(chore): migrate to infisical iac secrets

[slate-rehm]

What

Grant the Bearfire operator admin membership in every managed project for direct local Infisical CLI actions. Add module and formatter tests, keep the provider acceptance fixture current, and prevent a successful global apply from failing when organization policy blocks an automated lock-file PR.

Checklist

• No secret values, tokens, state, plan files, or .env content are committed (names and IDs only).
• placeholder_version is unchanged for every existing secret (incrementing it is destructive: it resets the live value).
• pnpm validate && pnpm lint && pnpm typecheck && pnpm test pass locally.
• The plan workflow comment for each changed root was read; the counts match intent.
• If the plan deletes/replaces anything (secret objects, folders, syncs, identities, connections), the destructive-change label is set and consumers were checked (docs/DELETING_A_SECRET.md). No deletes or replacements are expected.
• Global connection change: not applicable. The lock formatter changes, but connection resources do not.
• Dependent application PR(s) reference this PR as Depends on bearfire-dev/infisical-iac#<n> and wait for pnpm secrets:check <slug> to pass. The open env package PR will be updated after this PR applies.

Depends on / blocks

Blocks paperkeel/env#3 and the remaining application migrations.

Release notes

• Grant the Bearfire operator admin access to each managed Infisical project.
• Validate operator usernames and support zero, one, or multiple usernames.
• Add module, acceptance, and formatter tests.
• Share the connections-lock formatter across the CLI.
• Keep global applies successful when organization policy blocks lock-file pull requests.
• Update project setup and provider acceptance documentation.

[github-actions]

Plan: projects/bearfire-env

Terraform plan

Action	Count
create	1
update	0
replace	0
delete	0

Changed resources

• create module.project.infisical_project_user.operator["yehumbleaccounts@pm.me"]

No destructive changes.

[github-actions]

Plan: projects/bearly-browser-sync

Terraform plan

Action	Count
create	1
update	0
replace	0
delete	0

Changed resources

• create module.project.infisical_project_user.operator["yehumbleaccounts@pm.me"]

No destructive changes.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3cfc1509-d512-422e-8c77-81b874e2a55a

📥 Commits

Reviewing files that changed from the base of the PR and between aab102b and 7b0780c.

📒 Files selected for processing (17)

• .github/workflows/apply.yml
• .github/workflows/bootstrap.yml
• .github/workflows/ci.yml
• CHANGELOG.md
• docs/ADDING_A_PROJECT.md
• docs/PROVIDER_COMPATIBILITY.md
• modules/infisical-project/identities.tf
• modules/infisical-project/tests/acceptance/main.tf
• modules/infisical-project/tests/operator-membership.tftest.hcl
• modules/infisical-project/variables.tf
• projects/_template/main.tf
• projects/bearfire-env/main.tf
• projects/bearly-browser-sync/main.tf
• scripts/provider-acceptance.sh
• tools/cli/__tests__/connections-lock-format.test.ts
• tools/cli/src/connections-lock.ts
• tools/cli/src/lib/connections-lock-format.ts

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Walkthrough

The pull request adds configurable Infisical operator admin memberships, wires operator credentials into acceptance tests, and centralizes connection-lock formatting. The apply workflow now reports blocked lock-file pull-request creation without failing the global apply.

Changes

Managed operator membership

Layer / File(s)	Summary
Operator input and membership resource modules/infisical-project/variables.tf, modules/infisical-project/identities.tf	The module validates operator_usernames and creates an admin project membership for each username.
Project and acceptance wiring projects/*/main.tf, modules/infisical-project/tests/acceptance/main.tf, scripts/provider-acceptance.sh, .github/workflows/bootstrap.yml, docs/PROVIDER_COMPATIBILITY.md	Project wrappers and acceptance runs pass the operator username and create the acceptance membership.
Membership validation and project guidance modules/infisical-project/tests/operator-membership.tftest.hcl, .github/workflows/ci.yml, docs/ADDING_A_PROJECT.md	Tests cover empty, single, multiple, blank, and whitespace-padded usernames. CI and project guidance include the new membership.

Connection-lock formatting and workflow handling

Layer / File(s)	Summary
Shared connection-lock serializer tools/cli/src/lib/connections-lock-format.ts, tools/cli/src/connections-lock.ts	The CLI uses the shared ConnectionsLock model and serializer for stable JSON output.
Serializer tests and apply reporting tools/cli/__tests__/connections-lock-format.test.ts, .github/workflows/apply.yml, CHANGELOG.md	Tests verify lock formatting. The apply workflow reports blocked pull-request creation without failing the global apply.

Estimated code review effort: 3 (Moderate) | ~25 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[slate-rehm]

#AI-Automation

• Added Terraform tests for empty, single, multiple, and invalid operator username inputs after local CodeRabbit feedback.
• Updated the provider acceptance fixture to require a CI-provided operator username and configured the repository variable.
• Updated the project guide to include the operator membership in expected plans.
• Added CI execution for the Terraform module tests.
• Added focused tests for formatter-compatible connection lock output.
• Confirmed all CI checks pass.
• Reviewed both project plans: one additive operator membership each, with no updates, replacements, or deletions.
• Hosted CodeRabbit remained delayed in “Review in progress,” so no hosted findings were available under the requested delay policy.