Stand up the infrastructure repo and Terraform CI with drift detection

[matt-edmondson]

Context

The Terraform workspace lives only on a local branch (feat/terraform-org-management in C:/dev/ktsu-dev/infrastructure). It has no remote, no CI, and therefore no drift detection. Drift detection is the actual mechanism that keeps settings synchronized, so without it this work is a one-time convergence rather than ongoing management.

Work

1. Create ktsu-dev/infrastructure as a private repo and push the branch.
2. Create an Azure service principal with a federated credential so Actions can reach the state backend over OIDC. State lives in the existing ktsuhomelabtfstate storage account, tfstate container, key ktsu-dev-github.tfstate, alongside an unrelated homelab.tfstate.
3. Set four repository secrets: GH_ORG_TOKEN (needs admin:org and repo), AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID. The default GITHUB_TOKEN cannot manage other repositories.
4. Add .github/workflows/terraform.yml: PR runs plan and posts it as a comment, push to main runs apply, and a nightly scheduled job runs plan -detailed-exitcode and fails on drift.
5. Verify drift detection actually fires. Set has_wiki=true on one repo through the API, confirm the nightly job fails, then revert. A drift check that has never failed is not known to work.

Acceptance criteria

• Repo exists, is private, and carries the branch
• A PR produces a plan comment
• A merge to main applies
• Deliberately introduced drift makes the scheduled job fail, and reverting makes it pass

Note

github/.terraform.lock.hcl is committed and pins the provider to 6.13.0. Keep it that way. Without it, CI resolves the provider non-deterministically inside ~> 6.0, and three attributes currently in use are already deprecated, so a silent float could turn warnings into removals.

[matt-edmondson]

Depends on #3 for there to be managed state worth detecting drift against. The Azure service principal and the admin:org PAT are the two external prerequisites, and neither exists yet.

[matt-edmondson]

Triage

Priority: Medium Effort: Large

What needs to be done: Stand up ktsu-dev/infrastructure as a real remote repo with Terraform CI (plan-on-PR, apply-on-merge, nightly drift detection), replacing the current local-only branch.

Suggested next steps / acceptance criteria:

• Create the repo, push the branch, set up the Azure OIDC federated credential and the four required secrets
• Add the plan/apply/drift-detection workflow
• Deliberately introduce drift (e.g. toggle has_wiki) and confirm the nightly job actually fails, then revert — a drift check that's never failed is unproven

Blockers / dependencies: Depends on .github#3 (needs managed state to converge against before drift detection is meaningful). Needs external prerequisites: Azure service principal + admin:org PAT, neither of which exists yet

---

Generated by Claude Code