fix(e2e): use fixtures.stackit.project_id in storage-bucket test; exclude .terraform from validate-modules scan

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: JohannesRudolph

ci/validate_modules.sh

@@ -115,16 +115,16 @@ fi
 
 modules_glob="$modules_path/*/*/buildingblock"
 
-for readme_file in $(find $modules_glob -name 'README.md'); do
+for readme_file in $(find $modules_glob -name 'README.md' -not -path '*/.terraform/*'); do
 	check_readme_format "$readme_file"
 done
 
-for png_file in $(find $modules_glob -name '*.png'); do
+for png_file in $(find $modules_glob -name '*.png' -not -path '*/.terraform/*'); do
 	check_png_naming "$png_file"
 	check_png_minimization "$png_file"
 done
 
-for buildingblock_dir in $(find $modules_glob -type d -name 'buildingblock'); do
+for buildingblock_dir in $(find $modules_glob -type d -name 'buildingblock' -not -path '*/.terraform/*'); do
 	check_terraform_files "$buildingblock_dir"
 done
 

modules/stackit/storage-bucket/e2e/main.tf

@@ -0,0 +1,47 @@
+variable "test_context" {
+  type = object({
+    hub_git_ref = string
+    workspace   = string
+    project     = string
+    name_suffix = string
+
+    fixtures = object({
+      stackit = object({
+        project_id     = string
+        mesh_tenant_id = string
+      })
+    })
+  })
+  nullable = false
+}
+
+module "stackit_storage_bucket" {
+  source = "../"
+  meshstack = {
+    owning_workspace_identifier = var.test_context.workspace
+    tags                        = {}
+  }
+  hub = {
+    git_ref   = var.test_context.hub_git_ref
+    bbd_draft = true
+  }
+
+  stackit_project_id = var.test_context.fixtures.stackit.project_id
+}
+
+resource "meshstack_building_block_v2" "this" {
+  wait_for_completion = true
+  spec = {
+    building_block_definition_version_ref = module.stackit_storage_bucket.building_block_definition.version_ref
+
+    display_name = "smoke-test-stackit-storage-bucket-${var.test_context.name_suffix}"
+    target_ref = {
+      kind = "meshWorkspace"
+      name = var.test_context.workspace
+    }
+
+    inputs = {
+      bucket_name = { value_string = "smoke-test-bucket-${var.test_context.name_suffix}" }
+    }
+  }
+}

modules/stackit/storage-bucket/e2e/terraform.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    meshstack = {
+      source = "meshcloud/meshstack"
+    }
+  }
+}

modules/stackit/storage-bucket/e2e/tests/building_block_stackit_storage-bucket_hub.tftest.hcl

@@ -0,0 +1,26 @@
+run "building_block_stackit_storage_bucket_hub" {
+  assert {
+    condition     = meshstack_building_block_v2.this.status.status == "SUCCEEDED"
+    error_message = "stackit storage-bucket hub building block expected SUCCEEDED, got ${meshstack_building_block_v2.this.status.status}"
+  }
+
+  assert {
+    condition     = meshstack_building_block_v2.this.status.outputs["bucket_name"].value_string == "smoke-test-bucket-${var.test_context.name_suffix}"
+    error_message = "stackit storage-bucket hub building block expected bucket_name to be 'smoke-test-bucket-${var.test_context.name_suffix}', got ${meshstack_building_block_v2.this.status.outputs["bucket_name"].value_string}"
+  }
+
+  assert {
+    condition     = strcontains(meshstack_building_block_v2.this.status.outputs["bucket_url_path_style"].value_string, "smoke-test-bucket-${var.test_context.name_suffix}")
+    error_message = "stackit storage-bucket hub building block expected bucket_url_path_style to contain bucket name, got ${meshstack_building_block_v2.this.status.outputs["bucket_url_path_style"].value_string}"
+  }
+
+  assert {
+    condition     = strcontains(meshstack_building_block_v2.this.status.outputs["bucket_url_path_style"].value_string, "object.storage.eu01.onstackit.cloud")
+    error_message = "stackit storage-bucket hub building block expected bucket_url_path_style to contain STACKIT domain, got ${meshstack_building_block_v2.this.status.outputs["bucket_url_path_style"].value_string}"
+  }
+
+  assert {
+    condition     = length(meshstack_building_block_v2.this.status.outputs["s3_access_key"].value_string) > 0
+    error_message = "stackit storage-bucket hub building block expected non-empty s3_access_key"
+  }
+}

