Replace Travis CI with GitHub Actions

[Copilot]

Migrates CI/CD from Travis CI to GitHub Actions using ddev/github-action-setup-ddev. Removes all Travis dependencies with no backward compatibility layer.

Workflows

• lint.yml - PhpStan, PHPCS, shellcheck on PRs and main
• test.yml - Functional tests on PRs and non-main branches
• deploy-qa.yml - Auto-deploy main → Pantheon QA
• deploy-test.yml - Deploy tags → Pantheon TEST
• deploy-live.yml - Deploy *live tags → Pantheon LIVE

Key Changes

• Removed .travis.yml, .travis.template.yml, travis-key.enc
• Renamed travis-key → deploy-key throughout codebase
• Updated ci-scripts/prepare_deploy.sh to use GITHUB_WORKSPACE and GITHUB_COMMIT_MESSAGE
• Modified robo-components/DeploymentTrait.php to generate OpenSSL-encrypted deploy keys for GitHub Actions
• Added explicit workflow permissions (contents:read, issues:write, pull-requests:write)
• Fixed commit message injection vulnerability via environment variables

Migration Requirements

Projects need these GitHub secrets:

• PANTHEON_GIT_URL - from terminus connection:info
• TERMINUS_TOKEN - Pantheon machine token
• ENCRYPTED_KEY, ENCRYPTED_IV - from ddev robo deploy:config-autodeploy
• ROLLBAR_SERVER_TOKEN - optional

Deploy key setup:

ddev robo deploy:config-autodeploy <terminus_token> <github_token>
# Add deploy-key.pub to Pantheon user SSH keys
# Commit deploy-key.enc to repository

Security

• Workflow permissions follow least-privilege principle
• Commit messages sanitized via env vars to prevent injection
• CodeQL passing with 0 alerts

[!WARNING]

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com//advisories
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Replace Travis CI with GH actions</issue_title> <issue_description>We can use https://github.com/ddev/github-action-setup-ddev </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Gizra/drupal-starter#951

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.