feat(ci): add production deployment workflows

.dockerignore

@@ -0,0 +1,23 @@
+# Source-control and CI metadata
+.git
+.github
+
+# Local dependencies, caches, logs, and build output
+**/node_modules
+.pnpm-store
+**/dist
+coverage
+logs
+*.log
+*.tsbuildinfo
+.DS_Store
+
+# Local environment and credential files
+.env
+.env.*
+.sentryclirc
+
+# Terraform configuration is not part of the application image. Excluding the
+# whole directory also keeps local variables, state, plans, and backups out of
+# the Docker build context.
+infra/terraform

.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  TERRAFORM_VERSION: 1.15.4
+  TF_WORKING_DIR: infra/terraform
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify application
+        run: pnpm verify
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: ${{ env.TERRAFORM_VERSION }}
+          terraform_wrapper: false
+
+      - name: Check Terraform formatting
+        run: terraform fmt -check -recursive "$TF_WORKING_DIR"
+
+      - name: Validate Terraform
+        run: |
+          terraform -chdir="$TF_WORKING_DIR" init -backend=false -input=false
+          terraform -chdir="$TF_WORKING_DIR" validate