deploy-stack 0.15.2 → 0.16.0

package/README.md

@@ -48,6 +48,7 @@ You retain complete ownership of your infrastructure code without relying on bla
 * **Zero Vendor Lock-In:** Generates standard, readable Terraform (`.tf`) files. You own the infrastructure.
 * **Native S3 State Locking:** Automatically creates an encrypted S3 state bucket utilizing modern Terraform concurrency locking.
 * **Safe Iteration:** Idempotent CLI safely backs up existing configurations to `.bak` files to guarantee zero data loss.
+* **Ephemeral PR Previews (Opt-In):** Automatically spins up completely isolated AWS Fargate environments for every Pull Request and posts the live preview URL to GitHub, accelerating team code reviews.
 
 ---
 
@@ -57,6 +58,7 @@ Transitioning from PaaS to AWS involves a few architectural shifts. We've writte
 * [Managing Secrets & Environment Variables](./docs/guides/secrets-management.md)
 * [Zero-Trust Database Connections](./docs/guides/database-connections.md)
 * [Migrating Next.js from Vercel](./docs/migrations/nextjs-vercel-to-aws.md)
+* [Ephemeral PR Previews & AWS Costs](./docs/guides/ephemeral-pr-previews.md)
 
 ---
 
@@ -154,11 +156,11 @@ npx deploy-stack --no-telemetry
 
 ## 🗺️ Roadmap
 
-### Current Focus (Phase 6: Migration & Trust Engine)
-- [x] **Dry-Run Visualization:** Interactive pre-flight terminal UI with ASCII topology maps and precise, dynamic AWS cost estimation.
-- [x] **PaaS Importers:** Auto-parse `vercel.json` and Heroku `Procfile` configurations to map routing rules, web commands, and background workers automatically.
-- [x] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
-- [x] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+### Current Focus (Phase 7: Team Workflows & Ecosystem Integrations)
+- [x] **Ephemeral PR Previews:** Generate GitHub Actions workflows that spin up temporary ECS Fargate tasks and post live preview URLs directly in pull request comments to streamline team code reviews.
+- [ ] **AI Context Synchronization:** Implement `deploy-stack sync-ai` to automatically generate `.cursorrules` and AI context files, ensuring coding assistants generate accurate deployment commands tailored to the project.
+- [ ] **Native Ecosystem Integrations:** Publish seamless, push-button plugins across major frameworks. Targets include a `svelte-adapter-deploy-stack`, an official `create-next-app` AWS template, a `vite-plugin-deploy-stack`, a NestJS schematic, and a Django Cookiecutter template.
+- [ ] **Automated Troubleshooting:** Build `deploy-stack diagnose` (alias: `wtf`) to automatically analyze and troubleshoot common day-2 AWS operational issues (e.g., Fargate OOM kills, ALB 502s) directly from the terminal.
 
 👉 **[See the full project history and future plans in ROADMAP.md](./ROADMAP.md)**
 

package/docs/ROADMAP.md

@@ -16,8 +16,15 @@
 - [x] **Local Execution Wrapper:** Native `deploy-stack apply` command with terminal-optimized streaming to eliminate Terraform context switching.
 - [x] **Ecosystem Integrations:** Official plugins published to the Astro Integrations directory (`astro-deploy-stack`) and Nuxt module registry (`nuxt-deploy-stack`).
 
-### Phase 6: Migration & Trust Engine (Current)
+### Phase 6: Migration & Trust Engine (Completed)
 - [x] **Dry-Run Visualization:** Interactive pre-flight terminal UI with ASCII topology maps and precise, dynamic AWS cost estimation.
 - [x] **PaaS Importers:** Auto-parse `vercel.json` and Heroku `Procfile` configurations to map routing rules, web commands, and background workers automatically.
 - [x] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
-- [ ] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+- [x] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+
+### Phase 7: Team Workflows & Ecosystem Integrations (Current)
+*Focus: Enhance collaborative development and expand native support across major framework ecosystems.*
+- [x] **Ephemeral PR Previews:** Generate GitHub Actions workflows that spin up temporary ECS Fargate tasks and post live URLs directly in PR comments to streamline team code reviews.
+- [ ] **AI Context Synchronization:** Implement `deploy-stack sync-ai` to automatically generate `.cursorrules` and AI context files, ensuring IDE assistants understand the infrastructure.
+- [ ] **Native Ecosystem Integrations:** Publish push-button plugins across major frameworks (e.g., `svelte-adapter-deploy-stack`, `create-next-app` AWS template, `vite-plugin-deploy-stack`, NestJS deployment schematic, Django Cookiecutter).
+- [ ] **Automated Troubleshooting:** Build `deploy-stack diagnose` to auto-diagnose common day-2 AWS failures (e.g., Fargate OOM kills, ALB 502s) to establish immediate technical credibility and simplify maintenance.

