From 3ad5e7df2efb25c6f10328a4a89f3dc713930cd7 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Tue, 16 Jun 2026 13:03:36 -0700
Subject: [PATCH 01/12] add reusable workflow

---
 .github/workflows/tofu-run.yml         | 62 ++++++++++++++++++++++++++
 ops/services/60-monitors/variables.tf  |  1 -
 ops/services/65-dashboard/variables.tf |  0
 3 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/tofu-run.yml
 delete mode 100644 ops/services/60-monitors/variables.tf
 delete mode 100644 ops/services/65-dashboard/variables.tf

diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
new file mode 100644
index 0000000000..5622876d76
--- /dev/null
+++ b/.github/workflows/tofu-run.yml
@@ -0,0 +1,62 @@
+name: Tofu Plan & Apply (Reusable)
+run-name: "[${{ inputs.apply && 'APPLY' || 'PLAN' }}] ${{ inputs.service }} → ${{ inputs.environment }}"
+
+on:
+  workflow_call:
+    inputs:
+      service:
+        description: "Service directory (e.g., 00-boostrap or 10-core)"
+        required: true
+        type: string
+      environment:
+        description: AB2D environment
+        required: true
+        type: string
+      apply:
+        description: "Run tofu apply (true) or plan only (false)"
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: tofu-plan-or-apply
+
+env:
+  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  tofu:
+    name: "tofu ${{ inputs.apply && 'apply' || 'plan' }} [${{ inputs.service }} / ${{ inputs.environment }}]"
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    runs-on: codebuild-ab2d-${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && 'non-prod' || 'prod' }}-${{ github.run_id }}-${{ github.run_attempt }}
+    env:
+      APP: ab2d
+      ENV: ${{ inputs.environment }}
+
+    defaults:
+      run:
+        working-directory: ops/services/${{ inputs.service }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 #v4.1.1
+      - uses: cmsgov/cdap/actions/setup-tenv@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: cmsgov/cdap/actions/setup-sops@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: cmsgov/cdap/actions/setup-yq@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        with:
+          role-to-assume: arn:aws:iam::${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && secrets.NON_PROD_ACCOUNT || secrets.PROD_ACCOUNT }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: tofu plan
+        run: |
+          tofu init -var=parent_env=$ENV -reconfigure
+          tofu workspace select -var=parent_env=$ENV -or-create=true $ENV
+          tofu plan -no-color -input=false -out=tfplan
+
+      - name: tofu apply
+        if: inputs.apply == true
+        run: tofu apply -no-color -input=false tfplan
diff --git a/ops/services/60-monitors/variables.tf b/ops/services/60-monitors/variables.tf
deleted file mode 100644
index 8b13789179..0000000000
--- a/ops/services/60-monitors/variables.tf
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/ops/services/65-dashboard/variables.tf b/ops/services/65-dashboard/variables.tf
deleted file mode 100644
index e69de29bb2..0000000000

From b07f16522c72cb8f180bed86f9bd75add356ebba Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Tue, 16 Jun 2026 13:20:42 -0700
Subject: [PATCH 02/12] add branch variable

---
 .github/workflows/tofu-run.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
index 5622876d76..f77f9c07b8 100644
--- a/.github/workflows/tofu-run.yml
+++ b/.github/workflows/tofu-run.yml
@@ -17,6 +17,11 @@ on:
         required: false
         type: boolean
         default: false
+      branch:
+        description: "Branch or ref to checkout (defaults to the calling workflow's ref)"
+        required: false
+        type: string
+        default: ""
 
 concurrency:
   group: tofu-plan-or-apply
@@ -42,6 +47,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+        with:
+          ref: ${{ inputs.branch != '' && inputs.branch || github.ref }}
       - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 #v4.1.1
       - uses: cmsgov/cdap/actions/setup-tenv@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
       - uses: cmsgov/cdap/actions/setup-sops@f4c14d47cc20e7f6de9112d7155af1213c9bca5a

From 24a95ff13deae914970a3e1bf72dbedc0f9644eb Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 17 Jun 2026 08:05:56 -0700
Subject: [PATCH 03/12] adds job setup and caller workflows

---
 .github/workflows/tofu-run.yml | 66 ++++++++++++++++++++++++----------
 1 file changed, 47 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
index f77f9c07b8..67c7d36ea9 100644
--- a/.github/workflows/tofu-run.yml
+++ b/.github/workflows/tofu-run.yml
@@ -1,24 +1,31 @@
-name: Tofu Plan & Apply (Reusable)
-run-name: "[${{ inputs.apply && 'APPLY' || 'PLAN' }}] ${{ inputs.service }} → ${{ inputs.environment }}"
+name: tofu-run
+run-name: "[${{ inputs.apply && 'APPLY' || 'PLAN' }}] ${{ inputs.service }} → ${{ inputs.environment }}${{ inputs.branch != '' && format(' ({0})', inputs.branch) || '' }}"
 
 on:
-  workflow_call:
+  workflow_dispatch:
     inputs:
       service:
-        description: "Service directory (e.g., 00-boostrap or 10-core)"
+        description: "Service directory"
         required: true
-        type: string
+        type: choice
+        options:
+          - "60-monitors"
+          - "65-dashboard"
       environment:
-        description: AB2D environment
+        description: "AB2D environment"
         required: true
-        type: string
+        type: choice
+        options:
+          - dev
+          - test
+          - sandbox
+          - prod
       apply:
-        description: "Run tofu apply (true) or plan only (false)"
-        required: false
+        description: "Run apply (vs plan only)"
         type: boolean
         default: false
       branch:
-        description: "Branch or ref to checkout (defaults to the calling workflow's ref)"
+        description: "Branch or ref to checkout"
         required: false
         type: string
         default: ""
@@ -30,12 +37,28 @@ env:
   TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
+  setup:
+    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      account_id: ${{ steps.check.outputs.account_id }}
+      apply: ${{ steps.check.outputs.apply }}
+      branch: ${{ steps.check.outputs.branch }}
+    steps:
+      - id: check
+        run: |
+          if [[ "${{ contains(fromJSON('["dev", "test"]'), inputs.environment) }}" == "true" ]]; then
+            echo "account_id=${{ secrets.NON_PROD_ACCOUNT }}" >> $GITHUB_OUTPUT
+          else
+            echo "account_id=${{ secrets.PROD_ACCOUNT }}" >> $GITHUB_OUTPUT
+          fi
+          echo "apply=${{ inputs.apply }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ inputs.branch || github.ref }}" >> $GITHUB_OUTPUT
+
   tofu:
-    name: "tofu ${{ inputs.apply && 'apply' || 'plan' }} [${{ inputs.service }} / ${{ inputs.environment }}]"
+    needs: setup
     permissions:
       contents: read
       id-token: write
-      pull-requests: write
     runs-on: codebuild-ab2d-${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && 'non-prod' || 'prod' }}-${{ github.run_id }}-${{ github.run_attempt }}
     env:
       APP: ab2d
@@ -46,24 +69,29 @@ jobs:
         working-directory: ops/services/${{ inputs.service }}
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
-          ref: ${{ inputs.branch != '' && inputs.branch || github.ref }}
-      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 #v4.1.1
+          ref: ${{ needs.setup.outputs.branch }}
+
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
+
       - uses: cmsgov/cdap/actions/setup-tenv@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+
       - uses: cmsgov/cdap/actions/setup-sops@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
+
       - uses: cmsgov/cdap/actions/setup-yq@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
-      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
         with:
-          role-to-assume: arn:aws:iam::${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && secrets.NON_PROD_ACCOUNT || secrets.PROD_ACCOUNT }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
+          role-to-assume: arn:aws:iam::${{ needs.setup.outputs.account_id }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
           aws-region: ${{ vars.AWS_REGION }}
 
       - name: tofu plan
         run: |
           tofu init -var=parent_env=$ENV -reconfigure
-          tofu workspace select -var=parent_env=$ENV -or-create=true $ENV
+          tofu workspace select -var=parent_env=$ENV -or-create=true ab2d-$ENV
           tofu plan -no-color -input=false -out=tfplan
 
       - name: tofu apply
-        if: inputs.apply == true
+        if: needs.setup.outputs.apply == 'true'
         run: tofu apply -no-color -input=false tfplan

From e5a6541ba8e01dc4f04f85e67b6800f6c7b8f756 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 17 Jun 2026 08:06:29 -0700
Subject: [PATCH 04/12] add caller workflows

