Migrate CI/CD from CircleCI to GitHub Actions (dual-run)

[dkn96]

CircleCI → GitHub Actions migration (dual-run)

Adds GitHub Actions equivalents of the CircleCI pipelines. .circleci/ is intentionally left in place — both systems run side by side until GHA is validated with the secrets below, then a follow-up PR removes CircleCI.

What's migrated

CircleCI	GitHub Actions
sfcc-flow / lint-and-unit-test (all branches)	ci.yml / lint-and-unit-test (on: push)
(no queue orb here)	concurrency: qa-sandbox-deploy group added on the deploy job so sandbox deploys serialize
sfcc-flow / update-qa-sandbox (master)	ci.yml / update-qa-sandbox (master only)
sfcc-flow / integration-tests (master)	Deliberately dropped — not migrated (see below)
sfcc-release-flow (API-triggered pipeline parameter)	release.yml via native workflow_dispatch with a tag input
publish-github-release (ghr + GITHUBTOKEN PAT)	gh release create/upload with the built-in GITHUB_TOKEN (permissions: contents: write) — PAT no longer needed
Slack orb notify-buildcop	curl to the webhook on master failures
restore_cache/save_cache (npm)	actions/cache keyed on package-lock.json

Jobs run in the same boltdev/sfcc-ci Docker image as CircleCI (pulled with Docker Hub credentials) for toolchain parity. Helper scripts are copied to .github/scripts/ (originals untouched); create-zip-artifacts.sh no longer stages release-artifacts.sh (replaced by gh release).

Repo secrets required before this can go green

DOCKER_USER, DOCKER_PASSWORD, SFCCCLIENTID, SFCCCLIENTSECRET, SFCC_QA_ACCOUNT, SFCC_QA_ACCOUNT_PW, QA_V2_SANDBOX_HOSTNAME, GREENKEEPER_WEBHOOK. These mirror the CircleCI sfcc-creds context.

Not migrated (parity decisions)

• The integration-tests cross-trigger — deliberately dropped. The CircleCI job called the CircleCI API (with CIRCLE_TOKEN) to run the SFRA wdio suite in BoltApp/integration-tests. That repo is archived (read-only since Oct 2025) and its SFRA suite has been unmaintained since mid-2023, so the trigger fires into a decommissioned project. Dropping it removes the last CircleCI dependency (and the CIRCLE_TOKEN secret) from this pipeline. If post-deploy integration coverage is wanted again, it needs a new owner and a new home first.

• The commented-out auto-release cron workflow — dead code in CircleCI, not carried over.

• The adhoc-deploy/* branch queue filter — it gated nothing downstream (deploy remains master-only).

Validation before cutover

• Secrets configured, one green ci.yml run on a branch push
• Confirm actions/checkout works inside boltdev/sfcc-ci (GHA mounts node20 into the container; a very old glibc base would fail — fallback is setup-node + npm i -g sfcc-ci on the runner)
• One master run deploying to zzgv-003
• Dry-run release.yml with a test tag; verify the zip on the GitHub release
• Follow-up PR: delete .circleci/