NWarila/github-terraform-runner

GitHub-as-code deployer for the NWarila GitHub user account. Owns repository inventory under terraform/ and delegates the actual terraform apply to the github-terraform-framework reusable workflow.

This repository is a runner under the NWarila/terraform-runner-template contract. It contains no Terraform module code of its own; validation, contract checks, security scanning, and release evidence are delegated to terraform-runner-template, NWarila/.github, and github-terraform-framework by immutable refs.

Layout

terraform/
  public/    YAML definitions for public repos under NWarila
  private/   Empty in-repo (gitkeep only); fetched from S3 at deploy time
             (Personal.yml, Resume.yml, github-sandbox.yml)
tests/
  fixtures/terraform/private/
             Public-safe private fixtures used by pr-validation
.github/workflows/
  pr-validation.yaml     checks out the pinned framework, overlays this runner's
                         inventory, and runs framework CI
  drift-gate.yaml        byte-compares org-baseline files (NWarila/.github) and
                         the runner-template scaffold against pinned sources
  org-adr-auto-sync.yaml scheduled caller that opens a PR to refresh org-ADR
                         mirrors on drift (see docs/reference/mirroring.md)
  security.yaml          calls org-owned security reusable workflows by SHA
  repo-hygiene.yaml      calls org-owned workflow policy validation by SHA
  release.yaml           calls org/framework-owned release reusable workflows by SHA
  auto-merge.yaml        calls org-owned trusted-bot auto-merge by SHA
  terraform-deploy.yaml  plans and applies on main using the framework deploy
                         reusable, AWS OIDC, and repo secrets

How A Change Lands

1. Edit YAML under terraform/public/, or upload reviewed private YAML to S3.
2. PR validation assembles framework plus this runner data plus the public-safe private fixture, then runs contract, lint, security, and Terraform plan gates.
3. After merge, terraform-deploy.yaml applies on main.

Renovate keeps framework_ref, the framework reusable SHA, and the runner-template SHA current. Trusted-bot PRs auto-merge once the Pull Request Gate review requirements are met; no required status checks are configured, so auto-merge does not wait for CI. Human PRs follow normal review.

The complete gate inventory lives in docs/reference/quality-gates.md.

Architecture

The deploy overlay sequence — runner inventory to framework checkout to Terraform apply — is documented in docs/diagrams/deploy-overlay-sequence.mmd.