terraform-ci.yml

name: Terraform CI

on:
  push:
    branches: [main]
  pull_request:
    paths:
      - '**.tf'
      - '.github/workflows/**'

jobs:
  validate:
    name: Validate & Lint Terraform
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          # TODO: read from .tool-versions
          terraform_version: 1.13.3

      - name: Terraform fmt (check)
        run: terraform fmt -recursive -check

      - name: Terraform init (no backend for CI)
        run: terraform init -backend=false

      - name: Terraform validate
        run: terraform validate

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@v6
        with:
          tflint_version: latest

      - name: Run TFLint
        run: tflint --init && tflint