Issues

• Split the Terraform CI role: read-only plan credentials on pull requests, write apply credentials on main (tf-lint AVD-AWS-0345)

  enhancement
  lentago/solidago#225 · Filter by author cpitzi opened on Oct 30, 2026
  1

• ECR tag immutability: deploys reference the image by digest, :latest retires, then IMMUTABLE flips (tf-lint AVD-AWS-0031)

  enhancement
  lentago/solidago#224 · Filter by author cpitzi opened on Oct 30, 2026

• docs: list the betula and drosera cross-repo roles in ADOPTION.md, and scope BOOTSTRAP's locking note to solidago's own backend

  documentation
  lentago/solidago#223 · Filter by author cpitzi opened on Oct 30, 2026

• monitoring: pass the alert recipient as a sensitive variable, out of committed config and public plan output

  enhancement
  lentago/solidago#222 · Filter by author cpitzi opened on Oct 30, 2026

• On or after 2026-11-06: retire the pre-rename drosera Terraform role and state key (drosera#169 Phase 3)

  lentago/solidago#221 · Filter by author cpitzi opened on Oct 30, 2026

• iam: give the cross-repo Terraform pipeline roles a read-only plan path

  enhancement
  lentago/solidago#220 · Filter by author cpitzi opened on Oct 30, 2026

• Fail the apply when an out-of-band secret still holds its placeholder

  lentago/solidago#213 · Filter by author cpitzi opened on Oct 7, 2026

• CI plans are never clean: standing task-definition replacements and a recreating SNS email subscription

  lentago/solidago#184 · Filter by author cpitzi opened on Aug 19, 2026
  1

• Hardening backlog from tf-lint's first trivy run (ECR immutability, CI-role least-privilege, SNS encryption)

  enhancementepic
  lentago/solidago#180 · Filter by author cpitzi opened on Aug 17, 2026
  1

• DMARC posture on our own domains first (precondition for the Email Trust kit)

  enhancement
  lentago/solidago#167 · Filter by author cpitzi opened on Aug 16, 2026
  1

• Split plan/apply OIDC environments so the terraform environment can carry a branch policy

  lentago/solidago#156 · Filter by author cpitzi opened on Jul 25, 2026

• Rotating a Lambda's Axiom token requires an unrelated apply to take effect

  lentago/solidago#149 · Filter by author cpitzi opened on Jul 25, 2026
  1

• Ask Lambda logs land in CloudWatch with no path to Axiom

  lentago/solidago#144 · Filter by author cpitzi opened on Jul 24, 2026
  2