From efcf2259c598ecacdf42db21e4440252e030447f Mon Sep 17 00:00:00 2001
From: sebas_correa <sebastian.correa@nullplatform.io>
Date: Mon, 27 Jul 2026 15:45:01 -0300
Subject: [PATCH 1/2] ci: add PR validation checks and release automation

Mirrors the CI setup from services-postgresql-rds: branch naming
validation, conventional commit enforcement, shellcheck, a Trivy
IaC scan on OpenTofu/Terraform files, and release-please based
release automation, all via nullplatform/actions-nullplatform
reusable workflows.
---
 .github/workflows/branch-validation.yml   | 10 ++++++++++
 .github/workflows/conventional-commit.yml | 10 ++++++++++
 .github/workflows/release.yml             | 15 +++++++++++++++
 .github/workflows/shellcheck.yml          | 10 ++++++++++
 .github/workflows/trivy.yml               | 14 ++++++++++++++
 5 files changed, 59 insertions(+)
 create mode 100644 .github/workflows/branch-validation.yml
 create mode 100644 .github/workflows/conventional-commit.yml
 create mode 100644 .github/workflows/release.yml
 create mode 100644 .github/workflows/shellcheck.yml
 create mode 100644 .github/workflows/trivy.yml

diff --git a/.github/workflows/branch-validation.yml b/.github/workflows/branch-validation.yml
new file mode 100644
index 0000000..6d75b77
--- /dev/null
+++ b/.github/workflows/branch-validation.yml
@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
new file mode 100644
index 0000000..92952e1
--- /dev/null
+++ b/.github/workflows/conventional-commit.yml
@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8a65e73
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..abf7bd9
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..1a3c210
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main

From 5f71cc72192de9f1348dabc801ef2833c9b0ab82 Mon Sep 17 00:00:00 2001
From: sebas_correa <sebastian.correa@nullplatform.io>
Date: Tue, 28 Jul 2026 15:34:56 -0300
Subject: [PATCH 2/2] fix: use a customer managed KMS key for Aurora storage
 encryption

storage_encrypted = true alone falls back to the AWS-managed RDS key,
which fails AVD-AWS-0079 (trivy IaC scan requires an explicit
kms_key_id on aws_rds_cluster). Add a dedicated KMS key instead of
suppressing the check.
---
 aurora-postgres-server/deployment/main.tf | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/aurora-postgres-server/deployment/main.tf b/aurora-postgres-server/deployment/main.tf
index 6e42294..9c7efd6 100644
--- a/aurora-postgres-server/deployment/main.tf
+++ b/aurora-postgres-server/deployment/main.tf
@@ -59,6 +59,26 @@ resource "aws_secretsmanager_secret_version" "master" {
   })
 }
 
+# ---------------------------------------------------------------------------
+# KMS key for Aurora storage encryption (customer managed, required by
+# AVD-AWS-0079 — the default AWS-managed RDS key doesn't satisfy that check)
+# ---------------------------------------------------------------------------
+
+resource "aws_kms_key" "aurora" {
+  description         = "Customer managed key for Aurora cluster storage encryption (${var.instance_name})"
+  enable_key_rotation = true
+
+  tags = {
+    "managed-by" = "nullplatform"
+    "service-id" = var.service_id
+  }
+}
+
+resource "aws_kms_alias" "aurora" {
+  name          = "alias/nullplatform-aurora-${var.instance_name}"
+  target_key_id = aws_kms_key.aurora.key_id
+}
+
 # ---------------------------------------------------------------------------
 # Aurora PostgreSQL cluster
 # ---------------------------------------------------------------------------
@@ -85,6 +105,7 @@ resource "aws_rds_cluster" "main" {
   vpc_security_group_ids = [aws_security_group.aurora.id]
 
   storage_encrypted   = true
+  kms_key_id          = aws_kms_key.aurora.arn
   port                = 5432
   skip_final_snapshot = true
   deletion_protection = false