ci: validate bundled infra/ Terraform with fmt + validate (#54) - #55
Merged
Conversation
infra/ ships inside the npm package (dist/templates/infra/), so its HCL is a released artifact just like the JS — yet CI only ran build/typecheck/test, leaving the HCL unverified. A typo or dangling reference would break every user's `hostdoc provision`. `fmt -check` and `validate` (after `init -backend=false`) need no AWS credentials and make no AWS calls — only a provider download — so this widens artifact coverage to HCL without breaking the "CI never touches live AWS" rule. `plan`/`apply` remain local-only. Verified on a clean `git archive` copy of infra/: fmt + validate pass with no credentials; an unsupported argument fails validate (exit 1) and misaligned HCL fails fmt -check (exit 3). Closes #54 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JgrcpuSKPkvUE4xYity9ua
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a credential-free
terraform-validateCI job so the bundledinfra/HCL is verified like the JS is.infra/ships inside the npm package (scripts/copy-templates.mjs→dist/templates/infra/), andhostdoc provisionruns that HCL on the user's machine — so it is a released artifact. CI previously ran only build→typecheck→test, leaving the HCL unverified: a typo or dangling reference would ship and break every user'sprovision.Why this doesn't break the "CI never touches live AWS" rule
terraform fmt -checkterraform init -backend=false+validateplan/applyChanges
.github/workflows/ci.yml— newterraform-validatejob:fmt -check -diff→init -backend=false→validate.CLAUDE.md— "no AWS creds and no Terraform" → "no AWS creds and noplan/apply", so the allowance is explicit while the live-AWS ban stays.Verification
terraform-validatepasses in 17s with no credentials (run 31141651394). Fast enough that provider caching isn't worth the complexity yet.no_such_arg = trueto a bucket resource madeterraform-validatefail whilebuild-teststill passed — confirming the job blocks bad HCL and that the JS suite never would have (run 31141702581). That commit was dropped from the branch.fmt+validateboth pass — that PR's self-declared "CI structurally can't cover this" gap is now machine-checked.Non-goals
plan/applyand no live AWS contact, in CI or anywhere else automated.build-testjob (the Node 20 deprecation warning onactions/checkout@v4is pre-existing and out of scope).Closes #54
🤖 Generated with Claude Code
https://claude.ai/code/session_01JgrcpuSKPkvUE4xYity9ua