initial scaffold

.forgejo/workflows/terraform.yml

@@ -0,0 +1,35 @@
+name: terraform
+
+on:
+  pull_request:
+    paths:
+      - "terraform/**"
+  push:
+    branches: [main]
+    paths:
+      - "terraform/**"
+
+jobs:
+  validate:
+    runs-on: docker
+    container:
+      image: ghcr.io/opentofu/opentofu:1.8
+    defaults:
+      run:
+        working-directory: terraform
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: tofu fmt
+        run: tofu fmt -check -recursive
+
+      - name: tofu init
+        run: tofu init -backend=false
+
+      - name: tofu validate
+        run: tofu validate
+
+      # No `tofu plan` here: the libvirt provider needs to reach the T630's
+      # libvirt socket, which this ephemeral job container doesn't have
+      # access to. Real applies happen from the T630 itself as the `k8s`
+      # user (docs/SETUP.md step 5) - fmt/validate is what CI checks.