From 1ebd14b565bfd44b5caa51e3528f202b4b50f607 Mon Sep 17 00:00:00 2001
From: Brian Ojeda <9335829+sgtoj@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:31:35 -0400
Subject: [PATCH 1/2] ci: pin workflow actions to SHAs and update to latest
 standard

- pin all action versions to commit SHAs with version comments
- bump checkout v4->v6, setup-terraform v3->v4, tag-action v6.1->v6.2,
  release-action v1.12.0->v1.21.0, semantic-pull-request v5.2.0->v6.1.1,
  and reviewdog actions to current releases
- add tflint_init: true to tflint step

aligns CI with the latest cruxstack module standard.
---
 .github/workflows/release.yml        |  6 +++---
 .github/workflows/semantic-check.yml |  4 ++--
 .github/workflows/test.yml           | 16 ++++++++--------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6de42b4..c9980d4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,18 +13,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Bump Version
         id: tag_version
-        uses: mathieudutour/github-tag-action@v6.1
+        uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b # v6.2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           default_bump: minor
           custom_release_rules: bug:patch:Fixes,chore:patch:Chores,docs:patch:Documentation,feat:minor:Features,refactor:minor:Refactors,test:patch:Tests,ci:patch:Development,dev:patch:Development
 
       - name: Create Release
-        uses: ncipollo/release-action@v1.12.0
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ steps.tag_version.outputs.new_tag }}
           name: ${{ steps.tag_version.outputs.new_tag }}
diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml
index 684f992..4ab18b6 100644
--- a/.github/workflows/semantic-check.yml
+++ b/.github/workflows/semantic-check.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
-      - uses: amannn/action-semantic-pull-request@v5.2.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         name: Check PR for Semantic Commit Message
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 08c87e5..e29f001 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: setup terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
 
       - name: Cache Terraform Plugins
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ runner.temp }}/.terraform.d/plugin-cache
           key: tf-plugins-${{ runner.os }}-${{ hashFiles('**/.terraform.lock.hcl') }}
@@ -36,7 +36,7 @@ jobs:
 
       - name: Suggest Terraform Format
         if: github.event_name == 'pull_request'
-        uses: reviewdog/action-suggester@v1
+        uses: reviewdog/action-suggester@aa38384ceb608d00f84b4690cacc83a5aba307ff # v1.24.0
         with:
           tool_name: terraform-fmt
           level: warning
@@ -48,7 +48,7 @@ jobs:
         run: terraform fmt -recursive -check
 
       - name: Validate Terraform
-        uses: reviewdog/action-terraform-validate@v1
+        uses: reviewdog/action-terraform-validate@4aaf1db71358f4f35ff414d656334e0ce3c34ce5 # v1.17.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: github-pr-review
@@ -56,16 +56,16 @@ jobs:
           fail_level: error
 
       - name: Lint Terraform
-        uses: reviewdog/action-tflint@v1
+        uses: reviewdog/action-tflint@54a5e5aed57dcfbb4662ec548de876df33d6288d # v1.25.0
         with:
           reporter: github-pr-review
           filter_mode: nofilter
           fail_level: error
+          tflint_init: true
 
       - name: Lint GitHub Actions
-        uses: reviewdog/action-actionlint@v1
+        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
         with:
           reporter: github-pr-check
           fail_level: error
           filter_mode: nofilter
-

From 2ad318e6d8325430c1abcf2955fa3ccf34fda477 Mon Sep 17 00:00:00 2001
From: Brian Ojeda <9335829+sgtoj@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:46:12 -0400
Subject: [PATCH 2/2] ci: drop tflint lint step

removes the tflint step which required a .tflint.hcl config and full
module init; keeps terraform validate as the terraform check.
---
 .github/workflows/test.yml | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e29f001..4561a2c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -55,14 +55,6 @@ jobs:
           level: warning
           fail_level: error
 
-      - name: Lint Terraform
-        uses: reviewdog/action-tflint@54a5e5aed57dcfbb4662ec548de876df33d6288d # v1.25.0
-        with:
-          reporter: github-pr-review
-          filter_mode: nofilter
-          fail_level: error
-          tflint_init: true
-
       - name: Lint GitHub Actions
         uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
         with: