From 1f6e312537d98a34b62e203e846ac338c6f80b06 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Thu, 1 Oct 2026 21:13:22 -0400
Subject: [PATCH] ci: aggregate test and Terraform as ci-complete

Converted callers emit that check so this repo can leave the ci / ci ruleset.
---
 .github/workflows/ci.yaml       | 52 +++++++++++++++++----------------
 tests/infra/hcpContract.test.js |  9 ++++--
 2 files changed, 34 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index ce23746..c06a777 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,16 +1,31 @@
 name: CI
 
+# Parallel test and Terraform portions. The required check is ci-complete.
+
 on:
   pull_request:
-    branches: [main]
+    branches: [main, hotfix/**, release/**]
   merge_group:
+  push:
+    branches: [hotfix/**, release/**]
 
 permissions:
   contents: read
 
 jobs:
+  autofix:
+    if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-autofix.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
+    permissions:
+      contents: write
+    secrets: inherit
+    with:
+      presets: terraform
+
   test:
     name: Test
+    needs: autofix
+    if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -31,6 +46,8 @@ jobs:
 
   terraform:
     name: Terraform
+    needs: autofix
+    if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
     uses: Sea-Haven-Industries/.github/.github/workflows/ci-terraform.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd # v1.0.21
     with:
       terraform-version: "1.16.0"
@@ -40,33 +57,18 @@ jobs:
         package.json
         package-lock.json
 
-  ci:
-    name: ci / ci
-    needs: [test, terraform]
-    if: ${{ always() && !cancelled() }}
+  ci-complete:
+    name: ci-complete
+    needs: [autofix, test, terraform]
+    if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - name: Check jobs
+      - name: Require portions
         env:
-          TEST_RESULT: ${{ needs.test.result }}
-          TERRAFORM_RESULT: ${{ needs.terraform.result }}
+          TEST: ${{ needs.test.result }}
+          TERRAFORM: ${{ needs.terraform.result }}
         run: |
           set -euo pipefail
-          fail=0
-          check() {
-            local name="$1"
-            local result="$2"
-            case "${result}" in
-              success)
-                echo "${name}: ${result}"
-                ;;
-              *)
-                echo "${name}: ${result}" >&2
-                fail=1
-                ;;
-            esac
-          }
-          check test "${TEST_RESULT}"
-          check terraform "${TERRAFORM_RESULT}"
-          exit "${fail}"
+          test "${TEST}" = success
+          test "${TERRAFORM}" = success
diff --git a/tests/infra/hcpContract.test.js b/tests/infra/hcpContract.test.js
index 1798a52..3edf2e4 100644
--- a/tests/infra/hcpContract.test.js
+++ b/tests/infra/hcpContract.test.js
@@ -71,15 +71,20 @@ describe("HCP Terraform seam (PLAT-79)", () => {
     assert.match(deploy, /function-keys: process_csv,slack_app_home,fetch_boa,expense_receiver,expense_processor/);
   });
 
-  it("runs npm test and the Terraform callable behind ci / ci", () => {
+  it("runs npm test and the Terraform callable behind ci-complete", () => {
     assert.doesNotMatch(ci, /ci-typescript-cdk/);
     assert.doesNotMatch(ci, /run-sam-validate/);
     assert.match(ci, /npm test/);
     assert.match(ci, /ci-terraform\.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd/);
+    assert.match(ci, /ci-autofix\.yaml@47185fa602dffddb8297db5f3525d7c9bc05d7cd/);
+    assert.match(ci, /presets: terraform/);
     assert.match(ci, /src\//);
     assert.match(ci, /package\.json/);
     assert.match(ci, /package-lock\.json/);
-    assert.match(ci, /name: ci \/ ci/);
+    assert.match(ci, /hotfix\/\*\*/);
+    assert.match(ci, /release\/\*\*/);
+    assert.match(ci, /name: ci-complete/);
+    assert.doesNotMatch(ci, /name: ci \/ ci/);
   });
 
   it("names the five live functions", () => {