fix(ci): scope Terraform deployments

Skip Terraform for function-only Supabase releases to avoid unrelated provider drift failures. Continue applying infrastructure for terraform path changes or explicit manual deployment requests.

.github/workflows/deploy-supabase.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: boolean
         default: false
+      deploy_infrastructure:
+        description: Apply Terraform as part of this manual deployment
+        required: false
+        type: boolean
+        default: false
   push:
     branches:
       - master
@@ -17,6 +22,30 @@ on:
       - '.github/workflows/deploy-supabase.yml'
 
 jobs:
+  changes:
+    name: Detect infrastructure changes
+    runs-on: ubuntu-latest
+    outputs:
+      infrastructure: ${{ steps.infrastructure.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: infrastructure
+        name: Check Terraform scope
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          CURRENT_SHA: ${{ github.sha }}
+          DEPLOY_INFRASTRUCTURE: ${{ inputs.deploy_infrastructure }}
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "changed=${DEPLOY_INFRASTRUCTURE:-false}" >> "$GITHUB_OUTPUT"
+          elif git diff --quiet "$BEFORE_SHA" "$CURRENT_SHA" -- terraform/; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
   quality:
     name: Verify deployable source
     runs-on: ubuntu-latest
@@ -126,9 +155,10 @@ jobs:
           done
 
   deploy-infrastructure:
-    name: Deploy Infrastructure (Terraform)
+    name: Deploy Infrastructure (Terraform)
     runs-on: ubuntu-latest
-    needs: quality
+    needs: [quality, changes]
+    if: needs.changes.outputs.infrastructure == 'true'
 
     env:
       TF_VAR_supabase_access_token: ${{ secrets.SUPABASE_ACCESS_TOKEN }}