Team Workflow
Take Terraform off laptops: plans on every pull request, gated applies from CI with no stored keys, tests and static analysis, policy checks on plans, and the day-2 routines that keep it all healthy.
Everything so far ran from your terminal. On a team, that doesn't scale and it isn't safe: nobody else sees the plan, anyone with credentials can apply anything, and 'it worked on my machine' applies to infrastructure too. This final stage moves ShopLite's Terraform into GitHub Actions with OIDC, adds the automated checks that catch mistakes before a human reviews them, makes prod applies require approval, and sets up drift detection and upgrades — ending with a clean teardown of everything you built.
+ ShopLite gains: a GitHub Actions pipeline (plan on PR, gated apply on merge) using OIDC roles, tflint + trivy + terraform test, an OPA policy gate on plans, nightly drift detection, and a documented teardown
- 7.1
Plan on Pull Request, Apply on Merge — with OIDC
Every pull request touching infra gets a plan for dev and prod posted as a comment; merging to main applies dev automatically and prod after an approval — and no AWS key exists anywhere.
60 minFree (GitHub Actions minutes on public repos / free tier)2 break-its - 7.2
Test and Lint Before Anyone Reviews
The PR pipeline fails automatically on invalid AWS values (tflint), insecure configuration (trivy), and broken module behaviour (`terraform test` with mocked providers) — before a human reads the plan.
50 minFree — tests use mocked providers, nothing is created2 break-its - 7.3
Policy as Code: Gate Plans, Not Just Code
Every plan is checked by OPA policies that fail the pipeline if it would delete a protected resource or open SSH to the internet, prod files need a code owner's approval, and prod can't be applied from a laptop at all.
45 minFree2 break-its - 7.4
Day 2: Drift Detection, Upgrades, Stuck Locks, and Teardown
A nightly job reports drift in each environment, you know how to upgrade Terraform and providers safely and clear a stuck lock, and you finish by tearing all of ShopLite down in the right order.
45 minFree — and after this mission, nothing keeps costing anything2 break-its