add tofu auto-deployment workflows #4

	name: Apply OpenTofu plan

	on:
	workflow_dispatch: # manual trigger
	pull_request: # delete!
	push:
	branches:
	- main

	permissions:
	contents: read
	pull-requests: write

	jobs:
	apply:
	runs-on: ubuntu-latest
	name: Apply pre-prepared plan
	env:
	GITHUB_TOKEN: ${{ secrets.TF_GITHUB_TOKEN }}

	# FIXME: for daveadams/sshkey
	# (this only skips if no key is available in the registry)
	OPENTOFU_ENFORCE_GPG_VALIDATION: false

	TERRAFORM_PRE_RUN: \|
	export OPENTOFU_ENFORCE_GPG_VALIDATION=false

	# to access state db
	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: add ssh key
	uses: webfactory/[email protected]
	with:
	ssh-private-key: ${{ secrets.TF_SSH_PRIVATE_KEY }}

	- name: tofu apply
	uses: dflook/[email protected]
	with:
	label: dsekt-infra

Provide feedback