chore: housekeeping

[mishraomp]

Summary

Hardens CI workflows and the Helm chart against BC Gov's GitHub Actions and OpenShift platform standards.

GitHub Actions

• use centralized upstream github actions bcgov/actions repo
• pr-open.yml: PR branch name sanitization (fixes a script-injection path), single results aggregator as the required check, deny-all permissions: {} with per-job step-ups, migrated to bcgov/actions consolidated actions
• SHA-pinned third-party actions (cypress-io/github-action, aquasecurity/trivy-action, redhat-actions/openshift-tools-installer)
• set -euo pipefail added to all non-trivial run:/commands: blocks across .deploy.yml and scheduled.yml

Helm chart (charts/pubcode)

• Enabled PodDisruptionBudget for api and frontend
• Added pod anti-affinity (podAntiAffinity on kubernetes.io/hostname) for api and frontend
• Added explicit terminationGracePeriodSeconds (api/frontend: 30s, database: 60s)
• Added readOnlyRootFilesystem: true + writable /tmp emptyDir to all containers (api, frontend, database, database initContainer)

---

Thanks for the PR!

Any successful deployments (not always required) will be available below.
API available
Frontend available

Once merged, code will be promoted and handed off to following workflow run.
Main Merge Workflow

[Copilot]

Pull request overview

This PR hardens CI workflows and the charts/pubcode Helm chart to better align with BC Gov GitHub Actions and OpenShift/Kubernetes operational standards (pinned actions, tighter workflow permissions, and more resilient/safe pod scheduling and filesystem settings).

Changes:

• Updated GitHub Actions workflows to use centralized bcgov/actions, SHA-pin third-party actions, and add stricter shell execution (set -euo pipefail) in key script blocks.
• Hardened Helm workloads with PodDisruptionBudgets, termination grace periods, read-only root filesystems, and writable /tmp via emptyDir.
• Added pod anti-affinity defaults for API and frontend to improve replica spreading across nodes.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
charts/pubcode/values.yaml	Adds PDB config, termination grace periods, anti-affinity defaults, and /tmp volume settings (database)
charts/pubcode/templates/frontend/templates/pdb.yaml	Switches frontend PDB from minAvailable to maxUnavailable
charts/pubcode/templates/frontend/templates/deployment.yaml	Adds termination grace period and /tmp emptyDir mount; supports read-only root FS
charts/pubcode/templates/database/templates/sfs.yml	Adds termination grace period and read-only root FS (database + init); uses values-driven mounts/volumes
charts/pubcode/templates/api/templates/pdb.yml	Switches API PDB from minAvailable to maxUnavailable
charts/pubcode/templates/api/templates/deployment.yml	Adds termination grace period and /tmp emptyDir mount; enforces read-only root FS
.gitignore	Ignores additional local tooling artifacts
.github/workflows/scheduled.yml	Updates action versions/pinning and hardens shell execution
.github/workflows/pr-open.yml	Migrates to bcgov/actions, tightens permissions, and adds a results aggregator job
.github/workflows/merge.yml	Updates checkout action version
.github/workflows/analysis.yml	Updates checkout action and SHA-pins Trivy action
.github/workflows/.tests.yml	Updates checkout action and SHA-pins Cypress action
.github/workflows/.deploy.yml	Updates checkout action, hardens shell execution, and makes cleanup more resilient
.gitattributes	Enforces LF endings and treats binary assets appropriately

[DerekRoberts]

Incremental improvement. 😊