tools/scorecard/scorecard.mjs

@@ -494,7 +494,7 @@ const detectors = [
     category: "testing",
     name: "e2e/ contains .tftest.hcl files",
     emoji: "✅",
-    fixRef: E2E("e2etests-tftesthcl-conventions"),
+    fixRef: E2E("e2eteststftesthcl-conventions"),
     fn: (mod) => {
       const e2eDir = join(mod.path, "e2e", "tests");
       if (!existsSync(e2eDir)) return { pass: false };
@@ -577,6 +577,67 @@ function discoverModules() {
   return modules.sort((a, b) => a.id.localeCompare(b.id));
 }
 
+// ─── fixRef validator ────────────────────────────────────────────────────────
+
+function headingToAnchor(heading) {
+  return heading
+    .replace(/^#+\s*/, "")
+    .replace(/`([^`]*)`/g, "$1")
+    .toLowerCase()
+    .replace(/[^\w\s-]/g, "")
+    .replace(/\s+/g, "-");
+}
+
+function validateFixRefs() {
+  const filesToParse = [...new Set(detectors.filter((d) => d.fixRef).map((d) => d.fixRef.file))];
+  const markerMap = new Map(); // "file#section" → Set<checkId>
+  const allMarkerCheckIds = new Set();
+
+  for (const relFile of filesToParse) {
+    const filePath = join(ROOT, relFile);
+    if (!existsSync(filePath)) continue;
+
+    const lines = readFileSync(filePath, "utf-8").split("\n");
+    let pendingIds = null;
+
+    for (const line of lines) {
+      const m = line.match(/<!--\s*scorecard-checks:\s*([^-]+?)\s*-->/);
+      if (m) {
+        pendingIds = m[1].split(",").map((s) => s.trim()).filter(Boolean);
+        continue;
+      }
+      if (pendingIds && /^#{1,6}\s/.test(line)) {
+        const section = headingToAnchor(line);
+        markerMap.set(`${relFile}#${section}`, new Set(pendingIds));
+        for (const id of pendingIds) allMarkerCheckIds.add(id);
+        pendingIds = null;
+      }
+    }
+  }
+
+  const errors = [];
+  const detectorIds = new Set(detectors.map((d) => d.id));
+
+  for (const d of detectors) {
+    if (!d.fixRef) continue;
+    const key = `${d.fixRef.file}#${d.fixRef.section}`;
+    const checksInSection = markerMap.get(key);
+    if (!checksInSection) {
+      errors.push(`fixRef "${key}" not found — no <!-- scorecard-checks: ... --> marker before that heading`);
+    } else if (!checksInSection.has(d.id)) {
+      errors.push(`check "${d.id}" missing from marker at "${key}" (has: ${[...checksInSection].join(", ")})`);
+    }
+  }
+
+  for (const id of allMarkerCheckIds) {
+    if (!detectorIds.has(id)) {
+      errors.push(`marker references unknown check "${id}" — no detector with that id`);
+    }
+  }
+
+  return errors;
+}
+
 // ─── Fix prompt generator ────────────────────────────────────────────────────
 
 function generateFixPrompt(mod, failingChecks) {
@@ -620,6 +681,13 @@ function main() {
   const filterModules = args.filter((a) => a.startsWith("--module=")).map((a) => a.split("=")[1]);
   const fixMode = args.includes("--fix");
 
+  const fixRefErrors = validateFixRefs();
+  if (fixRefErrors.length > 0) {
+    process.stderr.write("❌ fixRef/marker validation failed:\n");
+    for (const e of fixRefErrors) process.stderr.write(`  • ${e}\n`);
+    process.exit(1);
+  }
+
   let modules = discoverModules();
   if (filterProvider) {
     modules = modules.filter((m) => m.provider === filterProvider);