[EPAC-2081]: remove Terraform apply job from backend staging deploy#607
Merged
riddim-developer-bot[bot] merged 1 commit intoMay 25, 2026
Conversation
The infra-apply job fails because the staging deploy IAM role does not have S3 access to the Terraform state bucket. Infrastructure provisioning (Lambda creation, API Gateway routes) should use a dedicated Terraform workflow with appropriate IAM permissions, not the code-deploy pipeline. The production deploy workflow already follows this pattern — it deploys Lambda code without running Terraform.
riddim-developer-bot
Bot
added
the
autonomous
riddim-developer-bot
Bot
deleted the
symphony/epac-2081-ci-backend-staging-deploy-failing-on-main
branch
May 25, 2026 19:59
riddim-developer-bot Bot
added a commit
that referenced
this pull request
May 25, 2026
## Why Backend Staging Deploy is failing on `main` after PR #607 removed Terraform apply from the code deploy workflow. The deploy matrix now targets manifest services whose source directory or staging Lambda is not currently provisioned, and the staging account also has a deleted `epac/database-url` secret plus no artifact bucket variable set. ## What changed - Added source-directory and staging-Lambda existence guards before packaging or updating a service. - Preserved the current Lambda `DATABASE_URL` when the staging secret is marked for deletion, instead of failing the deploy while the existing function config is still usable. - Added the known EPAC artifact bucket as a fallback when repo variables are absent. - Skipped route sync and smoke tests with an explicit warning when manifest HTTP services are missing staging Lambda resources, so infrastructure drift is visible without hard-failing the code deploy workflow. ## Trade-offs not taken Did not reintroduce Terraform apply into Backend Staging Deploy. PR #607 deliberately moved infrastructure provisioning out of this workflow because the staging deploy role cannot reliably initialize the Terraform backend in the current account state. ## Test plan - `actionlint .github/workflows/backend-staging.yml` - `git diff --check origin/main...HEAD` - `python3 scripts/ci/backend_staging_smoke.py --list` - Local AWS readiness probe confirmed the missing staging Lambdas that caused the failed run are detected and would skip smoke with a warning. Skipped: live GitHub Actions execution, because it depends on GitHub OIDC and the repository staging deploy role. Resolves EPAC-2083 Reviewer-Boundary: review-only Estimate was missing from the Linear issue; treated as the standard 8 complexity tier. Co-authored-by: riddim-developer-bot <developer-bot@riddimsoftware.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Backend Staging Deploy fails on every push to main because the
infra-applyjob runs
terraform initagainst the S3 state bucket(
epac-tfstate-staging-227530433709), but the staging deploy IAM role(
AWS_BACKEND_STAGING_ROLE_ARN) lacks S3 access to that bucket (403 Forbidden).Failed run: https://github.com/RiddimSoftware/epac/actions/runs/26416968209
Previous attempts (EPAC-2074) removed the
bootstrap.shcall but leftterraform initandterraform apply, which still require state bucket access.What changed
infra-applyjob frombackend-staging.yml. Infrastructureprovisioning (Lambda definitions, API Gateway routes) belongs in a dedicated
Terraform workflow with the right IAM permissions — not in the code-deploy
pipeline. The production deploy workflow already follows this pattern.
infra/terraform/**from thepathstrigger since the workflow nolonger runs Terraform.
actions: readandpull-requests: readpermissions that were onlyneeded for the Terraform plan artifact download.
needs: infra-applydependency from thepreparejob so Lambdacode deploys are no longer blocked by Terraform.
Trade-offs not taken
role is scoped for Lambda code updates, not infrastructure management.
added when infrastructure-as-code changes need automated post-merge apply.
Verification
actionlint .github/workflows/backend-staging.yml— passes clean.AWS_BACKEND_STAGING_ROLE_ARN). GitHub Actions must validate the deploy path.Resolves EPAC-2081
Reviewer-Boundary: review-only
Estimate was missing from the Linear issue; treated as the standard 8 complexity
tier.