---
 .github/workflows/dashboard.yml |  0
 .github/workflows/monitors.yml  | 89 +++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+)
 create mode 100644 .github/workflows/dashboard.yml
 create mode 100644 .github/workflows/monitors.yml

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
new file mode 100644
index 0000000000..faa507cd3b
--- /dev/null
+++ b/.github/workflows/monitors.yml
@@ -0,0 +1,89 @@
+name: 60-monitors
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "ops/services/60-monitors/**"
+  pull_request:
+    paths:
+      - "ops/services/60-monitors/**"
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: AB2D environment
+        required: true
+        type: choice
+        options: [dev, test, sandbox, prod]
+      apply:
+        description: "Run apply (vs plan only)"
+        type: boolean
+        default: false
+      branch:
+        description: "Branch or ref to checkout"
+        required: false
+        type: string
+        default: ""
+
+jobs:
+  setup:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: codebuild-ab2d-${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && 'non-prod' || 'prod' }}-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      apply: ${{ steps.check.outputs.apply }}
+      branch: ${{ steps.check.outputs.branch }}
+    steps:
+      - id: check
+        run: |
+          echo "apply=${{ github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.head_ref || github.ref }}" >> $GITHUB_OUTPUT
+
+  dev:
+    needs: setup
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "dev"
+      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  test:
+    needs: [setup, dev]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "test"
+      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  sandbox:
+    needs: [setup, test]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "sandbox"
+      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  prod:
+    needs: [setup, sandbox]
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: "prod"
+      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
+
+  manual:
+    if: github.event_name == 'workflow_dispatch'
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "60-monitors"
+      environment: ${{ inputs.environment }}
+      apply: ${{ inputs.apply }}
+      branch: ${{ inputs.branch }}
+    secrets: inherit

From c382d99f6af228789724ade43615e0bb7df6d242 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Mon, 6 Jul 2026 11:30:51 -0700
Subject: [PATCH 05/12] revise to just handle monitors and dashboards for now

---
 .github/workflows/dashboard.yml | 46 ++++++++++++++++++++++
 .github/workflows/monitors.yml  | 55 ++++++++++----------------
 .github/workflows/tofu-run.yml  | 69 ++++++---------------------------
 3 files changed, 79 insertions(+), 91 deletions(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index e69de29bb2..11faf76e62 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -0,0 +1,46 @@
+name: 65-dashboard
+run-name: "[${{ github.event_name == 'push' && 'APPLY' || 'PLAN' }}] 65-dashboard → ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "ops/services/65-dashboard/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "ops/services/65-dashboard/**"
+
+concurrency:
+  group: tofu-plan-or-apply
+
+env:
+  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  setup:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: codebuild-ab2d-prod-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      apply: ${{ steps.check.outputs.apply }}
+      branch: ${{ steps.check.outputs.branch }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
+      - id: check
+        run: |
+          echo "apply=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
+          echo "branch=${{ github.head_ref || github.ref }}" >> $GITHUB_OUTPUT
+
+  prod:
+    needs: setup
+    uses: ./.github/workflows/tofu-run.yml
+    with:
+      service: "65-dashboard"
+      environment: "prod"
+      apply: ${{ needs.setup.outputs.apply }}
+      branch: ${{ needs.setup.outputs.branch }}
+    secrets: inherit
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index faa507cd3b..aaef63792c 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -1,41 +1,38 @@
 name: 60-monitors
+run-name: "[${{ github.event_name == 'push' && 'APPLY' || 'PLAN' }}] 60-monitors → ${{ github.event_name == 'push' && github.ref_name || github.head_ref }}"
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
     paths:
       - "ops/services/60-monitors/**"
   pull_request:
+    branches:
+      - main
     paths:
       - "ops/services/60-monitors/**"
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: AB2D environment
-        required: true
-        type: choice
-        options: [dev, test, sandbox, prod]
-      apply:
-        description: "Run apply (vs plan only)"
-        type: boolean
-        default: false
-      branch:
-        description: "Branch or ref to checkout"
-        required: false
-        type: string
-        default: ""
+
+concurrency:
+  group: tofu-plan-or-apply
+
+env:
+  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   setup:
-    if: github.event_name != 'workflow_dispatch'
-    runs-on: codebuild-ab2d-${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && 'non-prod' || 'prod' }}-${{ github.run_id }}-${{ github.run_attempt }}
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       apply: ${{ steps.check.outputs.apply }}
       branch: ${{ steps.check.outputs.branch }}
     steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
       - id: check
         run: |
-          echo "apply=${{ github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
+          echo "apply=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}" >> $GITHUB_OUTPUT
           echo "branch=${{ github.head_ref || github.ref }}" >> $GITHUB_OUTPUT
 
   dev:
@@ -44,7 +41,7 @@ jobs:
     with:
       service: "60-monitors"
       environment: "dev"
-      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      apply: ${{ needs.setup.outputs.apply }}
       branch: ${{ needs.setup.outputs.branch }}
     secrets: inherit
 
@@ -54,7 +51,7 @@ jobs:
     with:
       service: "60-monitors"
       environment: "test"
-      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      apply: ${{ needs.setup.outputs.apply }}
       branch: ${{ needs.setup.outputs.branch }}
     secrets: inherit
 
@@ -64,7 +61,7 @@ jobs:
     with:
       service: "60-monitors"
       environment: "sandbox"
-      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      apply: ${{ needs.setup.outputs.apply }}
       branch: ${{ needs.setup.outputs.branch }}
     secrets: inherit
 
@@ -74,16 +71,6 @@ jobs:
     with:
       service: "60-monitors"
       environment: "prod"
-      apply: ${{ needs.setup.outputs.apply == 'true' }}
+      apply: ${{ needs.setup.outputs.apply }}
       branch: ${{ needs.setup.outputs.branch }}
     secrets: inherit
-
-  manual:
-    if: github.event_name == 'workflow_dispatch'
-    uses: ./.github/workflows/tofu-run.yml
-    with:
-      service: "60-monitors"
-      environment: ${{ inputs.environment }}
-      apply: ${{ inputs.apply }}
-      branch: ${{ inputs.branch }}
-    secrets: inherit
diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
index 67c7d36ea9..2f7f88406f 100644
--- a/.github/workflows/tofu-run.yml
+++ b/.github/workflows/tofu-run.yml
@@ -1,61 +1,23 @@
 name: tofu-run
-run-name: "[${{ inputs.apply && 'APPLY' || 'PLAN' }}] ${{ inputs.service }} → ${{ inputs.environment }}${{ inputs.branch != '' && format(' ({0})', inputs.branch) || '' }}"
 
 on:
-  workflow_dispatch:
+  workflow_call:
     inputs:
       service:
-        description: "Service directory"
         required: true
-        type: choice
-        options:
-          - "60-monitors"
-          - "65-dashboard"
+        type: string
       environment:
-        description: "AB2D environment"
         required: true
-        type: choice
-        options:
-          - dev
-          - test
-          - sandbox
-          - prod
+        type: string
       apply:
-        description: "Run apply (vs plan only)"
-        type: boolean
-        default: false
+        required: true
+        type: string
       branch:
-        description: "Branch or ref to checkout"
-        required: false
+        required: true
         type: string
-        default: ""
-
-concurrency:
-  group: tofu-plan-or-apply
-
-env:
-  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
-  setup:
-    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
-    outputs:
-      account_id: ${{ steps.check.outputs.account_id }}
-      apply: ${{ steps.check.outputs.apply }}
-      branch: ${{ steps.check.outputs.branch }}
-    steps:
-      - id: check
-        run: |
-          if [[ "${{ contains(fromJSON('["dev", "test"]'), inputs.environment) }}" == "true" ]]; then
-            echo "account_id=${{ secrets.NON_PROD_ACCOUNT }}" >> $GITHUB_OUTPUT
-          else
-            echo "account_id=${{ secrets.PROD_ACCOUNT }}" >> $GITHUB_OUTPUT
-          fi
-          echo "apply=${{ inputs.apply }}" >> $GITHUB_OUTPUT
-          echo "branch=${{ inputs.branch || github.ref }}" >> $GITHUB_OUTPUT
-
   tofu:
-    needs: setup
     permissions:
       contents: read
       id-token: write
@@ -63,27 +25,20 @@ jobs:
     env:
       APP: ab2d
       ENV: ${{ inputs.environment }}
-
     defaults:
       run:
         working-directory: ops/services/${{ inputs.service }}
-
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.3.0
         with:
-          ref: ${{ needs.setup.outputs.branch }}
-
-      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
-
+          ref: ${{ inputs.branch }}
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
       - uses: cmsgov/cdap/actions/setup-tenv@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
-
       - uses: cmsgov/cdap/actions/setup-sops@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
-
       - uses: cmsgov/cdap/actions/setup-yq@f4c14d47cc20e7f6de9112d7155af1213c9bca5a
-
-      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
         with:
-          role-to-assume: arn:aws:iam::${{ needs.setup.outputs.account_id }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
+          role-to-assume: arn:aws:iam::${{ contains(fromJSON('["dev", "test"]'), inputs.environment) && secrets.NON_PROD_ACCOUNT || secrets.PROD_ACCOUNT }}:role/delegatedadmin/developer/ab2d-${{ inputs.environment }}-github-actions
           aws-region: ${{ vars.AWS_REGION }}
 