package/docs/guides/ephemeral-pr-previews.md

@@ -0,0 +1,32 @@
+# 🚀 Ephemeral PR Previews
+
+When enabled, `deploy-stack` automatically configures your GitHub Actions pipeline to spin up isolated, temporary AWS environments every time a developer opens a Pull Request.
+
+A bot will comment on the PR with a live URL (e.g., `http://pr-123-your-app...`), allowing your team to test features, UI changes, and API updates before merging to `main`. When the PR is closed or merged, the environment is automatically destroyed.
+
+### 🏗️ How it Works
+
+Under the hood, `deploy-stack` utilizes **Terraform Workspaces**. 
+
+When a PR is opened, Terraform creates a new workspace (e.g., `pr-12`). It provisions a completely isolated Application Load Balancer and ECS Fargate Task using the exact same infrastructure definitions as your production environment, ensuring 100% parity.
+
+To save time and simplify architecture, PR environments **share** your production AWS Secrets Manager vault and ECR Image Repository.
+
+### ⚖️ The Rule of Thumb: Should I enable this?
+
+**✅ Enable PR Previews if:**
+* You are working on a team of 2+ developers and require visual QA or UX sign-off before merging code.
+* You are building a frontend application or full-stack monolith where seeing the live UI is critical.
+
+**❌ Do NOT enable PR Previews if:**
+* You are a solo developer (you can just test locally).
+* You have a massive volume of PRs (e.g., automated Dependabot updates). Spinning up an AWS Load Balancer takes ~3 minutes, which will slow down rapid automated merges.
+
+### 💰 AWS Cost Implications
+
+Because PR previews provision a real Application Load Balancer (ALB) and ECS Fargate compute tasks, **they are not free.**
+
+* **Compute:** You are charged standard AWS Fargate rates per minute while the PR environment is running.
+* **Load Balancing:** AWS charges ~$16/month per active Load Balancer. If a PR is open for 2 days, you pay the prorated ALB cost for those 48 hours (~$1.00).
+
+To keep costs low, ensure your team closes or merges Pull Requests promptly so the `teardown.yml` workflow can destroy the resources and stop the billing clock!

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "engines": {
     "node": ">=18.0.0"

package/src/commands/init.js

@@ -143,7 +143,8 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         DISABLE_DEFAULT_CI: disableDefaultCI,
         PROCFILE: procfile,
         VERCEL_RULES: vercelRules,
-        DOCKER_COMPOSE: dockerCompose
+        DOCKER_COMPOSE: dockerCompose,
+        ENABLE_PR_PREVIEWS: config.enablePrPreviews
     });
 
     // 8. Telemetry
@@ -169,6 +170,7 @@ export async function mainStack({ isHeadless = false, headlessOptions = {} } = {
         is_heroku_migration: !!procfile,
         is_vercel_migration: !!vercelRules,
         is_docker_compose: !!dockerCompose,
+        has_pr_previews: config.enablePrPreviews,
     });
 
     s.stop('Infrastructure provisioned successfully!');

package/src/utils/generator.js

@@ -26,6 +26,12 @@ export async function generateTemplates(targetDir, config) {
         { src: 'README.md', dest: 'README.md' }
     ];
 
+    // 2.1 Add Ephemeral PR workflows only if opted in
+    if (config.ENABLE_PR_PREVIEWS) {
+        filesToProcess.push({ src: 'github/preview.yml', dest: '.github/workflows/preview.yml' });
+        filesToProcess.push({ src: 'github/teardown.yml', dest: '.github/workflows/teardown.yml' });
+    }
+
     // 3. Configure Compute Commands & Environment Variables
     let secretsArray = [];
 
