Cost diff for OpenTofu and Terramate stacks with Infracost (#89)

[ms280690]

Closes #89. Stacked on #170 (issue-91-cost-gate) for gate.py and the docs; retarget to main once that merges.

What

• .github/actions/infracost: Infracost 0.10.46 tarball verified against the published .sha256; mode input. breakdown: config file from the stack list (mkconfig.sh: one project per <stack>/plan.json, usage_file when present, stacks without a plan skipped with a notice) then infracost breakdown --config-file --format json. diff: same with --compare-to <base json>, then gate.py with the thresholds, writing the gate snippet. comment: infracost output --format github-comment plus the snippet, posted as one comment found by the <!-- infracost --> marker and edited in place (fork PRs skipped by the workflow). INFRACOST_SKIP_UPDATE_CHECK and INFRACOST_ENABLE_CLOUD=false set. Outputs monthly-diff, monthly-total, percent-change, gate.
• plan.sh: tofu init -input=false, tofu plan -lock=false -out, tofu show -json per listed stack of one checkout; a stack missing from the base checkout is treated as new; the binary plan is deleted after the JSON is written.
• cost-diff-tofu.yml: inputs from the issue plus tofu-version, terramate-version, actions-ref; secret INFRACOST_API_KEY. Head checkout with full history, base checkout into .cost-base, aws-oidc-auth, opentofu/setup-opentofu and terramate-io/terramate-action at the pins the existing setup composite uses, terramate list --changed --git-change-base <base sha> or the directory input, plan both refs, breakdown, diff, comment, artefact infracost (both JSONs, gate snippet, plans). No changed stacks ends the job with a notice. Caller grants id-token: write, contents: read, pull-requests: write.
• Docs: plan role (state bucket and lock table read plus ReadOnlyAccess) in docs/oidc-trust-policies.md; infracost row in docs/approved-actions.md; README rows and "Cost Diff (Infracost)" section with the egress hosts. The docs/egress-allowlist.md row waits for feat(#83): harden-runner block mode with per-job egress allowlists #139 like the other stacks.
• CI: the Cost Gate job now also runs the config-writer tests and the composite's checksum-verified install (comment mode with an empty PR number, which exits after the install).

Tests

tests/infracost/run.sh gains mkconfig.sh cases: two stacks with plans and a usage file (exact YAML), a stack without a plan skipped with a notice and no usage_file when empty, and no plans at all exiting 1. The gate cases from #170 unchanged.

Deferred

• Run against a Sparkgeo Terramate repo once the plan role and the INFRACOST_API_KEY org secret exist (admin items). plan.sh is exercised only there; it has no local test because it needs a backend.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NPH9145e4gFo6bmXvMgBoF

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/cost-diff-tofu.yml

Package	Version	License	Issue Type
opentofu/setup-opentofu	847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4	MPL-2.0	Incompatible License
terramate-io/terramate-action	c5a1375801a3fac44d29fc7e0ebb3757ea0db3e0	Null	Unknown License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.3	Details Check Score Reason Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Packaging ⚠️ -1 packaging workflow not detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/upload-artifact	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	🟢 5.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
actions/opentofu/setup-opentofu	847eaa4afeb791b06daa46e8eafa8b1b68d7cfb4	🟢 5.7	Details Check Score Reason Maintained 🟢 9 10 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
actions/terramate-io/terramate-action	c5a1375801a3fac44d29fc7e0ebb3757ea0db3e0	Unknown	Unknown

Scanned Files

• .github/workflows/cost-diff-tofu.yml