       - name: tofu plan
@@ -93,5 +48,5 @@ jobs:
           tofu plan -no-color -input=false -out=tfplan
 
       - name: tofu apply
-        if: needs.setup.outputs.apply == 'true'
+        if: inputs.apply == 'true'
         run: tofu apply -no-color -input=false tfplan

From 0e7ef186330235bc761b0437f9ae9bbb59f242ad Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Mon, 6 Jul 2026 11:40:31 -0700
Subject: [PATCH 06/12] add permissions for dashboards and monitors at the
 workflow level

---
 .github/workflows/dashboard.yml | 4 ++++
 .github/workflows/monitors.yml  | 7 ++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index 11faf76e62..d4818a6027 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -16,6 +16,10 @@ on:
 concurrency:
   group: tofu-plan-or-apply
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index aaef63792c..badadcf2ff 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -16,14 +16,15 @@ on:
 concurrency:
   group: tofu-plan-or-apply
 
+permissions:
+  contents: read
+  id-token: write
+
 env:
   TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   setup:
-    permissions:
-      contents: read
-      id-token: write
     runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       apply: ${{ steps.check.outputs.apply }}

From e72c7ac841085e9210cdafdc9e4f6bd973ed0ef7 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Mon, 6 Jul 2026 11:48:35 -0700
Subject: [PATCH 07/12] remove ab2d- prefix from workspace environment

---
 .github/workflows/tofu-run.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
index 2f7f88406f..43f2e95a5f 100644
--- a/.github/workflows/tofu-run.yml
+++ b/.github/workflows/tofu-run.yml
@@ -44,7 +44,7 @@ jobs:
       - name: tofu plan
         run: |
           tofu init -var=parent_env=$ENV -reconfigure
-          tofu workspace select -var=parent_env=$ENV -or-create=true ab2d-$ENV
+          tofu workspace select -var=parent_env=$ENV -or-create=true $ENV
           tofu plan -no-color -input=false -out=tfplan
 
       - name: tofu apply

From b237213f54806f531820649035bea05da1007b13 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 8 Jul 2026 11:18:04 -0700
Subject: [PATCH 08/12] move token to tofu-run

---
 .github/workflows/dashboard.yml | 3 ---
 .github/workflows/monitors.yml  | 3 ---
 .github/workflows/tofu-run.yml  | 3 +++
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index d4818a6027..459693dc40 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -20,9 +20,6 @@ permissions:
   contents: read
   id-token: write
 
-env:
-  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
 jobs:
   setup:
     permissions:
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index badadcf2ff..1639b672cd 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -20,9 +20,6 @@ permissions:
   contents: read
   id-token: write
 
-env:
-  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
 jobs:
   setup:
     runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
diff --git a/.github/workflows/tofu-run.yml b/.github/workflows/tofu-run.yml
index 43f2e95a5f..baffee4b28 100644
--- a/.github/workflows/tofu-run.yml
+++ b/.github/workflows/tofu-run.yml
@@ -16,6 +16,9 @@ on:
         required: true
         type: string
 
+env:
+  TENV_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 jobs:
   tofu:
     permissions:

From 32da9019d5151c9140d33b8cc4ec34eac3f1b0a3 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 8 Jul 2026 11:20:02 -0700
Subject: [PATCH 09/12] dashboard caller workflow to nonprod runner

---
 .github/workflows/dashboard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index 459693dc40..adc23a8325 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: codebuild-ab2d-prod-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: codebuild-ab2d-non-prod-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       apply: ${{ steps.check.outputs.apply }}
       branch: ${{ steps.check.outputs.branch }}

