feat(microvm): add Terraform provider

.github/workflows/terraform.yml

@@ -1,4 +1,5 @@
 name: "Terraform checks"
+
 on:
   push:
     branches:
@@ -20,6 +21,8 @@ env:
     modules/ami-housekeeper
     modules/compute-providers/aws/ec2
     modules/compute-providers/aws/ec2/trust-policy
+    modules/compute-providers/aws/microvm
+    modules/compute-providers/aws/microvm/trust-policy
     modules/download-lambda
     modules/lambda
     modules/multi-runner
@@ -53,11 +56,15 @@ env:
   TEST_MODULES: |
     modules/runners
     modules/multi-runner
+    modules/compute-providers/aws/microvm
+    modules/compute-providers/aws/microvm/trust-policy
+
 jobs:
   verify_modules:
     name: Verify modules (${{ matrix.iac.name }} ${{ matrix.iac.version }})
     strategy:
-      fail-fast: false
+      fail-fast: true
+      max-parallel: 1
       matrix:
         iac:
           - name: terraform
@@ -72,7 +79,9 @@ jobs:
           - name: tofu-latest
             version: latest
             command: tofu
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -97,7 +106,7 @@ jobs:
           mkdir -p "$HOME/.terraform.d/plugin"
           echo "TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin" >> "$GITHUB_ENV"
 
-      - name: "Fake zip files" # Validate will fail if it cannot find the zip files
+      - name: Fake zip files
         run: |
           touch lambdas/functions/webhook/webhook.zip
           touch lambdas/functions/control-plane/runners.zip
@@ -125,7 +134,10 @@ jobs:
         run: |
           printf '%s\n' "${MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
+
+            echo "::group::Running $IAC_COMMAND init for module: ${module}"
             $IAC_COMMAND -chdir="${module}" init -get -backend=false -input=false
+            echo "::endgroup::"
           done
 
       - name: Check ${{ matrix.iac.name }} formatting
@@ -134,7 +146,10 @@ jobs:
         run: |
           printf '%s\n' "${MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
+
+            echo "::group::Checking $IAC_COMMAND formatting for module: ${module}"
             $IAC_COMMAND -chdir="${module}" fmt -recursive -check=true -write=false
+            echo "::endgroup::"
           done
         continue-on-error: ${{ matrix.iac.version == 'latest' }}
 
@@ -144,7 +159,10 @@ jobs:
         run: |
           printf '%s\n' "${MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
+
+            echo "::group::Validating module: ${module}"
             $IAC_COMMAND -chdir="${module}" validate
+            echo "::endgroup::"
           done
 
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -161,15 +179,23 @@ jobs:
       - name: Run TFLint
         run: |
           tflint --init -c ${GITHUB_WORKSPACE}/.tflint.hcl
+
           printf '%s\n' "${MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
-            tflint -f compact -c ${GITHUB_WORKSPACE}/.tflint.hcl --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars --chdir "${module}"
+
+            echo "::group::Running TFLint for module: ${module}"
+            tflint -f compact \
+              -c ${GITHUB_WORKSPACE}/.tflint.hcl \
+              --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars \
+              --chdir "${module}"
+            echo "::endgroup::"
           done
 
   verify_examples:
     name: Verify examples (${{ matrix.iac.name }} ${{ matrix.iac.version }})
     strategy:
-      fail-fast: false
+      fail-fast: true
+      max-parallel: 1
       matrix:
         iac:
           - name: terraform
@@ -188,7 +214,9 @@ jobs:
             version: latest
             command: tofu
             lockfile: .terraform.lock.hcl.tofu
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -234,7 +262,11 @@ jobs:
         run: |
           printf '%s\n' "${EXAMPLES}" | while IFS= read -r example; do
             [ -z "${example}" ] && continue
-            cp "examples/${example}/${IAC_LOCK_FILE}" "examples/${example}/.terraform.lock.hcl"
+
+            echo "::group::Selecting lockfile for example: ${example}"
+            cp "examples/${example}/${IAC_LOCK_FILE}" \
+              "examples/${example}/.terraform.lock.hcl"
+            echo "::endgroup::"
           done
 
