# Read-only Terraform validate job. Review third-party action versions and pin to SHAs before production.
name: Terraform static validation
on:
  pull_request:
    paths: ['**/*.tf', '.github/workflows/terraform-validate.yml']
permissions:
  contents: read
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: '1.9.8' # Example only; update and approve version
      - name: Format check
        run: terraform fmt -check -recursive
      - name: Initialize without backend
        run: terraform init -backend=false -input=false
      - name: Validate
        run: terraform validate -no-color