ci.yml

---
name: CI

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  format:
    name: Format Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version_file: .opentofu-version

      - name: Check formatting
        run: tofu fmt -check -recursive

  validate:
    name: Validate
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        environment:
          - modules/libvirt-vm
          - modules/talos-cluster
          - environments/lab
          - environments/production
          - environments/talos-lab
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version_file: .opentofu-version

      - name: Initialize (${{ matrix.environment }})
        run: tofu init -backend=false
        working-directory: ${{ matrix.environment }}

      - name: Validate (${{ matrix.environment }})
        run: tofu validate
        working-directory: ${{ matrix.environment }}

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Pinned: tflint v0.61.0+ panics (nil pointer in sigstore-go's Bundle.TlogEntries,
      # inside tflint's plugin signature verification) when installing the pinned
      # terraform ruleset plugin from .tflint.hcl. Reproduced locally: v0.59.1 installs
      # cleanly, v0.61.0/v0.62.1/v0.63.1 (latest) all crash identically. Likely tied to
      # tflint enabling plugin keyless verification by default around this version range.
      # Revisit this pin once upstream fixes it; check https://github.com/terraform-linters/tflint/issues
      # for the sigstore-go TlogEntries panic before bumping.
      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0
        with:
          tflint_version: v0.59.1

      # GITHUB_TOKEN lifts the unauthenticated GitHub API rate limit so the
      # pinned terraform ruleset (.tflint.hcl) downloads reliably.
      - name: Initialize TFLint
        run: tflint --init
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run TFLint
        run: tflint --recursive

  security:
    name: Security Scan (Trivy)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Run Trivy IaC misconfiguration scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: config
          scan-ref: .
          severity: HIGH,CRITICAL
          exit-code: "1"
          ignore-unfixed: true
          skip-dirs: "**/.terraform"
          format: sarif
          output: trivy.sarif

      - name: Upload Trivy SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
        with:
          sarif_file: trivy.sarif
          category: trivy-config

  secret-scan:
    name: Secret Scan (gitleaks)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Full working-tree secret scan, server-side. The gitleaks pre-commit
      # hook only scans STAGED changes (a no-op in a clean CI checkout), so
      # this dedicated job is what actually enforces detection on every push/PR.
      # Pinned by immutable image digest (matching the action SHA-pins above and
      # the companion repos); the digest is gitleaks v8.30.1, the same version as
      # the pre-commit hook. Bump the digest and the version comment together.
      - name: Run gitleaks (full working-tree scan)
        run: |
          docker run --rm -v "${{ github.workspace }}:/repo" \
            ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
            dir /repo --redact --no-banner # gitleaks v8.30.1

  pre-commit:
    name: Pre-commit (hygiene + EditorConfig)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"

      # terraform_* hooks already run as dedicated jobs above; skip them
      # here so this job stays fast and doesn't double-report.
      - name: Run hygiene hooks
        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
        env:
          SKIP: terraform_fmt,terraform_validate,terraform_tflint,terraform_trivy

  test:
    name: Module Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        # Each module's suite mocks its providers (mock_provider), so neither
        # libvirtd, talosctl, nor a real cluster is required. talos-cluster
        # mocks BOTH libvirt and talos.
        module:
          - modules/libvirt-vm
          - modules/talos-cluster
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup OpenTofu
        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
        with:
          tofu_version_file: .opentofu-version

      # tofu init -backend=false downloads the provider schemas the mocks
      # derive their shape from.
      - name: Initialize (${{ matrix.module }})
        run: tofu init -backend=false
        working-directory: ${{ matrix.module }}

      - name: Run module tests (${{ matrix.module }})
        run: tofu test
        working-directory: ${{ matrix.module }}