OCM-24672 | chore: consolidate checks under make pre-push-checks

Unify the module merge gate in Makefile (inline pre-push-checks),
add make tools for pinned CLI installs, extend the CI client image,
add verify-min-terraform workflow, remove test.yml, and align docs.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Amanda Hager Lopes de Andrade Katz <amanda.katz@redhat.com>

Author: amandahla

.dockerignore

@@ -0,0 +1,4 @@
+.git
+bin/
+**/.terraform/
+.terraform-docs-cache/

.github/pull_request_template.md

@@ -83,7 +83,6 @@ Examples: variable rename/removal, output rename/removal, default value change,
 - [ ] Relevant Jira/GitHub issues and related PRs are linked.
 - [ ] Tests were added/updated where appropriate.
 - [ ] I manually tested the change.
-- [ ] `make verify` passes.
-- [ ] `make verify-gen` passes.
+- [ ] `make pre-push-checks` passes (or each step: `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, `docs-lint`).
 - [ ] Documentation was added/updated where appropriate (see `make terraform-docs`).
 - [ ] Any risk, limitation, or follow-up work is documented.

…b/workflows/generate_terraform_docs.yaml …b/workflows/generate-terraform-docs.yaml.github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml .github/workflows/generate_terraform_docs.yaml renamed to .github/workflows/generate-terraform-docs.yaml

@@ -28,15 +28,7 @@ jobs:
           ref: ${{ github.head_ref }}
 
       - name: Install terraform-docs
-        run: |
-          set -euo pipefail
-          TERRAFORM_DOCS_VERSION="$(grep -E '^ARG TERRAFORM_DOCS_VERSION=' Dockerfile | cut -d= -f2)"
-          curl -sSLo ./terraform-docs.tar.gz "https://terraform-docs.io/dl/v${TERRAFORM_DOCS_VERSION}/terraform-docs-v${TERRAFORM_DOCS_VERSION}-linux-amd64.tar.gz"
-          tar -xzf terraform-docs.tar.gz terraform-docs
-          chmod +x terraform-docs
-          sudo mv terraform-docs /usr/local/bin/terraform-docs
-          rm -f terraform-docs.tar.gz
-          terraform-docs version
+        run: make terraform-docs-bin
 
       # Commits are created via the GitHub Git Database API (not git commit) so GitHub can
       # attribute and verify them for the authenticated GitHub App installation.

.github/workflows/license-check.yaml

@@ -0,0 +1,32 @@
+# Interim GitHub Actions security gate until OpenShift Prow runs the client image scan.
+# A dedicated Prow presubmit will be investigated and added in openshift/release.
+# Requires Docker on the runner (available on ubuntu-latest) for `make security-check-image`.
+name: Security check (Trivy image)
+
+on:
+  pull_request:
+    paths:
+      - "**/Dockerfile"
+      - "**/.dockerignore"
+      - Makefile
+      - trivy-image.yaml
+      - hack/install-release-tool.sh
+      - .github/workflows/security-check-image.yaml
+
+jobs:
+  security-check-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install Trivy
+        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514 # v0.2.6
+        with:
+          version: v0.70.0
+
+      - name: Build client image and scan for vulnerabilities
+        run: make security-check-image TRIVY="$(command -v trivy)"

.github/workflows/security-check-image.yaml

@@ -1,10 +1,11 @@
-name: Terraform test
+# Validates examples at the minimum Terraform version (root versions.tf required_version).
+name: Verify (minimum Terraform)
 
 on:
   pull_request:
 
 jobs:
-  test:
+  verify-terraform-1-5-7:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -13,12 +14,8 @@ jobs:
 
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
+          terraform_version: "1.5.7"
           terraform_wrapper: false
 
-      - uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93 # v6.2.2
-
-      - name: Lint
-        run: make lint
-
-      - name: Terraform unit tests
-        run: make unit-tests
+      - name: Validate examples (minimum supported Terraform)
+        run: make verify

.github/workflows/test.yml …ithub/workflows/verify-min-terraform.yml.github/workflows/test.yml renamed to .github/workflows/verify-min-terraform.yml .github/workflows/test.yml renamed to .github/workflows/verify-min-terraform.yml

@@ -1,4 +1,4 @@
-# terraform-docs.sh pinned binary cache (version from Dockerfile)
+# terraform-docs local cache (version from Makefile)
 .terraform-docs-cache/
 
 # Local tool binaries (for example Vale installed via make docs-lint)

.gitignore

@@ -1,5 +1,5 @@
 # Misconfiguration IDs to skip — see https://trivy.dev/latest/docs/configuration/filtering/
-# Prefer `#trivy:ignore:<ID>` on Terraform resources; use this file when required (e.g. Dockerfile).
+# Prefer `#trivy:ignore:<ID>` on Terraform resources; use this file only when inline suppression is not possible.
 
