TRU-342: Migrate CI/CD from Azure DevOps to GitHub Actions - #5
Open
jtcrde wants to merge 3 commits into
Open
Conversation
Pattern-setter for the content-flow module dependency repos. - Add .github/workflows/ci.yaml with four jobs mirroring the AzDO terraform.yml template: pre-commit (fmt/tflint/tfsec/validate + hygiene hooks), Checkov validate, semantic-release on master, and a verbatim port of update-source-reference — the automation that rewrites this package's ?ref= pins in infrastructure-modules on each release (direct push for minor/patch, feature branch + PR for major). - Switch .releaserc.json to @cncsc/semantic-release-config and add the matching devDependencies (previously provided globally by the CI container). - Delete azure-pipelines.yml in the same commit so AzDO's npm link step never runs against the local semantic-release stack (the v19/v21 EPERM collision documented on TRU-327). - No terratest port: runFunctionalTests was explicitly false and the repo has no Go test files.
Checkov CKV2_GHA_1: without a top-level permissions block the workflow inherits the repository's default GITHUB_TOKEN grant (write-all on the legacy default). Default to contents: read; the release job elevates to contents: write explicitly. The real credentials in these jobs come from GIT_TOKEN_BASIC, so nothing loses access.
…um (fix) Security-review findings on the pattern: - LATEST_VERSION comes from git tag names, which may legally contain sed/content metacharacters and are later interpolated into sed expressions that write into infrastructure-modules (pushed as signed bot commits). Require strict semver before using the value anywhere. - Verify the tfsec binary against its official release sha256 instead of trusting the download blindly.
zhianchow
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pattern-setter PR for TRU-342 — migrating the 11 content-flow module dependency repos to GHA before the org move. package-pki goes first (small, dormant, 3 downstream references); once verified, the same shape stamps out across the other terraform module repos.
Changes
.github/workflows/ci.yaml(new), four jobs at parity with the AzDOterraform.ymltemplate:run-ci-analysisstep)update-source-reference.yml: on a new release, rewrites this package's?ref=pins in infrastructure-modules — direct GPG-signed push for minor/patch, feature branch + PR for major bumps.releaserc.json/package.json/ lockfile — @quantum-sec → @cncsc semantic-release stack with local devDependenciesazure-pipelines.ymldeleted in the same commit (the npm-link rule from TRU-327)runFunctionalTestswas explicitlyfalseand the repo has no Go testsTest plan
GIT_TOKEN_BASIC,QUANTUM_CI_BOT_GITHUB_SSH_KEY,IMPORT_GPG_KEY(+_PASSPHRASE) — the update job needs all four (same set just verified working on infrastructure-live-customer)package-pkirefs in infrastructure-modules and pushes (minor/patch) — which then flows through infra-modules' own import-gated, validated release chainquantum-sec.package-pkiAzDO pipeline definition to the org owners for deletion