ci: add terraform apply workflow on platform changes

[vargas-jr]

Summary

GitHub Action that runs terraform apply when platform changes are merged to main.

Trigger

• Push to main branch
• Only when platform/** files are modified

Workflow Steps

1. Checkout code
2. Setup Terraform 1.7.0
3. Authenticate to GCP
4. Get GKE cluster credentials
5. terraform init
6. terraform validate
7. terraform plan
8. terraform apply

Required Secrets

Secret	Description
GCP_SA_KEY	GCP service account JSON key
DATABASE_URL	PostgreSQL connection string
ANTHROPIC_API_KEY	Anthropic API key

Required Variables

Variable	Description
GCP_PROJECT_ID	GCP project ID
GCP_REGION	GCP region (e.g. us-central1)
GKE_CLUSTER_NAME	Target GKE cluster name

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 5 additional findings in Devin Review.

[devin-ai-integration]

🟡 Script injection via unsanitized interpolation of vars.* into shell run block

The Get GKE credentials step directly interpolates ${{ vars.GKE_CLUSTER_NAME }}, ${{ vars.GCP_REGION }}, and ${{ vars.GCP_PROJECT_ID }} into a shell run: command. If any of these repository variables contain shell metacharacters (e.g., ; rm -rf / or $(malicious_command)), they will be interpreted by the shell, leading to arbitrary command execution in the CI runner.

Security Details and Recommended Fix

While vars.* are set by repository admins (not arbitrary PR authors), this is still a security anti-pattern per GitHub's security hardening guide. The recommended approach is to assign the values to environment variables first, then reference them in the shell:

- name: Get GKE credentials
  run: |
    gcloud container clusters get-credentials "$GKE_CLUSTER_NAME" \
      --region "$GCP_REGION" \
      --project "$GCP_PROJECT_ID"
  env:
    GKE_CLUSTER_NAME: ${{ vars.GKE_CLUSTER_NAME }}
    GCP_REGION: ${{ vars.GCP_REGION }}
    GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}

This ensures the values are passed as environment variables and properly quoted, preventing shell interpretation of special characters.

Impact: A compromised or misconfigured repository variable could lead to arbitrary command execution in the CI environment, potentially leaking secrets or modifying infrastructure.

Suggested change

	run: |
	gcloud container clusters get-credentials ${{ vars.GKE_CLUSTER_NAME }} \
	--region ${{ vars.GCP_REGION }} \
	--project ${{ vars.GCP_PROJECT_ID }}
	run: |
	gcloud container clusters get-credentials "$GKE_CLUSTER_NAME" \
	--region "$GCP_REGION" \
	--project "$GCP_PROJECT_ID"
	env:
	GKE_CLUSTER_NAME: ${{ vars.GKE_CLUSTER_NAME }}
	GCP_REGION: ${{ vars.GCP_REGION }}
	GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}

---

Was this helpful? React with 👍 or 👎 to provide feedback.