++ add STACKS filter bootstrap escape hatch for cross-stack read dependencies

.gitea/workflows/terraform.yml

@@ -42,6 +42,11 @@ env:
   PG_ADMIN_HOST: ${{ vars.PG_ADMIN_HOST }}
   KAFKA_BOOTSTRAP: ${{ vars.KAFKA_BOOTSTRAP }}
   RABBITMQ_ENDPOINT: ${{ vars.RABBITMQ_ENDPOINT }}
+  # Bootstrap escape hatch (see scripts/run_all_stacks.sh) - normally unset;
+  # set temporarily to a space-separated stack subset (e.g. "namespace
+  # rabbitmq vault-secrets") for one run when a stack's plan can't succeed
+  # until another stack has already been applied, then clear it back to "".
+  STACKS: ${{ vars.STACKS }}
 
 jobs:
   validate:

scripts/run_all_stacks.sh

@@ -7,6 +7,28 @@ if [[ -z "$ACTION" ]]; then
   exit 1
 fi
 
+# STACKS (optional, space/comma-separated stack dirs relative to live/, e.g.
+# "namespace rabbitmq vault-secrets") restricts the run to that subset. This
+# is the bootstrap escape hatch for cross-stack read dependencies that can't
+# plan until another stack has already been applied (e.g. a v2 secret with
+# ownership=referenced reading a value vault-secrets writes): the normal
+# "plan everything, abort on first error, apply only if plan was all-green"
+# pipeline can never apply anything on its own the first time around, since
+# the dependent stack's plan fails before apply ever runs. Set STACKS to just
+# the prerequisite stack(s) for one bootstrap run, then clear it back to
+# empty for normal full-pipeline runs.
+IFS=', ' read -r -a STACK_FILTER <<< "${STACKS:-}"
+
+should_run_stack() {
+  local rel="${1#live/}"
+  [[ ${#STACK_FILTER[@]} -eq 0 ]] && return 0
+  local s
+  for s in "${STACK_FILTER[@]}"; do
+    [[ -n "$s" && "$rel" == "$s" ]] && return 0
+  done
+  return 1
+}
+
 STACK_FILES=()
 while IFS= read -r tg; do
   STACK_FILES+=("$tg")
@@ -25,6 +47,11 @@ for tg in "${STACK_FILES[@]}"; do
     continue
   fi
 
+  if ! should_run_stack "$stack_dir"; then
+    echo "=== SKIP (not in STACKS filter): ${stack_dir} ==="
+    continue
+  fi
+
   echo "=== STACK: ${stack_dir} ==="
 
   (