Add GitHub Actions workflows, documentation, and Terraform review guidelines

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# CODEOWNERS
+#
+# Each line is a file pattern followed by one or more owners.
+# Owners are notified when a pull request modifies files matching the pattern.
+#
+# Update this file to reflect the current maintaining team or individuals.
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+* @datasciencecampus/cloud-enablement-admins

.github/copilot-instructions.md

@@ -0,0 +1,96 @@
+# Copilot Instructions — Cloud Engineering Standards
+
+## About this repository
+
+This is a public guidance and standards repository for cloud engineering at the
+Strategic Innovation and Analysis team at ONS. It is published as a Quarto
+book to GitHub Pages and is intended for data scientists and engineers who are
+beginning their journey into cloud infrastructure.
+
+Content is written in UK English and should be accurate, clear, and accessible
+to someone who is not yet a cloud specialist.
+
+## Audience
+
+The primary audience is **data scientists and engineers new to cloud
+infrastructure**. Do not assume familiarity with Terraform, cloud networking, or
+infrastructure as code concepts. Explain terms when first used, or direct the
+reader to the glossary.
+
+## Tone and style
+
+- Follow [GDS content design principles](https://www.gov.uk/guidance/content-design/writing-for-gov-uk):
+  plain English, active voice, short sentences, no jargon without explanation.
+- Use UK English spelling (e.g. "authorise" not "authorize", "organisation" not
+  "organization").
+- Write in the second person (for example, "you should review the plan" or
+  "check that logging is enabled") rather than the
+  passive ("it should be checked").
+- Avoid marketing language and unnecessary superlatives.
+- Use numbered lists for sequential steps; bullet lists for unordered items.
+
+## Content format
+
+- All content pages are Quarto `.qmd` files.
+- Use Quarto callout blocks for notes, warnings, tips, and important caveats:
+  - `:::{.callout-note}` — general supplementary information
+  - `:::{.callout-tip}` — helpful hints or shortcuts
+  - `:::{.callout-warning}` — actions that could cause problems if missed
+  - `:::{.callout-important}` — critical requirements or constraints
+- GCP-specific examples should appear in a callout block labelled clearly as
+  GCP-specific, so the surrounding content remains cloud-agnostic.
+- Cross-reference other sections using Quarto cross-reference syntax
+  (`@sec-label`) rather than bare URLs where possible.
+- YAML frontmatter must include at minimum: `title` and `order`.
+
+## Repository and infrastructure context
+
+- Terraform examples should align with the structure used in
+  [datasciencecampus/terraform-template](https://github.com/datasciencecampus/terraform-template):
+  environments split into `01_sandbox`, `02_dev_nonprod`, `03_stg_prod`,
+  `04_prd_prod`; reusable code in `modules/`.
+- The four environments are: **sandbox**, **non-production**, **pre-production**,
+  **production**. Use these terms consistently.
+- HMG security classifications in scope are `OFFICIAL` and `OFFICIAL-SENSITIVE`.
+  Do not provide guidance on `SECRET` or above — note that a separate
+  architecture and assurance conversation is needed.
+
+## Commit messages
+
+Use [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/):
+
+- `docs:` — content additions or corrections
+- `feat:` — new chapter, section, or significant new guidance
+- `fix:` — factual corrections or broken references
+- `chore:` — maintenance (config, CI, dependency updates)
+- `refactor:` — restructuring without changing meaning
+
+The Release Please GitHub Actions workflow uses commit messages to generate the
+CHANGELOG and version bumps.
+`feat:` produces a minor bump; `fix:` produces a patch; `feat!:` produces a major.
+
+## Security and sensitivity checks
+
+**Flag immediately and do not proceed if you detect any of the following:**
+
+- Credentials, API keys, tokens, passwords, or secrets of any kind.
+- Personal data (names, emails, NI numbers, addresses, or any data that could
+  identify an individual).
+- Internal system names, hostnames, IP addresses, or project IDs that are not
+  already publicly documented.
+- Content marked or described as `OFFICIAL-SENSITIVE`, `SECRET`, or above.
+- Commercial or contractual information that is not intended for public release.
+- Any content that appears to have been copied from a non-public internal source.
+
+This repository is **public**. Anything committed here is immediately visible to
+the world. When in doubt, leave it out and ask.
+
+## What Copilot should not do
+
+- Do not add undocumented features, refactor existing content, or expand scope
+  beyond what is asked.
+- Do not add fictional tool outputs, version numbers, or command responses.
+  All examples must reflect real, documented behaviour.
+- Do not reference internal ONS systems, team names, or processes that are not
+  already public.
+- Do not provide guidance on SECRET or above security classifications.

