feat: inital version #1
Conversation
WalkthroughThis update introduces initial repository configuration files, automation workflows, documentation, and a new GitHub Action for Terraform/OpenTofu module testing. The changes add code ownership and PR templates, set up linting and release workflows using GitHub Actions, and configure Trunk CLI with linting and formatting rules. The README is expanded to provide comprehensive documentation for the new "TF Test" GitHub Action, which is defined in Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant GitHub Actions Runner
participant TF Test Action
participant Aqua
participant AWS
participant Terraform/OpenTofu
User->>GitHub Actions Runner: Trigger workflow (e.g., on PR)
GitHub Actions Runner->>TF Test Action: Execute action.yaml
TF Test Action->>GitHub Actions Runner: Checkout repository
TF Test Action->>Aqua: Install Aqua and required packages
alt AWS Role ARN provided
TF Test Action->>AWS: Assume role and configure credentials
end
TF Test Action->>Terraform/OpenTofu: Run init and test commands
Terraform/OpenTofu-->>TF Test Action: Return test results
TF Test Action-->>GitHub Actions Runner: Complete action
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (11)
.github/workflows/release-please.yaml (1)
16-17: Include an explicit checkout stepMost GitHub Actions workflows include an explicit checkout to guarantee the action has access to the repo contents (e.g.,
CHANGELOG.md,package.json, or Terraform modules). Whilegoogleapis/release-please-actionmay handle checking out by default, adding it improves clarity and avoids surprises:jobs: release-please: runs-on: ubuntu-latest steps: + - uses: actions/checkout@v3 - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f #v4.1.3 with: release-type: simplePlease verify in the action’s documentation whether the checkout is required or redundant.
.trunk/configs/.yamllint.yaml (1)
1-7: YAML Lint Rules: Ensure syntactic coverageThe rules enforce only-needed quoting, catch duplicate keys, and forbid implicit octals—good defaults. Consider:
- Adding
line-lengthortrailing-spacesrules if style consistency is desired.- Defining severity levels or exclusions for specific file patterns.
Would you like assistance extending the rule set for broader coverage?
.github/CODEOWNERS (1)
6-7: Wildcard ownership may be too broadAssigning
*to a single team delegates review for everything. Consider narrowing patterns for critical directories (e.g.,/.github/**,src/**) to specific owners to avoid review bottlenecks.I can help draft a more granular CODEOWNERS file—let me know.
.github/PULL_REQUEST_TEMPLATE.md (1)
9-9: Use more formal verb in description: Replace “were made” with “implemented” for a more formal tone.- Describe why these changes were made (e.g. why do these commits fix the problem?) + Describe why these changes were implemented (e.g. how these commits resolve the issue)🧰 Tools
🪛 LanguageTool
[style] ~9-~9: Consider using a different verb for a more formal wording.
Context: ...es were made (e.g. why do these commits fix the problem?) - Use bullet points to be...(FIX_RESOLVE)
README.md (4)
13-19: Ensure parallel phrasing in feature list: Align bullet points to start with active verbs. For example, change "Aqua-based dependency management" to "Manages dependencies with Aqua".- - Aqua-based dependency management + - Manages dependencies with Aqua
47-63: Enhance caching example: To demonstrate the action's caching capability, consider adding anactions/cachestep before running the action.- uses: actions/cache@v3 with: path: | .terraform key: ${{ runner.os }}-terraform-${{ hashFiles('**/*.tf') }}
117-130: Refine phrasing for readability:
- Add a comma in line 123: "Our mission is to simplify cloud infrastructure, so developers can innovate faster..."
- Hyphenate "hard-earned" in line 133 for correct compound.
