iac.yml

name: iac

# Terraform hygiene for the committed infra modules: the IaC half of
# QUALITY-AND-METRICS QM-08 and the remainder of remediation item P1-5 (the
# container half already runs in container-scan.yml). `terraform fmt -check`
# keeps formatting canonical; `terraform validate` proves each module still
# parses and type-checks against the providers pinned by its committed
# .terraform.lock.hcl. Validation is offline (`init -backend=false`): no cloud
# credentials, no state, no plan, no apply. Applies remain operator work per
# docs/deploy.md.

on:
  push:
    branches: [main]
  pull_request:

# RELIABILITY/CICD (issue #289): this used to filter on `paths:` at the
# trigger level. Required-status-check enforcement (ADR 0033) blocks a merge
# on a named context; a trigger-level path filter means the job — and its
# check — never runs at all for a PR that doesn't touch infra/**, which is
# indistinguishable from a hung check and blocks that PR forever with no
# recovery short of an admin bypass. Verified against two real in-flight PRs
# that didn't touch infra/** before this fix landed. `terraform fmt +
# validate` is cheap (a handful of small modules, offline), so it now
# triggers unconditionally rather than adding path-check skip logic.

# Least privilege: the checks only read the repo.
permissions:
  contents: read

# Cancel superseded runs on the same ref (new push to a PR) to save minutes.
concurrency:
  group: iac-${{ github.ref }}
  cancel-in-progress: true

jobs:
  terraform:
    name: terraform fmt + validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        with:
          # Nothing in this job pushes; do not leave credentials on disk.
          persist-credentials: false
      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
        with:
          # Matches the modules' required_version = ">= 1.5" floor; bump
          # deliberately, with a fresh local fmt/validate pass, not implicitly.
          terraform_version: "1.5.7"
          terraform_wrapper: false
      - name: terraform fmt (canonical formatting, all modules)
        run: terraform fmt -check -recursive -diff infra/
      - name: terraform validate (offline, per module)
        run: |
          set -euo pipefail
          for dir in infra/*/; do
            [ -f "${dir}main.tf" ] || continue
            echo "== ${dir}"
            terraform -chdir="${dir}" init -backend=false -input=false -no-color >/dev/null
            terraform -chdir="${dir}" validate -no-color
          done