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+      time: "07:00"
+      timezone: "Europe/London"
+    open-pull-requests-limit: 10
+    rebase-strategy: "auto"
+    commit-message:
+      prefix: "deps"
+      include: "scope"
+    labels:
+      - "github-actions"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -0,0 +1,34 @@
+<!-- PR author: please fill out each section below. -->
+
+## Summary
+
+<!-- What changed and why — 1 to 3 sentences. -->
+
+## Context
+
+<!-- Link to the related issue or background discussion, e.g. Closes #123 -->
+
+## Changes
+
+<!-- Bullet list of meaningful changes made in this PR. -->
+
+-
+
+## Verification
+
+<!-- How you checked this works, e.g. "Rendered locally with `quarto render`, no errors." -->
+
+## Risks and notes
+
+<!-- Optional: edge cases, follow-ups, or anything reviewers should pay particular attention to. -->
+
+---
+
+## Sensitivity declaration
+
+> This repository is public. Tick all boxes before requesting review.
+
+- [ ] No credentials, API keys, tokens, or passwords
+- [ ] No personal data (names, emails, NI numbers, or other identifying information)
+- [ ] No internal hostnames, IP addresses, or project IDs not already publicly documented
+- [ ] No content marked `OFFICIAL-SENSITIVE` or above

.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+name: Quarto Publish
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Quarto
+        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Render site
+        run: quarto render
+
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: _site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/release-please.yml

@@ -0,0 +1,17 @@
+on:
+  push:
+    branches: [main]
+
+name: Release Please
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -10,3 +10,5 @@ Thumbs.db
 # Editor
 .vscode/
 *.swp
+
+**/*.quarto_ipynb

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.3.0"
+}

CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.3.0](https://github.com/datasciencecampus/cloud-engineering-standards/compare/v0.2.1...v0.3.0) (2026-06-10)
+
+
+### Features
+
+* add custom CSS for dark mode code readability ([040e368](https://github.com/datasciencecampus/cloud-engineering-standards/commit/040e368e1f4a0f519d5200707159c30a421d7bf1))
+
+
+### Bug Fixes
+
+* clarify wording in tone and style section for improved clarity ([df7c7c7](https://github.com/datasciencecampus/cloud-engineering-standards/commit/df7c7c75755bf1658a030e14cf9b8ae8206a1ffd))
+* clarify wording on Release Please workflow for better understanding ([cbc126d](https://github.com/datasciencecampus/cloud-engineering-standards/commit/cbc126da7e4e2a077d77f94ffb669ae5571c4bdd))
+* clarify wording on secrets management in Terraform review documentation to be cloud agnostic ([49ffebe](https://github.com/datasciencecampus/cloud-engineering-standards/commit/49ffebe73eb8baf0bd24ce9a96dbf6407a105063))
+* correct wording in side effects comparison for clarity ([597dfe1](https://github.com/datasciencecampus/cloud-engineering-standards/commit/597dfe15e9f5da3981d15e0f22b27e31dec2338a))
+
+## [0.2.1](https://github.com/datasciencecampus/cloud-engineering-standards/compare/v0.2.0...v0.2.1) (2026-06-08)
+
+
+### Bug Fixes
+
+* Improve clarity and formatting in Terraform review guide sections ([663e79f](https://github.com/datasciencecampus/cloud-engineering-standards/commit/663e79fe1e59a5a4746694f5d831ca40c6a62c35))
+* remove number-sections configuration to guide metadata ([a54777e](https://github.com/datasciencecampus/cloud-engineering-standards/commit/a54777eae1fb8888c4b54c05a1bbd4da9d3c45f2))
+* Update deploy-pages action to version 5.0.0 in GitHub Actions workflow ([e076100](https://github.com/datasciencecampus/cloud-engineering-standards/commit/e076100551023d29cdfeea2c94a038865fc30b14))
+
+## [0.2.0](https://github.com/datasciencecampus/cloud-engineering-standards/compare/v0.1.0...v0.2.0) (2026-06-08)
+
+
+### Features
+
+* Add initial documentation for environments, glossary, and patterns sections ([e35b1fb](https://github.com/datasciencecampus/cloud-engineering-standards/commit/e35b1fb09f2932fef190da8dd8a894739771ffba))
+
+
+### Bug Fixes
+
+* Update documentation links and improve clarity in Terraform review guide ([9b43a87](https://github.com/datasciencecampus/cloud-engineering-standards/commit/9b43a874bff0a8a674eba8f9d998ef15186d2407))
+
+## Changelog
+
 All notable changes to this project will be documented in this file.
 
 This changelog is managed by [Release Please](https://github.com/googleapis/release-please) and follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/).