also do terraform

.github/workflows/deploy-on-merge.yml

@@ -9,14 +9,11 @@ on:
       - "docs/**"
       - "**/*.md"
       - ".github/**"
-  # Daily fleet deploy at midday to catch drift from anything changed by hand.
-  # Cron is UTC: 11:00 UTC is 12:00 in London during BST, 11:00 during GMT.
   schedule:
     - cron: "0 11 * * *"
 
-# Serialize fleet deploys so two quick merges (or a merge and the daily run)
+# Serialize fleet deploys so two quick merges can't run Ansible against the
-# can't run Ansible against the same hosts at once. Don't cancel an in-flight
+# same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.
-# deploy mid-run — queue it.
 concurrency:
   group: deploy-on-merge
   cancel-in-progress: false

.github/workflows/terraform.yml

@@ -6,6 +6,8 @@ on:
     paths:
       - "terraform/**"
       - ".github/workflows/terraform.yml"
+  schedule:
+    - cron: "0 11 * * *"
 
 # Requires these repository secrets:
 #   AGE_SECRET_KEY     — age private key for SOPS decryption
@@ -43,7 +45,7 @@ jobs:
         run: tofu plan -out=tfplan
 
       - name: Upload plan
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v7
         with:
           name: tfplan
@@ -53,7 +55,7 @@ jobs:
   apply:
     name: Apply
     needs: plan
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: production
     steps:

ansible/README.md

@@ -29,6 +29,8 @@ make deploy-host HOST=helsinki-a
 
 Ad-hoc runs against a single host or playbook go through the manual `deploy.yml` workflow.
 
+`.github/workflows/terraform.yml` runs plan + apply on the same daily schedule, as well as on merges touching `terraform/`.
+
 ## Playbooks
 
 | Playbook | Purpose | Usage |