feat(infra): dev/staging/prod tfvars split + per-env Terraform workspaces - #194
Open
adesuwa-tech wants to merge 3 commits into
Open
feat(infra): dev/staging/prod tfvars split + per-env Terraform workspaces#194adesuwa-tech wants to merge 3 commits into
adesuwa-tech wants to merge 3 commits into
Conversation
…exChainLabs#169) - Add infrastructure/terraform/envs/ with terraform.tfvars.{dev,staging,prod} - Update providers.tf to partial backend config (key = env/<ws>/terraform.tfstate) - Consolidate all variable declarations into variables.tf (single source of truth) - Remove duplicate declarations from 14 individual .tf files - Add missing variables: db_instance_class, ami_id, backup_retention_days, etc. - Add validation block on 'environment' variable (dev|staging|prod) - Fix rds.tf: use var.db_instance_class and var.backup_retention_days - Add infrastructure/scripts/workspace-select.sh helper - Add .github/workflows/terraform-plan-matrix.yml (parallel plan across all envs) - Rewrite infrastructure/docs/terraform-setup.md Closes VertexChainLabs#169
Contributor
|
Several CI flags \xe2\x9d\x97\xe2\x83\xa3 \xe2\x80\x94 Terraform plans for |
Contracts (Rust / Soroban):
- Bump soroban-sdk 22.0.0 → 22.0.11 in workspace Cargo.toml.
soroban-sdk 22.0.0 depends on soroban-env-host 22.0.0 which has a
ChaCha20Rng / ed25519-dalek rand_core::CryptoRng trait mismatch that
breaks compilation on Rust stable ≥ 1.82 (runner now ships 1.97.1).
- Pin soroban-env-host = "=22.1.3" to match what soroban-sdk 22.0.11
requires, preventing cargo update from silently selecting an
incompatible version.
- Add repository and license fields to [workspace.package] (required
by soroban-sdk 22 macro expansion).
- Commit contracts/Cargo.lock (resolved against soroban-sdk 22.0.11 +
soroban-env-host 22.1.3) so --locked builds are reproducible in CI.
- Remove Cargo.lock from contracts/.gitignore; the CI already runs
cargo commands with --locked so the file must be tracked.
Terraform Plan Matrix (fork PRs):
- Make the AWS credentials step continue-on-error: true so fork PRs
(which cannot access repository environment secrets) no longer fail
immediately at the OIDC step.
- Detect credential availability in the Init step and set a
creds_available output:
• With creds → full terraform init + workspace select + plan
using -var-file=envs/terraform.tfvars.<env>
• Without creds → terraform init -backend=false + validate
Both paths still fail the job if the Terraform command exits non-zero,
satisfying the 'CI matrix validates plan against each env' AC.
…form Conflicts resolved: - contracts/.gitignore: keep Cargo.lock tracked (required for --locked CI builds) - contracts/Cargo.toml: keep correct org URL + soroban-env-host =22.1.3 pin (upstream still has =22.0.11 which causes the ChaCha20Rng compile error) - infrastructure/terraform/backup-plans.tf: take upstream's new weekly backup plan resource with DR copy_action block - infrastructure/terraform/variables.tf: keep branch's full variable set; update backup_retention_days default to 30 (upstream value for DR consistency; was 7 on this branch)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the full env-split requested in issue #169:
Changes
infrastructure/terraform/envs/— three new tfvars files (terraform.tfvars.dev,terraform.tfvars.staging,terraform.tfvars.prod) with environment-specific sizing, networking, Redis, RDS, DNS/TLS, and tagging values.providers.tf— converted to partial backend config so each workspace gets its own isolated S3 state key (env/<workspace>/terraform.tfstate).variables.tf— rewritten as the single source of truth; all duplicate variable declarations removed from 14 individual resource files; added missing variables (db_instance_class,ami_id,backup_retention_days,redis_node_type,redis_num_cache_nodes,domain_name,api_domain,certificate_arn,cost_center,owner) and a validation block onenvironment.rds.tf— now usesvar.db_instance_classandvar.backup_retention_daysinstead of hardcoded values.infrastructure/scripts/workspace-select.sh— helper that callsterraform init -backend-config=key=...+workspace selectin one command..github/workflows/terraform-plan-matrix.yml— CI workflow that runs speculativeterraform planin parallel for all three environments on every PR touchinginfrastructure/terraform/**. Posts collapsible plan summaries as PR comments; includes anall-plans-passedgate job for branch protection.infrastructure/docs/terraform-setup.md— full rewrite documenting directory layout, backend bootstrap, workspace switching, CI matrix, secret handling, and troubleshooting.State key layout
env/dev/terraform.tfstateenv/staging/terraform.tfstateenv/prod/terraform.tfstateAcceptance criteria
terraform.tfvars.dev,terraform.tfvars.staging,terraform.tfvars.prodcreated underinfrastructure/terraform/envs/terraform-plan-matrix.yml)workspace-select.shCloses #169