OCM-24672 | chore: consolidate checks under make pre-push-checks

Unify the module merge gate in Makefile (inline pre-push-checks),
extend the CI client image for tflint/addlicense/Vale, add
verify-min-terraform workflow, remove test.yml, align CONTRIBUTING
and workflows, and drop broken manual tf-* targets.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com>

Author: amandahla

.github/pull_request_template.md

@@ -83,7 +83,6 @@ Examples: variable rename/removal, output rename/removal, default value change,
 - [ ] Relevant Jira/GitHub issues and related PRs are linked.
 - [ ] Tests were added/updated where appropriate.
 - [ ] I manually tested the change.
-- [ ] `make verify` passes.
-- [ ] `make verify-gen` passes.
+- [ ] `make pre-push-checks` passes (or each step: `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, `docs-lint`).
 - [ ] Documentation was added/updated where appropriate (see `make terraform-docs`).
 - [ ] Any risk, limitation, or follow-up work is documented.

…b/workflows/generate_terraform_docs.yaml …b/workflows/generate-terraform-docs.yaml.github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml .github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml

@@ -1,10 +1,11 @@
-name: Terraform test
+# Validates examples at the minimum Terraform version (root versions.tf required_version).
+name: Verify (minimum Terraform)
 
 on:
   pull_request:
 
 jobs:
-  test:
+  verify-terraform-1-5-7:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -13,12 +14,8 @@ jobs:
 
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
+          terraform_version: "1.5.7"
           terraform_wrapper: false
 
-      - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
-
-      - name: Lint
-        run: make lint
-
-      - name: Terraform unit tests
-        run: make unit-tests
+      - name: Validate examples (minimum supported Terraform)
+        run: make verify

.github/workflows/test.yml …ithub/workflows/verify-min-terraform.yml.github/workflows/test.yml renamed to .github/workflows/verify-min-terraform.yml .github/workflows/test.yml renamed to .github/workflows/verify-min-terraform.yml

@@ -93,4 +93,4 @@ Use mocks for AWS and RHCS resources to verify logic without requiring live cred
 
 When module behavior branches on a **boolean variable** (e.g. **`count = var.x ? 1 : 0`**), prefer **more than one `run` block** (or clearly separated scenarios) so **both** outcomes are covered—typically **`true` / `count = 1`** and **`false` / `count = 0`**—not only the default or “happy” path. That avoids regressions where the positive case passes but the opt-out path breaks.
 
-For exact commands and pass/fail criteria, follow **`CONTRIBUTING.md`**.
+Before opening a PR, `make pre-push-checks` must pass locally; see **`CONTRIBUTING.md`** for commands and pass/fail criteria.

AGENTS.md

@@ -17,20 +17,20 @@ This repo is **ROSA HCP** only. The sibling **ROSA Classic** module is [`terrafo
 ## Before you open a PR
 
 1. **Format** — `terraform fmt -recursive` (or format only dirs you changed).
-2. **Validate** — `make verify` (runs `terraform init` + `validate` in each `examples/*` directory). Fix failures in examples you touch or that your change breaks.
+2. **Validate** — `make verify` (runs `terraform init` + `validate` in each `examples/*` directory; compatible with the minimum Terraform version in root **`versions.tf`**, currently **>= 1.5.7**). Fix failures in examples you touch or that your change breaks.
 3. **Docs** — If you changed variables, outputs, modules, or root wiring: run `make verify-gen` (runs `terraform-docs` via [`scripts/terraform-docs.sh`](scripts/terraform-docs.sh), then [`scripts/verify-gen.sh`](scripts/verify-gen.sh) to ensure README inject blocks are committed).
 4. **Module tests** — If a submodule under `modules/<name>/tests/` has `*.tftest.hcl`, run `terraform init -backend=false && terraform test` from `modules/<name>/`, or run `make unit-tests` for all modules with tests.
 5. **Documentation lint** — `make docs-lint` runs the pinned [Vale](https://docs.vale.sh/) CLI with Red Hat documentation styles (see [`.vale.ini`](.vale.ini)). Building Vale uses `CGO_ENABLED=1` and requires a C compiler toolchain on the first install.
 6. **Provider** — Treat [`terraform-redhat/rhcs`](https://github.com/terraform-redhat/terraform-provider-rhcs) as the source of truth: mirror its schemas in variables and docs. Add `validation` / `precondition` only to echo the provider’s required fields and allowed values (fail fast); do not duplicate or tighten rules the provider already enforces.
 7. **Module scope (AWS-only)** — If the change adds or expands **AWS-only** configuration (no `rhcs` surface), confirm it matches **`Module scope (AWS-only vs core HCP)`** in [`.cursor/rules/rosa-hcp-terraform.mdc`](.cursor/rules/rosa-hcp-terraform.mdc). In the PR, **link official Red Hat or cited ROSA HCP documentation** that supports shipping it in-repo, or explain why an exception is justified.
 
