Merge pull request #150 from amandahla/OCM-24672

OCM-24672: chore: consolidate checks under make pre-push-checks

Author: openshift-merge-bot[bot]

.coderabbit.yaml

@@ -80,6 +80,6 @@ reviews:
     tflint:
       enabled: true
     trivy:
-      enabled: true
+      enabled: false
     yamllint:
       enabled: true

.dockerignore

@@ -0,0 +1,4 @@
+.git
+bin/
+**/.terraform/
+.terraform-docs-cache/

.github/pull_request_template.md

@@ -83,7 +83,6 @@ Examples: variable rename/removal, output rename/removal, default value change,
 - [ ] Relevant Jira/GitHub issues and related PRs are linked.
 - [ ] Tests were added/updated where appropriate.
 - [ ] I manually tested the change.
-- [ ] `make verify` passes.
-- [ ] `make verify-gen` passes.
+- [ ] `make pre-push-checks` passes (or each step: `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, `docs-lint`).
 - [ ] Documentation was added/updated where appropriate (see `make terraform-docs`).
 - [ ] Any risk, limitation, or follow-up work is documented.

.github/workflows/check-commit-format.yml

@@ -14,6 +14,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Validate Commit Message(s)
         env:
           PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}

…b/workflows/generate_terraform_docs.yaml …b/workflows/generate-terraform-docs.yaml.github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml .github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml

@@ -28,15 +28,7 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Install terraform-docs
-        run: |
-          set -euo pipefail
-          TERRAFORM_DOCS_VERSION="$(grep -E '^ARG TERRAFORM_DOCS_VERSION=' Dockerfile | cut -d= -f2)"
-          curl -sSLo ./terraform-docs.tar.gz "https://terraform-docs.io/dl/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz"
-          tar -xzf terraform-docs.tar.gz terraform-docs
-          chmod +x terraform-docs
-          sudo mv terraform-docs /usr/local/bin/terraform-docs
-          rm -f terraform-docs.tar.gz
-          terraform-docs version
+        run: make terraform-docs-bin
 
       # Commits are created via the GitHub Git Database API (not git commit) so GitHub can
       # attribute and verify them for the authenticated GitHub App installation.

.github/workflows/license-check.yaml

@@ -0,0 +1,24 @@
+# Validates examples at the minimum Terraform version (root versions.tf required_version).
+# The Prow client Dockerfile pins the newest Terraform release; this job guards module minimum compatibility.
+name: Verify (minimum Terraform)
+
+on:
+  pull_request:
+
+jobs:
+  verify-terraform-1-5-7:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: "1.5.7"
+          terraform_wrapper: false
+
+      - name: Validate examples (minimum supported Terraform)
+        run: make verify

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-# terraform-docs.sh pinned binary cache (version from Dockerfile)
+# terraform-docs local cache (version from Makefile)
 .terraform-docs-cache/
 
 # Local tool binaries (for example Vale installed via make docs-lint)

.github/workflows/verify-min-terraform.yml

@@ -14,4 +14,8 @@ description = "Terraform CLI test configs may contain mock tokens/placeholders."
 paths = [
   # e.g. modules/*/tests/*.tftest.hcl
   '''\.tftest''',
+  # Pinned CLI binaries and Terraform/plugin caches (not source secrets)
+  '''^bin/''',
+  '''(?:^|/)\.terraform(?:/|$)''',
+  '''(?:^|/)\.terraform-docs-cache(?:/|$)''',
 ]