-# Root Dockerfile: tooling image installs yum/terraform/aws/rosa/terraform-docs as root; no non-root USER by design.
-DS-0002
+# Go stdlib in CI client image (bundled ROSA/toolchain); fixed in Go 1.25.7+ — bump when upstream releases ship.
+CVE-2025-68121

.trivyignore

@@ -55,6 +55,17 @@ Useful skills for this codebase:
 - Use **`sensitive`** on variables and outputs where values must not appear in logs or casual `terraform show` output; avoid echoing secrets in `local` values used only for debugging. Passthrough outputs (**`module.*` → root output**) must match submodule sensitivity—see **Security** in [`.cursor/rules/rosa-hcp-terraform.mdc`](.cursor/rules/rosa-hcp-terraform.mdc).
 - Do not add logging, outputs, or comments that expose credentials or session tokens.
 
+## CI client Dockerfile (Prow)
+
+The root **`Dockerfile`** builds the **OpenShift Prow** client image (`terraform-rhcs-rosa-hcp-clients`). Treat it as a **minimal supply-chain surface**: include **only** what presubmit jobs in [`openshift/release`](https://github.com/openshift/release/tree/master/ci-operator/config/terraform-redhat/terraform-rhcs-rosa-hcp) need today (`make verify`, `make verify-gen`, `make run-example`, and the tools behind `make pre-push-checks`).
+
+When changing the Dockerfile:
+
+- **Minimize attack surface** — prefer **`ubi-minimal`** with a **pinned** minor tag (not `:latest`); end with a **non-root** `USER` (currently `65532:65532`); do not add OS packages, compilers, or CLIs “for convenience” without a job that uses them.
+- **Pin versions** — base image, ROSA CLI, and Makefile tools; use **`# renovate:`** comments and existing patterns (`hack/install-release-tool.sh` release binaries, not `go install`, unless unavoidable).
+- **Avoid bloat** — the image is tool-heavy (Terraform, AWS CLI, ROSA, lint binaries); do not grow it with extra runtimes, caches, or unrelated utilities. Prefer release tarballs over full language SDKs in the final image.
+- **Security scans** — `make security-check` / `make security-check-image` are separate from `make pre-push-checks`; fix findings or document narrow suppressions per the **Trivy** section below.
+
 ## Trivy (IaC misconfiguration)
 
 Repo config: root **`trivy.yaml`** (severity, scanners, skips; includes **`examples/`**). CodeRabbit may run Trivy when enabled in **`.coderabbit.yaml`**. References: [Trivy config file](https://trivy.dev/latest/docs/references/configuration/config-file/), [filtering / ignores](https://trivy.dev/latest/docs/configuration/filtering/).
@@ -93,4 +104,4 @@ Use mocks for AWS and RHCS resources to verify logic without requiring live cred
 
 When module behavior branches on a **boolean variable** (e.g. **`count = var.x ? 1 : 0`**), prefer **more than one `run` block** (or clearly separated scenarios) so **both** outcomes are covered—typically **`true` / `count = 1`** and **`false` / `count = 0`**—not only the default or “happy” path. That avoids regressions where the positive case passes but the opt-out path breaks.
 
-For exact commands and pass/fail criteria, follow **`CONTRIBUTING.md`**.
+Before opening a PR, `make pre-push-checks` must pass locally; see **`CONTRIBUTING.md`** for commands and pass/fail criteria.

