chore: post terraform plan summary as PR comment

[jgravois]

resolves #3926

terraform plan - https://github.com/cal-itp/benefits/actions/runs/30667671806/job/91278352667#step:6:139

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[thekaveman]

Oof... this is posting the subscription ID in cleartext, something the plan output in GHA does not do.

I don't know why, I don't know if there's something we can do about that? Ideally we aren't printing it if we can avoid doing so.

[jgravois]

good catch @thekaveman. @lalver1 and i just noticed the same exact thing. 🤦‍♂️

i deleted the PR comment. annoyingly, the copy of the summary that is appended to the job itself does obscure our azure subscription id. i suspect this is because GitHub itself filters out strings that match repo secrets there.

https://github.com/cal-itp/benefits/actions/runs/30582336772/attempts/1#summary-91005402263

if only these summaries outlived the logs themselves...

[jgravois]

alright, i ended up changing tack slightly in this PR. my modified proposal is outlined in #3926 (comment)

[github-actions]

CHANGE	RESOURCE
update (4)	azurerm_key_vault_access_policy.devsecops
	azurerm_key_vault_access_policy.engineering
	azurerm_key_vault_access_policy.pgadmin_container_app
	azurerm_key_vault_access_policy.web_container_app

CHANGE	OUTPUT
update (1)	outbound_ip_ranges

[jgravois]

i just pushed 614e369 ae8b4b6 to wire up 'sticky' comment behavior.

[thekaveman]

I'm lovin' it 🍔

[jgravois]

if 'Update with rebase' dismisses your approvals, i apologize in advance 😈

[github-actions]

Preview url: https://benefits-3923--cal-itp-previews.netlify.app