Create infrastructure destroy workflow

- Add destroy.yml workflow for infrastructure destruction
- Include validation step requiring 'destroy' confirmation
- Support multiple environments (dev, staging, prod)
- Automatically mark GitHub deployments as inactive after destroy

Author: suhailskhan

.github/workflows/destroy.yml

@@ -0,0 +1,107 @@
+name: Destroy Infrastructure
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to destroy'
+        required: true
+        default: 'dev'
+        type: choice
+        options:
+          - dev
+          - staging
+          - prod
+      confirm:
+        description: 'Type "destroy" to confirm'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  deployments: write
+
+jobs:
+  validate:
+    name: Validate Destroy Request
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate confirmation
+        run: |
+          if [ "${{ inputs.confirm }}" != "destroy" ]; then
+            echo "❌ Confirmation failed. You must type 'destroy' to proceed."
+            exit 1
+          fi
+          echo "✅ Destroy confirmed"
+
+  set-variables:
+    name: Set Variables
+    runs-on: ubuntu-latest
+    needs: validate
+    outputs:
+      aws_region: ${{ steps.vars.outputs.aws_region }}
+      domain_name: ${{ steps.vars.outputs.domain_name }}
+      subdomain: ${{ steps.vars.outputs.subdomain }}
+    
+    steps:
+      - id: vars
+        run: |
+          AWS_REGION="${{ vars.AWS_REGION || 'us-east-1' }}"
+          DOMAIN_NAME="${{ vars.DOMAIN_NAME || 'suhailskhan.com' }}"
+          SUBDOMAIN="${{ vars.SUBDOMAIN || 'ai-usage-log' }}"
+          
+          echo "aws_region=$AWS_REGION" >> $GITHUB_OUTPUT
+          echo "domain_name=$DOMAIN_NAME" >> $GITHUB_OUTPUT
+          echo "subdomain=$SUBDOMAIN" >> $GITHUB_OUTPUT
+
+  destroy:
+    name: Destroy Infrastructure
+    needs: [validate, set-variables]
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up OpenTofu
+        uses: opentofu/setup-opentofu@v1
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ needs.set-variables.outputs.aws_region }}
+
+      - name: Initialize Tofu
+        run: tofu -chdir=infra init
+
+      - name: Tofu Destroy
+        run: |
+          tofu -chdir=infra destroy -auto-approve \
+            -var="aws_region=${{ needs.set-variables.outputs.aws_region }}" \
+            -var="environment=${{ inputs.environment }}" \
+            -var="cloudflare_api_token=${{ secrets.CLOUDFLARE_API_TOKEN }}" \
+            -var="cloudflare_zone_id=${{ secrets.CLOUDFLARE_ZONE_ID }}" \
+            -var="domain_name=${{ needs.set-variables.outputs.domain_name }}" \
+            -var="subdomain=${{ needs.set-variables.outputs.subdomain }}"
+
+      - name: Mark deployments as inactive
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const deployments = await github.rest.repos.listDeployments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              environment: '${{ inputs.environment }}'
+            });
+
+            for (const deployment of deployments.data) {
+              await github.rest.repos.createDeploymentStatus({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                deployment_id: deployment.id,
+                state: 'inactive',
+                description: 'Infrastructure destroyed'
+              });
+            }

.github/workflows/release-build-and-deploy.yml

@@ -130,7 +130,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up OpenTofu
-        uses: hashicorp/setup-opentofu@v1
+        uses: opentofu/setup-opentofu@v1
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4