Credentials

Credential values remain in GitHub organization secrets. Terraform never reads or stores their values.

GitHub root credentials

Secret	Consumer	Purpose
`TF_GITHUB_PLAN_TOKEN`	`terraform-github-plan`	Read organization configuration and create plans
`TF_GITHUB_APPLY_TOKEN`	`terraform-github-apply`	Apply reviewed organization configuration
`CLOUDFLARE_R2_ACCESS_KEY_ID`	Terraform jobs	Read, write, and lock remote state
`CLOUDFLARE_R2_SECRET_ACCESS_KEY`	Terraform jobs	Authenticate remote state operations

The plan and apply secrets are restricted to the infrastructure repository. Apply environments accept only the main branch.

Local validation

Local validation does not require provider or R2 credentials. make verify initializes Terraform without the remote backend, validates configuration, and runs TFLint.