From 6fa8074a8a28a95497630bb4560a2974e93d62f2 Mon Sep 17 00:00:00 2001
From: Rasmus Wejlgaard <pez@pez.sh>
Date: Mon, 14 Sep 2026 20:18:16 +0100
Subject: [PATCH] also do terraform

---
 .github/workflows/deploy-on-merge.yml | 7 ++-----
 .github/workflows/terraform.yml       | 6 ++++--
 ansible/README.md                     | 2 ++
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-on-merge.yml b/.github/workflows/deploy-on-merge.yml
index c0f3db5..5721708 100644
--- a/.github/workflows/deploy-on-merge.yml
+++ b/.github/workflows/deploy-on-merge.yml
@@ -9,14 +9,11 @@ on:
       - "docs/**"
       - "**/*.md"
       - ".github/**"
-  # Daily fleet deploy at midday to catch drift from anything changed by hand.
-  # Cron is UTC: 11:00 UTC is 12:00 in London during BST, 11:00 during GMT.
   schedule:
     - cron: "0 11 * * *"
 
-# Serialize fleet deploys so two quick merges (or a merge and the daily run)
-# can't run Ansible against the same hosts at once. Don't cancel an in-flight
-# deploy mid-run — queue it.
+# Serialize fleet deploys so two quick merges can't run Ansible against the
+# same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.
 concurrency:
   group: deploy-on-merge
   cancel-in-progress: false
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
index a7f942d..c323a5d 100644
--- a/.github/workflows/terraform.yml
+++ b/.github/workflows/terraform.yml
@@ -6,6 +6,8 @@ on:
     paths:
       - "terraform/**"
       - ".github/workflows/terraform.yml"
+  schedule:
+    - cron: "0 11 * * *"
 
 # Requires these repository secrets:
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
@@ -43,7 +45,7 @@ jobs:
         run: tofu plan -out=tfplan
 
       - name: Upload plan
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v7
         with:
           name: tfplan
@@ -53,7 +55,7 @@ jobs:
   apply:
     name: Apply
     needs: plan
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: production
     steps:
diff --git a/ansible/README.md b/ansible/README.md
index 4597dec..c1cf6f2 100644
--- a/ansible/README.md
+++ b/ansible/README.md
@@ -29,6 +29,8 @@ make deploy-host HOST=helsinki-a
 
 Ad-hoc runs against a single host or playbook go through the manual `deploy.yml` workflow.
 
+`.github/workflows/terraform.yml` runs plan + apply on the same daily schedule, as well as on merges touching `terraform/`.
+
 ## Playbooks
 
 | Playbook | Purpose | Usage |