refactor(scripts): move provisioning scripts to scripts/provision/

[Smana]

PR 3 of 3, and the last step of the scripts/ restructure. It moves the apply-time provisioning scripts into scripts/provision/. After it, scripts/ holds no loose executables (spec criterion 1):

$ ls scripts/
AGENTS.md  CLAUDE.md  README.md  tasks.yaml  ci/  docs/  lib/  ops/  provision/

flowchart LR
  T["terramate · tofu"] -->|"global.provisioner<br/>global.cloud_gate"| TP["provision/tm-provisioner.sh"]
  T -->|"data external (plan time)"| H["provision/helm-release-present.sh"]
  T --> OC["provision/openbao-config.sh"]
  OC -->|"sibling call"| S["provision/openbao-snapshot.sh<br/>(symlink → container-images/…)"]
  T --> Z["provision/zitadel-oidc-clients.sh"]
  HU["a human"] -->|"task provision:*"| Z & SS["provision/secret-store.sh"] & ZI["provision/zitadel-idp.sh"] & S
  classDef moved fill:#d4edda,stroke:#28a745
  class TP,H,OC,S,Z,SS,ZI moved

Loading

📋 Design

• Design: 2026-09-17-scripts-restructure-design.md. It calls this "the one that can fail at 2am".
• Plan: 2026-09-22-scripts-restructure-pr3-plan.md. PRs 1 (refactor(scripts): move the CI half to scripts/ci, index it with task #2061) and 2 (refactor(scripts): move ops and docs scripts by audience, gate terramate script paths #2076) are merged.

What moved

The files moved in three commits, one per risk group, each ending green. A fourth commit came from the rebase on #2078:

Commit	Moves	Refs failing, then fixed
plumbing	tm-provisioner.sh, helm-release-present.sh, openbao-adopt-jwt-mount.sh	27 → 0
OpenBao	openbao-config.sh, secret-store.sh, and the openbao-snapshot.sh symlink, re-pointed	19 → 0
ZITADEL	zitadel-idp.sh, zitadel-actions/, zitadel-oidc-clients.sh	7 → 0
after the rebase on #2078	openbao-oidc-check.sh, which #2078 added at the root	3 refs + 5 paths → 0

Two lines change for 172 uses of tm-provisioner.sh: global.provisioner and global.cloud_gate, which names it separately.

openbao-snapshot.sh stays a symlink and moves next to openbao-config.sh, which runs it as a sibling at apply time (:1224, :1403, unchanged).

Nine lib/ sources gained one ../. Thirteen test suites now point at provision/, and no "still at scripts/ root" comment is left. The four human-run scripts are indexed as task provision:*. The terramate and tofu plumbing is not.

Every count was predicted by simulating each move first, and matched. Both gates are green on every intermediate commit, so the branch is bisectable.

⚠️ Merge gate

This is the one PR where terramate script run preview is real evidence: helm-release-present.sh runs at plan time through data "external" in both configure stacks, so a wrong path fails the preview. It can share a cluster session with the post-merge rebuild of #2078 (#2045).

• TM_CLOUD=aws terramate script run preview and TM_CLOUD=gcp terramate script run preview both succeed

Evidence

Run on this branch, rebased on main @ 8eceefc6 (after #2078):

$ bash scripts/ci/tests/test-terramate-script-refs.sh
91 script reference(s) on executed opentofu/terramate lines checked; 0 failed
$ bash scripts/ci/tests/test-script-paths.sh
11 roots, 16 relative paths, 25 sources, 20 subjects checked; 0 failed
$ task ci:test
25 passed, 1 skipped, 0 failed
$ task ci:links / ci:doc-paths / ci:doc-claims / ci:idp-topology     # all exit 0
$ task --list | grep -cE '^\* (ops|docs|provision):'
19

In addition:

• terramate fmt --check passes.
• tofu fmt -check passes on all 11 touched directories, and tofu validate on 7 stacks. Neither step touched state.
• ShellCheck with CI's exact find passes.
• All 13 symlinks are intact.
• terramate debug show globals resolves every scripts/ path in all 16 stacks.

Notes for review

• Rebased on feat(openbao): reconcile the OIDC client after ZITADEL rotates it #2078 (OpenBao SSO breaks after every rebuild: management applies before ZITADEL exists, so oidc_client_id is the previous rebuild's #2045), which merged first. Three conflicts came up, all lines feat(openbao): reconcile the OIDC client after ZITADEL rotates it #2078 edited that this PR renames: stage4's sync call, the lib/ sources in zitadel-oidc-clients.sh, and sso.md step 1. Each takes feat(openbao): reconcile the OIDC client after ZITADEL rotates it #2078's content at the provision/ path. 0f95d7c8 moves openbao-oidc-check.sh into provision/ and re-points stage4's CA fetch, stage5, both suites, the lib/ sources and the docs. The two path gates found all 8 stale spots (3 refs, 5 paths) before the fix.
• Three hooks were skipped on two commits. The commits that touch .tf files skipped terraform_fmt, terraform_validate and terraform_tflint, after the known pre-commit-terraform GIT_INDEX_FILE leak swapped the worktree index. The index was repaired with git read-tree HEAD. All three hooks were run by hand on every touched stack and pass; detect-secrets and every other hook ran. CI's pre-commit job runs --all-files, including those three.
• Merging re-publishes the openbao-snapshot image. Comment edits under container-images/openbao-snapshot/ trigger a rebuild. The script change is comments only.
• Spec criterion 11 is superseded. It said test -f "$(readlink -f scripts/openbao-snapshot.sh)". By owner decision, the check is now test -f "$(readlink -f scripts/provision/openbao-snapshot.sh)".
• Three secret-description strings now name scripts/provision/…. They are stamped only on newly created secrets and never compared.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

No changes to the rendered desired state. ✅