refactor(ci): split platform validation and security workflows

.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+---
+name: Platform CI
+
+on:
+  pull_request:
+    branches: [main]
+
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Platform
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Install Helm
+        uses: azure/setup-helm@v4
+
+      - name: Add OpenTelemetry Helm Repository
+        run: |
+          helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
+          helm repo update
+
+      - name: Render Helm Chart
+        run: |
+          source platform/helm/versions.env
+          helm pull open-telemetry/opentelemetry-demo \
+            --version "$OTEL_DEMO_CHART_VERSION" \
+            --untar
+
+          helm lint opentelemetry-demo \
+            --values platform/helm/values.yaml
+
+          helm template astronomy-shop \
+            opentelemetry-demo \
+            --namespace astronomy-shop \
+            --values platform/helm/values.yaml \
+            > rendered.yaml
+
+      - name: Install kubeconform
+        run: |
+          curl -sSL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
+            | tar -xz
+          sudo mv kubeconform /usr/local/bin/
+
+      - name: Validate Kubernetes Manifests
+        run: |
+          kubeconform \
+            -strict \
+            -summary \
+            -ignore-missing-schemas \
+            rendered.yaml

.github/workflows/security.yml

@@ -0,0 +1,35 @@
+---
+name: Platform Security
+
+on:
+  pull_request:
+    branches: [main]
+
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Scan Platform Configuration
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: config
+          scan-ref: platform
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          artifact-name: platform-sbom.spdx.json