Repository navigation
chore(infra): add terraform bootstrap for azure remote state - #14
Merged
Merged
Conversation
Phase 999.1 slice (a). Adds infra/bootstrap: resource group, versioned private storage account and tfstate container, a user-assigned managed identity with a federated credential for GitHub Actions on main, and role assignments for the pipeline. State is migrated to the azurerm backend. A managed identity replaces an app registration because the university tenant denies service-principal and credential writes.
Coverage
head 0266def · 2026-10-31T01:28:41Z |
danielrpof
added a commit
that referenced
this pull request
Oct 31, 2026
## Summary Clears the Trivy gates: `trivy-fs` first, then `build-scan`, which it had been hiding. No `package.json` or `go.mod` changes. ```diff # web/pnpm-lock.yaml, transitive, within existing ranges -body-parser 2.3.0 +body-parser 2.4.0 # CVE-2026-111181 -systeminformation 5.33.1 +systeminformation 5.33.18 # CVE-2026-116576 -undici 7.30.0 +undici 7.30.1 # CVE-2026-109383, -109829, -109869, -87018 -undici 8.11.2 +undici 8.12.3 # Dockerfile, go-build stage -golang:1.26.9-alpine3.24 +golang:1.26.10-alpine3.24 # stdlib CVE-2026-111943 ``` ## Evidence - **Before:** `trivy-fs` fails with 6 HIGH findings in `web/pnpm-lock.yaml` (blocking #14); then `build-scan` fails with 1 HIGH in the `server` binary's stdlib. **After:** `trivy-fs` and `build-scan` both pass on this branch. - `pnpm install --frozen-lockfile`, prettier and `pnpm test` ran locally on the updated lockfile. ## Merge Danger **Door:** two-way Revert restores the previous lockfile and builder image. **Blast Radius:** minor `fix` type cuts a patch release. The server binary is rebuilt with Go 1.26.10; the web packages come through tooling (`shadcn`, `jsdom`).
# Conflicts: # .planning/STATE.md
danielrpof
added a commit
that referenced
this pull request
Oct 31, 2026
## Summary Squash merges removed the commits that the planning docs cite. ```diff -84bc8a8 +67b1bec # #14 -f45762a +d000201 # #15 ``` ## Evidence - **Before:** `git grep` finds both old hashes in `.planning/`. **After:** it finds neither. ## Merge Danger **Door:** two-way **Blast Radius:** none Planning docs only. `docs` type, so no release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 999.1 slice (a). Adds
infra/bootstrap, applied once by hand and never destroyed.sequenceDiagram participant GH as GitHub Actions (main) participant AAD as Entra ID participant MI as Managed identity GH->>AAD: OIDC token (subject = repo + main) AAD->>MI: match federated credential AAD-->>GH: short-lived access tokenA user-assigned managed identity replaces an app registration: the university tenant returned 403 on service-principal and credential writes.
Evidence
terraform.tfstate.After:
terraform planreportsNo changes. Your infrastructure matches the configuration.and thetfstatecontainer holds one blob,bootstrap/terraform.tfstate.Merge Danger
Door: two-way
Merging adds files only. The Azure resources were already applied by hand, so reverting the PR changes nothing in Azure, and
prevent_destroyblocks accidental teardown.Blast Radius: none
No app code, workflow or release change. Titled
choreso the release job skips; merge with squash.