Wire Forge-native release infrastructure

Scripts/identity-tofu.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(
+  git rev-parse --show-toplevel 2>/dev/null || {
+    cd "$(dirname "${BASH_SOURCE[0]}")/.."
+    pwd
+  }
+)"
+
+work_dir="${BURROW_IDENTITY_TOFU_DIR:-$ROOT/infra/identity}"
+plugin_cache_dir="${BURROW_TOFU_PLUGIN_CACHE_DIR:-$ROOT/.cache/opentofu/plugins}"
+
+usage() {
+  cat <<'EOF'
+Usage: Scripts/identity-tofu.sh [tofu args...]
+
+Runs OpenTofu for Burrow Google KMS and Workload Identity Federation resources.
+Cloud provider credentials must come from the normal provider environment or a
+WIF flow; do not put credentials in backend config.
+
+Examples:
+  Scripts/identity-tofu.sh init -backend-config=backend.hcl
+  Scripts/identity-tofu.sh plan -var-file=terraform.tfvars
+
+Local syntax check:
+  Scripts/identity-tofu.sh init -backend=false
+  Scripts/identity-tofu.sh validate
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+mkdir -p "$plugin_cache_dir"
+export TF_PLUGIN_CACHE_DIR="$plugin_cache_dir"
+export TF_IN_AUTOMATION="${TF_IN_AUTOMATION:-true}"
+
+exec nix shell --inputs-from "$ROOT" nixpkgs#opentofu -c tofu -chdir="$work_dir" "$@"