fix: scope terraform CI to what actually changed

[nboyers]

CI: deploy only what changed, and start watching modules/.

• Gated apply on has_changes — an empty change set produced an empty --filter, so terragrunt run --all -- apply -auto-approve was applying all 33 units unfiltered. Also fixed the summary so a skipped apply isn't reported as a failure.
• Added modules/** to both workflows (trigger paths + git diff scope) — 16 units consume the shared modules, so edits there were silently never validated or deployed.
• Fixed the tf-*.yml self-trigger glob — was terraform-*.yml, matched nothing, so workflow edits went untested.

Known tradeoff

A shared-module change maps to no single Terragrunt directory, so changed_dirs is empty and the deploy applies everything. Intentional — there's no reliable way to map a module to its consumers. Worth noting separately: the EKS addons have no pinned addon_version (most_recent = true), so a full apply can bump coredns/kube-proxy/vpc-cni. Pinning those would make full applies boring.

Verification

YAML parses on both files; discovery logic simulated against real paths:

Scenario	Result
One unit changed	--filter=aws/us-east-2/eks — unchanged
Shared module changed	has_changes=true, validates + applies everything (was: nothing ran)
Nothing relevant	has_changes=false, apply skips cleanly

Not yet exercised in CI — this PR is the first real test.

Out of scope

terraform-*.yml is still dead in tf-deploy.yml (nothing to deploy on a workflow edit). Separately, the hclfmt/terraform fmt checks still scan the whole tree instead of the changed area — follow-up.

🤖 Generated with Claude Code

[github-actions]

🔍 Terraform Validation Summary

ℹ️ No changes detected in infra/ or modules/

❌ Validation checks failed

• ❌ Planning failed: Review the plan output in job logs

⚠️ Please fix the issues before merging.

---

View Full Run