chore: add pre-commit hooks and variable ordering check (#7)

* chore: add pre-commit hooks

* chore: update trivy action

Author: robdiciuccio

.github/workflows/pull-request.yaml

@@ -0,0 +1,18 @@
+name: Pull request checks
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.x'
+      - uses: pre-commit/action@v3.0.1

.gitignore

@@ -1,6 +1,9 @@
 # Local .terraform directories
 **/.terraform/*
 
+# Terrform lock files
+.terraform.lock.hcl
+
 # .tfstate files
 *.tfstate
 *.tfstate.*

.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+repos:
+  - repo: local
+    hooks:
+      - id: check-tf-variable-order
+        name: Check OpenTofu variable ordering
+        language: system
+        entry: bash scripts/check-tf-variable-order.sh
+        files: \.tf$

README.md

@@ -66,6 +66,28 @@ tofu init -upgrade
 
 ## Contributing
 
+This repository uses [pre-commit](https://pre-commit.com) to enforce code
+style checks before each commit. Install it once after cloning:
+
+**1. Install pre-commit**
+
+```sh
+brew install pre-commit
+```
+
+**2. Install the git hook**
+
+```sh
+pre-commit install
+```
+
+This symlinks the hook into `.git/hooks/pre-commit`. The checks will now run
+automatically on every `git commit`. To run them manually against all files:
+
+```sh
+pre-commit run --all-files
+```
+
 Follow the [contributing guidelines][contributing] to contribute to this
 repository.
 

scripts/check-tf-variable-order.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Check that variable blocks in OpenTofu/Terraform files are in alphabetical order.
+
+set -euo pipefail
+
+failed=0
+
+for file in "$@"; do
+  vars=$(grep -E '^variable "' "$file" | sed 's/^variable "\([^"]*\)".*/\1/' || true)
+
+  [ -z "$vars" ] && continue
+
+  sorted=$(echo "$vars" | sort)
+
+  if [ "$vars" != "$sorted" ]; then
+    echo "ERROR: Variables in $file are not in alphabetical order."
+    echo "  Current: $(echo "$vars" | tr '\n' ' ')"
+    echo "  Expected: $(echo "$sorted" | tr '\n' ' ')"
+    failed=1
+  fi
+done
+
+exit $failed