Conversation
Pin updates: CHECKOV_VERSION 3.2.504 -> 3.2.525 PRECOMMIT_VERSION 4.5.1 -> 4.6.0 OPENTOFU_VERSION 1.11.5 -> 1.11.6 SOPS_VERSION 3.11.0 -> 3.12.2 TERRAFORM_DOCS_VERSION 0.21.0 -> 0.22.0 TFUPDATE_VERSION 0.9.1 -> 0.9.3 TFLINT_VERSION 0.61.0 -> 0.62.0 INFRACOST_VERSION 0.10.43 -> 0.10.44 conventional-pre-commit hook v4.3.0 -> v4.4.0 The terraform-docs bump in particular fixes a months-long divergence where the Homebrew formula moved to v0.22.0 while CI was pinned at v0.21.0, causing local pre-commit runs to regenerate README markdown tables in a format CI rejected. Drops the OpenShift CLI install (and the gcompat alpine package that was only there to provide glibc compat for the oc binary). Adds kubectl as the replacement (KUBECTL_VERSION=1.36.0); the new PostSync hooks in kustomize-cluster use kubectl directly. Tools: terraform-docs, opentofu/tofu, sops, kustomize, tfupdate, hcledit, tflint, infracost, kubectl (new), pre-commit, checkov.
xnoto
changed the title
xnoto
added a commit
that referenced
this pull request
Apr 29, 2026
Hotfix for the post-merge build of #2. The buildah workflow runs pre-commit on every push to main. The bundled `no-commit-to-branch` hook (in this repo's own `.pre-commit-config.yaml`) is intended to block interactive commits to `main`, not CI runs of pushes that already exist on main. With no `SKIP` env, the hook fails and the post-merge image build/push to ghcr never happens. This adds `SKIP: no-commit-to-branch` to the pre-commit step — same pattern `shared-workflows/.github/workflows/opentofu.yml` already uses.
xnoto
added a commit
that referenced
this pull request
Apr 29, 2026
Auto-deploy on push-to-main is unchanged. This PR adds workflow_dispatch as a second trigger that publishes — useful from the Actions pane to refresh `tfroot-runner:latest` (which still hasn't been republished since the bump in #2 due to the failed run + path-filter exclusion of CI-only commits).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bump every pinned tool in
tfroot-runner/Containerfileto current latest:The terraform-docs 0.21.0 → 0.22.0 bump fixes a months-long local-vs-CI divergence (Homebrew shipped v0.22.0; CI image stuck at v0.21.0 → README markdown tables regenerated in different formats locally vs in CI).
Drop
oc(OpenShift CLI) +gcompat(alpine package, only needed for oc's glibc linking) — OpenShift Local is gone from the stack.Add
kubectl 1.36.0as the replacement; the new PostSync hooks in kustomize-cluster (wait-for-crds,wait-for-repo-server,ci-token-sync) use kubectl directly.Delete
.github/workflows/pull.yml— this workflow imported each built image into OpenShift's internal registry atimage-registry.openshift-image-registry.svc:5000/public-registry/<image>:latest. With CRC retired and consumers (CI workflows in tfroot-libvirt and kustomize-cluster) already pulling directly fromghcr.io/makeitworkcloud/...:latest, the import is dead code.Bundles the previously-staged repo-local opencode config (the prior commit on this branch).
Test plan
pre-commitruns clean locally (hadolint not installed locally; CI'sBuildworkflow runs hadolint via the buildah job)Buildjob passes on PR (rebuilds image without push)Buildworkflow rebuilds and pushes newtfroot-runner:latesttoghcr.io/makeitworkcloud