fix(ci): scope Terraform deployments

Skip Terraform for function-only Supabase releases to avoid unrelated provider drift failures. Continue applying infrastructure for terraform path changes or explicit manual deployment requests.

.github/workflows/deploy-supabase.yml

@@ -8,6 +8,11 @@ on:
         required: false
         type: boolean
         default: false
+      deploy_infrastructure:
+        description: Apply Terraform as part of this manual deployment
+        required: false
+        type: boolean
+        default: false
   push:
     branches:
       - master
@@ -17,6 +22,30 @@ on:
       - '.github/workflows/deploy-supabase.yml'
 
 jobs:
+  changes:
+    name: Detect infrastructure changes
+    runs-on: ubuntu-latest
+    outputs:
+      infrastructure: ${{ steps.infrastructure.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: infrastructure
+        name: Check Terraform scope
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          CURRENT_SHA: ${{ github.sha }}
+          DEPLOY_INFRASTRUCTURE: ${{ inputs.deploy_infrastructure }}
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "changed=${DEPLOY_INFRASTRUCTURE:-false}" >> "$GITHUB_OUTPUT"
+          elif git diff --quiet "$BEFORE_SHA" "$CURRENT_SHA" -- terraform/; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
   quality:
     name: Verify deployable source
     runs-on: ubuntu-latest
@@ -128,7 +157,8 @@ jobs:
   deploy-infrastructure:
     name: Deploy Infrastructure (Terraform)
     runs-on: ubuntu-latest
-    needs: quality
+    needs: [quality, changes]
+    if: needs.changes.outputs.infrastructure == 'true'
 
     env:
       TF_VAR_supabase_access_token: ${{ secrets.SUPABASE_ACCESS_TOKEN }}

docs/operations/database-migrations.md

@@ -19,4 +19,8 @@ All schema changes are versioned local files under `apps/supabase/migrations/`.
 - Never insert migration history manually except an explicitly approved repair.
 - Never hardcode a production URL in a migration or cron definition.
 
-CI deploys committed migrations. Local verification must not link a remote project.
+CI deploys committed migrations and Edge Functions to non-production after relevant
+pushes. Production promotion is a manual workflow dispatch. Terraform is applied
+only when files under `terraform/` change, or when `deploy_infrastructure` is
+explicitly selected during a manual deployment. Local verification must not link a
+remote project.