feat: integrate Landing Zone Configurator MVP

.github/workflows/assistant-live.yml

@@ -0,0 +1,87 @@
+name: Assistant live regression
+
+on:
+  workflow_dispatch:
+    inputs:
+      topic:
+        description: 'Knowledge topic ID, or all'
+        required: true
+        default: 'all'
+        type: string
+      repetitions:
+        description: 'Independent runs per case (1-3); every failure remains blocking'
+        required: true
+        default: 2
+        type: number
+  workflow_call:
+    inputs:
+      topic:
+        type: string
+        default: 'all'
+      repetitions:
+        type: number
+        default: 2
+    secrets:
+      LZC_MODEL_SERVING_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  assistant:
+    name: assistant-live-qualification
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: assistant-tests
+    concurrency:
+      group: configurator-assistant-model-serving
+      cancel-in-progress: false
+    defaults:
+      run:
+        working-directory: landing-zone-configurator/app
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: landing-zone-configurator/app/.node-version
+          cache: npm
+          cache-dependency-path: landing-zone-configurator/app/package-lock.json
+      - name: Install pinned test toolchain
+        id: install
+        run: |
+          npm install --global npm@11.19.0
+          npm ci
+      - name: Check source-bound scenario catalogue
+        id: catalogue
+        run: npm run assistant:check
+      - name: Run synthetic cases against real Model Serving
+        env:
+          LZC_MODEL_SERVING_TOKEN: ${{ secrets.LZC_MODEL_SERVING_TOKEN }}
+          LZC_ASSISTANT_TEST_TOPIC: ${{ inputs.topic }}
+          LZC_ASSISTANT_TEST_REPETITIONS: ${{ inputs.repetitions }}
+          LZC_EXECUTION_ENABLED: 'false'
+          LZC_APPLICATION_EXECUTION_ENABLED: 'false'
+        run: |
+          set -o pipefail
+          node --use-system-ca --import tsx scripts/assistant-tests.ts --topic "$LZC_ASSISTANT_TEST_TOPIC" --repeat "$LZC_ASSISTANT_TEST_REPETITIONS" | tee assistant-live-results.jsonl
+      - name: Verify a continuous multi-topic dialogue and native export
+        if: ${{ !cancelled() && steps.install.outcome == 'success' && steps.catalogue.outcome == 'success' }}
+        env:
+          LZC_MODEL_SERVING_TOKEN: ${{ secrets.LZC_MODEL_SERVING_TOKEN }}
+          LZC_EXECUTION_ENABLED: 'false'
+          LZC_APPLICATION_EXECUTION_ENABLED: 'false'
+        run: |
+          set -o pipefail
+          node --use-system-ca --import tsx scripts/assistant-journey.ts | tee assistant-journey-results.jsonl
+      - name: Upload synthetic results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: assistant-live-results
+          path: |
+            landing-zone-configurator/app/assistant-live-results.jsonl
+            landing-zone-configurator/app/assistant-journey-results.jsonl
+          retention-days: 7