@@ -122,7 +128,7 @@ export async function generateTemplates(targetDir, config) {
 
     // 4.1. Inject Rails Master Key if applicable
     if (config.finalFramework === 'rails') {
-        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${aws_secretsmanager_secret.app_secrets.arn}:RAILS_MASTER_KEY::" }`);
+        secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${local.secret_arn}:RAILS_MASTER_KEY::" }`);
 
         initialSecretMap += `,\n    RAILS_MASTER_KEY = var.rails_master_key`;
 

package/src/utils/prompts.js

@@ -46,6 +46,7 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
             desiredCount: headlessOptions.desiredCount || '1',
             branch: headlessOptions.branch || 'main',
             needsDatabase: false,
+            enablePrPreviews: headlessOptions.enablePrPreviews || false,
             setupType: 'headless'
         };
     }
@@ -99,6 +100,16 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
         needsDatabase = dbChoice;
     }
 
+    let enablePrPreviews = false;
+    if (setupType === 'advanced') {
+        const prChoice = await confirm({
+            message: `Enable Ephemeral PR Previews? (Spins up isolated, temporary AWS environments for PRs)\n  ${color.gray('📖 Learn more: https://github.com/anton-codes-iac/deploy-stack/blob/main/docs/guides/ephemeral-pr-previews.md')}`,
+            initialValue: false,
+        });
+        if (typeof prChoice === 'symbol') process.exit(0);
+        enablePrPreviews = prChoice;
+    }
+
     const project = await group({
         region: () => select({
             message: 'Which AWS region do you want to deploy to?',
@@ -151,6 +162,7 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
         desiredCount: project.desiredCount || '1',
         branch: project.branch || currentGitBranch,
         needsDatabase,
+        enablePrPreviews,
         setupType
     };
 }

package/templates/github/preview.yml

@@ -0,0 +1,69 @@
+name: Ephemeral PR Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+env:
+  AWS_REGION: {{REGION}}
+  ECR_REPOSITORY: {{PROJECT_NAME}}-repo
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write # Required to post the comment
+
+jobs:
+  deploy-preview:
+    name: Provision Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build and Push Docker image
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+        run: |
+          # We tag the image specifically for this PR workspace
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }} .
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.WORKSPACE }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Apply
+        id: tf-apply
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Create or select the workspace specific to this PR
+          terraform workspace select -or-create ${{ env.WORKSPACE }}
+          terraform apply -auto-approve
+          
+          # Extract the ALB URL to post to GitHub
+          ALB_URL=$(terraform output -raw alb_direct_url)
+          echo "PREVIEW_URL=$ALB_URL" >> $GITHUB_ENV
+
+      - name: Comment PR
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `🚀 **Preview Environment Deployed!**\n\nYour ephemeral AWS Fargate environment is live at:\n[${process.env.PREVIEW_URL}](${process.env.PREVIEW_URL})\n\n_This environment will be automatically destroyed when the PR is merged or closed._\n\n---\n<div align="right"><sup>☁️ Generated by <a href="https://github.com/anton-codes-iac/deploy-stack">deploy-stack</a></sup></div>`
+            })

package/templates/github/teardown.yml

@@ -0,0 +1,43 @@
+name: Destroy PR Preview
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  AWS_REGION: {{REGION}}
+  WORKSPACE: pr-${{ github.event.pull_request.number }}
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  destroy-preview:
+    name: Teardown Preview Environment
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::{{AWS_ACCOUNT_ID}}:role/{{PROJECT_NAME}}-github-actions-role
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+
+      - name: Terraform Init & Destroy
+        working-directory: ./terraform
+        run: |
+          terraform init
+          # Select the PR workspace
+          terraform workspace select ${{ env.WORKSPACE }}
+          # Destroy all resources in this workspace safely
+          terraform destroy -auto-approve
+          # Switch back to default and delete the PR workspace
+          terraform workspace select default
+          terraform workspace delete ${{ env.WORKSPACE }}

package/templates/terraform/database.tf

@@ -6,19 +6,19 @@ resource "aws_subnet" "db_isolated" {
   availability_zone = data.aws_availability_zones.available.names[count.index]
 
   tags = {
-    Name = "{{PROJECT_NAME}}-db-isolated-${count.index}"
+    Name = "${local.app_name}-db-isolated-${count.index}"
   }
 }
 
 resource "aws_db_subnet_group" "main" {
-  name       = "{{PROJECT_NAME}}-db-subnet-group"
+  name       = "${local.app_name}-db-subnet-group"
   subnet_ids = aws_subnet.db_isolated[*].id
 }
 
