fix(terraform): make apply find the reviewed plan [NOJIRA]

[tobias0106]

Follow-up to #341. Three defects found while validating that workflow against the three Terraform repos — all of them block the first adopter.

1. Apply can never find the plan. Blocking.

terraform-stack.yml uploads tfplan-<slug>-${{ github.sha }}. On a pull_request event github.sha is the merge commit of refs/pull/N/merge — ephemeral, and equal to neither the commit that lands on main nor the PR head. Apply looks up the pushed commit, then falls back to .head.sha via /commits/{sha}/pulls. It matches neither, so every apply fails with No reviewed plan.

A merge queue does not rescue it: all three repos enforce required_linear_history, so the queue squashes or rebases and the landed SHA differs from the merge_group SHA too. None of the three has a merge queue configured today anyway.

Fix: name the artifact with github.event.pull_request.head.sha || github.sha. The download step's existing head-SHA fallback then resolves it for squash, rebase and merge-commit alike.

2. terraform-ok goes green on a failed discovery

Discovery deliberately hard-fails a stack with no accounts[] entry. That leaves terraform skipped, not failed, and [[ result != 'failure' ]] passes on skipped — so the only required status check reports success while nothing was planned. It now gates on discover too, and treats cancelled as a failure.

3. No way to pass per-account static keys

terraform-core has four AWS accounts with a key pair each (TERRAFORM_CORE_{INTERNAL,MONTA,PRODUCTION,STAGING}_AWS_*) and no OIDC roles yet — it is the suggested first adopter. The discover jq built a fixed {dir, role, environment, region} object and dropped every other key, so the caller had nothing to select a secret with, and GitHub expressions have no upper() to derive one from environment.

Discovery now passes through any key on the matched accounts[] entry except match:

aws-access-key-id: ${{ secrets[format('TERRAFORM_CORE_{0}_AWS_ACCESS_KEY_ID', matrix.stack.secret_key)] }}

Defaults and first-match-wins are unchanged; an unmatched stack still fails discovery.

Not fixed here

The over-wide fan-out already called out in #341. Still blocking for terraform-db-access, and worth landing before monta-app/terraform adopts: that repo's root main.tf declares its own S3 backend without a backend.tf, so any change to it fans out to all four stacks on apply.

🤖 Generated with Claude Code