fix(terraform): align Vercel token fallback with default

[hreiten]

Summary

• Updates both Terraform workflow VERCEL_API_TOKEN fallbacks from unused to the same 24-character dummy token used by the Terraform variable default.

Why

PR #508 updated the Terraform variable default to a 24-character dummy token, but .github/workflows/terraform.yml still overrides that default with unused. Since the Vercel provider validates api_token during provider init, Cloudflare-only deployments can still fail in CI even though no Vercel resources are created.

This keeps the workflow fallback aligned with the existing Terraform default without changing provider constraints, lockfiles, or deployment behavior for real Vercel tokens.

Prior Upstream Work Checked

• docs: document Vercel provider limitation for Cloudflare deployments #465 documented the Vercel provider limitation and introduced the workflow fallback to avoid empty-string overrides.
• fix: dummy vercel api token has to be 24 chars long to pass validation #508 fixed the Terraform variable default to a valid dummy token shape.
• upstream/main still had TF_VAR_vercel_api_token: "${{ secrets.VERCEL_API_TOKEN || 'unused' }}" in both the plan and apply jobs before this change.

Testing

• git diff --check
• terraform fmt -check -recursive terraform
• npm run lint
• npm run typecheck
• npm test (fails on existing packages/control-plane/src/utils/models.test.ts GPT 5.5 reasoning default expectations: 2 failed, 1117 passed)
• terraform -chdir=terraform/environments/production init -backend=false -lockfile=readonly (initializes successfully, with the existing readonly-lockfile warning)
• terraform -chdir=terraform/environments/production validate -no-color (blocked locally by the existing cloudflare/cloudflare 5.19.1 checksum mismatch in .terraform.lock.hcl on darwin_arm64; this PR intentionally does not update the lockfile)

Summary by CodeRabbit

• Chores
  • Updated deployment workflow to use a fixed fallback token value for the API token environment variable, reducing failures when the secret is absent and improving workflow stability during infrastructure deployments.

[coderabbitai]

📝 Walkthrough

Walkthrough

The GitHub Actions Terraform workflow changes the TF_VAR_vercel_api_token fallback from 'unused' to the 24-character all-zero token string ('000000000000000000000000') in both the plan and apply steps.

Changes

Vercel API Token Fallback

Layer / File(s)	Summary
Plan & Apply fallback update .github/workflows/terraform.yml	TF_VAR_vercel_api_token fallback value changed from 'unused' to '000000000000000000000000' in the Terraform plan and apply steps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• ColeMurray/background-agents#508: Yes—both PRs update the dummy “missing/unset” Vercel API token value from "unused" to the 24-character all-zero placeholder ("000000000000000000000000") to satisfy Vercel validation.
• ColeMurray/background-agents#465: Both PRs modify .github/workflows/terraform.yml’s TF_VAR_vercel_api_token handling by changing the dummy fallback used when secrets.VERCEL_API_TOKEN is unset/empty, so they directly overlap on the same Terraform credential environment setup.

Suggested reviewers

• ColeMurray

Poem

🐰 In YAML fields where secrets hide,
A zero-string now stands with pride,
No more "unused" to trip the run,
CI hops onward, job well done! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: updating the Vercel token fallback in the Terraform workflow to align with the default value, which is the core objective of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/terraform.yml (1)

186-186: ⚡ Quick win

Centralize the dummy Vercel token to avoid fallback drift.

This works, but repeating the literal in two places can regress again. Define one workflow-level env constant and reference it in both jobs.

♻️ Suggested change

 env:
   TF_VERSION: "1.14.8"
   TF_WORKING_DIR: terraform/environments/production
+  TF_VERCEL_DUMMY_API_TOKEN: "000000000000000000000000"
@@
-          TF_VAR_vercel_api_token: "${{ secrets.VERCEL_API_TOKEN || '000000000000000000000000' }}"
+          TF_VAR_vercel_api_token: "${{ secrets.VERCEL_API_TOKEN || env.TF_VERCEL_DUMMY_API_TOKEN }}"
@@
-          TF_VAR_vercel_api_token: "${{ secrets.VERCEL_API_TOKEN || '000000000000000000000000' }}"
+          TF_VAR_vercel_api_token: "${{ secrets.VERCEL_API_TOKEN || env.TF_VERCEL_DUMMY_API_TOKEN }}"

Also applies to: 317-317

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/terraform.yml at line 186, Centralize the dummy Vercel
token by adding a workflow-level environment variable (e.g., VERCEL_DUMMY_TOKEN)
and update both usages of TF_VAR_vercel_api_token to reference
secrets.VERCEL_API_TOKEN with a fallback to that env var (so
TF_VAR_vercel_api_token uses secrets.VERCEL_API_TOKEN ||
env.VERCEL_DUMMY_TOKEN); update the occurrences that currently use the literal
"000000000000000000000000" so they reference VERCEL_DUMMY_TOKEN instead to avoid
duplicate literals and future drift.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/terraform.yml:
- Line 186: Centralize the dummy Vercel token by adding a workflow-level
environment variable (e.g., VERCEL_DUMMY_TOKEN) and update both usages of
TF_VAR_vercel_api_token to reference secrets.VERCEL_API_TOKEN with a fallback to
that env var (so TF_VAR_vercel_api_token uses secrets.VERCEL_API_TOKEN ||
env.VERCEL_DUMMY_TOKEN); update the occurrences that currently use the literal
"000000000000000000000000" so they reference VERCEL_DUMMY_TOKEN instead to avoid
duplicate literals and future drift.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f57881fa-099f-4370-a05e-f4946dc9d848

📥 Commits

Reviewing files that changed from the base of the PR and between a015c30 and 980bd20.

📒 Files selected for processing (1)

• .github/workflows/terraform.yml