Install terraform and trivy for raptor module validation

ubuntu-latest runners ship neither terraform nor trivy, so raptor's
--dry-run validation hard-failed ("terraform is not installed") and the
security scan silently degraded. Added an install step (after mode
resolution, gated to skip cleanup mode, which needs neither):

- terraform: pinned via new input terraform-version (default 1.5.7 to match
  module-preview-action), unzipped from releases.hashicorp.com to
  /usr/local/bin.
- trivy: pinned via new input trivy-version (default 0.72.0), tarball from
  aquasecurity/trivy releases to /usr/local/bin.

No third-party setup actions. README inputs table + requirements note
updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: anujhydrabadi

module-ci-action/README.md

@@ -40,7 +40,9 @@ modules live at `infra/modules/...`).
 
 ## Requirements
 
-- **Runner:** Ubuntu (the action installs a Linux amd64 `raptor` binary).
+- **Runner:** Ubuntu (the action installs Linux amd64 `raptor`, and — for preview/publish
+  — `terraform` and `trivy`, which raptor's module validation and security scan require;
+  ubuntu-latest ships none of them). Versions are pinnable via the inputs below.
 - **raptor version:** preview and cleanup depend on newer `raptor` capabilities:
   - **preview** uses `raptor create iac-module --feature-branch`, a flag that marks a
     preview as **unpublishable**.
@@ -65,6 +67,8 @@ modules live at `infra/modules/...`).
 | `github_token` | no | `""` | GitHub token. Enables the PR **preview comment** and, in **cleanup**, reading the PR's commit SHAs for the ownership check. When absent, those are skipped (cleanup does nothing, safely). |
 | `raptor_version` | no | `latest` | `latest`, or an exact release tag such as `v1.2.3`. Ignored when `raptor-download-url` is set. |
 | `raptor-download-url` | no | `""` | Exact URL to download the raptor `linux-amd64` binary from, bypassing the default `Facets-cloud/raptor-releases` location. When set, `raptor_version` is ignored. An escape hatch for testing / pre-release raptor builds and enterprise mirrors. |
+| `terraform-version` | no | `1.5.7` | Terraform version installed (from `releases.hashicorp.com`) for raptor's module validation. Not installed in **cleanup** mode. |
+| `trivy-version` | no | `0.72.0` | Trivy version installed (from `aquasecurity/trivy` releases, no `v` prefix) for raptor's module security scan. Not installed in **cleanup** mode. |
 | `all-modules` | no | `false` | When `true`, operate on **every** module under `<path-prefix>modules/` instead of only the ones the event changed. |
 | `mode` | no | `auto` | `auto` \| `preview` \| `publish` \| `cleanup`. `auto` derives the mode from the event (see the table above). Set explicitly to override. |
 | `path-prefix` | no | `""` | Sub-path to the `modules/` tree relative to the repo root (e.g. `infra/`). Empty means `modules/` is at the root. |

module-ci-action/action.yml

@@ -24,6 +24,14 @@ inputs:
     description: "Exact URL to download the raptor linux-amd64 binary from, bypassing the default Facets-cloud/raptor-releases location. When set, raptor_version is ignored. Escape hatch for testing/pre-release builds and enterprise mirrors."
     required: false
     default: ""
+  terraform-version:
+    description: "Terraform version to install for raptor's module validation (terraform fmt/validate). Downloaded from releases.hashicorp.com. Not installed in cleanup mode."
+    required: false
+    default: "1.5.7"
+  trivy-version:
+    description: "Trivy version to install for raptor's module security scan. Downloaded from github.com/aquasecurity/trivy releases (no 'v' prefix). Not installed in cleanup mode."
+    required: false
+    default: "0.72.0"
   all-modules:
     description: "When 'true', operate on every module under <path-prefix>modules/ instead of only the ones changed by the triggering event."
     required: false
@@ -106,6 +114,37 @@ runs:
         echo "Resolved mode: ${MODE} (event=${EVENT_NAME}, action=${EVENT_ACTION:-none})"
         echo "MODE=${MODE}" >> "$GITHUB_ENV"
 
+    - name: Install Terraform and Trivy
+      # Only preview/publish run raptor's module validation, which shells out to
+      # terraform and trivy. Cleanup deletes previews and needs neither.
+      if: env.MODE != 'cleanup'
+      shell: bash
+      env:
+        TERRAFORM_VERSION: ${{ inputs.terraform-version }}
+        TRIVY_VERSION: ${{ inputs.trivy-version }}
+      run: |
+        set -euo pipefail
+
+        # Terraform — raptor's module validation runs `terraform fmt`/`validate`,
+        # and ubuntu-latest runners ship no terraform (raptor hard-fails without it).
+        echo "Installing Terraform ${TERRAFORM_VERSION}..."
+        TF_ZIP="terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
+        curl -fsSL -o "$TF_ZIP" "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/${TF_ZIP}"
+        unzip -o "$TF_ZIP" terraform
+        sudo mv terraform /usr/local/bin/terraform
+        rm -f "$TF_ZIP"
+        terraform version
+
+        # Trivy — raptor's security scan uses it. Without it raptor only warns, but
+        # we want the scan enforced in CI.
+        echo "Installing Trivy ${TRIVY_VERSION}..."
+        TRIVY_TGZ="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+        curl -fsSL -o "$TRIVY_TGZ" "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${TRIVY_TGZ}"
+        tar -xzf "$TRIVY_TGZ" trivy
+        sudo mv trivy /usr/local/bin/trivy
+        rm -f "$TRIVY_TGZ"
+        trivy --version
+
     - name: Detect target module directories
       shell: bash
       env: