Bump configure-aws-credentials to v6 and dflook/terraform-* to v3 in the Terraform workflows

Start by reading .github/workflows/terraform-plan.yaml and .github/workflows/terraform-apply.yaml, locating the relevant uses: lines rather than relying on line numbers. Check the paths filter and coordinate with the related OIDC and checkout work before editing. Done means only the specified action pins change, a no-op .tf change produces an empty plan, and the post-merge apply succeeds without a Node.js 20 deprecation annotation.

Overview

We need to bump aws-actions/configure-aws-credentials from @v4 to @v6 and dflook/terraform-plan/dflook/terraform-apply from @v1 to @v3 in both Terraform workflows, because configure-aws-credentials@v4 runs on the deprecated Node 20 and the dflook pins are four releases behind, including a fix for terraform-apply wrongly aborting on a plan that contains both imports and warnings.

Action Items

aws-actions/configure-aws-credentials — @v4 to @v6, 2 lines:

• .github/workflows/terraform-plan.yaml:25 and .github/workflows/terraform-apply.yaml:25.
• Go to v6, not v4-for-parity and not v5. Reading action.yml at each tag: v3 = node16, v4 = node20, v5 = node20, v6 = node24. Only v6 clears the Node 20 deprecation. This repo was previously described as the "good" state that incubator's @v3 should be brought up to — that was wrong, @v4 here is deprecated too.
• Note this is the opposite call from actions/checkout in hackforla/devops#183, which deliberately stops at v5 rather than going current. The two look inconsistent and are not: for checkout an intermediate version already reaches Node 24, and for this action nothing below v6 does.

dflook/terraform-plan and dflook/terraform-apply — @v1 to @v3, 2 lines:

• terraform-plan.yaml:32 (dflook/terraform-plan@v1) and terraform-apply.yaml:32 (dflook/terraform-apply@v1).
• @v1 is a floating tag, so this is less stale than it looks — it resolves to v1.49.0 (2025-05-29), not the 2021 release. Latest is v3.0.0 (2026-07-18). The honest framing is four missed releases, not "two majors behind".
• The Node 20 deprecation does not apply to these two. Both are Docker actions (runs: using: docker), so no JS runtime is involved. That is why going straight to current is fine here.
• Checked before this ticket was written, so you do not have to: the only input removed across both majors is the deprecated var: input (v2.0.0), and neither workflow uses it — they pass only path, backend_config_file and auto_approve, all still present at v3.0.0. The real risk is the debian 11 → 12 → 13 base-image bump.

Out of scope — do not change these here:

• actions/checkout@v4 at line 23 of both files belongs to hackforla/devops#183. Leave it alone. If hackforla/devops#183's devops-security PR has already merged, rebase; if it has not, whoever merges second rebases. Same two files, adjacent lines.

Verification — read this before opening the PR, it is the awkward part:

• Both workflows filter on paths: ['**/*.tf'] only, so a PR that changes only .github/workflows/*.yaml triggers neither plan nor apply and shows no checks at all. That is expected, not a failure — and it means this change is not self-testing the way the equivalent incubator work (hackforla/incubator#158, hackforla/incubator#159) was.
• To exercise the plan job in the same PR, include a no-op change to a .tf file (a comment line). Treat an empty plan as a hard gate: if the plan shows any resource change, stop and raise it rather than merging.
• After the PR merges, terraform-apply.yaml runs a real terraform apply against AWS on push to main. Confirm that run succeeds and carries no "Node.js 20 is deprecated" annotation. This cannot be checked from the branch.

Resources/Instructions

• Files (default branch is main): .github/workflows/terraform-plan.yaml, .github/workflows/terraform-apply.yaml
• Line numbers accurate 2026-08-27 and will drift — locate each pin by its uses: line rather than by position.
• Coordination with the OIDC work. There is an unticketed plan to move both workflows off static AWS credentials onto OIDC role assumption, which rewrites configure-aws-credentials — the very line this ticket bumps. If that work starts before this is picked up, fold this in and close this issue as covered rather than editing the same lines twice.
• Related: hackforla/devops#183 (actions/checkout in the same files), hackforla/incubator#158 (same configure-aws-credentials bump, already ticketed), hackforla/incubator#159 (same dflook bump, already ticketed).