ci: remove duplicate SaaS jobs from ci.yml (covered by release.yml)

release.yml already runs saas_integration (8.7) and saas_integration_8_8

on push to main and stable/**, with full secret access via the

integration / integration-8.8 environments. The copies in ci.yml were

gated to push-to-main only and ran the same commands against the same

secrets — pure duplication.

With CI's push trigger now scoped to stable/** (#740), the ci.yml

copies would never have fired anyway. Drop them outright.

Net effect: SaaS coverage is unchanged on main, and gains stable/**

coverage (which release.yml already provided but the ci.yml copies

did not).

Author: jwulf

.github/workflows/ci.yml

@@ -134,78 +134,3 @@ jobs:
         if: always()
         run: docker compose -f docker/8.9/docker-compose.yaml down
 
-  # SaaS integration tests hit real SaaS endpoints and require environment
-  # secrets. To protect secret material and avoid running untrusted code
-  # against production-like infrastructure, these only run on pushes to
-  # `main` — i.e. after a PR has been reviewed and merged.
-  saas_integration:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    environment: integration
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v6
-
-      - name: Use Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Integration Tests
-        run: |
-          npm run test:8.7:saas
-        env:
-          ZEEBE_REST_ADDRESS: ${{ vars.ZEEBE_REST_ADDRESS }}
-          ZEEBE_GRPC_ADDRESS: ${{ vars.ZEEBE_GRPC_ADDRESS }}
-          ZEEBE_CLIENT_ID: ${{ secrets.ZEEBE_CLIENT_ID }}
-          ZEEBE_AUTHORIZATION_SERVER_URL: ${{ vars.ZEEBE_AUTHORIZATION_SERVER_URL }}
-          ZEEBE_CLIENT_SECRET: ${{ secrets.ZEEBE_CLIENT_SECRET }}
-          ZEEBE_TOKEN_AUDIENCE: ${{ vars.ZEEBE_TOKEN_AUDIENCE }}
-          CAMUNDA_OAUTH_URL: ${{ vars.CAMUNDA_OAUTH_URL }}
-          CAMUNDA_TASKLIST_BASE_URL: ${{ vars.CAMUNDA_TASKLIST_BASE_URL }}
-          CAMUNDA_OPERATE_BASE_URL: ${{ vars.CAMUNDA_OPERATE_BASE_URL }}
-          CAMUNDA_OPTIMIZE_BASE_URL: ${{ vars.CAMUNDA_OPTIMIZE_BASE_URL }}
-          CAMUNDA_MODELER_BASE_URL: https://modeler.cloud.camunda.io/api
-          CAMUNDA_CONSOLE_CLIENT_ID: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_ID }}
-          CAMUNDA_CONSOLE_CLIENT_SECRET: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_SECRET }}
-          CAMUNDA_CONSOLE_BASE_URL: ${{ vars.CAMUNDA_CONSOLE_BASE_URL }}
-          CAMUNDA_CONSOLE_OAUTH_AUDIENCE: ${{ vars.CAMUNDA_CONSOLE_OAUTH_AUDIENCE}}
-
-  # SaaS 8.8 integration. Same policy as saas_integration — main pushes only.
-  saas_integration_8_8:
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    environment: integration-8.8
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v6
-
-      - name: Use Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run Integration Tests
-        run: |
-          npm run test:8.8:saas
-        env:
-          ZEEBE_REST_ADDRESS: ${{ vars.ZEEBE_REST_ADDRESS }}
-          ZEEBE_GRPC_ADDRESS: ${{ vars.ZEEBE_GRPC_ADDRESS }}
-          ZEEBE_CLIENT_ID: ${{ secrets.ZEEBE_CLIENT_ID }}
-          ZEEBE_AUTHORIZATION_SERVER_URL: ${{ vars.ZEEBE_AUTHORIZATION_SERVER_URL }}
-          ZEEBE_CLIENT_SECRET: ${{ secrets.ZEEBE_CLIENT_SECRET }}
-          ZEEBE_TOKEN_AUDIENCE: ${{ vars.ZEEBE_TOKEN_AUDIENCE }}
-          CAMUNDA_OAUTH_URL: ${{ vars.CAMUNDA_OAUTH_URL }}
-          CAMUNDA_TASKLIST_BASE_URL: ${{ vars.CAMUNDA_TASKLIST_BASE_URL }}
-          CAMUNDA_OPERATE_BASE_URL: ${{ vars.CAMUNDA_OPERATE_BASE_URL }}
-          CAMUNDA_OPTIMIZE_BASE_URL: ${{ vars.CAMUNDA_OPTIMIZE_BASE_URL }}
-          CAMUNDA_MODELER_BASE_URL: https://modeler.cloud.camunda.io/api
-          CAMUNDA_CONSOLE_CLIENT_ID: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_ID }}
-          CAMUNDA_CONSOLE_CLIENT_SECRET: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_SECRET }}
-          CAMUNDA_CONSOLE_BASE_URL: ${{ vars.CAMUNDA_CONSOLE_BASE_URL }}