🎛 [ci] Apply staging change pipeline

Author: tomy0000000

.github/workflows/apply-staging.yml

@@ -0,0 +1,96 @@
+name: "🚀 Apply Staging"
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "staging/**"
+      - "template/**"
+      - ".github/workflows/apply-staging.yml"
+  workflow_dispatch:
+
+# Stateless runs must never overlap: each one imports existing buckets into
+# a fresh throwaway state, so two racing applies would double-create.
+concurrency:
+  group: terraform-staging
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+  TF_VAR_cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  TF_IN_AUTOMATION: "true"
+  # Lets mise query the GitHub releases API without anonymous rate limits
+  GITHUB_TOKEN: ${{ github.token }}
+
+jobs:
+  plan:
+    name: "🏗 Terraform Plan"
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: "staging"
+    steps:
+      - name: "🛒 Checkout"
+        uses: actions/checkout@v7
+
+      - name: "🐭 Setup mise"
+        uses: jdx/mise-action@v4
+
+      - name: "🎨 Format Check"
+        working-directory: "."
+        run: terraform fmt -check -recursive staging template
+
+      - name: "⚙️ Terraform Init"
+        run: terraform init -input=false
+
+      - name: "✅ Terraform Validate"
+        run: terraform validate
+
+      - name: "📥 Import Existing Buckets"
+        run: ../scripts/import-resources.sh
+
+      - name: "📋 Terraform Plan"
+        run: terraform plan -input=false -out=tfplan
+
+      - name: "📦 Upload Plan"
+        uses: actions/upload-artifact@v4
+        with:
+          name: tfplan
+          path: |
+            staging/tfplan
+            staging/terraform.tfstate
+          retention-days: 3
+          if-no-files-found: warn
+
+  apply:
+    name: "🚀 Terraform Apply"
+    needs: plan
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    # The environment carries a 24h wait timer (configured in repo settings):
+    # the job sits in "Waiting" for 24h, and cancelling the run aborts the apply.
+    environment: "Staging"
+    defaults:
+      run:
+        working-directory: "staging"
+    steps:
+      - name: "🛒 Checkout"
+        uses: actions/checkout@v7
+
+      - name: "🐭 Setup mise"
+        uses: jdx/mise-action@v4
+
+      - name: "📦 Download Plan"
+        uses: actions/download-artifact@v4
+        with:
+          name: tfplan
+          path: staging
+
+      - name: "⚙️ Terraform Init"
+        run: terraform init -input=false
+
+      - name: "🚀 Terraform Apply"
+        run: terraform apply -input=false tfplan