Feat/production refactor

.github/workflows/terraform-apply.yml

@@ -0,0 +1,56 @@
+name: Terraform Apply
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-apply
+  cancel-in-progress: false
+
+jobs:
+  apply:
+    name: Terraform Apply
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.7"
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-west-2
+
+      - name: Terraform Init
+        run: |
+          terraform init -input=false \
+            -backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" \
+            -backend-config="key=eks-gitops-platform/terraform.tfstate" \
+            -backend-config="region=us-west-2" \
+            -backend-config="dynamodb_table=${{ secrets.TF_STATE_TABLE }}" \
+            -backend-config="encrypt=true"
+        working-directory: eks-gitops-platform
+
+      - name: Terraform Plan
+        run: |
+          terraform plan -no-color -input=false -out=/tmp/tfplan \
+            -var="datadog_api_key=${{ secrets.DATADOG_API_KEY }}" \
+            -var="datadog_app_key=${{ secrets.DATADOG_APP_KEY }}" \
+            -var="github_repo_url=${{ secrets.TF_VAR_GITHUB_REPO_URL }}"
+        working-directory: eks-gitops-platform
+
+      - name: Terraform Apply
+        run: terraform apply -auto-approve /tmp/tfplan
+        working-directory: eks-gitops-platform

.github/workflows/terraform-plan.yml

@@ -0,0 +1,100 @@
+name: Terraform Plan
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: terraform-plan-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  plan:
+    name: Terraform Plan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.7"
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-west-2
+
+      - name: Terraform Format Check
+        id: fmt
+        run: terraform fmt -check -recursive
+        working-directory: eks-gitops-platform
+
+      - name: Terraform Init
+        id: init
+        run: |
+          terraform init -input=false \
+            -backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" \
+            -backend-config="key=eks-gitops-platform/terraform.tfstate" \
+            -backend-config="region=us-west-2" \
+            -backend-config="dynamodb_table=${{ secrets.TF_STATE_TABLE }}" \
+            -backend-config="encrypt=true"
+        working-directory: eks-gitops-platform
+
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate
+        working-directory: eks-gitops-platform
+
+      - name: Run tfsec
+        uses: aquasecurity/tfsec-action@v1.0.3
+        with:
+          working_directory: eks-gitops-platform
+          minimum_severity: HIGH
+          soft_fail: false
+
+      - name: Terraform Plan
+        id: plan
+        run: |
+          terraform plan -no-color -input=false \
+            -var="datadog_api_key=${{ secrets.DATADOG_API_KEY }}" \
+            -var="datadog_app_key=${{ secrets.DATADOG_APP_KEY }}" \
+            -var="github_repo_url=${{ secrets.TF_VAR_GITHUB_REPO_URL }}" \
+            2>&1 | tee /tmp/plan.txt
+          echo "exit_code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+        working-directory: eks-gitops-platform
+
+      - name: Post Plan as PR Comment
+        uses: actions/github-script@v7
+        if: always()
+        env:
+          PLAN_PATH: /tmp/plan.txt
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            if (!fs.existsSync(process.env.PLAN_PATH)) {
+              console.log('No plan output — skipping comment (plan did not run)');
+              return;
+            }
+            const plan = fs.readFileSync(process.env.PLAN_PATH, 'utf8');
+            const truncated = plan.length > 60000
+              ? plan.substring(0, 60000) + '\n\n...[truncated — see Actions logs for full output]'
+              : plan;
+            const header = `## Terraform Plan — ${{ github.event.pull_request.head.sha }}`;
+            const body = `${header}\n\n\`\`\`\n${truncated}\n\`\`\``;
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body,
+            });

.gitignore

@@ -0,0 +1,2 @@
+.worktrees/
+.DS_Store