 # 2. Database Security Group
 resource "aws_security_group" "rds" {
-  name        = "{{PROJECT_NAME}}-rds-sg"
-  vpc_id      = aws_vpc.main.id
+  name   = "${local.app_name}-rds-sg"
+  vpc_id = aws_vpc.main.id
 
   # ONLY allow inbound traffic from the ECS Fargate tasks
   ingress {
@@ -31,31 +31,31 @@ resource "aws_security_group" "rds" {
 
 # 3. The PostgreSQL Instance
 resource "aws_db_instance" "postgres" {
-  identifier                  = "{{PROJECT_NAME}}-db"
-  engine                      = "postgres"
-  engine_version              = "16"
-  instance_class              = "db.t4g.micro"
-  allocated_storage           = 20
-  storage_encrypted           = true
-  
+  identifier        = "${local.app_name}-db"
+  engine            = "postgres"
+  engine_version    = "16"
+  instance_class    = "db.t4g.micro"
+  allocated_storage = 20
+  storage_encrypted = true
+
   # Clean up dashes for the database name (e.g. my-project -> my_project)
-  db_name                     = replace("{{PROJECT_NAME}}", "-", "_") 
-  username                    = "dbadmin"
-  
+  db_name  = replace("${local.app_name}", "-", "_")
+  username = "dbadmin"
+
   # AWS automatically creates and manages the secret in Secrets Manager!
-  manage_master_user_password = true 
+  manage_master_user_password = true
 
-  db_subnet_group_name        = aws_db_subnet_group.main.name
-  vpc_security_group_ids      = [aws_security_group.rds.id]
-  
-  skip_final_snapshot         = true
-  publicly_accessible         = false
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  vpc_security_group_ids = [aws_security_group.rds.id]
+
+  skip_final_snapshot = true
+  publicly_accessible = false
 }
 
 # 4. IAM Permission for RDS Master Password Secret
 resource "aws_iam_role_policy" "rds_secret_access" {
-  name   = "{{PROJECT_NAME}}-rds-secret-policy"
-  role   = aws_iam_role.execution_role.id
+  name = "${local.app_name}-rds-secret-policy"
+  role = aws_iam_role.execution_role.id
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
@@ -68,4 +68,4 @@ resource "aws_iam_role_policy" "rds_secret_access" {
       }
     ]
   })
-}
+}

package/templates/terraform/main.tf

@@ -12,16 +12,23 @@ provider "aws" {
 locals {
   # Safely read the keys generated by the CLI, default to empty list if file doesn't exist
   secret_keys = fileexists("${path.module}/secret_keys.json") ? jsondecode(file("${path.module}/secret_keys.json")) : []
+  
+  # Workspace suffix for PR preview environments (e.g., "-pr-123"). Empty for production.
+  env_suffix = terraform.workspace == "default" ? "" : "-${terraform.workspace}"
+  
+  # Dynamic naming variable to prevent collisions
+  app_name = "{{PROJECT_NAME}}${local.env_suffix}"
 }
 
 # --- CloudWatch Logs ---
 resource "aws_cloudwatch_log_group" "app_logs" {
-  name              = "/ecs/{{PROJECT_NAME}}"
+  name              = "/ecs/${local.app_name}"
   retention_in_days = 14
 }
 
-# --- ECR Repository ---
+# --- ECR Repository (Shared across workspaces) ---
 resource "aws_ecr_repository" "app" {
+  count                = terraform.workspace == "default" ? 1 : 0
   name                 = "{{PROJECT_NAME}}-repo"
   # trivy:ignore:AVD-AWS-0031 - Mutable tags allow the CI/CD pipeline to reuse the 'latest' tag for simplified deployments
   image_tag_mutability = "MUTABLE"
@@ -32,6 +39,16 @@ resource "aws_ecr_repository" "app" {
   }
 }
 
