feat: automate StackGuardian cloud onboarding

.devcontainer/Dockerfile

@@ -0,0 +1,38 @@
+FROM mcr.microsoft.com/devcontainers/base:debian-12
+
+ARG TARGETARCH
+
+COPY .terraform-version .opentofu-version .task-version /tmp/versions/
+
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates curl git gnupg jq perl unzip; \
+    rm -rf /var/lib/apt/lists/*; \
+    case "${TARGETARCH}" in \
+      amd64) architecture="amd64" ;; \
+      arm64) architecture="arm64" ;; \
+      *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    terraform_version="$(tr -d '[:space:]' < /tmp/versions/.terraform-version)"; \
+    tofu_version="$(tr -d '[:space:]' < /tmp/versions/.opentofu-version)"; \
+    task_version="$(tr -d '[:space:]' < /tmp/versions/.task-version)"; \
+    curl --fail --location --silent --show-error --output "/tmp/terraform_${terraform_version}_linux_${architecture}.zip" "https://releases.hashicorp.com/terraform/${terraform_version}/terraform_${terraform_version}_linux_${architecture}.zip"; \
+    curl --fail --location --silent --show-error --output /tmp/terraform_SHA256SUMS "https://releases.hashicorp.com/terraform/${terraform_version}/terraform_${terraform_version}_SHA256SUMS"; \
+    (cd /tmp && grep "terraform_${terraform_version}_linux_${architecture}.zip" terraform_SHA256SUMS | sha256sum --check --status); \
+    unzip -q "/tmp/terraform_${terraform_version}_linux_${architecture}.zip" -d /usr/local/bin; \
+    curl --fail --location --silent --show-error --output "/tmp/tofu_${tofu_version}_linux_${architecture}.zip" "https://github.com/opentofu/opentofu/releases/download/v${tofu_version}/tofu_${tofu_version}_linux_${architecture}.zip"; \
+    curl --fail --location --silent --show-error --output /tmp/tofu_SHA256SUMS "https://github.com/opentofu/opentofu/releases/download/v${tofu_version}/tofu_${tofu_version}_SHA256SUMS"; \
+    (cd /tmp && grep "tofu_${tofu_version}_linux_${architecture}.zip" tofu_SHA256SUMS | sha256sum --check --status); \
+    unzip -q "/tmp/tofu_${tofu_version}_linux_${architecture}.zip" tofu -d /usr/local/bin; \
+    curl --fail --location --silent --show-error --output "/tmp/task_linux_${architecture}.tar.gz" "https://github.com/go-task/task/releases/download/v${task_version}/task_linux_${architecture}.tar.gz"; \
+    curl --fail --location --silent --show-error --output /tmp/task_checksums.txt "https://github.com/go-task/task/releases/download/v${task_version}/task_checksums.txt"; \
+    (cd /tmp && grep "task_linux_${architecture}.tar.gz" task_checksums.txt | sha256sum --check --status); \
+    tar -xzf "/tmp/task_linux_${architecture}.tar.gz" -C /usr/local/bin task; \
+    terraform version; \
+    tofu version; \
+    task --version; \
+    rm -rf /tmp/terraform_* /tmp/tofu_* /tmp/task_* /tmp/versions; \
+    mkdir -p /home/vscode/.cache/terraform/providers; \
+    chown -R vscode:vscode /home/vscode/.cache
+
+ENV TF_PLUGIN_CACHE_DIR=/home/vscode/.cache/terraform/providers

.devcontainer/devcontainer.json

@@ -0,0 +1,19 @@
+{
+  "name": "Terraform StackGuardian Modules",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "context": ".."
+  },
+  "remoteUser": "vscode",
+  "containerEnv": {
+    "TF_PLUGIN_CACHE_DIR": "/home/vscode/.cache/terraform/providers"
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "hashicorp.terraform",
+        "opentofu.vscode-opentofu"
+      ]
+    }
+  }
+}

.github/workflows/checks.yml

@@ -0,0 +1,31 @@
+name: Checks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: checks-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checks:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run checks in the devcontainer
+        uses: devcontainers/ci@v0.3
+        with:
+          push: never
+          runCmd: |
+            task check
+            task validate
+            task test

.gitignore

@@ -35,9 +35,13 @@ override.tf.json
 
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
 # example: *tfplan*
+*.tfplan
 
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
 
+# Local environment files can contain API tokens.
+.env
+
 **/.DS_Store

.opentofu-version

@@ -0,0 +1 @@
+1.12.5

.task-version

@@ -0,0 +1 @@
+3.45.5

.terraform-version

@@ -0,0 +1 @@
+1.5.7

CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Add root-level AWS, Azure, and GCP identity wiring so Terraform creates the selected cloud identity and registers its generated identifiers with StackGuardian.
+- Add CLI-authenticated AWS and Azure onboarding and guarded destroy tasks with temporary targeted plans and StackGuardian token prompting.
+
+### Changed
+- Move AWS region, Azure subscription and tenant IDs, and GCP project IDs into their respective `cloud_connectors` entries instead of using root cloud-provider variables.
+- Rebuild the scoped role-v4 permission document from the observed v4 positional path shape, including exact and nested workflow-group paths and matching wildcard arrays.
+- Deprecate static AWS and Azure authentication. Static identity modules and static cloud connector kinds now require explicit `allow_static_credentials = true` acknowledgement and emit an apply-time warning.
+- Replace the unsafe Taskfile example-copy initialization workflow with non-mutating formatting, source-contract, and isolated validation tasks compatible with Terraform 1.5.7.
+
+### Added
+- Add pinned OpenTofu 1.12.5 native tests for role-v4 permission construction and static cloud connector acknowledgement behavior, using isolated mocked plan runs.
+
+## [2.0.0] - 2026-08-12
+
+### Breaking
+- Pin Terraform Core to `1.5.7` and upgrade bounded provider ranges: StackGuardian 1.12, AWS 6, AzureRM 5, AzureAD 3.9, and Google 7.
+- Replace legacy camelCase/hyphenated inputs, untyped connector objects, root static credential duplicates, and leaf StackGuardian API credential inputs with v2 flat snake_case contracts.
+- Migrate roles to `stackguardian_rolev4` and assignments to `roles = [role_name]`. Existing role state requires the documented state remove/import procedure.
+- Replace global AWS policy attachments and authoritative GCP service-account IAM policy management with narrowly scoped attachments/members. Existing state needs the documented import procedure before apply.
+
+### Changed
+- Correct Azure connector settings to the provider's `arm_tenant_id`, `arm_subscription_id`, `arm_client_id`, and `arm_client_secret` schema.
+- Use production StackGuardian OIDC issuer/audience defaults for AWS, Azure, and GCP; expose their configuration inputs.
+- Retain configurable permissive defaults: AWS `ReadOnlyAccess`, Azure subscription `Contributor`, and GCP `roles/owner`. These defaults are documented as high-risk where applicable.
+- Add validation, sensitive flags, finite Azure secret lifetime, typed VCS credentials, typed cloud connectors, and GCP same-type state moves.
+
 ### Added
 - Comprehensive README.md with detailed documentation
 - Input validation for variables