chore(terraform): Standardize module repository

.github/workflows/pr-title.yml

@@ -1,52 +1,29 @@
-name: 'Validate PR title'
+name: Validate PR title
 
 on:
   pull_request_target:
-    types:
-      - opened
-      - edited
-      - synchronize
+    types: [opened, edited, synchronize]
+
+permissions:
+  pull-requests: read
 
 jobs:
-  main:
-    name: Validate PR title
+  validate:
     runs-on: ubuntu-latest
     steps:
-      # Please look up the latest version from
-      # https://github.com/amannn/action-semantic-pull-request/releases
-      - uses: amannn/action-semantic-pull-request@v3.4.6
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          # Configure which types are allowed.
-          # Default: https://github.com/commitizen/conventional-commit-types
           types: |
             fix
             feat
             docs
             ci
             chore
-          # Configure that a scope must always be provided.
+            style
+            revert
           requireScope: false
-          # Configure additional validation for the subject based on a regex.
-          # This example ensures the subject starts with an uppercase character.
-          subjectPattern: ^[A-Z].+$
-          # If `subjectPattern` is configured, you can use this property to override
-          # the default error message that is shown when the pattern doesn't match.
-          # The variables `subject` and `title` can be used within the message.
-          subjectPatternError: |
-            The subject "{subject}" found in the pull request title "{title}"
-            didn't match the configured pattern. Please ensure that the subject
-            starts with an uppercase character.
-          # For work-in-progress PRs you can typically use draft pull requests
-          # from Github. However, private repositories on the free plan don't have
-          # this option and therefore this action allows you to opt-in to using the
-          # special "[WIP]" prefix to indicate this state. This will avoid the
-          # validation of the PR title and the pull request checks remain pending.
-          # Note that a second check will be reported if this is enabled.
-          wip: true
-          # When using "Squash and merge" on a PR with only one commit, GitHub
-          # will suggest using that commit message instead of the PR title for the
-          # merge commit, and it's easy to commit this by mistake. Enable this option
-          # to also validate the commit message for one commit PRs.
+          subjectPattern: ^[a-z].+$
+          subjectPatternError: "The subject must start with a lowercase character."
           validateSingleCommit: false

.github/workflows/release.yml

@@ -1,35 +1,33 @@
 name: Release
 
 on:
-  workflow_dispatch:
   push:
-    branches:
-      - main
-      - master
+    branches: [master]
     paths:
-      - '**/*.tpl'
-      - '**/*.py'
-      - '**/*.tf'
-      - '.github/workflows/release.yml'
+      - "**/*.tf"
+      - ".releaserc.json"
+      - ".github/workflows/release.yml"
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 
 jobs:
   release:
-    name: Release
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
-          persist-credentials: false
           fetch-depth: 0
+          persist-credentials: false
 
-      - name: Release
-        uses: cycjimmy/semantic-release-action@v2
+      - uses: cycjimmy/semantic-release-action@v5.0.2
         with:
-          semantic_version: 18.0.0
+          semantic_version: 25.0.8
           extra_plugins: |
-            @semantic-release/changelog@6.0.0
-            @semantic-release/git@10.0.0
-            conventional-changelog-conventionalcommits@4.6.3
+            @semantic-release/changelog@6.0.3
+            @semantic-release/git@10.0.1
+            conventional-changelog-conventionalcommits@8.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/validate.yml

@@ -0,0 +1,38 @@
+name: Validate Terraform module
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "0.13.1"
+          terraform_wrapper: false
+
+      - uses: terraform-linters/setup-tflint@v6
+        with:
+          tflint_version: v0.58.0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install pre-commit
+        run: pipx install pre-commit
+
+      - name: Validate root module
+        run: |
+          terraform fmt -check -recursive
+          terraform init -backend=false
+          terraform validate
+          pre-commit run --all-files

.gitignore

@@ -16,6 +16,7 @@ crash.log
 # control as they are data points which are potentially sensitive and subject
 # to change depending on the environment.
 *.tfvars
+*.tfvars.json
 
 # Ignore override files as they are usually used to override resources locally and so
 # are not checked in

.pre-commit-config.yaml

@@ -1,37 +1,36 @@
 repos:
-- repo: git://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.68.1
-  hooks:
-    - id: terraform_fmt
-    - id: terraform_validate
-    - id: terraform_tflint
-      args:
-        - '--args=--only=terraform_deprecated_interpolation'
-        - '--args=--only=terraform_deprecated_index'
-        - '--args=--only=terraform_unused_declarations'
-        - '--args=--only=terraform_comment_syntax'
-        - '--args=--only=terraform_documented_outputs'
-        - '--args=--only=terraform_documented_variables'
-        - '--args=--only=terraform_typed_variables'
-        - '--args=--only=terraform_module_pinned_source'
-        - '--args=--only=terraform_naming_convention'
-        - '--args=--only=terraform_required_version'
-        - '--args=--only=terraform_required_providers'
-        - '--args=--only=terraform_standard_module_structure'
-        - '--args=--only=terraform_workspace_remote'
-- repo: local
-  hooks:
-    - id: terraform-docs
-      name: terraform-docs
-      language: docker_image
-      entry: quay.io/terraform-docs/terraform-docs:latest
-      args: ["markdown", "--output-file", "README.md", "--output-mode", "replace", "./"]
-      pass_filenames: false
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v3.2.0
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.108.0
     hooks:
-    - id: trailing-whitespace
-    - id: end-of-file-fixer
-      exclude: README.md
-    - id: check-added-large-files
-    - id: detect-aws-credentials
+      - id: terraform_fmt
+      - id: terraform_validate
+        files: ^(main|variables|outputs|versions)\.tf$
+      - id: terraform_tflint
+        files: ^(main|variables|outputs|versions)\.tf$
+        args:
+          - --args=--only=terraform_deprecated_interpolation
+          - --args=--only=terraform_deprecated_index
+          - --args=--only=terraform_unused_declarations
+          - --args=--only=terraform_documented_outputs
+          - --args=--only=terraform_documented_variables
+          - --args=--only=terraform_typed_variables
+          - --args=--only=terraform_required_version
+          - --args=--only=terraform_required_providers
+          - --args=--only=terraform_standard_module_structure
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+        exclude: README.md
+      - id: check-added-large-files
+      - id: detect-aws-credentials
+        args: [--allow-missing-credentials]
+  - repo: local
+    hooks:
+      - id: terraform-docs
+        name: Terraform docs
+        language: docker_image
+        entry: quay.io/terraform-docs/terraform-docs:0.20.0
+        args: ["markdown", "table", "--output-file", "README.md", "--output-mode", "inject", "."]
+        pass_filenames: false

.releaserc.json

@@ -1,45 +1,21 @@
 {
-  "branches": [
-    "main",
-    "master"
-  ],
+  "branches": ["master"],
   "ci": false,
   "plugins": [
-    [
-      "@semantic-release/commit-analyzer",
-      {
-        "preset": "conventionalcommits"
-      }
-    ],
-    [
-      "@semantic-release/release-notes-generator",
-      {
-        "preset": "conventionalcommits"
-      }
-    ],
-    [
-      "@semantic-release/github",
-      {
-        "successComment": "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:",
-        "labels": false,
-        "releasedLabels": false
-      }
-    ],
-    [
-      "@semantic-release/changelog",
-      {
-        "changelogFile": "CHANGELOG.md",
-        "changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file."
-      }
-    ],
-    [
-      "@semantic-release/git",
-      {
-        "assets": [
-          "CHANGELOG.md"
-        ],
-        "message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
-      }
-    ]
+    ["@semantic-release/commit-analyzer", { "preset": "conventionalcommits" }],
+    ["@semantic-release/release-notes-generator", { "preset": "conventionalcommits" }],
+    ["@semantic-release/changelog", {
+      "changelogFile": "CHANGELOG.md",
+      "changelogTitle": "# Changelog\n\nAll notable changes to this project will be documented in this file."
+    }],
+    ["@semantic-release/github", {
+      "successComment": "This ${issue.pull_request ? 'PR is included' : 'issue has been resolved'} in version ${nextRelease.version} :tada:",
+      "labels": false,
+      "releasedLabels": false
+    }],
+    ["@semantic-release/git", {
+      "assets": ["CHANGELOG.md"],
+      "message": "chore(release): version ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+    }]
   ]
 }

.terraform-version

@@ -0,0 +1 @@
+0.13.1