+# In PR workspaces, fetch the existing production repository
+data "aws_ecr_repository" "existing_app" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-repo"
+}
+
+locals {
+  ecr_url = terraform.workspace == "default" ? aws_ecr_repository.app[0].repository_url : data.aws_ecr_repository.existing_app[0].repository_url
+}
+
 # --- IAM: Execution Role ---
 # Allows the underlying AWS Fargate agent to pull images and push logs
 data "aws_iam_policy_document" "ecs_trust" {
@@ -45,7 +62,7 @@ data "aws_iam_policy_document" "ecs_trust" {
 }
 
 resource "aws_iam_role" "execution_role" {
-  name               = "{{PROJECT_NAME}}-execution-role"
+  name               = "${local.app_name}-execution-role"
   assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
 }
 
@@ -57,18 +74,18 @@ resource "aws_iam_role_policy_attachment" "execution_role_policy" {
 # --- IAM: Task Role ---
 # Allows your application code running INSIDE the container to access AWS services
 resource "aws_iam_role" "task_role" {
-  name               = "{{PROJECT_NAME}}-task-role"
+  name               = "${local.app_name}-task-role"
   assume_role_policy = data.aws_iam_policy_document.ecs_trust.json
 }
 
 # --- ECS Cluster ---
 resource "aws_ecs_cluster" "main" {
-  name = "{{PROJECT_NAME}}-cluster"
+  name = "${local.app_name}-cluster"
 }
 
 # --- ECS Task Definition ---
 resource "aws_ecs_task_definition" "app" {
-  family                   = "{{PROJECT_NAME}}-task"
+  family                   = "${local.app_name}-task"
   network_mode             = "awsvpc"
   requires_compatibilities = ["FARGATE"]
   cpu                      = "{{CPU}}"
@@ -78,8 +95,8 @@ resource "aws_ecs_task_definition" "app" {
 
   container_definitions = jsonencode([
     {
-      name      = "{{PROJECT_NAME}}-container"
-      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      name      = "${local.app_name}-container"
+      image     = "${local.ecr_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
       essential = true
 
       environment = [
@@ -92,7 +109,7 @@ resource "aws_ecs_task_definition" "app" {
         [
           for key in local.secret_keys : {
             name      = key
-            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+            valueFrom = "${local.secret_arn}:${key}::"
           }
         ],
         [
@@ -125,7 +142,7 @@ resource "aws_ecs_task_definition" "app" {
 # --- Application Load Balancer ---
 # trivy:ignore:AVD-AWS-0053 - This ALB is intended to be publicly facing behind CloudFront
 resource "aws_lb" "main" {
-  name               = "{{SAFE_ALB_NAME}}-alb"
+  name               = substr("${local.app_name}-alb", 0, 32)
   load_balancer_type = "application"
   security_groups    = [aws_security_group.alb.id]
   subnets            = aws_subnet.public[*].id
@@ -133,7 +150,7 @@ resource "aws_lb" "main" {
 }
 
 resource "aws_lb_target_group" "app" {
-  name        = "{{SAFE_ALB_NAME}}-tg"
+  name        = substr("${local.app_name}-tg", 0, 32)
   port        = {{PORT}}
   protocol    = "HTTP"
   vpc_id      = aws_vpc.main.id
@@ -163,7 +180,7 @@ resource "aws_lb_listener" "http" {
 
 # --- ECS Service ---
 resource "aws_ecs_service" "app" {
-  name            = "{{PROJECT_NAME}}-service"
+  name            = "${local.app_name}-service"
   cluster         = aws_ecs_cluster.main.id
   task_definition = aws_ecs_task_definition.app.arn
   launch_type     = "FARGATE"
@@ -177,7 +194,7 @@ resource "aws_ecs_service" "app" {
 
   load_balancer {
     target_group_arn = aws_lb_target_group.app.arn
-    container_name   = "{{PROJECT_NAME}}-container"
+    container_name   = "${local.app_name}-container"
     container_port   = {{PORT}}
   }
 
@@ -194,7 +211,7 @@ resource "aws_iam_role_policy" "secrets_policy" {
       {
         Effect = "Allow"
         Action = ["secretsmanager:GetSecretValue"]
-        Resource = [aws_secretsmanager_secret.app_secrets.arn]
+        Resource = [local.secret_arn]
       }
     ]
   })
@@ -208,12 +225,12 @@ output "alb_direct_url" {
 
 output "ecr_repository_url" {
   description = "The URL of the ECR repository"
-  value       = aws_ecr_repository.app.repository_url
+  value       = local.ecr_url
 }
 
 # --- CloudWatch Alarms ---
 resource "aws_cloudwatch_metric_alarm" "alb_5xx_errors" {
-  alarm_name          = "{{PROJECT_NAME}}-high-5xx-errors"
+  alarm_name          = "${local.app_name}-high-5xx-errors"
   comparison_operator = "GreaterThanThreshold"
   evaluation_periods  = "2"
   metric_name         = "HTTPCode_Target_5XX_Count"

package/templates/terraform/network.tf

@@ -5,7 +5,7 @@ resource "aws_vpc" "main" {
   enable_dns_support   = true
 
   tags = {
-    Name = "{{PROJECT_NAME}}-vpc"
+    Name = "${local.app_name}-vpc"
   }
 }
 
@@ -28,7 +28,7 @@ resource "aws_subnet" "public" {
   map_public_ip_on_launch = true
 
   tags = {
-    Name = "{{PROJECT_NAME}}-public-subnet-${count.index + 1}"
+    Name = "${local.app_name}-public-subnet-${count.index + 1}"
   }
 }
 
@@ -50,7 +50,7 @@ resource "aws_route_table_association" "public" {
 # --- Security Groups ---
 # ALB SG: Allow public internet access on HTTP
 resource "aws_security_group" "alb" {
-  name        = "{{PROJECT_NAME}}-alb-sg"
+  name        = "${local.app_name}-alb-sg"
   description = "Allow inbound HTTP to ALB"
   vpc_id      = aws_vpc.main.id
 
@@ -72,7 +72,7 @@ resource "aws_security_group" "alb" {
 
 # ECS SG: Allow traffic ONLY from the ALB on the app's specific port
 resource "aws_security_group" "ecs_tasks" {
-  name        = "{{PROJECT_NAME}}-ecs-sg"
+  name        = "${local.app_name}-ecs-sg"
   description = "Allow inbound access from the ALB only"
   vpc_id      = aws_vpc.main.id
 

package/templates/terraform/oidc.tf

@@ -9,9 +9,9 @@ variable "create_oidc_provider" {
   default     = true
 }
 
-# Register GitHub as an Identity Provider in AWS
+# Register GitHub as an Identity Provider in AWS (Production Only)
 resource "aws_iam_openid_connect_provider" "github" {
-  count           = var.create_oidc_provider ? 1 : 0
+  count           = (var.create_oidc_provider && terraform.workspace == "default") ? 1 : 0
   url             = "https://token.actions.githubusercontent.com"
   client_id_list  = ["sts.amazonaws.com"]
   thumbprint_list = [data.tls_certificate.github.certificates[0].sha1_fingerprint]
@@ -19,18 +19,19 @@ resource "aws_iam_openid_connect_provider" "github" {
 
 # Reference the Provider (whether newly created or already existing)
 data "aws_iam_openid_connect_provider" "github_existing" {
-  count = var.create_oidc_provider ? 0 : 1
-  url = "https://token.actions.githubusercontent.com"
+  count = (var.create_oidc_provider && terraform.workspace == "default") ? 0 : 1
+  url   = "https://token.actions.githubusercontent.com"
 }
 
 # Dynamically pick the ARN of the provider based on the variable
 locals {
-  github_provider_arn = var.create_oidc_provider ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github_existing[0].arn
+  github_provider_arn = (var.create_oidc_provider && terraform.workspace == "default") ? aws_iam_openid_connect_provider.github[0].arn : data.aws_iam_openid_connect_provider.github_existing[0].arn
 }
 
 # Create the IAM Role that GitHub Actions will assume
 resource "aws_iam_role" "github_actions" {
-  name = "{{PROJECT_NAME}}-github-actions-role"
+  count = terraform.workspace == "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-github-actions-role"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -44,10 +45,10 @@ resource "aws_iam_role" "github_actions" {
         Condition = {
           StringLike = {
             # ⚠️ SECURITY: Update "repo:*" to "repo:your-github-username/your-repo-name:*" in production
-            "token.actions.githubusercontent.com:sub" : "repo:*" 
+            "token.actions.githubusercontent.com:sub" : "repo:*"
           }
           StringEquals = {
-            "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
+            "token.actions.githubusercontent.com:aud" : "sts.amazonaws.com"
           }
         }
       }
@@ -57,6 +58,7 @@ resource "aws_iam_role" "github_actions" {
 
 # Grant the CI/CD pipeline permissions to provision infrastructure
 resource "aws_iam_role_policy_attachment" "github_actions_admin" {
-  role       = aws_iam_role.github_actions.name
-  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess" 
-}
+  count      = terraform.workspace == "default" ? 1 : 0
+  role       = aws_iam_role.github_actions[0].name
+  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
+}

package/templates/terraform/secrets.tf

@@ -1,10 +1,24 @@
-# --- AWS Secrets Manager ---
+# --- Shared AWS Secrets Manager ---
+
+# 1. Only create the Secret Vault in the default (production) workspace
 resource "aws_secretsmanager_secret" "app_secrets" {
+  count                   = terraform.workspace == "default" ? 1 : 0
   name                    = "{{PROJECT_NAME}}-secrets"
   description             = "Environment variables for {{PROJECT_NAME}}"
   recovery_window_in_days = 0 # Allows instant deletion for dev/POC environments
 }
 
+# 2. Fetch the existing Secret Vault when running in a PR workspace
+data "aws_secretsmanager_secret" "existing_secrets" {
+  count = terraform.workspace != "default" ? 1 : 0
+  name  = "{{PROJECT_NAME}}-secrets"
+}
+
+# 3. Export a single local variable that works in both environments
+locals {
+  secret_arn = terraform.workspace == "default" ? aws_secretsmanager_secret.app_secrets[0].arn : data.aws_secretsmanager_secret.existing_secrets[0].arn
+}
+
 # Fallback dummy key for CI/CD environments where the real key isn't present
 variable "rails_master_key" {
   type    = string
@@ -13,7 +27,8 @@ variable "rails_master_key" {
 
 # Initial placeholder secret so the ECS task doesn't fail on first boot
 resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
-  secret_id = aws_secretsmanager_secret.app_secrets.id
+  count         = terraform.workspace == "default" ? 1 : 0
+  secret_id     = aws_secretsmanager_secret.app_secrets[0].id
   secret_string = jsonencode({{INITIAL_SECRET_MAP}})
 
   lifecycle {

package/templates/terraform/worker.tf

@@ -1,6 +1,6 @@
 # --- Worker ECS Task Definition ---
 resource "aws_ecs_task_definition" "worker" {
-  family                   = "{{PROJECT_NAME}}-worker-task"
+  family                   = "${local.app_name}-worker-task"
   network_mode             = "awsvpc"
   requires_compatibilities = ["FARGATE"]
   cpu                      = "{{CPU}}"
@@ -10,8 +10,8 @@ resource "aws_ecs_task_definition" "worker" {
 
   container_definitions = jsonencode([
     {
-      name      = "{{PROJECT_NAME}}-worker-container"
-      image     = "${aws_ecr_repository.app.repository_url}:latest"
+      name      = "${local.app_name}-worker-container"
+      image     = "${aws_ecr_repository.app.repository_url}:${terraform.workspace == "default" ? "latest" : terraform.workspace}"
       essential = true
 
       environment = [
@@ -23,7 +23,7 @@ resource "aws_ecs_task_definition" "worker" {
         [
           for key in local.secret_keys : {
             name      = key
-            valueFrom = "${aws_secretsmanager_secret.app_secrets.arn}:${key}::"
+            valueFrom = "${local.secret_arn}:${key}::"
           }
         ],
         [
@@ -48,7 +48,7 @@ resource "aws_ecs_task_definition" "worker" {
 # --- Worker ECS Service ---
 # Notice there is NO load_balancer block. This service is strictly private.
 resource "aws_ecs_service" "worker" {
-  name            = "{{PROJECT_NAME}}-worker-service"
+  name            = "${local.app_name}-worker-service"
   cluster         = aws_ecs_cluster.main.id
   task_definition = aws_ecs_task_definition.worker.arn
   launch_type     = "FARGATE"