-Run the full local verification flow (same steps planned for CI) with:
+Run the full local verification flow (same steps as the planned single OpenShift Prow presubmit) with:
 
 ```shell
-make basic-checks
+make pre-push-checks
 ```
 
-`make basic-checks` runs `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, and `docs-lint` in order (fail-fast). Use `make run-checks -- basic --list-steps` or `--dry-run` to inspect the sequence without running it.
+`make pre-push-checks` runs `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, and `docs-lint` in order (fail-fast). Run individual targets when debugging one step. OpenShift Prow will use `make pre-push-checks` as the presubmit merge gate after `openshift/release` is updated. Until then, GitHub Actions runs `make verify` at Terraform 1.5.7 via **`verify-min-terraform.yml`**; run `make pre-push-checks` locally before opening a PR.
 
 ## Commit format
 

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 FROM registry.access.redhat.com/ubi9/ubi:latest
 WORKDIR /app
 COPY . /app
-RUN yum update -y && yum install -y yum-utils shadow-utils unzip tar make && \
+RUN yum update -y && yum install -y yum-utils shadow-utils unzip tar make golang gcc gcc-c++ git which && \
     yum-config-manager --add-repo https://rpm.releases.hashicorp.com/AmazonLinux/hashicorp.repo && \
     yum -y install terraform && \
     yum clean all && \
@@ -13,4 +13,10 @@ RUN curl -sL "https://mirror.openshift.com/pub/cgw/rosa/latest/rosa-linux.tar.gz
 ARG TERRAFORM_DOCS_VERSION=0.22.0
 RUN curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-$(uname)-amd64.tar.gz && \
     tar -xzf terraform-docs.tar.gz terraform-docs && chmod +x terraform-docs && \
-    mv terraform-docs /usr/local/bin/terraform-docs && rm terraform-docs.tar.gz
+    mv terraform-docs /usr/local/bin/terraform-docs && rm terraform-docs.tar.gz
+ARG VALE_VERSION=v3.14.1
+ARG ADDLICENSE_VERSION=v1.2.0
+RUN go install github.com/google/addlicense@${ADDLICENSE_VERSION} && \
+    CGO_ENABLED=1 go install github.com/errata-ai/vale/v3/cmd/vale@${VALE_VERSION} && \
+    curl -sL https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash -s -- -b /usr/local/bin
+ENV PATH="/root/go/bin:/usr/local/bin:${PATH}"

Dockerfile

@@ -2,8 +2,8 @@ SHELL := bash
 
 LOCALBIN ?= $(CURDIR)/bin
 LOCALBIN_ABS := $(abspath $(LOCALBIN))
-RUN_CHECKS_SCRIPT := ./hack/run-checks.sh
 VALE_VERSION ?= v3.14.1
+MODULE_REGISTRY := terraform-redhat/rosa-hcp/rhcs
 
 ifeq ($(shell go env GOOS 2>/dev/null),windows)
 	BIN_EXT=.exe
@@ -19,135 +19,59 @@ $(LOCALBIN):
 $(VALE): | $(LOCALBIN)
 	CGO_ENABLED=1 GOBIN="$(LOCALBIN_ABS)" go install github.com/errata-ai/vale/v3/cmd/vale@$(VALE_VERSION)
 
-######################
-# Define a variable for the Terraform examples directory
-TERRAFORM_DIR := examples/rosa-hcp-public-with-byo-vpc-byo-iam-byo-oidc
-
-######################
-# Log into your AWS account before running this make file.
-# Create .env file with your ROSA token. This file will be ignored by git.
-# format.
-# RHCS_TOKEN=<ROSA TOKEN>
-
-# include .env
-# export $(shell sed '/^\#/d; s/=.*//' .env)
-TF_LOG=INFO
-######################
-# .EXPORT_ALL_VARIABLES:
-
-# Run make init \ make plan \ make apply \ make destroy
-
+# Merge gate: verify, verify-gen, lint, unit-tests, license-check, docs-lint (fail-fast).
+# Intended single OpenShift Prow presubmit after openshift/release switches from verify + verify-gen.
+.PHONY: pre-push-checks
+pre-push-checks:
+	@$(MAKE) --no-print-directory verify
+	@$(MAKE) --no-print-directory verify-gen
+	@$(MAKE) --no-print-directory lint
+	@$(MAKE) --no-print-directory unit-tests
+	@$(MAKE) --no-print-directory license-check
+	@$(MAKE) --no-print-directory docs-lint
+
+# Prow today (until consolidated): verify-format → make verify, verify-gen → make verify-gen.
+# https://github.com/openshift/release/tree/master/ci-operator/config/terraform-redhat/terraform-rhcs-rosa-hcp
 .PHONY: verify
-# This target is used by prow target (https://github.com/openshift/release/blob/77159f7696ed6c7bae518091079724cb8217dd33/ci-operator/config/terraform-redhat/terraform-rhcs-rosa/terraform-redhat-terraform-rhcs-rosa-main.yaml#L18)
-# Don't remove this target
 verify:
 	@for d in examples/*; do \
-		echo "!! Validating $$d !!" && cd $$d && rm -rf .terraform .terraform.lock.hcl && terraform init && terraform validate && cd - ;\
+		echo "!! Validating $$d !!" && cd "$$d" && rm -rf .terraform .terraform.lock.hcl && terraform init && terraform validate && cd - ; \
 	done
 
+.PHONY: verify-gen
 verify-gen: terraform-docs
 	scripts/verify-gen.sh
 
-.PHONY: tf-init
-tf-init:
-	@cd $(TERRAFORM_DIR) && terraform init -input=false -lock=false -no-color -reconfigure
-
-.PHONY: tf-plan
-tf-plan: format validate
-	@cd $(TERRAFORM_DIR) && terraform plan -lock=false -out=.terraform-plan
-
-.PHONY: tf-apply
-tf-apply:
-	@cd $(TERRAFORM_DIR) && terraform apply .terraform-plan
-
-.PHONY: tf-destroy
-tf-destroy:
-	@cd $(TERRAFORM_DIR) && terraform destroy -auto-approve -input=false
-
-.PHONY: tf-output
-tf-output:
-	@cd $(TERRAFORM_DIR) && terraform output > tf-output-parameters
-
-.PHONY: tf-format
-tf-format:
-	@cd $(TERRAFORM_DIR) && terraform fmt
-
-.PHONY: tf-validate
-tf-validate:
-	@cd $(TERRAFORM_DIR) && terraform validate
-
-.PHONY: tests
-tests:
-	sh tests.sh
+.PHONY: lint
+lint:
+	terraform fmt -check -recursive
+	terraform init -backend=false -input=false
+	@command -v tflint >/dev/null 2>&1 || { echo "tflint not found; see https://github.com/terraform-linters/tflint"; exit 1; }
+	tflint --init
+	tflint --recursive \
+		--disable-rule=terraform_required_providers \
+		--disable-rule=terraform_unused_declarations \
+		--disable-rule=terraform_unused_required_providers
 
