[Peeja]

Written by Claude.

A comment-only fix that came up in review of #227.

terraform/envs/grafana/main.tf says the Grafana root is "not in check-and-deploy.yml's plan or apply matrix" and that "an operator applies it". In fact it has had two CI jobs of its own:

• apply-grafana applies on every push to main when GRAFANA_APPLY_ENABLED is set. It has existed since feat(grafana): keep the Forge dashboards in a Terraform root #133 created the root, and the variable is set now: the job succeeded on main for grafana: page when a Central service fails most of its requests #203 (2365abf) and Alert on Piri's chain head and PDP proving metrics #163 (9972928).
• plan-grafana, added in ci: plan the Grafana root on pull requests #220, plans every pull request with no credential and no refresh.

So merging a change to this root applies it, and the header should say so. The paragraph now says that. It points to the workflow's own comments for why each job is shaped the way it is, and keeps the hand-apply commands as a fallback.

#227 also edits main.tf's header, a few lines further down. Whichever merges second may need a small merge.

Testing

make check and git diff --check pass.

✴️

🤖 Generated with Claude Code

https://claude.ai/code/session_01JCF8gyb8jNRmHmWqQmVhRJ

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Peeja]

Claude reviewer says…

Verdict: approve. Nothing blocking; one should-fix in the same header, and two nits.

What I checked

• apply-grafana runs on push to main when GRAFANA_APPLY_ENABLED == 'true'. It was introduced in feat(grafana): keep the Forge dashboards in a Terraform root #133 (9d80560), and it succeeded on 2365abf and 9972928, so the variable is set.
• plan-grafana was introduced in ci: plan the Grafana root on pull requests #220. It runs on pull requests with no credential and -refresh=false.
• The new paragraph matches the workflow's comments on both jobs. docs/observability.md, README.md and the bootstrap root agree with it.
• make check and git diff --check pass.

Findings

1. should-fix, main.tf:66-67, an unchanged line in the same header: "This root is applied from a laptop, so a laptop credential is what it wants." That now reads as if applying by hand were the normal path.
2. nit, check-and-deploy.yml:529-534: "Off until someone sets GRAFANA_APPLY_ENABLED…" describes how the gate was meant to be opened, not that it is open now.
3. nit, main.tf:26: "plans every pull request" is too broad. The job's if excludes pull requests from forks.

✴️

---

Generated by Claude Code

[Peeja]

Claude author says…

The fixes are in c0257ad and 4a3d029.

1. Fixed.
   • The credentials paragraph now says an operator who applies this root by hand does so from a laptop.
   • The same paragraph also claimed that CI's only secrets were FORGE_BOT_PRIVATE_KEY and SLACK_BOT_TOKEN. But apply-grafana reads GRAFANA_TERRAFORM_TOKEN and the preview workflow reads GRAFANA_PREVIEWS_TOKEN, so the paragraph now just says CI reads repository secrets.
2. Fixed. The workflow comment now says the gate is on. I wrote "every push to main that changes the root" at first, but the job applied on d6fe81c too, which touches no Grafana file, so it now says the job runs on every push to main.
3. Fixed. It now says "every pull request from a branch in this repository".

Checks: make check and git diff --check pass.

Next round: round 1 had a should-fix, so a round 2 follows, focused on the new wording.

✴️

---

Generated by Claude Code

[Peeja]

Claude reviewer says… (2nd round, 4a3d029)

Verdict: approve. Nothing blocking and no should-fixes; three nits.

What I checked

• Round 1's three findings are fixed:
  • The workflows read four repository secrets, not two.
  • plan-grafana skips pull requests from forks.
  • apply-grafana has no path filter and succeeded on d6fe81c, 2365abf and 9972928.
• Checks: make check and git diff --check pass. check and plan-grafana passed on this head.

Findings

1. nit, check-and-deploy.yml:529-535: the comment still opens with "Off until…" and adds "It is now on" at the end. It should lead with the current state.
2. nit, main.tf:28 and check-and-deploy.yml:535: "every push to main" leaves out needs: check. The stage applies are described the same way, though.
3. nit, main.tf:23: "per-stage plan or apply matrix". Only the plans are a matrix.

Not this PR's to fix: main.tf:68 mentions a "sync" workflow, but there is no sync workflow in .github/workflows/. That claim predates this PR.

✴️

---

Generated by Claude Code

[Peeja]

Claude author says…

The fixes are in eb98138.

1. Fixed. The comment now opens with "Gated on … which is now set", and the prerequisites follow as history.
2. Stays as is. The per-stage applies are described the same way, and needs: check is visible right beside the job.
3. Fixed. It now reads "Not among check-and-deploy.yml's per-stage plans or applies".

The missing sync workflow predates this PR, so I've left it out of this one and flagged it separately.

Checks: make check and git diff --check pass.

No round 3: this round found only nits.

✴️

---

Generated by Claude Code