feat(EN-2932): Migrate github secrets to vault

Author: Antoine Verin

.github/ci-secrets.yml

@@ -0,0 +1,6 @@
+secrets:
+  common:
+    - path: terraform/github/actions/terraform-provider-postgresql/common
+      version: 0
+    - path: common/github/actions/terraform-provider-postgresql/to_be_classified
+      version: 1

.github/workflows/release.yml

@@ -14,13 +14,22 @@ on:
   push:
     tags:
       - 'v*'
+
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       -
         name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: Load Secrets
+        uses: doctolib/actions/load-secrets@main
+        with:
+          prefix_secrets: true
       -
         name: Unshallow
         run: git fetch --prune --unshallow
@@ -35,8 +44,8 @@ jobs:
         uses: crazy-max/ghaction-import-gpg@d6f3f49f3345e29369fe57596a3ca8f94c4d2ca7 # v5
         with:
           # These secrets will need to be configured for the repository:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.PASSPHRASE }}
+          gpg_private_key: ${{ env.VAULT_SECRET_GPG_PRIVATE_KEY }}
+          passphrase: ${{ env.VAULT_SECRET_PASSPHRASE }}
       -
         name: Run GoReleaser
         uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6
@@ -46,4 +55,4 @@ jobs:
         env:
           GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
           # GitHub sets this automatically
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}