.github/workflows/configurator-bootstrap.yml

@@ -0,0 +1,185 @@
+name: Configurator Bootstrap
+
+on:
+  workflow_dispatch:
+    inputs:
+      root:
+        description: 'First bootstrap, then backend (bucket versioning)'
+        type: choice
+        options: [bootstrap, backend]
+        default: bootstrap
+      apply:
+        description: 'Apply the reviewed plan after environment approval'
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: configurator-lzc-dev-mutation
+  cancel-in-progress: false
+
+env:
+  LZC_ENVIRONMENT: lzc-dev
+  LZC_ROOT: ${{ inputs.root || vars.LZC_BOOTSTRAP_ROOT || 'bootstrap' }}
+
+jobs:
+  plan:
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && github.run_attempt == 1
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: lzc-dev-bootstrap-plan
+    defaults:
+      run:
+        working-directory: landing-zone-configurator
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '24.21.0'
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: '1.12.6'
+          tofu_wrapper: false
+      - name: Prepare credentials and backend configuration
+        id: prepare
+        run: node infra/ci/prepare.mjs management
+        env:
+          LZC_PROJECT_ID: ${{ vars.LZC_PROJECT_ID }}
+          LZC_REGION: ${{ vars.LZC_REGION }}
+          LZC_NAME_PREFIX: ${{ vars.LZC_NAME_PREFIX }}
+          LZC_MANAGEMENT_BUCKET: ${{ vars.LZC_MANAGEMENT_BUCKET }}
+          LZC_CREDENTIAL_EXPIRATION: ${{ vars.LZC_CREDENTIAL_EXPIRATION }}
+          LZC_MANAGEMENT_ACCESS_KEY: ${{ secrets.LZC_MANAGEMENT_ACCESS_KEY }}
+          LZC_MANAGEMENT_SECRET_KEY: ${{ secrets.LZC_MANAGEMENT_SECRET_KEY }}
+          LZC_SERVICE_ACCOUNT_KEY: ${{ secrets.LZC_SERVICE_ACCOUNT_KEY }}
+          LZC_STATE_KEY_BOOTSTRAP: ${{ secrets.LZC_STATE_KEY_BOOTSTRAP }}
+          LZC_STATE_KEY_BACKEND: ${{ secrets.LZC_STATE_KEY_BACKEND }}
+      - name: Read bootstrap backend outputs (private file)
+        if: env.LZC_ROOT != 'bootstrap'
+        timeout-minutes: 3
+        run: |
+          umask 077
+          export TF_DATA_DIR="$LZC_PRIVATE/bootstrap-data"
+          export TF_ENCRYPTION="$(cat "$LZC_PRIVATE/bootstrap.encryption.json")"
+          tofu -chdir=infra/bootstrap init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/bootstrap.backend.hcl"
+          tofu -chdir=infra/bootstrap output -json > "$LZC_PRIVATE/bootstrap-outputs.json"
+      - name: Prepare workload credentials
+        if: env.LZC_ROOT != 'bootstrap'
+        run: node infra/ci/prepare.mjs workload
+      - name: OpenTofu init
+        timeout-minutes: 3
+        run: tofu -chdir="infra/$LZC_ROOT" init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/$LZC_ROOT.backend.hcl"
+      - name: OpenTofu validate
+        run: tofu -chdir="infra/$LZC_ROOT" validate -no-color
+      - name: OpenTofu plan
+        run: >-
+          timeout --foreground --signal=INT --kill-after=2m 15m
+          tofu -chdir="infra/$LZC_ROOT" plan
+          -input=false -no-color -lock-timeout=60s
+          -out="$LZC_PLAN"
+      - name: Bind encrypted plan to commit and workflow run
+        run: node infra/ci/review.mjs seal
+      - name: Upload encrypted plan
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: bootstrap-plan-${{ github.run_id }}
+          path: |
+            landing-zone-configurator/.local/ci-plan/review.tfplan
+            landing-zone-configurator/.local/ci-plan/review.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 1
+      - name: Remove temporary credentials
+        if: always()
+        run: rm -rf -- "$RUNNER_TEMP/lzc-private"
+
+  apply:
+    needs: plan
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && github.run_attempt == 1 && inputs.apply
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    environment: lzc-dev-bootstrap-apply
+    defaults:
+      run:
+        working-directory: landing-zone-configurator
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: '24.21.0'
+      - uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: '1.12.6'
+          tofu_wrapper: false
+      - name: Prepare credentials and backend configuration
+        id: prepare
+        run: node infra/ci/prepare.mjs management
+        env:
+          LZC_PROJECT_ID: ${{ vars.LZC_PROJECT_ID }}
+          LZC_REGION: ${{ vars.LZC_REGION }}
+          LZC_NAME_PREFIX: ${{ vars.LZC_NAME_PREFIX }}
+          LZC_MANAGEMENT_BUCKET: ${{ vars.LZC_MANAGEMENT_BUCKET }}
+          LZC_CREDENTIAL_EXPIRATION: ${{ vars.LZC_CREDENTIAL_EXPIRATION }}
+          LZC_MANAGEMENT_ACCESS_KEY: ${{ secrets.LZC_MANAGEMENT_ACCESS_KEY }}
+          LZC_MANAGEMENT_SECRET_KEY: ${{ secrets.LZC_MANAGEMENT_SECRET_KEY }}
+          LZC_SERVICE_ACCOUNT_KEY: ${{ secrets.LZC_SERVICE_ACCOUNT_KEY }}
+          LZC_STATE_KEY_BOOTSTRAP: ${{ secrets.LZC_STATE_KEY_BOOTSTRAP }}
+          LZC_STATE_KEY_BACKEND: ${{ secrets.LZC_STATE_KEY_BACKEND }}
+      - name: Read bootstrap backend outputs (private file)
+        if: env.LZC_ROOT != 'bootstrap'
+        timeout-minutes: 3
+        run: |
+          umask 077
+          export TF_DATA_DIR="$LZC_PRIVATE/bootstrap-data"
+          export TF_ENCRYPTION="$(cat "$LZC_PRIVATE/bootstrap.encryption.json")"
+          tofu -chdir=infra/bootstrap init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/bootstrap.backend.hcl"
+          tofu -chdir=infra/bootstrap output -json > "$LZC_PRIVATE/bootstrap-outputs.json"
+      - name: Prepare workload credentials
+        if: env.LZC_ROOT != 'bootstrap'
+        run: node infra/ci/prepare.mjs workload
+      - name: OpenTofu init
+        timeout-minutes: 3
+        run: tofu -chdir="infra/$LZC_ROOT" init -input=false -no-color -lockfile=readonly -backend-config="$LZC_PRIVATE/$LZC_ROOT.backend.hcl"
+      - name: OpenTofu validate
+        run: tofu -chdir="infra/$LZC_ROOT" validate -no-color
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: bootstrap-plan-${{ github.run_id }}
+          path: landing-zone-configurator/.local/ci-plan
+      - name: Verify reviewed plan and apply authorization
+        run: node infra/ci/review.mjs verify
+      - name: OpenTofu apply reviewed plan
+        id: apply
+        # One SIGINT allows OpenTofu to save state before the outer job deadline.
+        run: >-
+          timeout --foreground --signal=INT --kill-after=5m 20m
+          tofu -chdir="infra/$LZC_ROOT" apply
+          -input=false -no-color -lock-timeout=60s "$LZC_PLAN"
+      - name: Capture and encrypt recovery state
+        if: always() && steps.apply.outcome != '' && steps.apply.outcome != 'skipped'
+        run: |
+          umask 077
+          if ! timeout --foreground --signal=INT --kill-after=10s 60s \
+            tofu -chdir="infra/$LZC_ROOT" state pull > "$LZC_PRIVATE/state.snapshot"; then
+            echo "::warning::Remote state snapshot unavailable; checking for emergency state."
+            rm -f -- "$LZC_PRIVATE/state.snapshot"
+          fi
+          node infra/ci/protect-state.mjs
+      - name: Upload encrypted recovery state
+        if: always() && steps.apply.outcome != '' && steps.apply.outcome != 'skipped'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: bootstrap-state-${{ github.run_id }}
+          path: landing-zone-configurator/.local/ci-recovery/*.enc.json
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Remove temporary credentials
+        if: always()
+        run: rm -rf -- "$RUNNER_TEMP/lzc-private"