feat(terraform)!: accept scoped Cloudflare credentials (CTK-651)

[samuelho-dev]

Summary

The shared Terraform interface required a global Cloudflare key/email pair, blocking the scoped-token
cutover in CTK-647. This new immutable interface accepts cloudflare-api-token and exports only
CLOUDFLARE_API_TOKEN. Terraform callers without Cloudflare remain supported. Existing CTK callers
remain on their working old SHA until a scoped credential and controlled plan/apply/R2 proof exist.

Verification

Checksum-verified actionlint 1.7.12 passed both workflows. Disposable native reusable-workflow
callers passed with scoped credentials and without Cloudflare; obsolete global-key callers failed
with the expected undefined-secret error. The disposable files were removed. Owner-wide code search
found only SHA-pinned CTK callers and no direct @main consumers; repository documentation has no
legacy credential examples. No production or credential mutation was performed.

The requested CodeRabbit full review
covered both changed workflow files at this exact head and reported no actionable comments
(run 3a060c76-3ac1-46f9-ba76-f8fd6cfb26e7). This is not live provider/R2 authorization proof.

Reviewed immutable SHA: f9f6590dfc77b106ee82e4b698cfb7e0bb986864. This is the reviewed-interface prerequisite for P14,
not evidence that credential provisioning or the CTK caller migration is complete.

Fixes CTK-651

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3a060c76-3ac1-46f9-ba76-f8fd6cfb26e7

📥 Commits

Reviewing files that changed from the base of the PR and between c92a1ab and f9f6590.

📒 Files selected for processing (2)

• .github/workflows/terraform-apply.yml
• .github/workflows/terraform-plan.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Both reusable Terraform workflows replace the Cloudflare API key and email secrets with one scoped API token secret. Each workflow exports the token through CLOUDFLARE_API_TOKEN.

Changes

Cloudflare token workflow configuration

Layer / File(s)	Summary
Replace Cloudflare credentials .github/workflows/terraform-apply.yml, .github/workflows/terraform-plan.yml	Both workflows declare the optional cloudflare-api-token secret and replace the former CLOUDFLARE_API_KEY and CLOUDFLARE_EMAIL variables with CLOUDFLARE_API_TOKEN.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to f9f65

Terraform plan and apply workflows now use an optional scoped Cloudflare API token instead of the legacy key and email pair. The updated interface is consistent across both workflows, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: Terraform now accepts scoped Cloudflare credentials. The breaking-change marker and issue identifier provide useful context.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[samuelho-dev]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.