terraform-ops

No clear malware or intentionally destructive behavior is present. The PR plan job presents a meaningful credential-exposure risk because pull-request-controlled Terraform/provider code runs while AWS OIDC credentials are available. Restrict or isolate PR planning credentials, use a tightly scoped role and trust policy, and pin actions to commit SHAs. The apply path is intentionally privileged and depends on correct environment and IAM protections.