test(terraform): apply examples directly against MiniStack

[edersonbrilhante]

Description

• run literal terraform apply and terraform destroy from eight checked-in examples/<name> roots against an isolated MiniStack service
• pass MiniStack-only values through ordinary example inputs and tfvars; remove the copied Terraform override layer entirely
• create only the external prerequisites the examples need: an inert Lambda archive and synthetic SSM values, all under the runner's temporary directory
• prevent real AWS or GitHub changes with validated local endpoints, synthetic credentials, disabled ambient profiles/session tokens, inert Lambda handlers, and an explicit GitHub App updater switch
• document the two exclusions: dedicated-mac-hosts requires APIs MiniStack does not implement, while lambdas-download contains no AWS resources

Test Plan

• GitHub Actions MiniStack Terraform apply: all eight example apply/destroy lanes passed (run 32881202055)
• direct examples/base lifecycle against MiniStack v1.5.0: 20 resources applied and destroyed
• direct examples/default lifecycle in the pinned Linux AMD64 Terraform 1.14 image: 147 resources applied and destroyed; shared fixture: 5 applied and destroyed
• direct examples/ephemeral lifecycle in the pinned Linux AMD64 Terraform 1.14 image: 128 resources applied and destroyed; shared fixture: 5 applied and destroyed
• commit hooks: Terraform fmt, Terraform validate with TFLint, and merge-conflict check passed
• terraform fmt -recursive -check -diff
• shellcheck tests/ministack/run-example.sh
• sh -n tests/ministack/run-example.sh
• parsed .github/workflows/ministack.yml as YAML
• verified service-specific endpoint variables fail closed with exit 65

Related Issues

None.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/step-security/harden-runner	9af89fc71515a100421586dfdb3dc9c984fbf411	🟢 7.8	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 5 out of 5 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 0 22 existing vulnerabilities detected

Scanned Files

• .github/workflows/ministack.yml