Fix Terraform cycle + add static-validation CI

.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: CI
+
+# Static validation — no AWS credentials required. Gives a meaningful green check
+# on every push/PR before any environment is configured. Deployment lives in deploy.yml.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+      - name: fmt
+        run: terraform fmt -check -recursive iac/
+      - name: validate static stack
+        working-directory: iac/spip/static
+        run: |
+          terraform init -backend=false -input=false
+          terraform validate
+      - name: validate app stack
+        working-directory: iac/spip/app
+        run: |
+          terraform init -backend=false -input=false
+          terraform validate
+
+  php-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.5'
+      - name: php -l on our PHP
+        run: |
+          find spip/overlay spip/scripts spip/plugins -name '*.php' -print0 \
+            | xargs -0 -n1 -P4 php -l >/dev/null
+          echo "no syntax errors"
+
+  shell-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: bash -n on scripts
+        run: for s in spip/scripts/*.sh; do bash -n "$s"; done
+
+  docker-build:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Read pinned SPIP version
+        run: echo "SPIP_VERSION=$(cat spip/SPIP_VERSION)" >> "$GITHUB_ENV"
+      # Build without pushing. Fetches SPIP core, builds PHP extensions + the image.
+      # ADOT collector is downloaded at deploy time; stub it so the COPY resolves.
+      - name: Stub ADOT collector (real one is fetched at deploy time)
+        run: touch spip/overlay/adot-collector
+      - name: Build image (no push)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: spip/Dockerfile
+          platforms: linux/arm64
+          push: false
+          build-args: |
+            SPIP_VERSION=${{ env.SPIP_VERSION }}
+          provenance: false

.github/workflows/deploy.yml

@@ -32,6 +32,9 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-24.04-arm
+    # Skips (stays green) until the target GitHub Environment defines AWS_ACCOUNT_ID.
+    # See docs/environments.md for the required environment variables.
+    if: ${{ vars.AWS_ACCOUNT_ID != '' }}
     environment: ${{ github.event.inputs.environment || 'test' }}
     permissions:
       contents: read

iac/spip/app/api-gateway.tf

@@ -74,7 +74,7 @@ resource "aws_cloudwatch_log_group" "apigw_access" {
 resource "aws_api_gateway_stage" "spip" {
   rest_api_id   = aws_api_gateway_rest_api.spip.id
   deployment_id = aws_api_gateway_deployment.spip.id
-  stage_name    = "live"
+  stage_name    = local.stage_name
 
   xray_tracing_enabled = true
 

iac/spip/app/cloudfront.tf

@@ -34,7 +34,7 @@ resource "aws_cloudfront_distribution" "spip" {
   origin {
     domain_name = "${aws_api_gateway_rest_api.spip.id}.execute-api.${var.aws_region}.amazonaws.com"
     origin_id   = "apigw"
-    origin_path = "/${aws_api_gateway_stage.spip.stage_name}"
+    origin_path = "/${local.stage_name}"
     custom_origin_config {
       http_port              = 80
       https_port             = 443

iac/spip/app/locals.tf

@@ -19,6 +19,11 @@ locals {
   account_id = data.aws_caller_identity.current.account_id
   region     = var.aws_region
 
+  # Constant (not derived from the stage resource) so CloudFront's origin_path can use
+  # it without depending on the stage → deployment → integration → lambda chain, which
+  # would form a cycle with the Lambda env var CF_DISTRIBUTION_ID.
+  stage_name = "live"
+
   dsql_endpoint      = data.terraform_remote_state.static.outputs.dsql_endpoint
   dsql_arn           = data.terraform_remote_state.static.outputs.dsql_arn
   s3_bucket          = data.terraform_remote_state.static.outputs.s3_assets_bucket