feat: snipemgr install --terraform-only — generate Terraform instead of creating resources

[jackvaughanjr]

Summary

Add a --terraform-only flag to snipemgr install that generates a Terraform .tf file for the Cloud Run Job and Cloud Scheduler resources instead of creating them directly via API. For teams that manage all GCP resources through Terraform.

Motivation

Teams with Terraform-managed GCP infrastructure can't use snipemgr install as-is — it creates resources outside of Terraform state, causing drift. --terraform-only lets them use snipemgr for discovery, config generation, and secret management while keeping resource provisioning in Terraform.

Usage

snipemgr install github2snipe --terraform-only
# Writes: github2snipe.tf

Generated file:

# Generated by snipemgr install --terraform-only
# Integration: github2snipe v1.3.0

resource "google_cloud_run_v2_job" "github2snipe" {
  name     = "github2snipe"
  location = "us-central1"
  project  = "my-org-project"

  template {
    template {
      containers {
        image = "us-central1-docker.pkg.dev/my-org-project/snipemgr/github2snipe:v1.3.0"
        ...
      }
    }
  }
}

resource "google_cloud_scheduler_job" "github2snipe" {
  name      = "github2snipe-scheduler"
  schedule  = "0 6 * * *"
  time_zone = "America/New_York"
  ...
}

Acceptance criteria

• --terraform-only skips all GCP API calls and writes a .tf file to the current directory
• The generated file includes the Cloud Run Job and Cloud Scheduler resources with values from the install wizard
• The generated file is valid Terraform (can be run through terraform validate)
• Secret Manager secrets are still created (secrets contain credentials — users want snipemgr to manage these even in Terraform mode)
• The binary is still downloaded and placed locally
• A comment at the top of the file notes the generator, integration name, and version
• --output <path> changes the output file location (default: ./<integration>.tf)

Implementation notes

• Use Go's text/template to render the .tf file — do not build the HCL string by concatenation
• Resource names and values should match exactly what snipemgr install would create via API, so terraform import works if needed
• Terraform provider versions and required_providers block are out of scope — the user's existing Terraform configuration handles that