TRU-342: Migrate CI/CD from Azure Pipelines to GitHub Actions

.github/workflows/ci.yaml

@@ -0,0 +1,55 @@
+name: CI/CD
+
+# Least-privilege default for the workflow's GITHUB_TOKEN; jobs that need
+# more elevate explicitly. Pipeline logic lives in quantum-sec/actions:
+# validation floats on the tag-protected @v1, secret-handling workflows
+# stay exact-pinned — converges onto armor/actions at org-move time.
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - master
+      - main
+  pull_request:
+    branches:
+      - master
+      - main
+
+# Serialize runs per ref so two default-branch pushes never race two
+# release jobs. The in-progress run always completes; a pending run
+# superseded by a newer push is replaced by it (safe here: releases are
+# cumulative and validation scans the full tree, so the surviving run
+# covers the replaced one's content).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  validation:
+    name: Validation
+    uses: quantum-sec/actions/.github/workflows/terraform-module-validation.yaml@v1
+
+  release:
+    name: Release
+    needs: validation
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
+    permissions:
+      contents: write
+    uses: quantum-sec/actions/.github/workflows/semantic-release.yaml@v1.4.0
+    secrets:
+      GIT_TOKEN_BASIC: ${{ secrets.GIT_TOKEN_BASIC }}
+
+  update-infrastructure-modules:
+    name: Update infrastructure-modules references
+    needs: release
+    if: needs.release.outputs.semver != ''
+    uses: quantum-sec/actions/.github/workflows/update-source-reference.yaml@v1.4.0
+    with:
+      package_name: package-cloudflare
+    secrets:
+      GIT_TOKEN_BASIC: ${{ secrets.GIT_TOKEN_BASIC }}
+      IMPORT_GPG_KEY: ${{ secrets.IMPORT_GPG_KEY }}
+      IMPORT_GPG_KEY_PASSPHRASE: ${{ secrets.IMPORT_GPG_KEY_PASSPHRASE }}
+      QUANTUM_CI_BOT_GITHUB_SSH_KEY: ${{ secrets.QUANTUM_CI_BOT_GITHUB_SSH_KEY }}

.releaserc.json

@@ -1,3 +1,3 @@
 {
-  "extends": "@quantum-sec/semantic-release-config/base"
+  "extends": "@cncsc/semantic-release-config/base"
 }