TRU-342: Migrate CI/CD from Azure DevOps to GitHub Actions - #5
Merged
Conversation
Pattern-setter for the content-flow module dependency repos. - Add .github/workflows/ci.yaml with four jobs mirroring the AzDO terraform.yml template: pre-commit (fmt/tflint/tfsec/validate + hygiene hooks), Checkov validate, semantic-release on master, and a verbatim port of update-source-reference — the automation that rewrites this package's ?ref= pins in infrastructure-modules on each release (direct push for minor/patch, feature branch + PR for major). - Switch .releaserc.json to @cncsc/semantic-release-config and add the matching devDependencies (previously provided globally by the CI container). - Delete azure-pipelines.yml in the same commit so AzDO's npm link step never runs against the local semantic-release stack (the v19/v21 EPERM collision documented on TRU-327). - No terratest port: runFunctionalTests was explicitly false and the repo has no Go test files.
Checkov CKV2_GHA_1: without a top-level permissions block the workflow inherits the repository's default GITHUB_TOKEN grant (write-all on the legacy default). Default to contents: read; the release job elevates to contents: write explicitly. The real credentials in these jobs come from GIT_TOKEN_BASIC, so nothing loses access.
…um (fix) Security-review findings on the pattern: - LATEST_VERSION comes from git tag names, which may legally contain sed/content metacharacters and are later interpolated into sed expressions that write into infrastructure-modules (pushed as signed bot commits). Require strict semver before using the value anywhere. - Verify the tfsec binary against its official release sha256 instead of trusting the download blindly.
zhianchow
previously approved these changes
Jul 31, 2026
This is a public repo: Actions logs are world-readable. set -x traces every command publicly and turns any accidental echo of a derived value into a public disclosure. Replace with set -e; the script's deliberate echo statements provide the useful log output.
Replace the self-contained pipeline with version-pinned consumers of the central reusable workflows (validation, semantic-release, update-source-reference) — all logic, hardening included, now lives in quantum-sec/actions@v1.0.0. The consumer file mirrors what an armor/actions consumer will look like after the org move: convergence is an org-name swap.
zhianchow
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pattern-setter PR for TRU-342 — and the first consumer of the new quantum-sec/actions reusable-workflow repo, which deliberately mirrors
armor/actionsso the org move (TRU-329) becomes an org-name swap in eachuses:line.Changes
.github/workflows/ci.yaml(new, ~45 lines) — version-pinned consumers of three reusable workflows fromquantum-sec/actions@v1.0.0:terraform-module-validation.yaml— the repo's pre-commit hooks (terraform from.terraform-version, tflint, checksum-verified tfsec) + Checkov. Secret-free; safe on fork PRs.semantic-release.yaml— interface mirrorsarmor/actions(same secret, samesemveroutput).update-source-reference.yaml— the auto-bump: rewrites this package's?ref=pins in infrastructure-modules on release (direct GPG-signed push for minor/patch, PR for major).GITHUB_TOKEN..releaserc.json/package.json/ lockfile — @quantum-sec → @cncsc semantic-release stack with local devDependencies.azure-pipelines.ymldeleted in the same commit (the npm-link rule from TRU-327).runFunctionalTestswas explicitlyfalse, no Go tests exist.Note for branch protection
With reusable workflows, check names become
Validation / Pre-Commit Validation,Validation / Validate, etc. — use those names when making checks required.Test plan
IMPORT_GPG_KEY,IMPORT_GPG_KEY_PASSPHRASE,QUANTUM_CI_BOT_GITHUB_SSH_KEYadded as repo secrets (GIT_TOKEN_BASICis org-level)package-pkirefs in infrastructure-modules and pushes — flowing through infra-modules' import-gated, validated release chainquantum-sec.package-pkiAzDO pipeline definition to the org owners for deletion