name: terraform

on:
  pull_request:
    paths:
      - "terraform/**"
  push:
    branches: [main]
    paths:
      - "terraform/**"

jobs:
  validate:
    runs-on: docker
    container:
      image: ghcr.io/opentofu/opentofu:1.8
    defaults:
      run:
        working-directory: terraform
    steps:
      - uses: actions/checkout@v4

      - name: tofu fmt
        run: tofu fmt -check -recursive

      - name: tofu init
        run: tofu init -backend=false

      - name: tofu validate
        run: tofu validate

      # No `tofu plan` here: the libvirt provider needs to reach the T630's
      # libvirt socket, which this ephemeral job container doesn't have
      # access to. Real applies happen from the T630 itself as the `k8s`
      # user (docs/04-tofu.md step 2) - fmt/validate is what CI checks.