ci: add Terraform integration test with trap-based cleanup

Extend CI to run a real Terraform integration flow against Ona using the examples configuration.

Changes:

- set up Terraform in CI

- build local provider binary and wire it via Terraform dev_overrides

- run terraform init/apply in examples

- use EXIT trap to always run terraform destroy and preserve failure status

Why:

- verify provider behavior against real API in CI

- ensure test runner resources are cleaned up reliably

Author: combor

.github/workflows/ci.yml

@@ -32,3 +32,54 @@ jobs:
 
       - name: Build
         run: go build ./...
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v4.0.0
+        with:
+          terraform_wrapper: false
+
+      - name: Terraform Integration (apply/destroy runner)
+        env:
+          GITPOD_API_KEY: ${{ secrets.GITPOD_API_KEY }}
+        run: |
+          set -euo pipefail
+
+          mkdir -p dist
+          go build -o dist/terraform-provider-ona .
+
+          cat > "${RUNNER_TEMP}/terraformrc" <<EOF
+          provider_installation {
+            dev_overrides {
+              "combor/ona" = "${GITHUB_WORKSPACE}/dist"
+            }
+            direct {}
+          }
+          EOF
+          export TF_CLI_CONFIG_FILE="${RUNNER_TEMP}/terraformrc"
+
+          RUNNER_NAME="ci-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          tf_initialized=0
+
+          cleanup() {
+            status=$?
+            trap - EXIT
+            set +e
+
+            if [ "${tf_initialized}" -eq 1 ]; then
+              terraform -chdir=examples destroy -auto-approve -input=false \
+                -var "runner_name=${RUNNER_NAME}"
+              destroy_status=$?
+              if [ "${status}" -eq 0 ] && [ "${destroy_status}" -ne 0 ]; then
+                status="${destroy_status}"
+              fi
+            fi
+
+            exit "${status}"
+          }
+          trap cleanup EXIT
+
+          terraform -chdir=examples init -input=false
+          tf_initialized=1
+
+          terraform -chdir=examples apply -auto-approve -input=false \
+            -var "runner_name=${RUNNER_NAME}"