ci: add PR validation checks and release automation

.github/workflows/branch-validation.yml

@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main

.github/workflows/conventional-commit.yml

@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main

.github/workflows/release.yml

@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit

.github/workflows/shellcheck.yml

@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main

.github/workflows/trivy.yml

@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main

aurora-postgres-server/deployment/main.tf

@@ -59,6 +59,26 @@ resource "aws_secretsmanager_secret_version" "master" {
   })
 }
 
+# ---------------------------------------------------------------------------
+# KMS key for Aurora storage encryption (customer managed, required by
+# AVD-AWS-0079 — the default AWS-managed RDS key doesn't satisfy that check)
+# ---------------------------------------------------------------------------
+
+resource "aws_kms_key" "aurora" {
+  description         = "Customer managed key for Aurora cluster storage encryption (${var.instance_name})"
+  enable_key_rotation = true
+
+  tags = {
+    "managed-by" = "nullplatform"
+    "service-id" = var.service_id
+  }
+}
+
+resource "aws_kms_alias" "aurora" {
+  name          = "alias/nullplatform-aurora-${var.instance_name}"
+  target_key_id = aws_kms_key.aurora.key_id
+}
+
 # ---------------------------------------------------------------------------
 # Aurora PostgreSQL cluster
 # ---------------------------------------------------------------------------
@@ -85,6 +105,7 @@ resource "aws_rds_cluster" "main" {
   vpc_security_group_ids = [aws_security_group.aurora.id]
 
   storage_encrypted   = true
+  kms_key_id          = aws_kms_key.aurora.arn
   port                = 5432
   skip_final_snapshot = true
   deletion_protection = false