AGENTS.md

@@ -17,20 +17,24 @@ This repo is **ROSA HCP** only. The sibling **ROSA Classic** module is [`terrafo
 ## Before you open a PR
 
 1. **Format** — `terraform fmt -recursive` (or format only dirs you changed).
-2. **Validate** — `make verify` (runs `terraform init` + `validate` in each `examples/*` directory). Fix failures in examples you touch or that your change breaks.
+2. **Validate** — `make verify` (runs `terraform init` + `validate` in each `examples/*` directory; compatible with the minimum Terraform version in root **`versions.tf`**, currently **>= 1.5.7**). Fix failures in examples you touch or that your change breaks.
 3. **Docs** — If you changed variables, outputs, modules, or root wiring: run `make verify-gen` (runs `terraform-docs` via [`scripts/terraform-docs.sh`](scripts/terraform-docs.sh), then [`scripts/verify-gen.sh`](scripts/verify-gen.sh) to ensure README inject blocks are committed).
 4. **Module tests** — If a submodule under `modules/<name>/tests/` has `*.tftest.hcl`, run `terraform init -backend=false && terraform test` from `modules/<name>/`, or run `make unit-tests` for all modules with tests.
-5. **Documentation lint** — `make docs-lint` runs the pinned [Vale](https://docs.vale.sh/) CLI with Red Hat documentation styles (see [`.vale.ini`](.vale.ini)). Building Vale uses `CGO_ENABLED=1` and requires a C compiler toolchain on the first install.
+5. **Documentation lint** — `make docs-lint` runs the pinned [Vale](https://docs.vale.sh/) CLI (release binary from [vale-cli/vale](https://github.com/vale-cli/vale)) with Red Hat documentation styles (see [`.vale.ini`](.vale.ini)).
 6. **Provider** — Treat [`terraform-redhat/rhcs`](https://github.com/terraform-redhat/terraform-provider-rhcs) as the source of truth: mirror its schemas in variables and docs. Add `validation` / `precondition` only to echo the provider’s required fields and allowed values (fail fast); do not duplicate or tighten rules the provider already enforces.
 7. **Module scope (AWS-only)** — If the change adds or expands **AWS-only** configuration (no `rhcs` surface), confirm it matches **`Module scope (AWS-only vs core HCP)`** in [`.cursor/rules/rosa-hcp-terraform.mdc`](.cursor/rules/rosa-hcp-terraform.mdc). In the PR, **link official Red Hat or cited ROSA HCP documentation** that supports shipping it in-repo, or explain why an exception is justified.
 
-Run the full local verification flow (same steps planned for CI) with:
+Run the full local verification flow (same steps as the planned single OpenShift Prow presubmit) with:
 
 ```shell
-make basic-checks
+make pre-push-checks
 ```
 
-`make basic-checks` runs `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, and `docs-lint` in order (fail-fast). Use `make run-checks -- basic --list-steps` or `--dry-run` to inspect the sequence without running it.
+`make pre-push-checks` runs `tools` (installs pinned CLI versions from the Makefile), then `verify`, `verify-gen`, `lint`, `unit-tests`, `license-check`, and `docs-lint` in order (fail-fast). Install tools alone with `make tools`. Run individual check targets when debugging one step. OpenShift Prow will use `make pre-push-checks` as the presubmit merge gate after `openshift/release` is updated. Until then, GitHub Actions runs `make verify` at Terraform 1.5.7 via **`verify-min-terraform.yml`**; run `make pre-push-checks` locally before opening a PR.
+
+**Security (separate from the merge gate):** `make security-check` runs [Trivy](https://trivy.dev/) IaC misconfiguration scans using [`trivy.yaml`](trivy.yaml) (HIGH/CRITICAL). `make security-check-image` builds the root [`Dockerfile`](Dockerfile) and scans the image with [`trivy-image.yaml`](trivy-image.yaml) (fails on **CRITICAL** vulnerabilities with a known fix). Install Trivy locally with `make security-check-bin`.
+
+Until OpenShift Prow runs the client image scan, GitHub Actions runs `make security-check-image` on pull requests when the client [`Dockerfile`](Dockerfile), [`.dockerignore`](.dockerignore), [`Makefile`](Makefile), [`trivy-image.yaml`](trivy-image.yaml), [`hack/install-release-tool.sh`](hack/install-release-tool.sh), or [`.github/workflows/security-check-image.yaml`](.github/workflows/security-check-image.yaml) change ([setup-trivy](https://github.com/aquasecurity/setup-trivy)). A dedicated Prow presubmit in [`openshift/release`](https://github.com/openshift/release) will be investigated and added later. IaC scans (`make security-check`) remain local/Prow-only for now.
 
 ## Commit format