From 880b3054b724999c4d32daf6e29f17e869355c63 Mon Sep 17 00:00:00 2001
From: Vimlesh Kumar <vimlesh@vimsco-consulting.com>
Date: Fri, 13 Feb 2026 23:54:59 -0500
Subject: [PATCH 1/2] ci: add terraform fmt/validate workflow and docs

---
 .github/workflows/terraform.yml | 53 +++++++++++++++++++++++++++++++++
 README.md                       |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 .github/workflows/terraform.yml
 create mode 100644 README.md

diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
new file mode 100644
index 0000000..667cbce
--- /dev/null
+++ b/.github/workflows/terraform.yml
@@ -0,0 +1,53 @@
+name: Terraform CI
+
+on:
+  pull_request:
+    branches: [ "main" ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  terraform:
+    name: Terraform fmt/validate/plan (envs)
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        env:
+          - envs/dev
+          - envs/prod
+
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ matrix.env }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.14.5
+
+      - name: Terraform fmt (check)
+        run: terraform fmt -check -recursive
+
+      - name: Terraform init
+        run: terraform init -input=false
+
+      - name: Terraform validate
+        run: terraform validate
+
+      # Plan is only safe if AWS creds exist in GitHub Actions.
+      # We'll enable this once secrets are configured.
+      - name: Terraform plan (skipped until AWS creds)
+        run: |
+          echo "Skipping terraform plan until AWS credentials are configured in repo secrets."
+          echo "To enable: set AWS creds and replace this step with terraform plan -input=false -no-color"
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e939bd0
--- /dev/null
+++ b/README.md
@@ -0,0 +1 @@
+PRs run Terraform fmt/validate across dev and prod envs.

From 42be54e3f71b4ecb6e475abfcc780ea4544f977b Mon Sep 17 00:00:00 2001
From: Vimlesh Kumar <vimlesh@vimsco-consulting.com>
Date: Sat, 14 Feb 2026 00:07:47 -0500
Subject: [PATCH 2/2] ci: disable backend for validater for now till AWS auth
 is available

---
 .github/workflows/terraform.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index 667cbce..589f86e 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -39,7 +39,7 @@ jobs:
         run: terraform fmt -check -recursive
 
       - name: Terraform init
-        run: terraform init -input=false
+        run: terraform init -backend=false -input=false
 
       - name: Terraform validate
         run: terraform validate