-# Terraform unit tests (distinct from `make tests`, which runs tests.sh).
-# for each module under modules, check if tests directory exists and run tests.
 .PHONY: unit-tests
 unit-tests:
 	@set -e; \
 	for submodule in modules/*; do \
 	  echo "== $$submodule =="; \
-	  cd $$submodule/tests 2> /dev/null || continue; \
+	  cd "$$submodule/tests" 2>/dev/null || continue; \
 	  echo "== running tests for $$submodule =="; \
-	  (cd .. && terraform init -backend=false -input=false && terraform test ); \
+	  (cd .. && terraform init -backend=false -input=false && terraform test); \
 	  cd ../../..; \
 	done
 
-# fmt -check and tflint across root and submodules. tflint --recursive does not
-# apply root .tflint.hcl rule blocks to child dirs; --disable-rule avoids failing
-# on undeclared optional providers (random/tls/local/http/time) until pinned.
-.PHONY: lint
-lint:
-	terraform fmt -check -recursive
-	@command -v tflint >/dev/null 2>&1 || { echo "tflint not found; see https://github.com/terraform-linters/tflint"; exit 1; }
-	tflint --init
-	tflint --recursive --disable-rule=terraform_required_providers
-
-.PHONY: dev-environment
-dev-environment:
-	find . -type f -name "versions.tf" -exec sed -i -e "s/terraform-redhat\/rhcs/terraform.local\/local\/rhcs/g" -- {} +
-
-.PHONY: registry-environment
-registry-environment:
-	find . -type f -name "versions.tf" -exec sed -i -e "s/terraform.local\/local\/rhcs/terraform-redhat\/rhcs/g" -- {} +
-
-.PHONY: run-example
-run-example:
-	bash scripts/run-example.sh $(EXAMPLE_NAME)
-
-.PHONY: change-ocp-version
-# Example for running: make change-ocp-version OLD_VER=4.13.13 NEW_VER=4.14.9
-change-ocp-version:
-	find . -type f -name "variables.tf" -exec sed -i -e 's/default = "${OLD_VER}"/default = "${NEW_VER}"/g' -- {} +
-
-.PHONY: terraform-docs
-# This target require teraform-docs, follow the installation guide: https://terraform-docs.io/user-guide/installation/
-terraform-docs:
-	bash scripts/terraform-docs.sh
-
-.PHONY: change-module-version
-# Example for running: make change-module-version MODULE_VERSION=1.7.0
-change-module-version:
-	find ./examples -type f -name '*.tf' -exec sed -i 's^source\s*= "\.\./\.\./"^source = "terraform-redhat/rosa-hcp/rhcs"\n  version = "${MODULE_VERSION}"^g' -- {} +
-	find ./examples -type f -name '*.tf' -exec sed -E -i 's^source\s*= "\.\./\.\./modules/([^"]+)"^source = "terraform-redhat/rosa-hcp/rhcs//modules/\1"\n  version = "${MODULE_VERSION}"^g' -- {} +
-
 .PHONY: license-check
 license-check:
-	@echo "Checking for missing license headers..."
 	@bash scripts/add-license-header.sh -check
 
 .PHONY: license-add
 license-add:
-	@echo "Adding license headers to files..."
 	@bash scripts/add-license-header.sh
 
-.PHONY: commits/check
-commits/check:
-	@./hack/commit-msg-verify.sh
-
-.PHONY: vale
-vale: $(VALE)
-
 .PHONY: docs-lint
 docs-lint: $(VALE)
 	@echo "Note: README and module docs are generated with 'make terraform-docs'; fix descriptions in *.tf, then run 'make verify-gen'."
@@ -162,15 +86,37 @@ docs-lint: $(VALE)
 	fi; \
 	"$(VALE)" --minAlertLevel=error $$docs
 
-.PHONY: basic-checks
-basic-checks:
-	@$(RUN_CHECKS_SCRIPT) basic
+.PHONY: terraform-docs
+terraform-docs:
+	bash scripts/terraform-docs.sh
+
+.PHONY: commits/check
+commits/check:
+	@./hack/commit-msg-verify.sh
+
+.PHONY: vale
+vale: $(VALE)
+
+# OpenShift Prow example jobs (rhcs-module-run-example-hcp): make run-example EXAMPLE_NAME=...
+.PHONY: run-example
+run-example:
+	bash scripts/run-example.sh $(EXAMPLE_NAME)
 
-.PHONY: run-checks
-run-checks:
-	@$(RUN_CHECKS_SCRIPT) $(filter-out $@,$(MAKECMDGOALS))
+# Maintainer utilities (not part of pre-push-checks).
+.PHONY: dev-environment registry-environment change-ocp-version change-module-version
+dev-environment:
+	find . -type f -name "versions.tf" -exec sed -i -e "s/terraform-redhat\/rhcs/terraform.local\/local\/rhcs/g" -- {} +
 
-RUN_CHECKS_PASSTHROUGH_ARGS := basic --dry-run --list-steps -h --help
-.PHONY: $(RUN_CHECKS_PASSTHROUGH_ARGS)
-$(RUN_CHECKS_PASSTHROUGH_ARGS):
-	@:
+registry-environment:
+	find . -type f -name "versions.tf" -exec sed -i -e "s/terraform.local\/local\/rhcs/terraform-redhat\/rhcs/g" -- {} +
+
+change-ocp-version:
+	find . -type f -name "variables.tf" -exec sed -i -e 's/default = "$(OLD_VER)"/default = "$(NEW_VER)"/g' -- {} +
+
+change-module-version:
+	find ./examples -type f -name '*.tf' -exec sed -i 's^source\s*= "\.\./\.\./"^source = "$(MODULE_REGISTRY)"\n  version = "$(MODULE_VERSION)"^g' -- {} +
+	find ./examples -type f -name '*.tf' -exec sed -E -i 's^source\s*= "\.\./\.\./modules/([^"]+)"^source = "$(MODULE_REGISTRY)//modules/\1"\n  version = "$(MODULE_VERSION)"^g' -- {} +
+
+.PHONY: tests
+tests:
+	sh tests.sh

Makefile

@@ -49,12 +49,12 @@ The primary sub-modules responsible for ROSA HCP cluster creation includes optio
 
 Contributors are encouraged to add Terraform tests when introducing or substantially changing a submodule, so configuration stays aligned with provider behavior before changes merge.
 
-Two Makefile targets help with that:
+Before opening a PR, run **`make pre-push-checks`** (or the individual targets below). That flow is the intended single merge gate for OpenShift Prow once `openshift/release` is updated.
 
 - **`make lint`** — Runs `terraform fmt -check -recursive` and [tflint](https://github.com/terraform-linters/tflint) across the root module and submodules so formatting and common Terraform issues are caught early.
-- **`make unit-tests`** — For each module directory that contains **`test/*.tftest.hcl`** files, runs `terraform init -backend=false` and `terraform test -test-directory=test` (requires **Terraform 1.6+**). If no matching files exist, the target succeeds without running tests. This is separate from **`make tests`**, which runs the legacy `tests.sh` script.
+- **`make unit-tests`** — For each submodule that contains **`modules/<name>/tests/*.tftest.hcl`**, runs `terraform init -backend=false` and `terraform test` from `modules/<name>/` (requires **Terraform 1.6+**). If no matching files exist, the target succeeds without running tests. This is separate from **`make tests`**, which runs the legacy `tests.sh` script.
 
-Place tests under a **`test/`** directory beside the module’s `.tf` files (for example `modules/my-module/test/example.tftest.hcl`). You need the Terraform CLI and tflint on your PATH; `make lint` runs `tflint --init`, which may download plugins from [.tflint.hcl](.tflint.hcl).
+Place tests under **`modules/<name>/tests/`** (for example `modules/my-module/tests/example.tftest.hcl`). You need the Terraform CLI and tflint on your PATH; `make lint` runs `tflint --init`, which may download plugins from [.tflint.hcl](.tflint.hcl).
 
 ## Pre-requisites