chore(deps): lock file maintenance (#68) #162

Workflow file for this run

	---
	name: CI

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	format:
	name: Format Check
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Setup OpenTofu
	uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
	with:
	tofu_version_file: .opentofu-version

	- name: Check formatting
	run: tofu fmt -check -recursive

	validate:
	name: Validate
	runs-on: ubuntu-latest
	timeout-minutes: 10
	strategy:
	fail-fast: false
	matrix:
	environment:
	- modules/libvirt-vm
	- modules/talos-cluster
	- environments/lab
	- environments/production
	- environments/talos-lab
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Setup OpenTofu
	uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
	with:
	tofu_version_file: .opentofu-version

	- name: Initialize (${{ matrix.environment }})
	run: tofu init -backend=false
	working-directory: ${{ matrix.environment }}

	- name: Validate (${{ matrix.environment }})
	run: tofu validate
	working-directory: ${{ matrix.environment }}

	lint:
	name: Lint
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	# Pinned: tflint v0.61.0+ panics (nil pointer in sigstore-go's Bundle.TlogEntries,
	# inside tflint's plugin signature verification) when installing the pinned
	# terraform ruleset plugin from .tflint.hcl. Reproduced locally: v0.59.1 installs
	# cleanly, v0.61.0/v0.62.1/v0.63.1 (latest) all crash identically. Likely tied to
	# tflint enabling plugin keyless verification by default around this version range.
	# Revisit this pin once upstream fixes it; check https://github.com/terraform-linters/tflint/issues
	# for the sigstore-go TlogEntries panic before bumping.
	- name: Setup TFLint
	uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0
	with:
	tflint_version: v0.59.1

	# GITHUB_TOKEN lifts the unauthenticated GitHub API rate limit so the
	# pinned terraform ruleset (.tflint.hcl) downloads reliably.
	- name: Initialize TFLint
	run: tflint --init
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Run TFLint
	run: tflint --recursive

	security:
	name: Security Scan (Trivy)
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Run Trivy IaC misconfiguration scan
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	scan-type: config
	scan-ref: .
	severity: HIGH,CRITICAL
	exit-code: "1"
	ignore-unfixed: true
	skip-dirs: "**/.terraform"
	format: sarif
	output: trivy.sarif

	- name: Upload Trivy SARIF to GitHub Security
	if: always()
	uses: github/codeql-action/upload-sarif@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
	with:
	sarif_file: trivy.sarif
	category: trivy-config

	secret-scan:
	name: Secret Scan (gitleaks)
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	# Full working-tree secret scan, server-side. The gitleaks pre-commit
	# hook only scans STAGED changes (a no-op in a clean CI checkout), so
	# this dedicated job is what actually enforces detection on every push/PR.
	# Pinned by immutable image digest (matching the action SHA-pins above and
	# the companion repos); the digest is gitleaks v8.30.1, the same version as
	# the pre-commit hook. Bump the digest and the version comment together.
	- name: Run gitleaks (full working-tree scan)
	run: \|
	docker run --rm -v "${{ github.workspace }}:/repo" \
	ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
	dir /repo --redact --no-banner # gitleaks v8.30.1

	pre-commit:
	name: Pre-commit (hygiene + EditorConfig)
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.14"

	# terraform_* hooks already run as dedicated jobs above; skip them
	# here so this job stays fast and doesn't double-report.
	- name: Run hygiene hooks
	uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
	env:
	SKIP: terraform_fmt,terraform_validate,terraform_tflint,terraform_trivy

	test:
	name: Module Tests
	runs-on: ubuntu-latest
	timeout-minutes: 10
	strategy:
	fail-fast: false
	matrix:
	# Each module's suite mocks its providers (mock_provider), so neither
	# libvirtd, talosctl, nor a real cluster is required. talos-cluster
	# mocks BOTH libvirt and talos.
	module:
	- modules/libvirt-vm
	- modules/talos-cluster
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Setup OpenTofu
	uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
	with:
	tofu_version_file: .opentofu-version

	# tofu init -backend=false downloads the provider schemas the mocks
	# derive their shape from.
	- name: Initialize (${{ matrix.module }})
	run: tofu init -backend=false
	working-directory: ${{ matrix.module }}

	- name: Run module tests (${{ matrix.module }})
	run: tofu test
	working-directory: ${{ matrix.module }}

Navigation Menu

chore(deps): lock file maintenance (#68) #162

Workflow file

chore(deps): lock file maintenance (#68) #162

Uh oh!

Workflow file for this run