From f71a089c3912a6623ea2184b5954f3b175c40cad Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 8 Jul 2026 11:26:16 -0700
Subject: [PATCH 10/12] add change detection on workflows

---
 .github/workflows/dashboard.yml | 4 ++++
 .github/workflows/monitors.yml  | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index adc23a8325..ec2d623936 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -7,11 +7,15 @@ on:
       - main
     paths:
       - "ops/services/65-dashboard/**"
+      - ".github/workflows/tofu-dashboard.yml"
+      - ".github/workflows/tofu-run.yml"
   pull_request:
     branches:
       - main
     paths:
       - "ops/services/65-dashboard/**"
+      - ".github/workflows/tofu-dashboard.yml"
+      - ".github/workflows/tofu-run.yml"
 
 concurrency:
   group: tofu-plan-or-apply
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index 1639b672cd..e1f21e3a18 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -7,11 +7,15 @@ on:
       - main
     paths:
       - "ops/services/60-monitors/**"
+      - ".github/workflows/tofu-monitors.yml"
+      - ".github/workflows/tofu-run.yml"
   pull_request:
     branches:
       - main
     paths:
       - "ops/services/60-monitors/**"
+      - ".github/workflows/tofu-monitors.yml"
+      - ".github/workflows/tofu-run.yml"
 
 concurrency:
   group: tofu-plan-or-apply

From 148471b945b356858e7607423a3a05337a6e0bd9 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Wed, 8 Jul 2026 12:10:11 -0700
Subject: [PATCH 11/12] specify concurrency to to enable datadog resources to
 be run separately

---
 .github/workflows/dashboard.yml | 2 +-
 .github/workflows/monitors.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index ec2d623936..86b3a1267b 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -18,7 +18,7 @@ on:
       - ".github/workflows/tofu-run.yml"
 
 concurrency:
-  group: tofu-plan-or-apply
+  group: tofu-dashboard-plan-or-apply
 
 permissions:
   contents: read
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index e1f21e3a18..9131bf179d 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -18,7 +18,7 @@ on:
       - ".github/workflows/tofu-run.yml"
 
 concurrency:
-  group: tofu-plan-or-apply
+  group: tofu-monitors-plan-or-apply
 
 permissions:
   contents: read

From 9d9620884ab773f45649d513ba761af5e1f1d139 Mon Sep 17 00:00:00 2001
From: Grant Freeman <grantfreeman@navapbc.com>
Date: Thu, 9 Jul 2026 08:05:31 -0700
Subject: [PATCH 12/12] fix filenames

---
 .github/workflows/dashboard.yml | 4 ++--
 .github/workflows/monitors.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/dashboard.yml b/.github/workflows/dashboard.yml
index 86b3a1267b..8b9bd453ec 100644
--- a/.github/workflows/dashboard.yml
+++ b/.github/workflows/dashboard.yml
@@ -7,14 +7,14 @@ on:
       - main
     paths:
       - "ops/services/65-dashboard/**"
-      - ".github/workflows/tofu-dashboard.yml"
+      - ".github/workflows/dashboard.yml"
       - ".github/workflows/tofu-run.yml"
   pull_request:
     branches:
       - main
     paths:
       - "ops/services/65-dashboard/**"
-      - ".github/workflows/tofu-dashboard.yml"
+      - ".github/workflows/dashboard.yml"
       - ".github/workflows/tofu-run.yml"
 
 concurrency:
diff --git a/.github/workflows/monitors.yml b/.github/workflows/monitors.yml
index 9131bf179d..978117259e 100644
--- a/.github/workflows/monitors.yml
+++ b/.github/workflows/monitors.yml
@@ -7,14 +7,14 @@ on:
       - main
     paths:
       - "ops/services/60-monitors/**"
-      - ".github/workflows/tofu-monitors.yml"
+      - ".github/workflows/monitors.yml"
       - ".github/workflows/tofu-run.yml"
   pull_request:
     branches:
       - main
     paths:
       - "ops/services/60-monitors/**"
-      - ".github/workflows/tofu-monitors.yml"
+      - ".github/workflows/monitors.yml"
       - ".github/workflows/tofu-run.yml"
 
 concurrency: