OCM-24672 | chore: consolidate checks under make pre-push-checks

Unify the module merge gate in Makefile (inline pre-push-checks),
add make tools for pinned CLI installs, extend the CI client image,
add verify-min-terraform workflow, remove test.yml, and align docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com>

Author: amandahla

.dockerignore

@@ -0,0 +1,4 @@
+.git
+bin/
+**/.terraform/
+.terraform-docs-cache/

.github/pull_request_template.md

@@ -83,7 +83,6 @@ Examples: variable rename/removal, output rename/removal, default value change,
 - [ ] Relevant Jira/GitHub issues and related PRs are linked.
 - [ ] Tests were added/updated where appropriate.
 - [ ] I manually tested the change.
-- [ ] `make verify` passes.
-- [ ] `make verify-gen` passes.
+- [ ] `make pre-push-checks` passes (or each step: `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, `docs-lint`).
 - [ ] Documentation was added/updated where appropriate (see `make terraform-docs`).
 - [ ] Any risk, limitation, or follow-up work is documented.

…b/workflows/generate_terraform_docs.yaml …b/workflows/generate-terraform-docs.yaml.github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml .github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml

@@ -28,15 +28,7 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Install terraform-docs
-        run: |
-          set -euo pipefail
-          TERRAFORM_DOCS_VERSION="$(grep -E '^ARG TERRAFORM_DOCS_VERSION=' Dockerfile | cut -d= -f2)"
-          curl -sSLo ./terraform-docs.tar.gz "https://terraform-docs.io/dl/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz"
-          tar -xzf terraform-docs.tar.gz terraform-docs
-          chmod +x terraform-docs
-          sudo mv terraform-docs /usr/local/bin/terraform-docs
-          rm -f terraform-docs.tar.gz
-          terraform-docs version
+        run: make terraform-docs-bin
 
       # Commits are created via the GitHub Git Database API (not git commit) so GitHub can
       # attribute and verify them for the authenticated GitHub App installation.

.github/workflows/license-check.yaml

@@ -0,0 +1,32 @@
+# Interim GitHub Actions security gate until OpenShift Prow runs the client image scan.
+# A dedicated Prow presubmit will be investigated and added in openshift/release.
+# Requires Docker on the runner (available on ubuntu-latest) for `make security-check-image`.
+name: Security check (Trivy image)
+
+on:
+  pull_request:
+    paths:
+      - "**/Dockerfile"
+      - "**/.dockerignore"
+      - Makefile
+      - trivy-image.yaml
+      - hack/install-release-tool.sh
+      - .github/workflows/security-check-image.yaml
+
+jobs:
+  security-check-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install Trivy
+        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6
+        with:
+          version: v0.70.0
+
+      - name: Build client image and scan for vulnerabilities
+        run: make security-check-image TRIVY="$(command -v trivy)"

.github/workflows/security-check-image.yaml

@@ -0,0 +1,24 @@
+# Validates examples at the minimum Terraform version (root versions.tf required_version).
+# The Prow client Dockerfile pins the newest Terraform release; this job guards module minimum compatibility.
+name: Verify (minimum Terraform)
+
+on:
+  pull_request:
+
+jobs:
+  verify-terraform-1-5-7:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: "1.5.7"
+          terraform_wrapper: false
+
+      - name: Validate examples (minimum supported Terraform)
+        run: make verify

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-# terraform-docs.sh pinned binary cache (version from Dockerfile)
+# terraform-docs local cache (version from Makefile)
 .terraform-docs-cache/
 
 # Local tool binaries (for example Vale installed via make docs-lint)

.github/workflows/verify-min-terraform.yml

@@ -0,0 +1,10 @@
+5c28becf-1c06-20db-56c0-b73dfe297bf0
+
+
+This signature is a randomly generated UUID used to de-duplicate
+alerts and version information. This signature is random, it is
+not based on any personally identifiable information. To create
+a new signature, you can simply delete this file at any time.
+See the documentation for the software using Checkpoint for more
+information on how to disable it.
+