DSTA-669: Add bootstrap support for backend resources

[micjustus-nc]

Description

These changes bring in support for the ability to bootstrap (create on first run) the needed Terraform resources in a target environment.

Context

To run the bootstrap on Windows, use Bash WSL
In the terminal

• run az login to authenticate to the cloud mind (tenant/subscription)
• from the repository root (containing the main Makefile), type make dev bootstrap

The bootstrap flow validates prerequisites (like the required Entra group screening_nbss_dev and subscription contexts), runs a what-if preview, and then deploys bootstrap resources after confirmation.

Why is this required?
This is required because Terraform deployments rely on remote backend state. terraform-init expectes the backend state to already exist. So, the bootstrap process provisions the prerequisites so Terraform can initialise, plan and apply its changes safely.

Deployment model
This set of changes uses Bicep-based Azure deployments to create Terraform backend prerequisites.

To view the deployments after make dev bootstrap run,

• Navigate to target deployment subscription (Digital Screening DToS - DevOps"
• Navigate to Settings -> Deployments
• In the list of deployments, look for bootstrap-nbsse-dev-main

Deployment resources

• backend storage account with NO public access, accessible only from a private endpoint

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[Copilot]

Pull request overview

Adds Azure Bicep bootstrap support for Terraform backend infrastructure.

Changes:

• Adds environment-aware make targets and bootstrap orchestration.
• Provisions private Terraform state storage, DNS, endpoint, RBAC, and resource groups.
• Adds infrastructure documentation and adjusts CI workflows.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
Makefile	Integrates bootstrap targets and revises setup commands.
.gitattributes	Enforces LF endings for scripts.
.github/workflows/cicd-1-pull-request.yaml	Inlines version generation and variable output.
.github/workflows/stage-1-commit.yaml	Disables Terraform linting.
scripts/make/environment.mk	Defines development and production contexts.
scripts/make/bootstrap.mk	Adds the bootstrap target.
scripts/make/azure.mk	Selects and resolves Azure subscriptions.
scripts/bootstrap/run_bootstrap.sh	Runs prerequisite checks, preview, and deployment.
infrastructure/bootstrap/main.bicep	Coordinates bootstrap resources.
infrastructure/bootstrap/terraformStorage.bicep	Creates Terraform state storage and RBAC.
infrastructure/bootstrap/privateEndpoint.bicep	Creates private storage connectivity.
infrastructure/bootstrap/dns.bicep	Resolves the private DNS zone.
infrastructure/environments/dev/variables.sh	Supplies development settings.
infrastructure/environments/prod/variables.sh	Supplies placeholder production settings.
infrastructure/README.md	Documents bootstrap architecture and usage.

Suppressed comments (2)

Makefile:34

• These are recipe lines, so Bash tries to execute _install-tools, _install-uv, githooks-config, and dependencies as commands; none of the first two exist anywhere in the repository, and the latter two are make targets rather than executables. Consequently, the documented make config fails immediately. Invoke available targets through $(MAKE) and restore or define the intended installation targets.

	_install-tools
	_install-uv
	githooks-config
	dependencies

Makefile:52

• The repository has no default .pre-commit-config.yaml; its only configuration is scripts/config/pre-commit.yaml. Calling pre-commit install without --config therefore fails instead of installing the hooks.

	pre-commit install

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[saliceti]

Rework from #66