AWSRESET1-514: CI/CD Vol API on Static & Non-PROD

.github/pull_request_template.md

@@ -0,0 +1,14 @@
+## Before submitting (or marking as "ready for review")
+- [ ] Does the pull request title follow the [conventional commit](https://www.conventionalcommits.org/en/v1.0.0/) specification?
+- [ ] Have you done a self-code review on the changes?
+- [ ] Did you make sure to update any documentation (`/website`) relating to this change?
+
+## Description
+<!--
+Include a summary of the change here, also include any Jira reference:
+
+Related issue: [JIRA_TICKET_NUMBER](LINK_TO_JIRA_TICKET)
+-->
+
+## How has this been tested?
+<!-- Describe how you have tested this change works -->

.github/workflows/docker-hadolint.yaml

@@ -0,0 +1,20 @@
+name: Lint check Dockerfile
+
+on:
+  workflow_call:
+
+jobs:
+  hadolint:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Checkout the repository to the runner
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      - name: Lint check on dockerfile
+        uses: hadolint/[email protected]
+        with:
+          dockerfile: dockerfile
+          ignore: DL3018,DL3048

.github/workflows/image-sign-validation.yaml

@@ -0,0 +1,46 @@
+name: Validate AWS ECR Image Signature
+
+on:
+  workflow_call:
+    secrets:
+      aws_role_arn:
+        required: true
+      ecr_tagged_image:
+        required: true
+
+jobs:
+
+  validate-image-signature:
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+
+      - name: Checkout the repository to the runner
+        uses: actions/checkout@v3
+
+      - name: Configure aws credential
+        uses: aws-actions/[email protected]
+        with:
+          role-to-assume: ${{ secrets.aws_role_arn }}
+          role-session-name: GithubActionsSession
+          aws-region: ${{ vars.DVSA_AWS_REGION }}
+
+      - name: Login to ECR
+        id: login-to-ecr
+        uses: aws-actions/[email protected]
+
+      - name: Setup Notation CLI
+        uses: notaryproject/notation-action/setup@v1
+        with:
+          version: 1.0.0
+
+      - name: Set up Notation AWS Signer plugin
+        run: |
+          wget https://d2hvyiie56hcat.cloudfront.net/linux/amd64/installer/deb/latest/aws-signer-notation-cli_amd64.deb
+          sudo dpkg -i aws-signer-notation-cli_amd64.deb
+
+      - name: Validate signature of VOL API image
+        run: |
+          notation inspect ${{ secrets.ecr_tagged_image }}