feature: governed pipelines

[jaredfholgate]

Overview/Summary

The PR implements governed templates for plan and apply stages to lock down what can be done with the identities.

Azure DevOps and GitHub have different implementations:

• GitHub: WIF subject is used to specify the template.
• Azure DevOps: Service Connection is used to specify the template.

This PR fixes/adds/changes/removes

1. Feature Request: Support governed pipelines #26

Breaking Changes

1. This will introduce new parameters and deployment artefacts, but will not fundamentally break anything

Testing Evidence

Please provide any testing evidence to show that your Pull Request works/fixes as described and planned (include screenshots, if appropriate).

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant issues, for tracking and closure.
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated relevant and associated documentation.

[luke-taylor]

Looks good, only thing (slightly pedantic so no worries if too difficult). I wouldn't "." some folders here. I think templates/.ci_cd can be just ci_cd because that folder will never be in the target repo(s), whereas templates/.ci_cd/.github/workflows and templates/.ci_cd/.azuredevops will be so it makes sense there. Secondly, maybe the templates/.templates folder could be named something like pipeline_templates or similar.

[jaredfholgate]

Looks good, only thing (slightly pedantic so no worries if too difficult). I wouldn't "." some folders here. I think templates/.ci_cd can be just ci_cd because that folder will never be in the target repo(s), whereas templates/.ci_cd/.github/workflows and templates/.ci_cd/.azuredevops will be so it makes sense there. Secondly, maybe the templates/.templates folder could be named something like pipeline_templates or similar.

I think I did this more for ordering than anything else and is now redundant since we can explicitly set the target folder / file names. I think I will move the azure devops templates to root and remove the dots as suggested. Incoming...