ci: replace terraform-docs Docker action with binary install

.github/workflows/docs.yml

@@ -18,77 +18,29 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
-      - name: Generate docs for modules/flash-nodes
-        uses: terraform-docs/gh-actions@v1
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v5
         with:
-          working-dir: modules/flash-nodes
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
+          go-version: stable
 
-      - name: Generate docs for modules/k3s-cluster
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/k3s-cluster
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
-
-      - name: Generate docs for modules/talos-cluster
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/talos-cluster
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
-
-      - name: Generate docs for modules/addons/metallb
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/addons/metallb
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
-
-      - name: Generate docs for modules/addons/ingress-nginx
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/addons/ingress-nginx
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
+      - name: Install terraform-docs
+        # Pinned to v0.20.0 — the version shipped by terraform-docs/gh-actions@v1.4.1.
+        # The Docker action fails on the containerized self-hosted runner because
+        # workspace bind-mounts don't resolve in the host docker daemon.
+        run: go install github.com/terraform-docs/terraform-docs@v0.20.0
 
-      - name: Generate docs for modules/addons/longhorn
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/addons/longhorn
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
-
-      - name: Generate docs for modules/addons/monitoring
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/addons/monitoring
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
-
-      - name: Generate docs for modules/addons/portainer
-        uses: terraform-docs/gh-actions@v1
-        with:
-          working-dir: modules/addons/portainer
-          config-file: .terraform-docs.yml
-          output-file: README.md
-          output-method: inject
-          git-push: false
+      - name: Generate docs for all modules
+        run: |
+          for dir in \
+            modules/flash-nodes \
+            modules/k3s-cluster \
+            modules/talos-cluster \
+            modules/addons/metallb \
+            modules/addons/ingress-nginx \
+            modules/addons/longhorn \
+            modules/addons/monitoring \
+            modules/addons/portainer; do
+            terraform-docs --config .terraform-docs.yml --output-file README.md --output-mode inject "$dir"
+          done
 
       - name: Check for changes
         id: changes

.github/workflows/security.yml

@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Run Trivy vulnerability scanner (IaC)
-        uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284 # v0.34.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           scan-type: 'config'
           scan-ref: '.'
@@ -78,7 +78,7 @@ jobs:
         if: always()
 
       - name: Run Trivy license scanner
-        uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284 # v0.34.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           scan-type: 'fs'
           scan-ref: '.'

.github/workflows/validate.yml

@@ -65,7 +65,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run Trivy security scanner
-        uses: aquasecurity/trivy-action@v0.34.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
         with:
           scan-type: config
           scan-ref: .

modules/addons/ingress-nginx/README.md

@@ -34,16 +34,21 @@ module "ingress" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_helm"></a> [helm](#provider\_helm) | >= 2.0 |
+| <a name="provider_helm"></a> [helm](#provider\_helm) | 3.1.1 |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_chart_version"></a> [chart\_version](#input\_chart\_version) | Ingress-NGINX Helm chart version | `string` | `"4.11.3"` | no |
+| <a name="input_controller_replicas"></a> [controller\_replicas](#input\_controller\_replicas) | Number of controller replicas | `number` | `1` | no |
+| <a name="input_controller_resources"></a> [controller\_resources](#input\_controller\_resources) | Resource requests/limits for ingress controller | <pre>object({<br/>    requests = optional(object({<br/>      cpu    = optional(string, "100m")<br/>      memory = optional(string, "128Mi")<br/>    }), {})<br/>    limits = optional(object({<br/>      cpu    = optional(string, "500m")<br/>      memory = optional(string, "512Mi")<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_default_ingress_class"></a> [default\_ingress\_class](#input\_default\_ingress\_class) | Make this the default ingress class | `bool` | `true` | no |
 | <a name="input_enable_admission_webhooks"></a> [enable\_admission\_webhooks](#input\_enable\_admission\_webhooks) | Enable admission webhooks | `bool` | `true` | no |
+| <a name="input_enable_metrics"></a> [enable\_metrics](#input\_enable\_metrics) | Enable Prometheus metrics | `bool` | `false` | no |
 | <a name="input_loadbalancer_ip"></a> [loadbalancer\_ip](#input\_loadbalancer\_ip) | Static IP for ingress LoadBalancer (optional) | `string` | `null` | no |
+| <a name="input_metrics_port"></a> [metrics\_port](#input\_metrics\_port) | Port for Prometheus metrics | `number` | `10254` | no |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace for ingress-nginx | `string` | `"ingress-nginx"` | no |
 | <a name="input_timeout"></a> [timeout](#input\_timeout) | Helm install timeout in seconds | `number` | `300` | no |
 
 ## Outputs

modules/addons/monitoring/README.md

@@ -119,7 +119,7 @@ module "monitoring" {
 | Name | Version |
 |------|---------|
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 3.1.1 |
-| <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | >= 1.14 |
+| <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | 1.19.0 |
 
 ## Inputs
 

modules/addons/portainer/README.md

@@ -38,7 +38,7 @@ Then connect from your Portainer instance using the agent URL.
 
 | Name | Version |
 |------|---------|
-| <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | >= 1.14 |
+| <a name="provider_kubectl"></a> [kubectl](#provider\_kubectl) | 1.19.0 |
 
 ## Inputs
 
@@ -51,7 +51,9 @@ Then connect from your Portainer instance using the agent URL.
 | <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Agent log level (DEBUG, INFO, WARN, ERROR) | `string` | `"INFO"` | no |
 | <a name="input_memory_limit"></a> [memory\_limit](#input\_memory\_limit) | Memory limit | `string` | `"256Mi"` | no |
 | <a name="input_memory_request"></a> [memory\_request](#input\_memory\_request) | Memory request | `string` | `"64Mi"` | no |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | Kubernetes namespace for Portainer | `string` | `"portainer"` | no |
 | <a name="input_node_port"></a> [node\_port](#input\_node\_port) | NodePort port number (when service\_type is NodePort) | `number` | `30778` | no |
+| <a name="input_replicas"></a> [replicas](#input\_replicas) | Number of Portainer agent replicas | `number` | `1` | no |
 | <a name="input_service_type"></a> [service\_type](#input\_service\_type) | Service type: NodePort or LoadBalancer | `string` | `"LoadBalancer"` | no |
 
 ## Outputs

modules/flash-nodes/README.md

@@ -33,7 +33,7 @@ module "flash" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_turingpi"></a> [turingpi](#provider\_turingpi) | >= 1.0 |
+| <a name="provider_turingpi"></a> [turingpi](#provider\_turingpi) | 1.3.10 |
 
 ## Inputs
 

modules/k3s-cluster/README.md

@@ -136,9 +136,9 @@ module "k3s" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_local"></a> [local](#provider\_local) | >= 2.0 |
-| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
-| <a name="provider_random"></a> [random](#provider\_random) | >= 3.0 |
+| <a name="provider_local"></a> [local](#provider\_local) | 2.6.1 |
+| <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
+| <a name="provider_random"></a> [random](#provider\_random) | 3.8.0 |
 
 ## Inputs
 

modules/talos-cluster/README.md

@@ -77,14 +77,14 @@ module "cluster" {
 
 | Name | Version |
 |------|---------|
-| <a name="provider_local"></a> [local](#provider\_local) | >= 2.0 |
-| <a name="provider_talos"></a> [talos](#provider\_talos) | >= 0.7 |
+| <a name="provider_local"></a> [local](#provider\_local) | 2.6.1 |
+| <a name="provider_talos"></a> [talos](#provider\_talos) | 0.10.0 |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Kubernetes API endpoint (<https://IP:6443>) | `string` | n/a | yes |
+| <a name="input_cluster_endpoint"></a> [cluster\_endpoint](#input\_cluster\_endpoint) | Kubernetes API endpoint (https://IP:6443) | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the Kubernetes cluster | `string` | n/a | yes |
 | <a name="input_control_plane"></a> [control\_plane](#input\_control\_plane) | Control plane node configurations | <pre>list(object({<br/>    host     = string<br/>    hostname = optional(string)<br/>  }))</pre> | n/a | yes |
 | <a name="input_controlplane_patches"></a> [controlplane\_patches](#input\_controlplane\_patches) | Config patches for control plane nodes (YAML strings) | `list(string)` | `[]` | no |
@@ -111,6 +111,7 @@ module "cluster" {
 | <a name="output_machine_secrets"></a> [machine\_secrets](#output\_machine\_secrets) | Talos machine secrets (for backup) |
 | <a name="output_nvme_enabled"></a> [nvme\_enabled](#output\_nvme\_enabled) | Whether NVMe storage is configured |
 | <a name="output_nvme_mountpoint"></a> [nvme\_mountpoint](#output\_nvme\_mountpoint) | NVMe mount point (if enabled) |
+| <a name="output_talosconfig_path"></a> [talosconfig\_path](#output\_talosconfig\_path) | Path to talosconfig file (if written) |
 <!-- END_TF_DOCS -->
 
 ## NVMe Storage Configuration