Migrate from Travis to GitHub Actions

[tcouch]

Summary

From @martintoreilly:

Hi all. Just to let those of you using the Heroku and Travis CI integrations on GitHub that we have temporarily suspended access to the Turing GitHub organisation for these integrations in response to an announcement by GitHub of a security incident involving unauthorised access to repositories using GitHub OAuth access tokens issued to Heroku and Travis CI (see https://github.blog/2022-04-15-security-alert-stolen-oauth-user-tokens/). Suspending access will prevent any access to repositories in the Turing GitHub organisation by these integrations from this point onwards. If you have private repositories hosted under other GitHub organisations or your personal account, you may wish to consider temporarily suspending access for these integrations there too. The GitHub announcement says that they are investigating which customers have been affected by this incident and will be contacting all affected customers by Monday, so we should know then if any of our repositories have been affected. Heroku have announced that they have taken proactive steps to prevent any further use of OAuth tokens issued to them by revoking all existing GitHub OAuth tokens and preventing any more being issued for the time being (see https://status.heroku.com/incidents/2413). This has the same effect as our suspension of the Heroku integration's access to our GitHub organisation. There has been no comment on this incident by Travis CI yet, but our suspension of their integration's access will prevent any further access from this point onwards in the same way as for Heroku. Revocation of access for these integrations prevents any further impact on the Turing from this incident. We will re-assess the situation after the bank holiday, when we should have heard from GitHub if we have been affected by this incident and know more about when access for these integrations can be safely restored ,and will post an update here to keep you informed. In the meantime we will monitor the GitHub incident in case any other integrations are reported as being affected and will suspend access for any that are.

What needs to be done?

.travis.yml has three sections we need to replicate in GH Actions if possible:

• [ ] run unit tests
• [ ] check for missing migrations
• [ ] verify built js files are up to date

[martintoreilly]

@tcouch Access to Travis CI should be restored later today.

[ChristinaLast]

moving this to project backlog because travis has been fixed and restored, and we have other tasks to get through!