ci: add terraform plan and demo workflows (OIDC)

Author: Utyman28

.github/workflows/ci-terraform-plan.yml

@@ -0,0 +1,48 @@
+name: CI - Terraform Plan (OIDC)
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+        working-directory: terraform/environments/dev
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::588738591601:role/github-actions-cloudops-dev
+          aws-region: ca-central-1
+          role-session-name: gha-tf-plan
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: 1.7.5
+
+      - name: Terraform fmt (check)
+        run: terraform fmt -check -recursive
+
+      - name: Terraform init
+        run: terraform init -input=false
+
+      - name: Terraform validate
+        run: terraform validate
+
+      - name: Terraform plan
+        run: terraform plan -no-color -input=false
+

.github/workflows/demo-rebuild-validate-teardown.yml

@@ -0,0 +1,41 @@
+name: Demo - Rebuild, Validate, Teardown (OIDC)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  demo:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::588738591601:role/github-actions-cloudops-dev
+          aws-region: ca-central-1
+          role-session-name: gha-demo
+
+      - name: Make scripts executable
+        run: chmod +x scripts/*.sh
+
+      - name: Rebuild demo environment
+        run: ./scripts/rebuild-demo.sh
+
+      - name: Validate environment
+        run: ./scripts/validate-env.sh
+
+      # CRITICAL: always teardown even if rebuild/validate fails
+      - name: Teardown (always)
+        if: always()
+        run: ./scripts/teardown.sh
+