       - name: ${{ matrix.iac.name }} init
@@ -243,7 +275,11 @@ jobs:
         run: |
           printf '%s\n' "${EXAMPLES}" | while IFS= read -r example; do
             [ -z "${example}" ] && continue
-            $IAC_COMMAND -chdir="examples/${example}" init -get -backend=false -input=false -lockfile=readonly
+
+            echo "::group::Running $IAC_COMMAND init for example: ${example}"
+            $IAC_COMMAND -chdir="examples/${example}" init \
+              -get -backend=false -input=false -lockfile=readonly
+            echo "::endgroup::"
           done
 
       - name: Check ${{ matrix.iac.name }} formatting
@@ -252,7 +288,11 @@ jobs:
         run: |
           printf '%s\n' "${EXAMPLES}" | while IFS= read -r example; do
             [ -z "${example}" ] && continue
-            $IAC_COMMAND -chdir="examples/${example}" fmt -recursive -check=true -write=false
+
+            echo "::group::Checking $IAC_COMMAND formatting for example: ${example}"
+            $IAC_COMMAND -chdir="examples/${example}" fmt \
+              -recursive -check=true -write=false
+            echo "::endgroup::"
           done
         continue-on-error: ${{ matrix.iac.version == 'latest' }}
 
@@ -262,7 +302,10 @@ jobs:
         run: |
           printf '%s\n' "${EXAMPLES}" | while IFS= read -r example; do
             [ -z "${example}" ] && continue
+
+            echo "::group::Validating example: ${example}"
             $IAC_COMMAND -chdir="examples/${example}" validate
+            echo "::endgroup::"
           done
 
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -279,15 +322,23 @@ jobs:
       - name: Run TFLint
         run: |
           tflint --init -c ${GITHUB_WORKSPACE}/.tflint.hcl
+
           printf '%s\n' "${EXAMPLES}" | while IFS= read -r example; do
             [ -z "${example}" ] && continue
-            tflint -f compact -c ${GITHUB_WORKSPACE}/.tflint.hcl --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars --chdir "examples/${example}"
+
+            echo "::group::Running TFLint for example: ${example}"
+            tflint -f compact \
+              -c ${GITHUB_WORKSPACE}/.tflint.hcl \
+              --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars \
+              --chdir "examples/${example}"
+            echo "::endgroup::"
           done
 
   terraform_test:
     name: ${{ matrix.iac.name }} test
     strategy:
-      fail-fast: false
+      fail-fast: true
+      max-parallel: 1
       matrix:
         iac:
           - name: terraform
@@ -296,7 +347,9 @@ jobs:
           - name: tofu
             version: latest
             command: tofu
+
     runs-on: ubuntu-latest
+
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -341,7 +394,11 @@ jobs:
         run: |
           printf '%s\n' "${TEST_MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
-            $IAC_COMMAND -chdir="${module}" init -backend=false -input=false
+
+            echo "::group::Running $IAC_COMMAND init for test module: ${module}"
+            $IAC_COMMAND -chdir="${module}" init \
+              -backend=false -input=false
+            echo "::endgroup::"
           done
 
       - name: ${{ matrix.iac.name }} test
@@ -350,5 +407,8 @@ jobs:
         run: |
           printf '%s\n' "${TEST_MODULES}" | while IFS= read -r module; do
             [ -z "${module}" ] && continue
-            $IAC_COMMAND -chdir="${module}" test -test-directory=tests
+
+            echo "::group::Running $IAC_COMMAND test for module: ${module}"
+            $IAC_COMMAND -chdir="${module}" test -test-directory=tests -compact-warnings
+            echo "::endgroup::"
           done

.pre-commit-config.yaml

@@ -1,12 +1,28 @@
 repos:
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.96.2
+    rev: 581213484f4262600d17c71e272176d4eb6724a5  # frozen: v1.109.0
     hooks:
       - id: terraform_fmt
+        name: Terraform · Format
       - id: terraform_tflint
+        name: Terraform · TFLint
         args:
           - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl --var-file __GIT_WORKING_DIR__/.github/lint/tflint.tfvars
+      - id: terraform_validate
+        name: Terraform · Validate 
+        args:
+          - --hook-config=--retry-once-with-cleanup=true
+          - --tf-init-args=-backend=false
+          - --tf-init-args=--upgrade=true
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: check-merge-conflict
+        name: Git · Check merge conflict
+        always_run: true
+      - id: check-case-conflict
+        name: Git · Case conflict
+        always_run: true
+      - id: forbid-new-submodules
+        name: Git · Forbid new submodules
+        always_run: true