Repository navigation

Standardize components + Claude Code quality gate, conventions & changelog automation #42

	name: ci

	# Lint + validate every module on PRs and pushes to main.
	# No cloud credentials needed — validation runs with the backend disabled.

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	validate:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	component: [vpc, ec2, network, compute-engine, github, automation-roles]
	steps:
	- uses: actions/checkout@v6

	- uses: hashicorp/setup-terraform@v4
	with:
	terraform_version: 1.15.5

	- name: terraform fmt
	run: terraform -chdir=${{ matrix.component }}/terraform fmt -check -recursive

	- name: terraform init (no backend)
	run: terraform -chdir=${{ matrix.component }}/terraform init -backend=false -input=false

	- name: terraform validate
	run: terraform -chdir=${{ matrix.component }}/terraform validate

	- uses: terraform-linters/setup-tflint@v6
	with:
	tflint_version: latest

	- name: tflint
	run: \|
	cd ${{ matrix.component }}/terraform
	tflint --init --config="$GITHUB_WORKSPACE/.tflint.hcl"
	tflint --config="$GITHUB_WORKSPACE/.tflint.hcl"

	# Server-side net for the .github/workflows/* themselves (also enforced locally via pre-commit).
	# Grabs the official prebuilt binary (script + version pinned to v1.7.12) — no Go build, runs in seconds.
	actionlint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6

	- name: actionlint
	run: \|
	curl -sSfL -o download-actionlint.bash \
	https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash
	bash download-actionlint.bash 1.7.12
	./actionlint -color