chore: add GitHub Action to sync Collins API spec to APIM

[devin-ai-integration]

Summary

Adds a new GitHub Actions workflow (.github/workflows/sync-to-apim.yml) that automatically bundles the Collins OpenAPI spec and pushes it to the APIOps Azure DevOps repo whenever spec files are updated on master.

How it works:

1. Triggers on pushes to master that modify main.yaml or files under bookings/, customers/, venues/, venue-groups/, shared/
2. Lints the spec with @redocly/cli to catch errors before anything is pushed downstream
3. Bundles the multi-file spec into a single specification.yaml
4. Clones the APIOps repo (Hospitality-Integration-Experience-ApiOps) using a PAT, copies the bundled spec to artifacts/apis/collins-api/specification.yaml, and pushes to main if there are changes
5. The push to artifacts/** on main in APIOps triggers the existing run-publisher.yaml pipeline (deploys to Dev APIM, then manual approval for Prod)

The existing publish.yaml workflow is not modified.

Review & Testing Checklist for Human

• AZURE_DEVOPS_PAT secret must be configured in the repo's GitHub Settings → Secrets → Actions before this workflow will function. Verify the PAT has write access to the Hospitality-Integration-Experience-ApiOps repo and is not expired.
• Verify the target directory exists in the APIOps repo: artifacts/apis/collins-api/. If it doesn't, the cp command will fail. You may need to create it with an initial commit.
• Path filters completeness: Confirm that main.yaml, bookings/**, customers/**, venues/**, venue-groups/**, shared/** covers all directories that contribute to the spec. If new top-level spec directories are added in the future, they'll need to be added here too (e.g. marketing-preferences/ is not currently included — verify whether it should be).
• Unpinned @redocly/cli version: The workflow uses npx @redocly/cli without a version pin. A breaking Redocly update could fail the workflow unexpectedly. Consider whether pinning (e.g. npx @redocly/cli@1.x) is preferred.

Suggested test plan: After merging and configuring the PAT secret, make a trivial change to main.yaml (e.g. update description text), push to master, and verify the Actions run succeeds and the bundled spec appears as a new commit in the APIOps repo.

Notes

• The PAT is injected via ${{ secrets.AZURE_DEVOPS_PAT }} and masked by GitHub Actions, so it won't appear in logs.
• The workflow is idempotent — if the bundled spec hasn't changed, no commit is made.

Link to Devin session: https://app.devin.ai/sessions/16003d76aa5a40a495560c6b1baef86e

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring