ci: add GitHub Actions workflows for PR testing and tag-based deployment

[Amnoor]

Summary

This PR introduces the full CI/CD pipeline for the Runtime Node project via two GitHub Actions workflows. The first workflow automates Dockerfile linting and multi-platform image build and integrity testing on every pull request targeting main or develop. The second workflow automates the build and publishing of the final multi-architecture Docker image to both Docker Hub and the GitHub Container Registry on every v* tag push.

Together, these two workflows establish the complete automated quality gate and release pipeline for the project, ensuring that every proposed change is validated across linux/amd64 and linux/arm64 before being merged, and that every tagged release is published consistently and reproducibly to both registries.

Files Changed

Added:

• .github/
  • workflows/
    • deployment.yml
    • pr-tests.yml

Modified:

• None

Deleted:

• None

Key Changes

• Added deployment.yml — a workflow triggered on v* tag pushes that builds and pushes the multi-platform image (linux/amd64, linux/arm64) to both Docker Hub (runtimenode/runtime-node) and GHCR (ghcr.io/Runtimes-Node/runtime-node) with provenance and SBOM attestations enabled.
• Added pr-tests.yml — a workflow triggered on pull requests targeting main or develop that runs in two sequential jobs: lint (Hadolint Dockerfile linting with a warning failure threshold) and build-and-test (multi-platform matrix build and smoke/integrity testing).
• Implemented four integrity tests in the PR testing workflow: a Node.js version smoke test (node --version), a no-shell distroless guarantee test, a no-package-manager distroless guarantee test, and a NODE_ENV=production environment validation test.
• Configured concurrency groups on both workflows to prevent duplicate runs — release-${{ github.ref_name }} for deployment and pr-tests-${{ github.event.pull_request.number }} for PR tests, both with cancel-in-progress: true.
• Used type=gha caching in both workflows with platform-scoped cache keys in the PR testing workflow to speed up multi-platform builds.
• Deployment workflow uses docker/metadata-action to auto-generate image tags, including the v* tag and a latest alias.
• Docker Hub and GHCR credentials are sourced from repository secrets (DOCKERHUB_USERNAME, DOCKERHUB_TOKEN, GITHUB_TOKEN).
• Both workflows pin all Actions to specific major versions (actions/checkout@v4, docker/setup-qemu-action@v3, etc.) for reproducibility.