Skip to content

Add CI workflows for docs, Terraform, and PowerShell checks#465

Merged
doherty100 merged 3 commits into
vnextfrom
ci/add-pr-checks
Jun 16, 2026
Merged

Add CI workflows for docs, Terraform, and PowerShell checks#465
doherty100 merged 3 commits into
vnextfrom
ci/add-pr-checks

Conversation

@doherty100

Copy link
Copy Markdown
Contributor

Purpose

Adds automated CI checks that run on every pull request targeting vnext (and on pushes to vnext). The checks are static-analysis only — no Azure deployment and no credentials required.

Workflows (.github/workflows/)

Workflow Checks
ci-docs markdownlint-cli2 (pinned 0.22.1) + lychee offline/internal link check
ci-terraform terraform fmt -check -recursive (Terraform 1.15.6) + tflint --recursive (v0.61.0, existing .tflint.hcl)
ci-powershell PSScriptAnalyzer 1.24.0, fails on Error/Warning

All run with contents: read only and concurrency-cancel.

New configuration

  • .markdownlint.jsonc (rules) + .markdownlint-cli2.jsonc (globs/ignores — excludes node_modules, the frozen retired module, and the agent copilot-instructions.md)
  • PSScriptAnalyzerSettings.psd1 — default rules minus documented exclusions for intentional patterns / false positives in this automation codebase (Write-Host, the project's own Write-Log helper, required plaintext→SecureString, uniform run-command parameter contracts, BOM on cross-platform pwsh 7, singular-noun / ShouldProcess style)

Baseline fixes (so the checks pass on the current tree)

  • Terraform: fmt normalization across 5 files; scoped # tflint-ignore comments on two intentional unused-variable declarations
  • Markdown: PR/issue templates, NVMe README (code-fence languages, blank lines, escaped table pipes), LICENSE trailing newline
  • PowerShell: 11 real findings fixed (unused vars → $null =, empty catch {}Write-Verbose, hardcoded host → variable); all scripts re-parsed clean

Documented in CONTRIBUTING.md with local reproduction commands.

Does this introduce a breaking change?

[ ] Yes
[x] No

Pull Request Type

[ ] Bugfix
[x] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

  • Open this PR and confirm the ci-docs, ci-terraform, and ci-powershell checks run and pass.
  • Locally: see the Continuous Integration section in CONTRIBUTING.md.

What to Check

  • All three CI workflows pass on the current baseline.

doherty100 and others added 3 commits June 16, 2026 14:33
Introduce three GitHub Actions workflows that run static-analysis checks on
pull requests targeting vnext (and pushes to vnext). No Azure deployment or
credentials are required.

Workflows:
- ci-docs: markdownlint-cli2 + lychee (offline/internal link check)
- ci-terraform: terraform fmt -check -recursive + tflint --recursive
- ci-powershell: PSScriptAnalyzer (fails on Error/Warning)

Configuration:
- .markdownlint.jsonc / .markdownlint-cli2.jsonc (rules, globs, ignores)
- PSScriptAnalyzerSettings.psd1 with documented rule exclusions for
  intentional patterns/false positives in this automation codebase

Baseline fixes so the checks pass on the current tree:
- terraform fmt normalization across 5 files; scoped tflint-ignore comments
  for two intentional unused-variable declarations
- Markdown fixes in PR/issue templates and the NVMe README; LICENSE newline
- PowerShell: resolve 11 real findings (unused vars -> $null=, empty catch
  blocks -> Write-Verbose, hardcoded host -> variable)

Document the CI in CONTRIBUTING.md with local reproduction commands.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The standalone extras/configurations/rg-devops-iac config pins a different
azurerm plugin version than the root, so a single 'tflint --init' did not
install the plugin used when recursing into that directory. Initialize
plugins for every directory containing a .tflint.hcl before running
'tflint --recursive'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use the latest supported tflint CLI in CI and the latest azurerm ruleset in
every .tflint.hcl in the repo:

- ci-terraform: tflint_version v0.61.0 -> v0.63.1
- root .tflint.hcl: azurerm ruleset 0.31.1 -> 0.32.0
- extras/configurations/rg-devops-iac/.tflint.hcl: azurerm ruleset
  0.28.0 -> 0.32.0 (also aligning it with the root version)

