Integrate Rabbit lifecycle resolution

[fqjony]

Scope

• Absorb Rabbit lifecycle resolution into this composite action; it no longer runs udx/rabbit-lifecycle.
• Resolve explicit lifecycles, development subdirectory hints, protected branches, and fallbacks before config merging.
• Consolidate compatible runtime improvements from PR Externalize auth, OpenTofu support, multi-cloud backends, Node.js 24 actions #1: caller-managed GCP credentials, generic state-backend overrides, resilient AWS credential forwarding, and Node.js 24 action runtimes.
• Keep the existing GCP and AWS action inputs working. Caller-managed credentials are opt-in.
• Use one validated policy for lifecycle resolution and config merging. Callers may optionally provide lifecycle_policy_path; the bundled policy remains the default.

Compatibility

• Existing callers continue to use the bundled policy and current action inputs.
• Existing GCP Workload Identity callers pass both GCP inputs unchanged.
• Callers that authenticate GCP before this action can omit both GCP inputs; the credential file is mounted read-only into the container.
• Direct/local merge scripts retain their existing fallback behavior when lifecycle metadata is not supplied.
• A caller policy is opt-in and must declare exactly one protected lifecycle and one fallback lifecycle.

Validation

• make test — 29 passed, 0 failed.
• Composite-action scripts changed in this PR pass bash -n.
• yq eval validates action and workflow metadata.
• dev.kit repo refreshed the generated repository context.
• PR CI is green.

[Copilot]

Pull request overview

This PR delegates lifecycle resolution to the external udx/rabbit-lifecycle action while keeping this action responsible for config discovery and deep-merge behavior. It also adds a small smoke test script and updates docs to reflect the new lifecycle flow and source_dir layout guidance.

Changes:

• Add a new “Resolve Rabbit lifecycle” step (via udx/rabbit-lifecycle) and surface additional lifecycle metadata outputs (is_protected, resolution_reason).
• Tighten config discovery to only consider directories under configured lifecycle roots, including supporting nested source_dir layouts (e.g. .rabbit/infra_configs).
• Add bash-based smoke coverage for lifecycle base + env override merge behavior and update README documentation.

Reviewed changes

Copilot reviewed 5 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
action.yml	Adds lifecycle resolution step and new outputs; pins yq install to a specific version.
bin/merge-configs.sh	Filters discovered config files by lifecycle root directories before merging.
bin/lib/lifecycle.sh	Adjusts lifecycle resolution to prefer pre-resolved lifecycle metadata and filters detection by lifecycle roots.
bin/lib/config.sh	Exports lifecycle metadata (LIFECYCLE, IS_PROTECTED, RESOLUTION_REASON) from inputs.
tests/run-merge-tests.sh	Adds smoke tests for merge behavior across lifecycle roots and nested source_dir layouts.
README.md	Updates “How it works”, environment/lifecycle wording, and documents nested source_dir usage and new outputs.
.rabbit/context.yaml	Adds refreshed dev.kit repo context manifest.
.github/dependabot.yml	Enables weekly Dependabot updates for GitHub Actions.

Comments suppressed due to low confidence (1)

README.md:152

• In the updated flow, the diagram’s step numbers are now inconsistent: after adding “1. Resolve Lifecycle” and “2. Merge Configs”, the next box still says “2. Safety Checks” and subsequent steps are off by one. Update the numbering so the sequence matches the new action step order.

        ┌─────────────▼──────────────┐
        │   2. Merge Configs         │
        │   Discover .rabbit/ YAML   │
        │   Deep merge by module::id │
         └─────────────┬──────────────┘
                       │
         ┌─────────────▼──────────────┐
         │   2. Safety Checks         │
         │   Block production manual  │
         │   Block production destroy │
         │   Auto plan-only for PRs   │
         └─────────────┬──────────────┘

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 17 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 19 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

action.yml:419

• This summary line uses LIFECYCLE_POLICY_PATH, but that variable isn’t set in the step env, so it will always render as bundled regardless of the selected policy. Use the resolve-lifecycle step output directly (or pass it into env) so the summary matches the actual policy used.

          echo "| Field | Value |"
          echo "| --- | --- |"
          echo "| Lifecycle | \`${LIFECYCLE:-unknown}\` |"
          echo "| Lifecycle Policy | \`${LIFECYCLE_POLICY_PATH:-bundled}\` |"
          echo "| Plan Only | \`${PLAN_ONLY:-true}\` |"

[Copilot]

Pull request overview

Copilot reviewed 12 out of 19 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 19 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 19 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 19 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

docs/configuration.md:36

• This section says the action “owns … cloud auth”, but the composite action no longer performs GCP/AWS authentication (it now relies on caller-managed credentials and forwards them into R2A). Please update the contract wording to avoid misleading consumers.

This action resolves lifecycle, environment, protected-branch status, and resolution reason before merging configuration. It then owns Rabbit config discovery, merge ordering, manifest merge behavior, deployment safety checks, cloud auth, Terraform/R2A execution, PR comments, summaries, and Slack notifications. It has no runtime dependency on `udx/rabbit-lifecycle`.

action.yml:13

• The PR description states that existing GCP/AWS action inputs remain supported and caller-managed credentials are opt-in, but action.yml removes the gcp_auth_provider, gcp_service_account, aws_role_arn, and aws_region inputs entirely. Please reconcile the PR description with the implemented contract (either reintroduce compatibility inputs or update the PR description to match the breaking change).

inputs:
  # Required
  project_id:
    description: "Project identifier for Terraform state and resource operations"
    required: true