terraform-apply.yml

# The honest scope (audit P2-4): this provisions the streaming-infrastructure
# REFERENCE (Kafka/Flink/object storage/monitoring), not a full runtime
# platform — API/ClickHouse/PostgreSQL/Redis/ingress are operator-owned, and
# the apply job stays `if: false` until an external approval reintroduces AWS.
name: Terraform (streaming-infrastructure-reference)

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Deployment environment
        required: true
        type: choice
        options:
          - staging
          - production
      confirm:
        description: Type PREFLIGHT for local readiness checks; APPLY remains disabled until external approval
        required: true
        type: string

permissions:
  contents: read
  id-token: write

jobs:
  preflight:
    if: ${{ inputs.confirm == 'PREFLIGHT' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.15.4"

      - name: Resolve Terraform tfvars file
        id: tfvars
        run: |
          case "${{ inputs.environment }}" in
            staging) echo "file=environments/staging.tfvars" >> "$GITHUB_OUTPUT" ;;
            production) echo "file=environments/prod.tfvars" >> "$GITHUB_OUTPUT" ;;
            *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
          esac

      - name: Validate OIDC and plan readiness without apply
        working-directory: infrastructure/terraform
        env:
          AWS_TERRAFORM_ROLE_ARN: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
          AWS_REGION: ${{ vars.AWS_REGION }}
        run: |
          missing=0
          if [ -z "$AWS_TERRAFORM_ROLE_ARN" ]; then
            echo "Missing AWS_TERRAFORM_ROLE_ARN repository variable"
            missing=1
          fi
          if [ -z "$AWS_REGION" ]; then
            echo "Missing AWS_REGION repository variable"
            missing=1
          fi
          if [ ! -f "${{ steps.tfvars.outputs.file }}" ]; then
            echo "Missing ${{ steps.tfvars.outputs.file }}"
            echo "Provide real tfvars through the approved secure operator path; do not commit them."
            missing=1
          fi
          echo "H4 remains evidence-pending until CloudTrail proves AssumeRoleWithWebIdentity and an owner-approved apply run exists."
          if [ "$missing" -ne 0 ]; then
            exit 1
          fi
          terraform init -backend=false
          terraform validate

  plan:
    # disabled 2026-04-23: AWS Terraform apply is out of scope for the current plan
    # re-enable checklist:
    # 1. Add repo-level vars AWS_TERRAFORM_ROLE_ARN and AWS_REGION for the plan job.
    # 2. Provide infrastructure/terraform/environments/staging.tfvars and either prod.tfvars or remove the production option.
    # 3. Create GitHub Actions environments staging and production.
    # 4. Capture a green staging run that proves OIDC assume-role, terraform init, and terraform plan.
    # 5. Restore if: inputs.confirm == 'APPLY' for both jobs.
    if: false
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.15.4"

      - name: Resolve Terraform tfvars file
        id: tfvars
        run: |
          case "${{ inputs.environment }}" in
            staging) echo "file=environments/staging.tfvars" >> "$GITHUB_OUTPUT" ;;
            production) echo "file=environments/prod.tfvars" >> "$GITHUB_OUTPUT" ;;
            *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
          esac

      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
        with:
          role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
          role-session-name: gha-terraform-${{ github.run_id }}

      - name: Validate tfvars presence
        working-directory: infrastructure/terraform
        run: |
          if [ ! -f "${{ steps.tfvars.outputs.file }}" ]; then
            echo "Missing ${{ steps.tfvars.outputs.file }}"
            echo "Copy the matching .tfvars.example file and provide real network values."
            exit 1
          fi

      - name: Terraform plan
        working-directory: infrastructure/terraform
        run: |
          # Per-environment state key (audit P2-4): the backend block carries
          # no key, so a bare init fails instead of sharing state across envs.
          terraform init -backend-config="key=env/${{ inputs.environment }}/terraform.tfstate"
          # Runtime-artifact ownership: the binary plan is a replaceable per-run
          # working file under ignored .artifacts/terraform/, never written next
          # to the configuration (plan files embed resolved variable values).
          mkdir -p "$GITHUB_WORKSPACE/.artifacts/terraform"
          terraform plan -var-file="${{ steps.tfvars.outputs.file }}" -out="$GITHUB_WORKSPACE/.artifacts/terraform/tfplan"

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: terraform-plan-${{ inputs.environment }}
          path: .artifacts/terraform/tfplan

  apply:
    # disabled 2026-04-23: AWS Terraform apply is out of scope for the current plan
    if: false
    needs: plan
    runs-on: ubuntu-latest
    timeout-minutes: 20
    environment:
      name: ${{ inputs.environment }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          terraform_version: "1.15.4"

      - name: Resolve Terraform tfvars file
        id: tfvars
        run: |
          case "${{ inputs.environment }}" in
            staging) echo "file=environments/staging.tfvars" >> "$GITHUB_OUTPUT" ;;
            production) echo "file=environments/prod.tfvars" >> "$GITHUB_OUTPUT" ;;
            *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
          esac

      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
        with:
          role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
          role-session-name: gha-terraform-${{ github.run_id }}

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: terraform-plan-${{ inputs.environment }}
          path: .artifacts/terraform

      - name: Terraform apply
        working-directory: infrastructure/terraform
        run: |
          terraform init -backend-config="key=env/${{ inputs.environment }}/terraform.tfstate"
          terraform apply -auto-approve "$GITHUB_WORKSPACE/.artifacts/terraform/tfplan"