: 'community or enterprise'
+  features-content:
+    description: Only used if server edition is enterprise. For enabling strong consistency
+    required: true
+  server-tag:
+    required: true
+    description: Specify Docker tag
+  where-is-client-connecting-from:
+    required: false
+    description: 'docker-host, separate-docker-container, "remote-connection" via DOCKER_HOST'
+    default: 'docker-host'
+
+runs:
+  using: "composite"
+  steps:
+  # Start up server
+  - uses: aerospike/shared-workflows/.github/actions/setup-aerospike-server@CLIENT-4793-setup-aerospike-server-use-named-volumes-instead-of-bind-mounts-to-support-windows-and-macos-runners
+    id: setup-as-server
+    with:
+      server-container-repo: database-docker-virtual/aerospike-server${{ inputs.server-edition == 'enterprise' && '-enterprise' || '' }}
+      enable-security: ${{ inputs.server-edition == 'enterprise' }}
+      enable-tls: ${{ inputs.server-edition == 'enterprise' }}
+      enable-strong-consistency: ${{ inputs.server-edition == 'enterprise' }}
+      features-content: ${{ inputs.features-content }}
+      num-nodes: 1
+      oidc-provider: ${{ inputs.oidc-provider-name }}
+      oidc-audience: ${{ inputs.oidc-audience }}
+      server-tag: ${{ inputs.server-tag }}
+      # This way doesn't work, so pass a custom server config for now with this setting enabled
+      # Problem is the shared action is overriding the entrypoint script that parses this env var
+      # env-vars: DEFAULT_TTL=2592000;
+      config-file: ./.github/workflows/aerospike${{ inputs.server-edition == 'community' && '-ce' || '' }}.conf
+
+  - name: Get config.conf
+    run: |
+      CONFIG_CONF=config.conf
+      echo "CONFIG_CONF=$CONFIG_CONF" >> "$GITHUB_ENV"
+      cp config.conf.template "$CONFIG_CONF"
+    working-directory: test
+    shell: bash -ex {0}
+
+  - if: ${{ inputs.server-edition == 'enterprise' }}
+    run: |
+      call_from_tools_container() {
+        # See comment in run-ee-server.bash's call_from_tools_container() for why we surround $@ with double quotes
+        docker run --rm --network host aerospike/aerospike-tools "$@"
+      }
+
+      SUPERUSER_NAME_AND_PASSWORD="superuser"
+      call_from_tools_container asadm -U admin -P admin --enable --execute "manage acl \
+          create user "$SUPERUSER_NAME_AND_PASSWORD" password "$SUPERUSER_NAME_AND_PASSWORD" \
+          roles read-write-udf, sys-admin, user-admin, data-admin"
+
+      # Install crudini to manipulate config.conf
+      pipx install crudini --pip-args "-c ${{ github.workspace }}/.github/workflows/requirements.txt"
+
+      # Disable community edition connection
+      crudini --existing=param --set "$CONFIG_CONF" community-edition hosts ''
+      crudini --existing=param --set "$CONFIG_CONF" enterprise-edition user "$SUPERUSER_NAME_AND_PASSWORD"
+      crudini --existing=param --set "$CONFIG_CONF" enterprise-edition password "$SUPERUSER_NAME_AND_PASSWORD"
+      crudini --set "$CONFIG_CONF" tls enable true
+
+      tls_cert_dir=${{ steps.setup-as-server.outputs.tls-cert-dir }}
+      if [[ "$WHERE_IS_CLIENT_CONNECTING_FROM" == "separate-docker-container" ]]; then
+        tls_cert_dir="/host${tls_cert_dir}"
+      fi
+
+      crudini --set "$CONFIG_CONF" tls cafile $tls_cert_dir/ca.crt
+      crudini --set "$CONFIG_CONF" tls keyfile $tls_cert_dir/client.key
+      crudini --set "$CONFIG_CONF" tls certfile $tls_cert_dir/client.crt
+
+      if [[ "$WHERE_IS_CLIENT_CONNECTING_FROM" == "docker-host" ]]; then
+        SERVER_IP=127.0.0.1
+      elif [[ "$WHERE_IS_CLIENT_CONNECTING_FROM" == "remote-connection" ]]; then
+        # Set IP address to remote machine running the Docker daemon
+        SERVER_IP=${DOCKER_HOST/tcp:\/\//}
+        SERVER_IP=${SERVER_IP/:2375/}
+      elif [[ "$WHERE_IS_CLIENT_CONNECTING_FROM" == "separate-docker-container" ]]; then
+        SERVER_IP="$SERVER_CONTAINER_NAME"
+      else
+        # Invalid input
+        exit 1
+      fi
+
+      # Set EE server's IP address and TLS name for test config
+      cluster_name=$(call_from_tools_container asinfo -U admin -P admin -v "get-config:context=service" -l | grep -i cluster-name | cut -d = -f 2)
+      crudini --existing=param --set "$CONFIG_CONF" enterprise-edition hosts "${SERVER_IP}:${TLS_PORT}|${cluster_name}"
+    working-directory: test
+    shell: bash -ex {0}
+    env:
+      WHERE_IS_CLIENT_CONNECTING_FROM: "${{ inputs.where-is-client-connecting-from }}"
+      TLS_PORT: ${{ steps.setup-as-server.outputs.tls-service-ports }}
+      SERVER_CONTAINER_NAME: ${{ steps.setup-as-server.outputs.container-names }}