feat: add new CI

.github/.releaserc.yml

@@ -1,12 +1,6 @@
-tagFormat: $${q}{version}
+tagFormat: ${version}
 branches:
     - main
-    - master
-    - +([0-9])?(.{+([0-9]),x}).x
-    - { name: next, prerelease: true }
-    - { name: beta, prerelease: true }
-    - { name: alpha, prerelease: true }
-    - { name: stable, prerelease: true }
 plugins:
     - "@semantic-release/commit-analyzer"
     - "@semantic-release/release-notes-generator"

.github/renovate.json

@@ -0,0 +1,5 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["config:recommended"],
+    "enabledManagers": ["terraform", "github-actions"]
+}

.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI Pipeline
+
+on:
+    push:
+        tags: ["*"]
+        branches: [main]
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+        inputs: {}
+
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            packages: write
+            attestations: write
+            id-token: write
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+
+            - name: Setup Terraform
+              uses: hashicorp/setup-terraform@v3
+              with:
+                  terraform_version: "1.10.5"
+
+            - name: Restore cache
+              uses: actions/cache@v4
+              with:
+                  path: .terraform/
+                  key: ${{ hashFiles('.terraform.lock.hcl') }}
+
+            - run: terraform init
+            - run: terraform fmt -check
+            - run: terraform validate -no-color
+
+    release:
+        needs: build
+        runs-on: ubuntu-latest
+        if: github.ref_protected && !startsWith(github.event.head_commit.message, 'chore')
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v4
+              with:
+                  persist-credentials: false
+
+            - name: Semantic Release
+              run: cp .github/.releaserc.yml .
+            - uses: cycjimmy/semantic-release-action@v4
+              with:
+                  extra_plugins: "@semantic-release/exec"
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  GITHUB_API: ${{ github.api_url }}