fix: scope terraform CI to what actually changed

- Gate the apply job on has_changes. An empty change set produced an
  empty --filter, so `terragrunt run --all -- apply -auto-approve` was
  applying all 33 units unfiltered. Also handle a skipped apply in the
  summary, which would otherwise report every no-op push as a failure.

- Watch modules/ in both workflows (trigger paths + git diff scope).
  16 units consume the shared modules, so edits there were silently
  never validated or deployed.

- Fix the self-trigger glob: the files are tf-*.yml, not terraform-*.yml,
  so the pattern matched nothing and workflow edits went untested.

Known tradeoff: a shared-module change maps to no single Terragrunt
directory, so changed_dirs is empty and the deploy applies everything.
Intentional - there is no reliable way to map a module to its consumers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Noah Boyers

.github/workflows/tf-deploy.yml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - 'infra/**'
+      - 'modules/**'
       - '.github/workflows/terraform-*.yml'
   workflow_dispatch:
 
@@ -51,11 +52,11 @@ jobs:
             exit 0
           fi
 
-          # Find all changed files in infra/
-          changed_files=$(git diff --name-only "$BASE_REF" "$HEAD_REF" -- infra/ || echo "")
+          # Find all changed files in infra/ and the shared modules they consume
+          changed_files=$(git diff --name-only "$BASE_REF" "$HEAD_REF" -- infra/ modules/ || echo "")
 
           if [ -z "$changed_files" ]; then
-            echo "No changes detected in infra/"
+            echo "No changes detected in infra/ or modules/"
             echo "has_changes=false" >> $GITHUB_OUTPUT
             echo "changed_dirs=[]" >> $GITHUB_OUTPUT
             exit 0
@@ -132,6 +133,9 @@ jobs:
   apply:
     name: Apply Infrastructure
     needs: discover-changes
+    # Without this gate an empty change set yields an empty filter, and
+    # `terragrunt run --all -- apply -auto-approve` then applies every unit.
+    if: needs.discover-changes.outputs.has_changes == 'true'
     runs-on: ubuntu-latest
     environment:
       name: production
@@ -308,10 +312,10 @@ jobs:
             echo "Manual deployment - all modules processed"
             echo ""
           elif [ "$has_changes" = "true" ]; then
-            echo "Changes detected in infra/ but not in terragrunt module directories"
+            echo "Changes detected in infra/ or modules/ but not in a specific terragrunt directory - applying everything"
             echo ""
           else
-            echo "No changes detected in infra/"
+            echo "No changes detected in infra/ or modules/"
             echo ""
           fi
 
@@ -323,6 +327,9 @@ jobs:
             echo ""
             echo "Infrastructure changes have been applied to production."
             exit 0
+          elif [[ "$apply_result" == "skipped" ]]; then
+            echo "⏭️ Deployment skipped - no infrastructure changes to apply."
+            exit 0
           else
             echo "❌ Deployment failed"
             echo ""

.github/workflows/tf-validate.yml

@@ -6,7 +6,8 @@ on:
       - main
     paths:
       - 'infra/**'
-      - '.github/workflows/terraform-*.yml'
+      - 'modules/**'
+      - '.github/workflows/tf-*.yml'
 
 permissions:
   contents: read
@@ -43,11 +44,11 @@ jobs:
           BASE_REF="${{ github.event.pull_request.base.sha }}"
           HEAD_REF="${{ github.sha }}"
 
-          # Find all changed files in infra/
-          changed_files=$(git diff --name-only "$BASE_REF" "$HEAD_REF" -- infra/ || echo "")
+          # Find all changed files in infra/ and the shared modules they consume
+          changed_files=$(git diff --name-only "$BASE_REF" "$HEAD_REF" -- infra/ modules/ || echo "")
 
           if [ -z "$changed_files" ]; then
-            echo "No changes detected in infra/"
+            echo "No changes detected in infra/ or modules/"
             echo "has_changes=false" >> $GITHUB_OUTPUT
             echo "changed_dirs=[]" >> $GITHUB_OUTPUT
             exit 0
@@ -495,10 +496,10 @@ jobs:
             echo "$changed_dirs" | jq -r '.[]' | sed 's/^/  - /'
             echo ""
           elif [ "$has_changes" = "true" ]; then
-            echo "Changes detected in infra/ but not in terragrunt module directories"
+            echo "Changes detected in infra/ or modules/ but not in a specific terragrunt directory - validating everything"
             echo ""
           else
-            echo "No changes detected in infra/"
+            echo "No changes detected in infra/ or modules/"
             echo ""
           fi
 
@@ -549,9 +550,9 @@ jobs:
               });
               body += '\n';
             } else if (hasChanges) {
-              body += '### ℹ️ Changes detected in `infra/` but not in terragrunt module directories\n\n';
+              body += '### ℹ️ Changes detected in `infra/` or `modules/` but not in a specific terragrunt directory - everything was validated\n\n';
             } else {
-              body += '### ℹ️ No changes detected in `infra/`\n\n';
+              body += '### ℹ️ No changes detected in `infra/` or `modules/`\n\n';
             }
 
             const allPassed = validateResult === 'success' && planResult === 'success';