fix: test the declared Terraform floor, and document it (ENG-8760)

.github/workflows/ci.yml

@@ -38,3 +38,50 @@ jobs:
 
       - name: Run pre-commit checks
         uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        with:
+          # Without a pin this installs whatever prek released most recently,
+          # so a hostile release reaches CI with no change here. The version
+          # comes from .tool-versions, so CI and a local run agree on it.
+          prek-version: ${{ env.PREK_TOOL_VERSION }}
+        env:
+          # zizmor's five online audits skip silently without a token, and its
+          # summary line reads the same either way, so CI would pass while the
+          # supply-chain audits never ran.
+          GH_TOKEN: ${{ github.token }}
+
+  lint-docs:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check documentation
+        uses: terraform-docs/gh-actions@6de6da0cefcc6b4b7a5cbea4d79d97060733093c # v1.4.1
+        with:
+          # Without this the action ignores .terraform-docs.yml and runs its own
+          # defaults, so CI would check the docs against a different
+          # configuration than `just docs` uses.
+          config-file: .terraform-docs.yml
+          fail-on-diff: true
+
+  validate-min-terraform:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # The lint job validates at the release pinned in .tool-versions. This
+      # validates at the floor declared in required_version, so that whenever
+      # the two differ the bottom of the supported range is covered too. The
+      # action reads the floor back out of the constraint, so editing the
+      # constraint moves what CI tests in the same commit.
+      - name: Validate at the declared Terraform floor
+        uses: stacklet/github-tooling/validate-min-terraform@3865043f45564294b8e447f9e8ea03a57ccca51d

.gitignore

@@ -5,5 +5,5 @@
 *.tfstate
 *.tfstate.*
 
-#Terraform files to not ignore
-!.terraform.lock.hcl
+# Reusable modules do not pin providers with a lock file
+.terraform.lock.hcl

.terraform-docs.yml

@@ -0,0 +1,7 @@
+formatter: markdown
+
+output:
+  file: README.md
+
+settings:
+  lockfile: false

.tool-versions

@@ -1,4 +1,6 @@
-just 1.40.0
-terraform 1.13.5
-tflint v0.61.0
-uv 0.8.14
+just 1.58.0
+prek 0.5.5
+terraform 1.16.5
+terraform-docs 0.20.0
+tflint v0.64.0
+uv 0.12.23

README.md

@@ -22,13 +22,16 @@ This setup ensures that the CUR is in the format required by Stacklet, and that
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 
-No requirements.
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.14.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 6.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 6.0 |
 
 ## Modules
 

justfile

@@ -7,4 +7,8 @@ format:
 
 # lint files
 lint:
-    uvx prek run --all-files
+    prek run --all-files
+
+# update autogenerated documentation
+docs:
+    terraform-docs .

provider.tf

@@ -1,5 +1,6 @@
 terraform {
-  required_version = ">= 1.13.5"
+  # Require a Terraform version that has had recent updates.
+  required_version = ">= 1.14.0"
 
   required_providers {
     aws = {