- Our mission is to simplify cloud infrastructure so developers can innovate faster, safer, and with greater confidence. + Our mission is to simplify cloud infrastructure, so developers can innovate faster, safer, and with greater confidence. - ...sharing our hard earned expertise... + ...sharing our hard-earned expertise...🧰 Tools
🪛 LanguageTool
[uncategorized] ~123-~123: Use a comma before ‘so’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...sion is to simplify cloud infrastructure so developers can innovate faster, safer, ...(COMMA_COMPOUND_SENTENCE_2)
7-8: Verify link anchor consistency: The link to the "Who We Are" section uses a Unicode anchor (#who-we-are-𐦂𖨆𐀪𖠋). Confirm that the heading matches exactly, or consider simplifying to a plain ASCII anchor to avoid potential navigation issues.Also applies to: 117-119
action.yaml (3)
1-7: Add optional branding metadata for better discoverability.Composite actions support an optional
brandingblock (icon and color) which makes the Action more recognizable in the GitHub Marketplace. Consider adding something like:branding: icon: 'terraform' color: 'blue'
8-25: Validate thetf_typeinput against allowed values.Currently,
tf_typeis free-form (tofu or terraform), so a typo could lead to a silent failure during the install or run steps. Since composite actions don’t support anenumfield, you can add an early validation step:- name: Validate tf_type if: ${{ !contains('terraform,tofu', inputs.tf_type) }} run: | echo "Invalid tf_type: ${{ inputs.tf_type }}. Must be 'terraform' or 'tofu'." exit 1This ensures users get immediate feedback if they pass an unsupported value.
53-60: Note required permissions for AWS OIDC.This step assumes an OIDC-enabled workflow. Make sure calling workflows include:
permissions: id-token: writeOtherwise,
configure-aws-credentialswill fail to obtain an OIDC token. You may want to add a comment or mention in the README to surface this requirement.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (11)
.github/CODEOWNERS(1 hunks).github/PULL_REQUEST_TEMPLATE.md(1 hunks).github/workflows/lint.yaml(1 hunks).github/workflows/release-please.yaml(1 hunks).github/workflows/trunk-upgrade.yaml(1 hunks).trunk/.gitignore(1 hunks).trunk/configs/.markdownlint.yaml(1 hunks).trunk/configs/.yamllint.yaml(1 hunks).trunk/trunk.yaml(1 hunks)README.md(1 hunks)action.yaml(1 hunks)
🧰 Additional context used
🪛 LanguageTool
.github/PULL_REQUEST_TEMPLATE.md
[style] ~9-~9: Consider using a different verb for a more formal wording.
Context: ...es were made (e.g. why do these commits fix the problem?) - Use bullet points to be...
(FIX_RESOLVE)
README.md
[uncategorized] ~123-~123: Use a comma before ‘so’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...sion is to simplify cloud infrastructure so developers can innovate faster, safer, ...
(COMMA_COMPOUND_SENTENCE_2)
[misspelling] ~133-~133: This word is normally spelled with a hyphen.
Context: ... content, giving talks, and sharing our hard earned expertise. Here are a few ways you can ...
(EN_COMPOUNDS_HARD_EARNED)
🔇 Additional comments (13)
.trunk/.gitignore (1)
1-9: Validate ignore patterns for Trunk CLI artifactsThe patterns seem reasonable for excluding Trunk’s transient outputs, but ensure they align with actual directories/files created by Trunk runs. For example:
- Should you also ignore
.trunk/.cacheor similar?- Confirm that
*actionswon’t unintentionally ignore your.github/actionsor local custom actions.[tag_missing_context]?
Run a dry Trunk run locally and list new files to adjust the ignore list if needed..trunk/configs/.markdownlint.yaml (1)
1-20: Markdownlint config relaxes all formatting rulesThis configuration disables most formatting rules to play nice with autoformatters. A few thoughts:
- Ensure teams are aware that line-length is now effectively unlimited (350 chars)—this may hide readability issues.
- You might selectively re-enable
MD041(first-line heading) for docs where consistency matters.If the broad disabling is intentional for your workflow, no changes are needed.
