fix(opentofu): enforce environment-gated applies

[xnoto]

Summary

Assign the reusable workflow's existing environment input (default production) to the main-only OpenTofu apply job. The apply step emits OPENTOFU_ENVIRONMENT_GATED=true; consumers can use that marker to fail closed unless the shared environment-gated apply path invoked them.

Also document the caller requirement to create and protect the selected GitHub Environment before a main apply.

Fixes #

None — owner-approved OpenTofu apply-gate repair.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — ci / lint passed at b2e9fc3.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none apply.

Independent adversarial and infrastructure-security reviews found no remaining Critical/High source findings after the fail-safe marker was added. PR CI remains the validation authority.

Impact and rollout

Producer: this reusable workflow is consumed from @main by OpenTofu roots. After an explicitly approved merge, callers use the configured Environment (default production) for their main-only apply jobs.

Manual prerequisite: each caller owner must create and protect its selected GitHub Environment with required reviewers/protection rules. Current repository-setting state is unknown and must be confirmed before any production merge/apply.

Consumer safety: tfroot-gcp has a companion draft PR that only enables unattended apply when this workflow emits the marker. If that root were merged first, the current shared workflow omits the marker and the unattended apply fails at the interactive prompt rather than mutating production.

Rollback: revert this workflow change. The companion root remains fail-closed without the marker. Use squash merge to collapse the corrective branch history.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent materially produced this change. Reviewers should verify the apply job Environment assignment, marker scope, and unchanged PR test/plan behavior.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed