cortexapps-cli 1.38.0__tar.gz → 1.40.0__tar.gz

{cortexapps_cli-1.38.0 → cortexapps_cli-1.40.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortexapps-cli
-Version: 1.38.0
+Version: 1.40.0
 Summary: Command Line Interface for cortexapps
 License: MIT
 License-File: LICENSE

{cortexapps_cli-1.38.0 → cortexapps_cli-1.40.0}/cortexapps_cli/commands/solutions.py

@@ -568,7 +568,84 @@ def _apply_hyperlinks(line: str, entity_tags: set[str], ui_url: str) -> str:
     return "".join(parts)
 
 
-def _show_diagram(readme: str, entity_tags: set[str] | None = None, ui_url: str = "https://app.getcortexapp.com") -> None:
+_GITHUB_BLOB = "https://github.com/cortexapps/cli/blob/main/cortexapps_cli/solutions"
+
+
+def _parse_tf_tags_by_type(solution_dir: Path) -> tuple[set[str], set[str]]:
+    """Scan *.tf files under _templates/<solution>/ and return (entity_tags, scorecard_tags)."""
+    entity_tags: set[str] = set()
+    scorecard_tags: set[str] = set()
+    templates = next(
+        (d for d in (solution_dir / "_templates").iterdir() if d.is_dir() and not d.name.endswith("-delta")),
+        None,
+    ) if (solution_dir / "_templates").exists() else None
+    if templates is None:
+        return entity_tags, scorecard_tags
+    for tf in templates.glob("*.tf"):
+        current_type: str | None = None
+        depth = 0
+        for line in tf.read_text(encoding="utf-8").split("\n"):
+            m = re.match(r'\s*resource\s+"(cortex_\w+)"\s+"[^"]+"\s*\{', line)
+            if m:
+                current_type = m.group(1)
+                depth = 1
+                continue
+            if current_type:
+                depth += line.count("{") - line.count("}")
+                if depth <= 0:
+                    current_type = None
+                    depth = 0
+                    continue
+                tm = re.search(r'\btag\s*=\s*"([^"]+)"', line)
+                if tm:
+                    if current_type == "cortex_catalog_entity":
+                        entity_tags.add(tm.group(1))
+                    elif current_type == "cortex_scorecard":
+                        scorecard_tags.add(tm.group(1))
+    return entity_tags, scorecard_tags
+
+
+def _extract_tf_entity_tags(solution_dir: Path) -> set[str]:
+    """Return only cortex_catalog_entity tags from .tf template files."""
+    entity_tags, _ = _parse_tf_tags_by_type(solution_dir)
+    return entity_tags
+
+
+
+def _apply_file_hyperlinks(line: str, solution_tag: str) -> str:
+    """Replace bare filenames in the diagram with OSC 8 links to GitHub blob URLs."""
+    base = f"{_GITHUB_BLOB}/{solution_tag}/_templates/{solution_tag}"
+    parts = []
+    i = 0
+    while i < len(line):
+        # Look for a word boundary start: not alphanumeric/hyphen/dot before current pos
+        for filename in sorted(
+            (f for f in [
+                "teams.tf", "ecommerce.tf", "supply-chain.tf", "scorecards.tf",
+                "provider.tf", "variables.tf", "terraform.tfvars",
+            ] if line.find(f, i) == i),
+            key=len, reverse=True,
+        ):
+            after = i + len(filename)
+            # Ensure word boundary after: next char must not be alphanumeric
+            if after < len(line) and (line[after].isalnum() or line[after] in "-_."):
+                continue
+            parts.append(_osc8(f"{base}/{filename}", filename))
+            i = after
+            break
+        else:
+            parts.append(line[i])
+            i += 1
+    return "".join(parts)
+
+
+
+def _show_diagram(
+    readme: str,
+    entity_tags: set[str] | None = None,
+    ui_url: str = "https://app.getcortexapp.com",
+    solution_tag: str = "",
+) -> None:
     block = _extract_first_codeblock(readme)
     if not block:
         return
@@ -577,23 +654,26 @@ def _show_diagram(readme: str, entity_tags: set[str] | None = None, ui_url: str
 
     print()
     for line in block.split("\n"):
-        if entity_tags and links_supported:
-            line = _apply_hyperlinks(line, entity_tags, ui_url)
+        if links_supported:
+            if entity_tags:
+                line = _apply_hyperlinks(line, entity_tags, ui_url)
+            if solution_tag:
+                line = _apply_file_hyperlinks(line, solution_tag)
         # Use print() not console.print(): Rich counts OSC 8 escape bytes as
         # visible characters, shifting ASCII art alignment.
         print(f"  {line}")
 
     if entity_tags and not links_supported:
-        diagram_tags = sorted(
+        entity_rows = sorted(
             (tag for tag in entity_tags if tag in block),
             key=lambda t: t.lower(),
         )
-        if diagram_tags:
+        if entity_rows:
             print()
             table = Table(show_header=True, header_style="bold", box=None, padding=(0, 2, 0, 0))
             table.add_column("Entity")
             table.add_column("URL")
-            for tag in diagram_tags:
+            for tag in entity_rows:
                 table.add_row(tag, f"{ui_url}/admin/resources?tag={tag}")
             console.print(table)
 
@@ -612,18 +692,21 @@ def _post_install_menu(
     import_report: str = "",
     entity_tags: set[str] | None = None,
     ui_url: str = "https://app.getcortexapp.com",
+    solution_tag: str = "",
 ) -> None:
     options = [
         ("1", "Data Model"),
         ("2", "Next steps"),
-        ("3", "Import report"),
-        ("4", "Exit"),
     ]
     actions = {
-        "1": lambda: _show_diagram(readme, entity_tags=entity_tags, ui_url=ui_url),
+        "1": lambda: _show_diagram(readme, entity_tags=entity_tags, ui_url=ui_url, solution_tag=solution_tag),
         "2": lambda: _show_next_steps(readme),
-        "3": lambda: (console.print(), typer.echo(import_report)),
     }
+    if import_report:
+        options.append(("3", "Import report"))
+        actions["3"] = lambda: (console.print(), typer.echo(import_report))
+    exit_key = str(len(options) + 1)
+    options.append((exit_key, "Exit"))
 
     while True:
         console.print()
@@ -634,7 +717,7 @@ def _post_install_menu(
 
         choice = Prompt.ask("Choice", choices=[k for k, _ in options], show_choices=False)
 
-        if choice == "4":
+        if choice == exit_key:
             break
         actions[choice]()
 
@@ -731,9 +814,23 @@ def install(
                     with as_file(root / solution) as sp:
                         resources = _collect_solution_resources(sp)
                 entity_tags = set(resources.get("catalog", []))
+                if solutions_dir:
+                    entity_tags |= _extract_tf_entity_tags(root / solution)
+                else:
+                    with as_file(root / solution) as sp:
+                        entity_tags |= _extract_tf_entity_tags(sp)
             except Exception:
                 pass
-            _post_install_menu(readme, import_report=output, entity_tags=entity_tags, ui_url=ui_url)
+            has_import_results = bool(
+                total_match and (int(total_match.group(1)) > 0 or int(total_match.group(2)) > 0)
+            )
+            _post_install_menu(
+                readme,
+                import_report=output if has_import_results else "",
+                entity_tags=entity_tags,
+                ui_url=ui_url,
+                solution_tag=solution,
+            )
 
 
 @app.command(name="post-install")

{cortexapps_cli-1.38.0 → cortexapps_cli-1.40.0}/cortexapps_cli/solutions/harness-deploy/setup.py

@@ -231,7 +231,7 @@ class HarnessDeploySetup(SolutionSetup):
         base_url = self._answers["cortex_base_url"].rstrip("/")
         app_url = base_url.replace("api.", "app.", 1) if "api." in base_url else base_url
         entity_tag = self._answers["entity_tag"]
-        cortex_url = f"{app_url}/admin/resources?tag={entity_tag}"  # /admin/resources is the correct URL path (entity terminology in UI)
+        cortex_url = f"{app_url}/admin/resources?tag={entity_tag}"
 
         harness_pipeline_url = (
             f"{self._harness_base()}/ng/account/{self._harness_account()}"

cortexapps_cli-1.40.0/cortexapps_cli/solutions/kubernetes-agent/README.md

@@ -0,0 +1,137 @@
+---
+name: Kubernetes Agent
+description: Deploy the Cortex Kubernetes agent to a kind cluster in a GitHub Codespace, or to any existing Kubernetes cluster, to demonstrate live workload discovery and k8s integration.
+---
+
+# Kubernetes Agent Solution
+
+Demonstrates the [Cortex Kubernetes agent](https://docs.cortex.io/docs/reference/integrations/kubernetes) integration. Supports two deployment paths:
+
+- **GitHub Codespace** — creates a Codespace with a local [kind](https://kind.sigs.k8s.io) cluster automatically (no cluster setup required)
+- **Existing cluster** — deploys to any Kubernetes cluster already configured in your `kubectl` context
+
+## What this installs
+
+- **Cortex k8s-agent** — connects your cluster to Cortex and syncs workload metadata
+- **Demo workloads** — Deployment, StatefulSet, CronJob, and Argo Rollout, all tagged `demo-kubernetes`
+- **demo-kubernetes** — a Cortex service entity that the workloads annotate to
+
+After setup, visit your entity's K8s tab to see live workload data synced from the cluster.
+
+## Data Model
+
+```
+  GitHub Codespace
+  ┌──────────────────────────────────────────────────────────┐
+  │  kind cluster (cortex-demo)                              │
+  │  ┌────────────────────────────────────────────────────┐  │
+  │  │                                                    │  │
+  │  │  ┌─────────────────┐   ┌──────────────────────┐    │  │
+  │  │  │  Kubernetes API │◀──│  cortex-k8s-agent    │    │  │
+  │  │  │  Server         │   │  (polls every 5 min) │    │  │
+  │  │  └─────────────────┘   └──────────┬───────────┘    │  │
+  │  │                                   │ HTTPS push     │  │
+  │  │  ┌──────────────────────────────┐ │                │  │
+  │  │  │  demo workloads              │ │                │  │
+  │  │  │  Deployment · StatefulSet    │ │                │  │
+  │  │  │  CronJob · Argo Rollout      │ │                │  │
+  │  │  └──────────────────────────────┘ │                │  │
+  │  └────────────────────────────────────────────────────┘  │
+  └──────────────────────────────────┬───────────────────────┘
+                                     ▼
+                           ┌─────────────────┐
+                           │  Cortex         │
+                           │  Platform       │
+                           └─────────────────┘
+```
+
+The agent runs inside the cluster as a Deployment. Every 5 minutes it queries the Kubernetes API for workload resources and pushes the metadata to Cortex over HTTPS. Cortex surfaces the data on each entity's K8s tab.
+
+## Prerequisites
+
+- A Cortex API key (`CORTEX_API_KEY`) — get from Cortex Settings → API Keys
+- A GitHub PAT provided by Cortex Customer Engineering (`GHCR_TOKEN`) — required to pull the k8s-agent image; see [Kubernetes prerequisites](https://docs.cortex.io/ingesting-data-into-cortex/integrations/kubernetes#prerequisites)
+
+**For the GitHub Codespace path only:**
+- The [gh CLI](https://cli.github.com) installed and authenticated (`gh auth login`)
+
+**For the existing cluster path only:**
+- `kubectl`, `helm` installed and configured to reach your cluster
+
+## Quick start
+
+```bash
+cortex solutions install -s kubernetes-agent
+cortex solutions post-install -s kubernetes-agent
+```
+
+The setup script will ask which path you want:
+
+```
+Create a new GitHub Codespace with a kind cluster? (yes = spin up Codespace, no = use an existing configured cluster) [yes]:
+```
+
+### GitHub Codespace path
+
+The script will:
+1. Create a Codespace from the `cortexapps/cli` repository using the `kubernetes-agent` devcontainer
+2. Wait for the Codespace to start and the kind cluster to initialize (~15-20 min on first run)
+3. Deploy the k8s-agent and demo workloads inside the Codespace via `gh codespace ssh`
+
+After setup, the Codespace URL and `gh codespace ssh` command are printed.
+
+### Existing cluster path
+
+Requires `kubectl` pointed at a running cluster. The script deploys the k8s-agent and demo workloads into whatever namespace your current context targets.
+
+## What you should see
+
+After the agent's first sync (~5 min), visit:
+`https://app.getcortexapp.com/admin/resources?tag=demo-kubernetes`
+
+- `demo-deployment` (Deployment)
+- `demo-statefulset` (StatefulSet)
+- `demo-cronjob` (CronJob)
+- `demo-rollout` (Argo Rollout — containers resolved from `demo-deployment`)
+
+## Troubleshooting
+
+**No K8s details showing on the entity page after the first sync**
+
+If you have configured [K8s metadata label customization](https://docs.cortex.io/ingesting-data-into-cortex/integrations/kubernetes#auto-mapping-customization) in your Cortex settings (Settings → Kubernetes → Metadata labels), Cortex uses *only* those labels for resource mapping and ignores the `cortex.io/tag` annotation used by the demo manifests. Either:
+
+- Remove the metadata label customization to use the default annotation-based mapping, or
+- Add a matching label (e.g., `app: demo-kubernetes`) to the demo manifests
+
+## Re-running setup
+
+The setup script is idempotent — re-run `cortex solutions post-install -s kubernetes-agent` to retry any failed step. Completed steps are skipped.
+
+For the Codespace path, the Codespace name is saved locally so re-runs reconnect to the same Codespace rather than creating a new one.
+
+## After Installing
+
+Once you have verified the agent working against the demo cluster, roll it out to your real clusters:
+
+1. **Install the Cortex Kubernetes agent Helm chart into each cluster** for which you want data associated with your Cortex entities. Give each cluster a distinct `clusterName` — this is how Cortex identifies which cluster a workload belongs to:
+
+   ```bash
+   helm upgrade --install cortex-k8s-agent \
+     oci://ghcr.io/cortexapps/k8s-agent/helm/cortex-k8s-agent \
+     --set app.apiKey=<your-cortex-api-key> \
+     --set app.clusterName=<name-as-it-appears-in-cortex> \
+     --set app.baseUrl=https://api.getcortexapp.com
+   ```
+
+2. **Ensure your Kubernetes workloads have the appropriate annotation or label** so Cortex can map them to your catalog entities:
+
+   - **Annotation** (default): add `cortex.io/tag: <entity-tag>` to each workload's metadata
+   - **Label** (if you have configured K8s metadata label customization in Cortex Settings): add the configured label key with the entity tag as the value, e.g. `app: <entity-tag>`
+
+3. **Wait for the first sync** (~5 min) then visit each entity's K8s tab in Cortex to confirm workload data is flowing.
+
+See the [Cortex Kubernetes integration docs](https://docs.cortex.io/ingesting-data-into-cortex/integrations/kubernetes) for full configuration options including namespace filtering, custom resource types, and RBAC setup.
+
+## Temporary limitation
+
+The k8s-agent image is currently private on GHCR, requiring `GHCR_TOKEN`. This requirement will be removed once the image is made public.

cortexapps_cli-1.40.0/cortexapps_cli/solutions/terraform/README.md

@@ -0,0 +1,255 @@
+---
+name: Terraform
+description: Manage your Cortex catalog as code using the Cortex Terraform provider.
+---
+
+# Terraform
+
+The [Cortex Terraform provider](https://github.com/cortexapps/terraform-provider-cortex) lets you define your entire service catalog — teams, services, domains, scorecards — as HCL code in `.tf` files. Changes go through PR review and apply automatically on merge, giving you a fully auditable, GitOps-driven catalog.
+
+## Data Model
+
+```
+  ┌──────────────────────────────────────────────────────┐
+  │                   Terraform Repo                     │
+  │                                                      │
+  │  teams.tf          scorecards.tf                     │
+  │  ecommerce.tf      provider.tf                       │
+  │  supply-chain.tf   variables.tf                      │
+  └─────────────────────────────┬────────────────────────┘
+                                │
+                                │  terraform apply
+                                │
+                                ▼
+  ┌──────────────────────────────────────────────────────┐
+  │                   Cortex Catalog                     │
+  │                                                      │
+  │  Teams                                               │
+  │  ┌────────────────────────────────────────────────┐  │
+  │  │  terraform-demo-team-development               │  │
+  │  │  terraform-demo-team-operations                │  │
+  │  │  terraform-demo-team-security                  │  │
+  │  │  terraform-demo-team-qa                        │  │
+  │  └────────────────────────────────────────────────┘  │
+  │                                                      │
+  │  Domains                                             │
+  │  ┌────────────────────────────────────────────────┐  │
+  │  │  terraform-demo-domain-ecommerce               │  │
+  │  │  terraform-demo-domain-supply-chain            │  │
+  │  └────────────────────────────────────────────────┘  │
+  │                                                      │
+  │  Services                                            │
+  │  ┌────────────────────────────────────────────────┐  │
+  │  │  terraform-demo-phoenix                        │  │
+  │  │  terraform-demo-parts-catalog-api              │  │
+  │  │  terraform-demo-payments-service               │  │
+  │  │  terraform-demo-inventory-service              │  │
+  │  │  terraform-demo-ordering-service               │  │
+  │  │  terraform-demo-shipping-service               │  │
+  │  └────────────────────────────────────────────────┘  │
+  │                                                      │
+  │  Scorecard                                           │
+  │  ┌────────────────────────────────────────────────┐  │
+  │  │  terraform-demo-production-readiness           │  │
+  │  └────────────────────────────────────────────────┘  │
+  └──────────────────────────────────────────────────────┘
+```
+
+## What is HCL?
+
+HCL (HashiCorp Configuration Language) is the declarative language used in `.tf` files. It reads like structured config rather than code:
+
+```hcl
+resource "cortex_catalog_entity" "phoenix" {
+  tag         = "terraform-demo-phoenix"
+  name        = "The Phoenix Project"
+  description = "Main e-commerce monolith for Parts Unlimited."
+
+  owners = [{ name = "terraform-demo-team-development", type = "group", provider = "CORTEX" }]
+
+  git = {
+    github = { repository = "parts-unlimited/phoenix" }
+  }
+}
+```
+
+Terraform reads all `.tf` files in a directory, compares them to the current live state, and applies only what changed.
+
+## Terraform vs. cortex.yaml — two flavors of GitOps
+
+Both approaches keep your catalog in git and apply changes on merge. The difference is where the files live:
+
+| | Terraform | cortex.yaml |
+|---|---|---|
+| **Files live in** | One central infra repo | Each service's own repo |
+| **Managed by** | Platform / infra team | Individual service teams |
+| **Also manages** | AWS, GCP, everything else | Just Cortex catalog |
+| **Apply mechanism** | CI runs `terraform apply` | Cortex git integration polls files |
+
+Neither is better. Platform teams who already manage cloud infrastructure with Terraform often prefer the centralized approach. Dev teams who want catalog config alongside their code prefer cortex.yaml.
+
+## File ownership at scale
+
+Terraform has no requirements on file names — it reads all `.tf` files in a directory and merges them. This means you can split by team or domain ownership:
+
+```
+infra-catalog/
+├── provider.tf          ← platform team
+├── teams.tf             ← platform team
+├── scorecards.tf        ← platform team
+├── ecommerce.tf         ← e-commerce team (domain + services)
+├── supply-chain.tf      ← supply chain team (domain + services)
+└── payments.tf          ← payments team
+```
+
+Each team submits PRs touching only their file. At very large scale (100K+ services), teams use Terraform modules (subdirectories) to organize further — but the ownership model is the same.
+
+## What's Included
+
+This solution installs a demo org for **Parts Unlimited** (from *The Phoenix Project*):
+
+- **4 teams**: Development (Bill's team), IT Operations (Brent's domain), Information Security (John's team), QA
+- **2 domains**: E-Commerce, Supply Chain
+- **6 services**: The Phoenix Project, Parts Catalog API, Payments Service, Inventory Service, Ordering Service, Shipping Service
+- **1 scorecard**: Terraform Demo Production Readiness (Bronze/Silver/Gold)
+
+All services start at **Bronze** — intentionally incomplete so you can see the delta in action.
+
+## Prerequisites
+
+- Terraform >= 1.5 — install at https://developer.hashicorp.com/terraform/install
+- Cortex API key with write access
+
+## Install
+
+```bash
+cortex solutions post-install -s terraform
+```
+
+You'll be asked where to create the working directory (default: `~/parts-unlimited-terraform`). The script will:
+1. Verify Terraform is installed
+2. Copy the `.tf` files to your working directory
+3. Write your credentials to `terraform.tfvars`
+4. Run `terraform init` to download the Cortex provider
+5. Run `terraform apply` to create all entities in Cortex
+
+## After Installing
+
+Terraform created 13 entities in your Cortex catalog: 4 teams, 2 domains, and 6 services — all tagged with the `terraform-demo` group.
+
+**Create a catalog to filter to the demo entities**
+
+1. Go to [Catalogs](https://app.getcortexapp.com/admin/catalogs) → **New Catalog**
+2. Name it **Terraform Demo**
+3. Set the catalog filter:
+   - **Entity type:** `service`
+   - **Advanced options → Groups → Include:** `terraform-demo`
+
+**Open the scorecard**
+
+Open [Scorecards](https://app.getcortexapp.com/admin/scorecards) and find **Terraform Demo Production Readiness** to see all 6 services at Bronze.
+
+### Try the Delta
+
+The delta shows what a real team PR looks like — modify a file, plan, apply, watch the scorecard update.
+
+**Step 1: Copy the delta files into your working directory**
+
+The exact delta file paths were printed when you ran `cortex solutions post-install -s terraform`. Copy the delta files shown there to your working directory.
+
+**Step 2: See what will change**
+
+```bash
+cd ~/parts-unlimited-terraform
+terraform plan
+```
+
+You'll see:
+- `~ cortex_catalog_entity.phoenix` — **update** (adds links, metadata to `terraform-demo-phoenix`)
+- `+ cortex_catalog_entity.notification_service` — **create** (`terraform-demo-notification-service`)
+- `~ cortex_catalog_entity.team_development` — **update** (new member on `terraform-demo-team-development`)
+
+**Step 3: Apply**
+
+```bash
+terraform apply
+```
+
+**Step 4: Check the scorecard**
+
+Open [Scorecards](https://app.getcortexapp.com/admin/scorecards) and find **Terraform Demo Production Readiness** in Cortex. The Phoenix Project should now show **Silver**. Also check that the new **Notification Service** appears in your catalog.
+
+## File Walkthrough
+
+**`provider.tf`** — Declares the `cortexapps/cortex` provider version and reads credentials from variables. This is the only file that changes if you upgrade the provider version.
+
+**`variables.tf`** — Defines `cortex_api_token` (sensitive) and `cortex_base_url`. Values come from `terraform.tfvars` (never committed) or environment variables (`CORTEX_API_TOKEN`, `CORTEX_API_URL`).
+
+**`teams.tf`** — Owned by the platform team. Defines all teams and their members. Changes here require a platform PR.
+
+**`ecommerce.tf`** — Owned by the e-commerce team. Defines the E-Commerce domain and its three services. Changes here — new services, updated descriptions, added links — are the e-commerce team's PR to make.
+
+**`supply-chain.tf`** — Same pattern, owned by the supply chain team.
+
+**`scorecards.tf`** — Owned by the platform team. Defines the Terraform Demo Production Readiness scorecard and its Bronze/Silver/Gold rules.
+
+## Customizing for Your Org
+
+1. Rename entity tags and display names throughout
+2. Replace `parts-unlimited/*` GitHub repos with your actual repos
+3. Add more services: copy any service block from `ecommerce.tf` and adjust the tag, name, and owner
+4. Extend scorecard rules: add rules to `scorecards.tf` with the expression language shown in the [Cortex docs](https://docs.cortex.io/docs/reference/scorecard-rules)
+5. Split into more files as your team grows — Terraform reads them all
+
+## Next Steps: CI/CD Integration
+
+In practice, customers commit their `.tf` files to a repo and let CI handle applies. Here's a minimal GitHub Actions workflow:
+
+```yaml
+# .github/workflows/cortex-catalog.yml
+name: Cortex Catalog
+
+on:
+  pull_request:
+    paths: ['catalog/**']
+  push:
+    branches: [main]
+    paths: ['catalog/**']
+
+jobs:
+  plan:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~> 1.5"
+      - run: terraform init
+        working-directory: catalog
+        env:
+          TF_VAR_cortex_api_token: ${{ secrets.CORTEX_API_TOKEN }}
+      - run: terraform plan
+        working-directory: catalog
+        env:
+          TF_VAR_cortex_api_token: ${{ secrets.CORTEX_API_TOKEN }}
+
+  apply:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~> 1.5"
+      - run: terraform init
+        working-directory: catalog
+        env:
+          TF_VAR_cortex_api_token: ${{ secrets.CORTEX_API_TOKEN }}
+      - run: terraform apply -auto-approve
+        working-directory: catalog
+        env:
+          TF_VAR_cortex_api_token: ${{ secrets.CORTEX_API_TOKEN }}
+```
+
+Store `CORTEX_API_TOKEN` as a GitHub Actions secret. Now every PR shows a plan diff as a CI check, and every merge to main applies automatically.