feat: validate encrypted Twilio credentials

[xnoto]

Summary

Adds the encrypted Twilio provider-credential delivery prerequisite without adding a Twilio provider block or any Twilio resource. make plan and make apply verify that the one tracked SOPS document is encrypted, then expose its required variables only to a short-lived child process.

Fixes # N/A — establishes the credential-delivery validation gate before later provider configuration, phone-number inventory, or inbound webhook work.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed. The credentialed plan initialized the remote backend, completed SOPS/KMS credential validation without printing values, and reported No changes.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated or centrally distributed file changed.

No local OpenTofu, Makefile, SOPS, state, import, plan, or apply operation was run.

Impact and rollout

Producer: the existing tfroot-aws backend role grants this exact repository SOPS KMS decrypt/describe access and scoped state-backend access. Consumer: tfroot-twilio now accepts only secrets/secrets.yaml, verifies it with sops filestatus, and loads TWILIO_ACCOUNT_SID, TWILIO_API_KEY, and TWILIO_API_SECRET through sops exec-env for an assertion-only child process. The runner already supplies SOPS and jq; no shared-workflows or runner-image contract changes are needed.

This PR deliberately retains no Twilio provider block and no Twilio resource, phone number, messaging webhook, bridge credential, mapping, allowlist, workload, Cloudflare route, or public endpoint. A confirmed merge would submit the environment-gated main apply, which would validate SOPS decryption but make no Twilio API call. Rollback is a reviewed revert; the encrypted ciphertext remains protected by the existing KMS recipient in Git history.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints — the one credential file was inspected only as SOPS ciphertext and is gated by sops filestatus.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

GitHub Advanced Security secret scanning is unavailable for this repository; the changed source and encrypted-file structure were manually reviewed. AI agent materially produced this change; reviewers should confirm the exact secret path, SOPS-only process injection, retained absence of a provider block/resources, and no bridge/runtime ownership crossover.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and