fix(terragrunt): update deploy workflow to run from root, skip dev, and remove stray lockfiles

- run Terragrunt from terragrunt/ instead of live/website
- switch CI commands to `run-all init/plan/apply`
- read outputs via `terragrunt output --terragrunt-include-dir live`
- delete incorrectly generated .terraform.lock.hcl in dev
- add `skip = true` to dev environment until DNS is ready
- update module source paths to ../../modules/website
- remove legacy before_hook and lockfile suppression hacks from live

Author: j4y

.github/workflows/deploy.yml

@@ -16,7 +16,7 @@ on:
         # user must select a branch when triggering workflow manually
 
 env:
-  working_dir: terragrunt/live/website
+  working_dir: terragrunt
 
 concurrency:
   group: ${{ github.workflow }}
@@ -50,30 +50,31 @@ jobs:
         TERRAGRUNT_DISABLE_COPY: true
       with:
         tg_dir: ${{ env.working_dir }}
-        tg_command: init
+        tg_command: "run-all init"
 
     - name: Terragrunt Plan
       uses: gruntwork-io/terragrunt-action@v3
       env:
         TERRAGRUNT_DISABLE_COPY: true
       with:
         tg_dir: ${{ env.working_dir }}
-        tg_command: plan
+        tg_command: "run-all plan"
+
 
     - name: Terragrunt Apply
       uses: gruntwork-io/terragrunt-action@v3
       env:
         TERRAGRUNT_DISABLE_COPY: true
       with:
         tg_dir: ${{ env.working_dir }}
-        tg_command: apply
+        tg_command: "run-all apply"
 
     - name: Read Values
       id: terragrunt_output
       run: |
-        cd terragrunt/live/website
-        printf "distribution_id=%s\n" $(terragrunt output distribution_id) >> "$GITHUB_OUTPUT"
-        printf "bucket_name=%s\n" $(terragrunt output bucket_name) >> "$GITHUB_OUTPUT"
+        cd terragrunt
+        printf "distribution_id=%s\n" $(terragrunt output --terragrunt-include-dir live distribution_id) >> "$GITHUB_OUTPUT"
+        printf "bucket_name=%s\n" $(terragrunt output --terragrunt-include-dir live bucket_name) >> "$GITHUB_OUTPUT"
 
     - name: Build Jekyll project
       run: |

mise.toml

@@ -17,7 +17,8 @@ run = [
 
   # Terraform lint
   "tflint --init",
-  "tflint --chdir terraform/website/ -c ../../.tflint.hcl",
+  "tflint --chdir terragrunt/modules/website -c ../../../.tflint.hcl",
+
 
   # HTML linting
   "bundle exec htmlproofer ./_site --check-external-hash"

terragrunt/dev/website/.terraform.lock.hcl

@@ -1,13 +1,17 @@
+
+# TODO(j4y): dev.colorcop.net DNS isn't there and needs some work
+skip = true
+
 include "root" {
-  path = find_in_parent_folders()
+  path = find_in_parent_folders("terragrunt.hcl")
 }
 
 terraform {
-  source = "../../../terraform/website/"
+  source = "../../modules/website"
 }
 
 inputs = {
   env    = "dev"
-  # FIXME: need new strategy for dev/staging domain
   domain = "dev.colorcop.net"
-}
+}
+

terragrunt/dev/website/terragrunt.hcl

@@ -1,27 +1,13 @@
 include "root" {
-  path = find_in_parent_folders()
+  path = find_in_parent_folders("terragrunt.hcl")
 }
 
-terraform {
-  # Prevent OpenTofu/Terraform from generating a .terraform.lock.hcl file
-  # inside the live Terragrunt directory. Live folders do not own provider
-  # versions — the module lockfile in terraform/website/ is the single
-  # source of truth. Without this flag, `terragrunt init` would create a
-  # local lockfile here, causing CI to detect uncommitted changes.
-  extra_arguments "disable_lockfile" {
-    commands  = ["init"]
-    arguments = ["-lockfile=readonly"]
-  }
-
-  # Force initialization before plan/apply, but run *terraform init*
-  # instead of terragrunt init. Running terragrunt init inside the
-  # .terragrunt-cache causes include recursion and breaks.
-  before_hook "force_init" {
-    commands = ["plan", "apply"]
-    execute  = ["terraform", "init", "-lockfile=readonly"]
-  }
 
-  source = "../../../terraform/website/"
+terraform {
+  # Point Terragrunt at the module inside terragrunt/modules/website.
+  # This ensures Terraform runs ONLY inside .terragrunt-cache and NEVER
+  # writes .terraform.lock.hcl into the live folder.
+  source = "../../modules/website"
 }
 
 inputs = {