From aecf8d5e09c10943b06d41d56f58c5589b888abd Mon Sep 17 00:00:00 2001 From: Patrick Hermann Date: Thu, 10 Sep 2026 12:31:15 +0000 Subject: [PATCH 1/3] feat(validate-terraform): take a working directory and an opt-in fmt check Both jobs ran at the repository root, so a repository keeping its Terraform in a subdirectory got a green run over no configuration. working-directory defaults to "." and changes nothing for existing callers. terraform fmt without -check rewrites the runner's checkout and cannot fail. fmt-check adds -check -diff -recursive; it is off by default because every current caller pins @main, and turning it on for them unasked could fail repositories that have never been held to it. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GoGGkGh5RLytzKMJ3PqLYa --- .github/workflows/call-validate-terraform.yaml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/call-validate-terraform.yaml b/.github/workflows/call-validate-terraform.yaml index 7b1b569..937b4e9 100644 --- a/.github/workflows/call-validate-terraform.yaml +++ b/.github/workflows/call-validate-terraform.yaml @@ -22,6 +22,14 @@ on: default: false required: true type: boolean + working-directory: + description: "Directory holding the Terraform configuration, relative to the repository root (for repositories where it is not at the root)" + default: "." + type: string + fmt-check: + description: "Fail when files are not formatted (terraform fmt -check -diff -recursive). Off by default, which keeps the previous behaviour: fmt rewrites the runner's checkout and never fails" + default: false + type: boolean jobs: Terraform-Validate: @@ -33,9 +41,10 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - run: | + - working-directory: ${{ inputs.working-directory }} + run: | terraform init - terraform fmt + terraform fmt ${{ inputs.fmt-check && '-check -diff -recursive' || '' }} terraform validate Terraform-Lint: @@ -47,6 +56,7 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - run: | + - working-directory: ${{ inputs.working-directory }} + run: | ls -lta tflint --recursive From 40b31076d00b09871a8da9ae4d358c86be636a9f Mon Sep 17 00:00:00 2001 From: Patrick Hermann Date: Thu, 10 Sep 2026 12:31:15 +0000 Subject: [PATCH 2/3] feat(terraform-test): take a working directory terraform test resolves -test-directory against the configuration it runs in, which was always the repository root. working-directory defaults to "." and changes nothing for existing callers. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GoGGkGh5RLytzKMJ3PqLYa --- .github/workflows/call-terraform-test.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/call-terraform-test.yaml b/.github/workflows/call-terraform-test.yaml index 5ec61c7..523f67d 100644 --- a/.github/workflows/call-terraform-test.yaml +++ b/.github/workflows/call-terraform-test.yaml @@ -18,8 +18,12 @@ on: default: false required: true type: boolean + working-directory: + description: "Directory holding the Terraform configuration under test, relative to the repository root (for repositories where it is not at the root)" + default: "." + type: string test-directory: - description: "Directory containing tftest.hcl files" + description: "Directory containing tftest.hcl files, relative to working-directory" default: tests type: string verbose: @@ -41,6 +45,7 @@ jobs: fetch-depth: '0' - name: Run terraform test + working-directory: ${{ inputs.working-directory }} run: | terraform init terraform test \ From 947c80da44a0d5acb084f45f39df64cffc1b2c7e Mon Sep 17 00:00:00 2001 From: Patrick Hermann Date: Thu, 10 Sep 2026 12:31:47 +0000 Subject: [PATCH 3/3] fix(terraform-test): pass -verbose when verbose is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit verbose is a boolean input, and comparing it with the string 'true' coerces both sides to numbers — 1 against NaN — so the flag was never passed. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GoGGkGh5RLytzKMJ3PqLYa --- .github/workflows/call-terraform-test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/call-terraform-test.yaml b/.github/workflows/call-terraform-test.yaml index 523f67d..c309001 100644 --- a/.github/workflows/call-terraform-test.yaml +++ b/.github/workflows/call-terraform-test.yaml @@ -50,4 +50,4 @@ jobs: terraform init terraform test \ -test-directory=${{ inputs.test-directory }} \ - ${{ inputs.verbose == 'true' && '-verbose' || '' }} + ${{ inputs.verbose && '-verbose' || '' }}