[marcosgilf]

Adds GitHub repository IaC and changes production deploys to release-only.

What changed

• Add infra/github/ Terraform, inspired by ../nanobot-iac/iac/github/:
  • repo settings (description, public visibility, squash/rebase only, delete branch on merge)
  • Issues on, Projects off, Wiki off
  • vulnerability alerts
  • Actions secret NETLIFY_AUTH_TOKEN
  • Actions variable NETLIFY_SITE_ID
  • Actions secret RELEASE_PLEASE_TOKEN
  • main branch ruleset requiring PRs and required checks (qa / qa, deploy-dev / deploy-dev)
• Release Please now requires RELEASE_PLEASE_TOKEN (PAT), instead of falling back to GITHUB_TOKEN.
  The latest failure was GitHub refusing to let GITHUB_TOKEN create PRs.
• Production deploy now triggers only on release.published via deploy-production.yml.
• ci.yml no longer deploys production on every push to main; it only runs QA and preview deploys.

Terraform validation

terraform -chdir=infra/github validate passes.

App checks

• pnpm check ✅
• pnpm test ✅

Manual apply steps after merge

Create infra/github/terraform.tfvars, then:

terraform -chdir=infra/github init
terraform -chdir=infra/github import github_repository.this timer
terraform -chdir=infra/github import github_repository_ruleset.main timer:20583655
terraform -chdir=infra/github plan
terraform -chdir=infra/github apply

Secrets/variables can be imported too, but first apply can also overwrite them from terraform.tfvars.

[github-actions]

🚀 Preview deploy: https://pr-8--timer-marcosgilf.netlify.app