DSTA-669: Incorporate boostrap from previous repo

[micjustus-nc]

Description

These changes bring in support for the ability to bootstrap (create on first run) the needed Terraform resources in a target environment.

Context

To run the bootstrap on Windows, use Bash WSL
In the terminal

• run az login to authenticate to the cloud mind (tenant/subscription)
• from the repository root (containing the main Makefile), type make dev bootstrap

The bootstrap flow validates prerequisites (like the required Entra group screening_nbss_dev and subscription contexts), runs a what-if preview, and then deploys bootstrap resources after confirmation.

Why is this required?
This is required because Terraform deployments rely on remote backend state. terraform-init expectes the backend state to already exist. So, the bootstrap process provisions the prerequisites so Terraform can initialise, plan and apply its changes safely.

Deployment model
This set of changes uses Bicep-based Azure deployments to create Terraform backend prerequisites.

Deployment resources

• backend storage account with NO public access, accessible only from a private endpoint

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[Copilot]

Pull request overview

Adds a bootstrap workflow to provision Azure prerequisites (Terraform remote state backend + private connectivity) via Bicep, and wires the flow into make targets so environments can be initialized consistently before running Terraform.

Changes:

• Introduces make targets for environment selection, Azure subscription context, bootstrap orchestration, and Terraform operations.
• Adds Bicep templates + a Bash orchestrator to validate prerequisites, run what-if, and deploy bootstrap resources.
• Documents the bootstrap flow and normalizes LF endings for shell/scripts to reduce CRLF-related issues.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
Makefile	Replaces template Makefile with make-based bootstrap/terraform workflow entrypoints.
scripts/make/shared.mk	Adds asdf tool installation and a custom help renderer shared across make targets.
scripts/make/environment.mk	Adds dev/prod environment selector targets that load per-environment variables.
scripts/make/bootstrap.mk	Adds bootstrap target to run the bootstrap orchestrator script with resolved inputs.
scripts/make/azure.mk	Adds Azure CLI subscription selection and subscription ID resolution targets.
scripts/make/terraform.mk	Adds Terraform init/plan/apply/destroy targets and module-fetching behavior.
scripts/bash/run_bootstrap.sh	Adds bootstrap orchestration (prereq validation, what-if, deploy, output).
infrastructure/bootstrap/main.bicep	Subscription-scope bootstrap orchestration module (state storage + DNS + private endpoint + infra RG).
infrastructure/bootstrap/terraformStorage.bicep	Creates locked-down state storage account/container + RBAC assignment.
infrastructure/bootstrap/dns.bicep	Looks up private DNS zones for private endpoint integration.
infrastructure/bootstrap/privateEndpoint.bicep	Creates private endpoint and DNS zone group registration.
infrastructure/environments/dev/variables.sh	Adds dev environment variables used by make/bootstrap.
infrastructure/environments/prod/variables.sh	Adds prod placeholders for environment variables used by make/bootstrap.
infrastructure/README.md	Adds bootstrap/terraform workflow documentation and usage guidance.
.gitattributes	Enforces LF endings for scripts/shell files to prevent WSL/shebang CRLF failures.

Suppressed comments (2)

scripts/bash/run_bootstrap.sh:112

• If infra-resource-group-name is provided, it should be passed through to the Bicep deployment as infraResourceGroupName so it actually takes effect.

mainBicepParams=(
  enableSoftDelete="$ENABLE_SOFT_DELETE"
  envConfig="$ENV_CONFIG"
  region="$REGION"
  storageAccountRGName="$STORAGE_ACCOUNT_RG"

infrastructure/README.md:61

• Typo in Mermaid title: "Boostrap" should be "Bootstrap".

title: Boostrap process flow

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[saliceti]

Closed in favour of #67