Refer to https://docs.google.com/document/d/1gfwVdVdN54OeWzl_fiCP8ZY-Taz1lsrnTcFI1zNWNhU/edit?usp=sha ring Apex needs to implement Technical requirement 3. Terraform apply operations must be manually triggered, must use the protected port-prod environment, and must not expose environment secrets before approval. Which option completes the workflow?

name: apply-port-infrastructure

on:
  (Missing value 1):

permissions:
  contents: read
  id-token: write

jobs:
  apply:
    runs-on: ubuntu-latest
    environment:
      name: (Missing value 2)
    steps:
      - uses: actions/checkout@v4

        - name: Verify approved plan
          run: |
            test -f .github/approvals/terraform-plan-approved.json

        - name: Apply approved infrastructure change
          env:
            CLOUD_ROLE: ${{ secrets.PORT_PROD_ROLE }}
          run: (Missing value 3)