livestorejs
diff --git a/‎.github/workflows/infra-drift.yml‎
Lines changed: 200 additions & 0 deletions b/‎.github/workflows/infra-drift.yml‎
Lines changed: 200 additions & 0 deletions
diff --git a/‎.github/workflows/infra-drift.yml.genie.ts‎
Lines changed: 62 additions & 0 deletions b/‎.github/workflows/infra-drift.yml.genie.ts‎
Lines changed: 62 additions & 0 deletions
diff --git a/‎.infra/iac/netlify/.gitignore‎
Lines changed: 21 additions & 0 deletions b/‎.infra/iac/netlify/.gitignore‎
Lines changed: 21 additions & 0 deletions
diff --git a/‎.infra/iac/netlify/.terraform.lock.hcl‎
Lines changed: 24 additions & 0 deletions b/‎.infra/iac/netlify/.terraform.lock.hcl‎
Lines changed: 24 additions & 0 deletions
@@ -0,0 +1,62 @@
+/**
+ * Infrastructure drift detection.
+ *
+ * A declaration nobody checks is documentation, not a control: the value of
+ * `.infra/iac/` is that a change made outside it becomes visible. Nothing in
+ * the repo ran `plan`, so this job does — on a schedule, and on any push that
+ * touches the config.
+ *
+ * `infra:netlify:drift-check` runs `tofu plan -detailed-exitcode`, so drift
+ * exits non-zero and turns the job red rather than printing a diff nobody
+ * reads.
+ *
+ * Secrets rather than op-proxy: the IaC preamble prefers already-set `TF_VAR_*`
+ * env vars and only falls back to 1Password, so CI supplies them directly.
+ * Scheduled and push-triggered only — never `pull_request`, because fork PRs
+ * receive no secrets and would fail for a reason unrelated to drift.
+ */
+import {
+  bashShellDefaults,
+  githubWorkflow,
+  livestoreSetupSteps,
+  nixDiagnosticsArtifactStep,
+  runDevenvTasksBefore,
+  savePnpmStateStep,
+} from '../../genie/repo.ts'
+
+export default githubWorkflow({
+  name: 'Infrastructure drift',
+  on: {
+    schedule: [{ cron: '0 7 * * 1-5' }],
+    workflow_dispatch: {},
+    push: {
+      branches: ['main'],
+      paths: ['.infra/iac/**'],
+    },
+  },
+  concurrency: {
+    group: '${{ github.workflow }}',
+    'cancel-in-progress': false,
+  },
+  jobs: {
+    'netlify-drift': {
+      'runs-on': 'ubuntu-24.04',
+      'timeout-minutes': 20,
+      defaults: bashShellDefaults,
+      steps: [
+        ...livestoreSetupSteps,
+        {
+          name: 'Check Netlify env-var drift',
+          run: runDevenvTasksBefore('infra:netlify:drift-check'),
+          env: {
+            NETLIFY_AUTH_TOKEN: '${{ secrets.NETLIFY_AUTH_TOKEN }}',
+            TF_VAR_state_encryption_passphrase: '${{ secrets.TOFU_STATE_ENCRYPTION_PASSPHRASE }}',
+            TF_VAR_mxbai_api_key: '${{ secrets.MXBAI_API_KEY }}',
+          },
+        },
+        savePnpmStateStep({ keyPrefix: 'livestore-pnpm-state-v1' }),
+        nixDiagnosticsArtifactStep(),
+      ],
+    },
+  },
+})
@@ -0,0 +1,21 @@
+# OpenTofu working dir: provider binaries + caches. Never commit.
+.terraform/
+.terraform.tfstate.lock.info
+
+# Plaintext state/backups must NEVER be committed (this repo is PUBLIC and state
+# holds the API key value). The committed state under state/netlify.tfstate is
+# encrypted by OpenTofu native state encryption; any *.tfstate elsewhere or
+# backup file must stay out of git.
+#
+# Match every backup shape, not just `*.tfstate.backup`: `tofu state mv` writes
+# `terraform.tfstate.<timestamp>.backup`, which that pattern does not cover, so
+# those files showed up as untracked and one commit away from being added.
+*.backup
+*.tfstate
+!state/netlify.tfstate
+
+# crash logs / var files that might hold secrets
+crash.log
+crash.*.log
+*.tfvars
+*.tfvars.json