Add secure Terraform release workflow

[gunzip]

Why

Deployment inputs are workflow-dispatch data and must not be trusted before code runs on credentialed self-hosted runners.

What changed

• Add a tested dx-task that validates the project/root relationship, immutable source commit, protected default branch, environment manifest, and required apply reviewers through the GitHub API.
• Pass the GitHub token through the default task dispatcher.
• Expose JSON task results from run-dx-task.
• Add a reusable workflow that plans, waits for environment approval, and applies the exact persisted plan.
• Rebuild the action bundle and add version plans for both user-facing projects.

The workflow is not connected to release-v2.yaml in this PR and is therefore inert.

Validation

• pnpm nx run-many -t test lint typecheck -p @pagopa/dx-tasks run-dx-task
• pnpm nx run run-dx-task:build

Depends on #1996.

Extracted from #1926.

[Copilot]

Pull request overview

This PR introduces a security-focused preflight validation step for Terraform environment releases, ensuring workflow-dispatch inputs are verified via the GitHub API before any credentialed self-hosted runner work begins. It also enhances the run-dx-task action to pass GitHub auth context and expose task return values as JSON, and adds an (currently inert) reusable workflow to plan/apply using the validated immutable commit.

Changes:

• Add validateTerraformEnvironmentRelease dx-task (with unit tests) that validates project/root mapping, protected default branch reachability, environment manifest, and required apply reviewers.
• Update the default dispatcher and run-dx-task action to pass a GitHub token through task context, and expose JSON task results as an action output.
• Add a workflow_dispatch Terraform environment release workflow that validates inputs, runs plan-upload, then applies a reviewed persisted plan.

Reviewed changes

Copilot reviewed 14 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/dx-tasks/src/tasks.ts	Registers the new validateTerraformEnvironmentRelease task definition.
packages/dx-tasks/src/index.ts	Exports the new validation task and its public types.
packages/dx-tasks/src/github/validate-terraform-environment-release.ts	Implements GitHub-API-based validation and trusted metadata resolution.
packages/dx-tasks/src/github/tests/validate-terraform-environment-release.test.ts	Unit tests covering validation and failure modes.
packages/dx-tasks/src/dispatcher.ts	Extends dispatcher context with githubToken.
packages/dx-tasks/src/default-dispatcher.ts	Wires githubToken into the default dispatcher context and registers the new task.
packages/dx-tasks/src/tests/default-dispatcher.test.ts	Adds dispatcher integration test coverage for the new task and Octokit mocks.
packages/dx-tasks/README.md	Documents the new available task.
actions/run-dx-task/src/index.ts	Reads GitHub token (currently via env) and sets JSON result output.
actions/run-dx-task/README.md	Documents the new result output contract.
actions/run-dx-task/dist/rolldown-runtime-DaDcL9Zw.mjs	Rebuilt bundled runtime output.
actions/run-dx-task/dist/es5-BIm4_leK.mjs	Rebuilt bundled dependency output.
actions/run-dx-task/action.yaml	Declares the new result output.
.nx/version-plans/version-plan-1784227063140.md	Version plan for run-dx-task action output change.
.nx/version-plans/version-plan-1784227055723.md	Version plan for @pagopa/dx-tasks new release validation task.
.github/workflows/release-terraform-environment-v1.yaml	Adds the new validated plan/approve/apply Terraform environment release workflow.

[github-actions]

Code Review Report

Terraform Plan: infra/policy/dev - ✅ Success

Plan: 2 to add, 0 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/dev - ✅ Success

Warning

Warning: Reference to undefined provider

on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1

There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".

If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws".

Plan: 0 to add, 1 to change, 27 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {

metric has been deprecated in favour of the enabled_metric property and
will be removed in v5.0 of the AzureRM provider

Plan: 0 to add, 7 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/dev - ✅ Success

Plan: 0 to add, 44 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/prod - ✅ Success

Plan: 0 to add, 2 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/dev - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.integration_tests_client_id[0],
on ../_modules/azure/custom_environments.tf line 16, in resource "github_actions_environment_secret" "integration_tests_client_id":
16: plaintext_value = azurerm_user_assigned_identity.integration_tests[0].client_id

Use value.

(and 26 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 3 to add, 14 to change, 14 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.automation_infra_cd_client_id,
on ../_modules/azure/custom_environments.tf line 32, in resource "github_actions_environment_secret" "automation_infra_cd_client_id":
32: plaintext_value = module.bootstrap.identities.infra.cd.client_id

Use value.

(and 23 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 14 to add, 16 to change, 58 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

---

Triggered by @gunzip, commit: a6820f90735f10c6da8a0e0db915c009b0d6cde4.