From bfed1c90e25dd841c4bd85e66226619eaa59ff44 Mon Sep 17 00:00:00 2001
From: Leonard Du <Leonarddu.career@gmail.com>
Date: Tue, 28 Jul 2026 12:38:40 +1000
Subject: [PATCH] ci: single approval covers the whole terraform-integration
 workflow

Two changes to terraform-integration.yml:

1. Remove max-parallel: 3 from terraform-plan. GitHub creates matrix
   jobs in waves of max-parallel size, and each wave is its own
   deployment request, so terraform-privileged approval had to be
   clicked once per wave (7-8 clicks for ~20 tfvars). Without
   max-parallel, all matrix jobs pend as one batch and are covered by
   a single approval.

2. Delete the authorize job. It was a no-op placeholder that only
   existed to attach environment: terraform-privileged. terraform-test
   and terraform-plan already carry the same environment (added in
   #1269), so the approval gate lives on those jobs directly. Same
   security guarantee, one fewer job in the DAG.

Runner concurrency: telescope has no self-hosted runners; workflows run
on the Azure org's shared GitHub-hosted Ubuntu pool (Enterprise cap
~500 concurrent). ~20 tfvars is well within budget; excess would just
queue behind the approved batch, not fail.
---
 .github/workflows/terraform-integration.yml | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/.github/workflows/terraform-integration.yml b/.github/workflows/terraform-integration.yml
index a1ded6cb8b..83811e24e4 100644
--- a/.github/workflows/terraform-integration.yml
+++ b/.github/workflows/terraform-integration.yml
@@ -19,15 +19,7 @@ env:
   TERRAFORM_AWS_MODULES_DIR: modules/terraform/aws
 
 jobs:
-  authorize:
-    environment: terraform-privileged
-    runs-on: ubuntu-latest
-    steps:
-      - name: Authorized
-        run: 'echo "Authorized PR ${{ github.event.pull_request.number }} head=${{ github.event.pull_request.head.sha }}"'
-
   terraform-test:
-    needs: authorize
     environment: terraform-privileged
     permissions:
       contents: read
@@ -37,7 +29,6 @@ jobs:
       - name: Checkout PR head
         uses: actions/checkout@v4
         with:
-          # Only checked out AFTER `authorize` completes.
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
@@ -69,7 +60,6 @@ jobs:
           ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
   setup-matrix:
-    needs: authorize
     runs-on: ubuntu-latest
     name: Setup terraform plan matrix for test scenarios
     steps:
@@ -130,7 +120,7 @@ jobs:
       matrix-combinations: ${{ steps.setup-matrix-scenarios.outputs.matrix_combinations }}
 
   terraform-plan:
-    needs: [authorize, setup-matrix]
+    needs: setup-matrix
     environment: terraform-privileged
     permissions:
       id-token: write
@@ -138,7 +128,6 @@ jobs:
     if: ${{ needs.setup-matrix.result == 'success' && needs.setup-matrix.outputs.matrix-combinations != '' && needs.setup-matrix.outputs.matrix-combinations != 'null' }}
     strategy:
       fail-fast: false
-      max-parallel: 3
       matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix-combinations) }}
     runs-on: ubuntu-latest
     name: ${{ matrix.cloud }}-${{ matrix.scenario_type }}-${{ matrix.scenario_name }} ${{ matrix.region }}