.github/workflows/lint.yaml (1)
1-19: Well-configured lint workflow: The workflow uses pinned action SHAs, minimal permissions, and triggers on pull requests, ensuring secure and consistent linting..trunk/trunk.yaml (1)
3-32: Configuration looks solid: Trunk CLI version, plugins, runtimes, linters, and actions are appropriately specified and align with your workflows..github/workflows/trunk-upgrade.yaml (1)
1-34: Well-designed upgrade workflow: The scheduled trigger, workflow dispatch, scoped permissions, token generation, and pinned action versions are correctly set up for automated Trunk CLI upgrades.README.md (4)
41-46: Confirm action version tagging: Ensure the@v1.0.0version in the basic usage snippet matches your release tag. Consider using a floating major version like@v1to automatically pick up patch releases.
64-73: Verify documented defaults: Please ensure the defaults foraws_region(us-east-1) androle_session_name(GitHubActions-TF-Test) match those defined inaction.yaml.
78-85: Required permissions documented correctly: The permissions block accurately reflects the scopes needed by the action and matches your workflow configurations.
94-102: Dependencies section complete: All primary dependencies—Aqua, AWS OIDC, actions/checkout, and actions/cache—are listed, giving users clear guidance.action.yaml (4)
30-33: Pinned checkout version looks good.Using a full commit SHA for
actions/checkout@…ensures stability and reproducibility.
44-48: Installer version pin is correct.Pinning the Aqua installer (
aquaproj/aqua-installer@…) and the Aqua version (v2.48.1) ensures a reproducible environment.
49-52: Aqua package installation is straightforward and correct.Using
aqua install --tags ${{ inputs.tf_type }}cleanly scopes package installs to the selected Terraform type.
61-66: Verify the intended test command for Terraform modules.Terraform’s built-in
testcommand is experimental and targets provider-level tests, not module validations. If your goal is module‐level checks, you might prefer:${{ inputs.tf_type }} init ${{ inputs.tf_type }} validate ${{ inputs.tf_type }} planOtherwise, confirm that
terraform test(andtofu test) exist in the environments you target.
| AWS role ARN can be provided either: | ||
| 1. As an input parameter (aws_role_arn) - takes precedence | ||
| 2. As an environment variable (TF_TEST_AWS_ROLE_ARN) | ||
| author: [email protected] | ||
| inputs: | ||
| tf_type: | ||
| required: true | ||
| description: Type of terraform to use (tofu or terraform) | ||
| aws_role_arn: | ||
| required: false | ||
| description: AWS role ARN to assume for testing (takes precedence over TF_TEST_AWS_ROLE_ARN env var) |
There was a problem hiding this comment.
Oh this is smart! I was wondering what the purpose of the environment variable if we can set a default value for the input parameter, but the using it as the organization-level environment environment makes it so much smoother and DRY.
There was a problem hiding this comment.
This might be a bit confusing for those who can't see the org-level vars, but I'm going to document this.
action.yaml
Outdated
| Reusable GitHub Action to test Terraform/OpenTofu modules. | ||
| AWS role ARN can be provided either: | ||
| 1. As an input parameter (aws_role_arn) - takes precedence | ||
| 2. As an environment variable (TF_TEST_AWS_ROLE_ARN) |
There was a problem hiding this comment.
| 2. As an environment variable (TF_TEST_AWS_ROLE_ARN) | |
| 2. As an environment variable (TF_TEST_AWS_ROLE_ARN) -- The use case for this is setting it in the GitHub organization's environment variable. See the README for more details. |
There was a problem hiding this comment.
I think might be good to have it here as well
|
@oycyc I've added your suggestion, and a bunch of other configs we typically use. Please review 🙏 |
🤖 I have created a release *beep* *boop* --- ## 1.0.0 (2025-05-05) ### Features * inital version ([#1](#1)) ([d1c3f89](d1c3f89)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
what
why
references
Summary by CodeRabbit