The 0.32.0 ruleset adds azurerm_resources_missing_prevent_destroy, which
flags the rg-devops-iac Key Vault, Storage Account, and Storage Container.
This is an ephemeral sandbox designed to be provisioned and torn down on
demand, so prevent_destroy is intentionally not used; the rule is disabled
in both .tflint.hcl files with an explanatory comment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@doherty100 doherty100 merged commit dad02f7 into vnext Jun 16, 2026
6 checks passed
@doherty100 doherty100 deleted the ci/add-pr-checks branch June 16, 2026 21:39
doherty100 added a commit that referenced this pull request Jun 16, 2026
* Update Terraform required_version to ~> 1.15.6 (#463)

Bump the pinned Terraform CLI version from ~> 1.15.5 to ~> 1.15.6 in the
root configuration and all modules to match the new CLI release.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#462)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#461)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#460)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#459)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#458)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#457)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#456)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#455)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#454)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#453)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#452)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#451)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#450)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update hashicorp/azurerm requirement from ~> 4.76.0 to ~> 4.77.0 (#449)

Updates the requirements on [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) to permit the latest version.

Updates `hashicorp/azurerm` to 4.77.0
- [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases)
- [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md)
- [Commits](hashicorp/terraform-provider-azurerm@v4.76.0...v4.77.0)

---
updated-dependencies:
- dependency-name: hashicorp/azurerm
  dependency-version: 4.77.0
  dependency-type: direct:production
  dependency-group: terraform-all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: update copilot instructions for use of allow-all

* chore: update .gitignore to ignore tfplan files

* chore: update cleanup script to delete tfplan files

* Add CI workflows for docs, Terraform, and PowerShell checks (#465)

* Add CI workflows for docs, Terraform, and PowerShell checks on vnext PRs

Introduce three GitHub Actions workflows that run static-analysis checks on
pull requests targeting vnext (and pushes to vnext). No Azure deployment or
credentials are required.

Workflows:
- ci-docs: markdownlint-cli2 + lychee (offline/internal link check)
- ci-terraform: terraform fmt -check -recursive + tflint --recursive
- ci-powershell: PSScriptAnalyzer (fails on Error/Warning)

Configuration:
- .markdownlint.jsonc / .markdownlint-cli2.jsonc (rules, globs, ignores)
- PSScriptAnalyzerSettings.psd1 with documented rule exclusions for
  intentional patterns/false positives in this automation codebase

Baseline fixes so the checks pass on the current tree:
- terraform fmt normalization across 5 files; scoped tflint-ignore comments
  for two intentional unused-variable declarations
- Markdown fixes in PR/issue templates and the NVMe README; LICENSE newline
- PowerShell: resolve 11 real findings (unused vars -> $null=, empty catch
  blocks -> Write-Verbose, hardcoded host -> variable)

Document the CI in CONTRIBUTING.md with local reproduction commands.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Initialize tflint plugins per-config for recursive linting

The standalone extras/configurations/rg-devops-iac config pins a different
azurerm plugin version than the root, so a single 'tflint --init' did not
install the plugin used when recursing into that directory. Initialize
plugins for every directory containing a .tflint.hcl before running
'tflint --recursive'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Upgrade tflint to v0.63.1 and azurerm ruleset to v0.32.0

Use the latest supported tflint CLI in CI and the latest azurerm ruleset in
every .tflint.hcl in the repo:

- ci-terraform: tflint_version v0.61.0 -> v0.63.1
- root .tflint.hcl: azurerm ruleset 0.31.1 -> 0.32.0
- extras/configurations/rg-devops-iac/.tflint.hcl: azurerm ruleset
  0.28.0 -> 0.32.0 (also aligning it with the root version)

The 0.32.0 ruleset adds azurerm_resources_missing_prevent_destroy, which
flags the rg-devops-iac Key Vault, Storage Account, and Storage Container.
This is an ephemeral sandbox designed to be provisioned and torn down on
demand, so prevent_destroy is intentionally not used; the rule is disabled
in both .tflint.hcl files with an explanatory comment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: copilot use .tfplan for plan output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant