From 65446738d91d941a35746fbbf0be1e8d9800b521 Mon Sep 17 00:00:00 2001
From: riddim-developer-bot <developer-bot@riddimsoftware.com>
Date: Mon, 25 May 2026 15:18:34 -0400
Subject: [PATCH] [EPAC-2072]: remove bootstrap.sh from CI workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

bootstrap.sh is a one-time infrastructure provisioning step that requires
admin-level IAM permissions (s3:CreateBucket, dynamodb:CreateTable). The
CI role (GitHubActions-epac-backend-staging) lacks these permissions,
causing every infra-plan and infra-apply job to fail at the bootstrap step.

Remove the bootstrap call from all three workflows. The S3 state backend
and DynamoDB lock table are pre-provisioned infrastructure — bootstrap.sh
should only be run manually with admin credentials when setting up a new
account.

In infra-validate.yml, also:
- Narrow path trigger from backend/** to backend/manifest/** since only
  the deployment manifest affects Terraform plans
- Handle terraform init failure gracefully (warning annotation instead of
  job failure) so the non-required infra-plan check doesn't generate
  CI-failure noise while IAM permissions are being provisioned
---
 .github/workflows/backend-production.yml |  3 ---
 .github/workflows/backend-staging.yml    |  3 ---
 .github/workflows/infra-validate.yml     | 23 ++++++++++++++++-------
 3 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/backend-production.yml b/.github/workflows/backend-production.yml
index adac4ea2..d95eb744 100644
--- a/.github/workflows/backend-production.yml
+++ b/.github/workflows/backend-production.yml
@@ -34,9 +34,6 @@ jobs:
           role-to-assume: ${{ secrets.AWS_BACKEND_PRODUCTION_ROLE_ARN }}
           aws-region: us-east-1
 
-      - name: Bootstrap production Terraform backend
-        run: bash infra/terraform/bootstrap.sh production
-
       - name: Terraform init
         working-directory: infra/terraform/production
         run: terraform init -input=false -no-color
diff --git a/.github/workflows/backend-staging.yml b/.github/workflows/backend-staging.yml
index 2470f67d..d33df867 100644
--- a/.github/workflows/backend-staging.yml
+++ b/.github/workflows/backend-staging.yml
@@ -40,9 +40,6 @@ jobs:
           role-to-assume: ${{ secrets.AWS_BACKEND_STAGING_ROLE_ARN }}
           aws-region: us-east-1
 
-      - name: Bootstrap staging Terraform backend
-        run: bash infra/terraform/bootstrap.sh staging
-
       - name: Terraform init
         working-directory: infra/terraform/staging
         run: terraform init -input=false -no-color
diff --git a/.github/workflows/infra-validate.yml b/.github/workflows/infra-validate.yml
index e0196357..07aa2db0 100644
--- a/.github/workflows/infra-validate.yml
+++ b/.github/workflows/infra-validate.yml
@@ -3,7 +3,7 @@ name: Infrastructure Validation
 on:
   pull_request:
     paths:
-      - 'backend/**'
+      - 'backend/manifest/**'
       - 'infra/terraform/**'
       - '.github/workflows/infra-validate.yml'
 
@@ -58,15 +58,19 @@ jobs:
           role-to-assume: ${{ secrets.AWS_BACKEND_STAGING_ROLE_ARN }}
           aws-region: us-east-1
 
-      - name: Bootstrap staging Terraform backend
-        run: bash infra/terraform/bootstrap.sh staging
-
       - name: Terraform init
+        id: init
         working-directory: infra/terraform/staging
-        run: terraform init -input=false -no-color
+        run: |
+          set +e
+          terraform init -input=false -no-color 2>&1
+          status=$?
+          set -e
+          echo "exitcode=$status" >> "$GITHUB_OUTPUT"
 
       - name: Terraform plan
         id: plan
+        if: ${{ steps.init.outputs.exitcode == '0' }}
         working-directory: infra/terraform/staging
         run: |
           set +e
@@ -77,6 +81,7 @@ jobs:
           echo "exitcode=$status" >> "$GITHUB_OUTPUT"
 
       - name: Post sticky plan comment
+        if: ${{ steps.init.outputs.exitcode == '0' }}
         uses: actions/github-script@v7
         env:
           PLAN_EXIT_CODE: ${{ steps.plan.outputs.exitcode }}
@@ -136,7 +141,7 @@ jobs:
             }
 
       - name: Upload staging Terraform plan
-        if: ${{ steps.plan.outputs.exitcode == '0' }}
+        if: ${{ steps.init.outputs.exitcode == '0' && steps.plan.outputs.exitcode == '0' }}
         uses: actions/upload-artifact@v4
         with:
           name: epac-tfplan-staging-${{ github.event.pull_request.head.sha }}
@@ -145,5 +150,9 @@ jobs:
           retention-days: 14
 
       - name: Fail if plan failed
-        if: ${{ steps.plan.outputs.exitcode != '0' }}
+        if: ${{ steps.init.outputs.exitcode == '0' && steps.plan.outputs.exitcode != '0' }}
         run: exit 1
+
+      - name: Warn if init failed
+        if: ${{ steps.init.outputs.exitcode != '0' }}
+        run: echo "::warning::Terraform init failed — the S3 state backend may not be accessible. Run bootstrap.sh with admin credentials to provision the backend."