Add manual "down" infrastructure workflow trigger and AWS credentials…

[forstmeier]

… configuration

Overview

Changes

• add manual "down" infrastructure workflow trigger
• add AWS credential configuration to "down" workflow

Comments

Manual triggers might get removed in the future but for now it will be helpful.

Summary by CodeRabbit

• Chores
  • Infrastructure teardown workflow can now be triggered manually in addition to scheduled runs.
  • Improved AWS credential configuration for more reliable authentication during infrastructure tasks.
  • Updated teardown process to use a token-based environment variable and a safer command execution approach.
  • Added a production AWS region configuration for deployments.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

The workflow .github/workflows/teardown_infrastructure.yaml was changed to allow manual triggers via workflow_dispatch, added job-level permissions (id-token: write, contents: read), inserted a Configure AWS credentials step using aws-actions/configure-aws-credentials@v5 (role-to-assume and region from secrets), and replaced the final dismantle step with flox/activate-action@v1, supplying PULUMI_ACCESS_TOKEN and overriding the command to run the Pulumi stack tear-down. infrastructure/Pulumi.production.yaml now sets config.aws:region.secure.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Trigger as Trigger (schedule / manual)
  participant Runner as GitHub Actions Runner
  participant AWS as AWS STS
  participant Flox as flox/activate-action (Pulumi)
  participant Pulumi as Pulumi engine

  Note over Trigger,Runner: Workflow starts
  Trigger->>Runner: start teardown_infrastructure workflow
  Runner->>AWS: aws-actions/configure-aws-credentials (assume role)
  AWS-->>Runner: short-lived AWS credentials
  Runner->>Runner: set AWS env creds
  Runner->>Flox: invoke flox/activate-action with PULUMI_ACCESS_TOKEN + command override
  Flox->>Pulumi: run `pulumi stack down` (masked)
  Pulumi-->>Flox: success / error
  Flox-->>Runner: action exit status
  Runner-->>Trigger: workflow complete (success/error)

Loading

Possibly related PRs

• Add automated infrastructure lifecycle management workflow #596 — Modifies GitHub Actions managing infrastructure lifecycle, including teardown steps using flox/activate-action and Pulumi commands.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the primary changes: adding a manual workflow trigger and AWS credentials configuration to the infrastructure teardown workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch add-manual-down-infrastructure-workflow-trigger

---

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b4c20c6 and 97bc454.

📒 Files selected for processing (2)

• .github/workflows/teardown_infrastructure.yaml
• infrastructure/Pulumi.production.yaml

✅ Files skipped from review due to trivial changes (1)

• infrastructure/Pulumi.production.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Run Rust code checks

🔇 Additional comments (2)

.github/workflows/teardown_infrastructure.yaml (2)

6-6: LGTM! Manual trigger capability added.

The workflow_dispatch trigger enables manual execution of the teardown workflow, which aligns with the PR objectives.

---

12-14: LGTM! OIDC permissions correctly configured.

The permissions block properly grants id-token: write and contents: read, which are required for OIDC-based AWS authentication. This addresses the concerns raised in previous reviews.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR enhances the teardown infrastructure workflow by adding manual trigger capability and AWS credential configuration. The changes enable both scheduled and on-demand infrastructure teardown operations with proper AWS authentication.

• Added workflow_dispatch trigger to allow manual execution of the teardown workflow
• Configured AWS credentials using IAM role assumption for the teardown job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 941b109 and b4c20c6.

📒 Files selected for processing (1)

• .github/workflows/teardown_infrastructure.yaml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Run Rust code checks

🔇 Additional comments (1)

.github/workflows/teardown_infrastructure.yaml (1)

6-6: LGTM! Manual trigger added correctly.

The workflow_dispatch trigger is properly configured, allowing operators to manually execute the teardown workflow when needed.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.