fix: simplify CI by skipping terraform_docs in favor of local pre-commit (#52)

* fix: simplify CI by skipping terraform_docs in favor of local pre-commit

- Remove terraform_docs from CI checks to eliminate environment parity issues
- Skip documentation generation in CI (handled locally via pre-commit hooks)
- Remove terraform-docs installation step (no longer needed in CI)
- Simplify workflow by removing .md from path filters
- Update cache key version to bust stale cache
- Upgrade actions/setup-python to v5 and Python to 3.13
- Upgrade actions/cache to v4
- Consolidate push/PR run steps into single conditional step
- Streamline pre-commit summary for clarity

This approach:
- Keeps critical checks in CI: terraform_fmt, terraform_validate, tflint
- Relies on local pre-commit for documentation generation
- Uses AI review as additional quality gate for documentation accuracy
- Eliminates macOS vs Linux environment differences causing CI failures

Closes #51

* fix: address security and bug issues in pre-commit workflow

- Replace curl|bash tflint install with official terraform-linters/setup-tflint@v4 action
  (eliminates supply chain attack vector)
- Fix file handling by converting newlines to spaces for pre-commit --files argument
- Add error handling for git fetch operation (|| exit 1)

Addresses feedback from bug hunt review.

Author: lgallard

.github/workflows/pre-commit.yml

@@ -6,14 +6,12 @@ on:
     paths:
       - '**.tf'
       - '**.tfvars'
-      - '**.md'
       - '.pre-commit-config.yaml'
   push:
     branches: [master]
     paths:
       - '**.tf'
       - '**.tfvars'
-      - '**.md'
       - '.pre-commit-config.yaml'
 
 jobs:
@@ -31,78 +29,52 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Set up Terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: '1.3.0'
 
-      - name: Cache terraform tools
-        uses: actions/cache@v3
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@v4
         with:
-          path: |
-            ~/.local/bin/terraform-docs
-            ~/.local/bin/tflint
-          key: terraform-tools-${{ runner.os }}-v1
-          restore-keys: |
-            terraform-tools-${{ runner.os }}-
-
-      - name: Install terraform-docs
-        run: |
-          if [ ! -f ~/.local/bin/terraform-docs ]; then
-            echo "Installing terraform-docs..."
-            mkdir -p ~/.local/bin
-            curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.16.0/terraform-docs-v0.16.0-$(uname)-amd64.tar.gz
-            tar -xzf terraform-docs.tar.gz
-            chmod +x terraform-docs
-            mv terraform-docs ~/.local/bin/
-            rm terraform-docs.tar.gz
-          fi
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Install tflint
-        run: |
-          if ! command -v tflint &> /dev/null; then
-            echo "Installing tflint..."
-            curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
-          fi
+          tflint_version: v0.54.0
 
       - name: Install pre-commit
         run: |
           python -m pip install --upgrade pip
           pip install pre-commit
 
       - name: Cache pre-commit hooks
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
-          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
-          restore-keys: |
-            pre-commit-${{ runner.os }}-
+          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}-v2
 
       - name: Install pre-commit hooks
         run: pre-commit install-hooks
 
-      - name: Run pre-commit on all files (push to master)
-        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-        run: pre-commit run --all-files
-
-      - name: Run pre-commit on changed files (pull request)
-        if: github.event_name == 'pull_request'
+      # Skip terraform_docs in CI - rely on local pre-commit + AI review
+      # This eliminates environment parity issues between macOS and Linux
+      - name: Run pre-commit checks
+        env:
+          SKIP: terraform_docs
         run: |
-          # Get the list of changed files
-          git fetch origin ${{ github.base_ref }}
-          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '*.tf' '*.tfvars' '*.md')
-
-          if [ -n "$CHANGED_FILES" ]; then
-            echo "Running pre-commit on changed files:"
-            echo "$CHANGED_FILES"
-            pre-commit run --files $CHANGED_FILES
+          if [ "${{ github.event_name }}" == "push" ]; then
+            pre-commit run --all-files
           else
-            echo "No relevant files changed, skipping pre-commit checks"
+            git fetch origin ${{ github.base_ref }} || exit 1
+            CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD -- '*.tf' '*.tfvars' | tr '\n' ' ')
+            if [ -n "$CHANGED_FILES" ]; then
+              echo "Running pre-commit on changed files:"
+              echo "$CHANGED_FILES"
+              pre-commit run --files $CHANGED_FILES
+            else
+              echo "No Terraform files changed, skipping pre-commit checks"
+            fi
           fi
 
       - name: Pre-commit summary
@@ -114,25 +86,15 @@ jobs:
           if [ "${{ job.status }}" == "success" ]; then
             echo "✅ All pre-commit checks passed!" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "**Tools verified:**" >> $GITHUB_STEP_SUMMARY
-            echo "- 🔧 Terraform formatting" >> $GITHUB_STEP_SUMMARY
-            echo "- ✅ Terraform validation" >> $GITHUB_STEP_SUMMARY
-            echo "- 📚 Documentation generation" >> $GITHUB_STEP_SUMMARY
-            echo "- 🔍 TFLint analysis" >> $GITHUB_STEP_SUMMARY
-            echo "- 🧹 File formatting" >> $GITHUB_STEP_SUMMARY
+            echo "**Checks performed:**" >> $GITHUB_STEP_SUMMARY
+            echo "- 🔧 Terraform formatting (terraform_fmt)" >> $GITHUB_STEP_SUMMARY
+            echo "- ✅ Terraform validation (terraform_validate)" >> $GITHUB_STEP_SUMMARY
+            echo "- 🔍 TFLint analysis (terraform_tflint)" >> $GITHUB_STEP_SUMMARY
+            echo "- 🧹 File formatting (trailing-whitespace, end-of-file)" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "**Note:** Documentation (terraform_docs) is handled locally via pre-commit hooks." >> $GITHUB_STEP_SUMMARY
           else
             echo "❌ Pre-commit checks failed" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Please check the logs above for specific failures." >> $GITHUB_STEP_SUMMARY
-            echo "You can run \`pre-commit run --all-files\` locally to fix issues." >> $GITHUB_STEP_SUMMARY
+            echo "Run \`pre-commit run --all-files\` locally to fix issues." >> $GITHUB_STEP_SUMMARY
           fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Configured hooks:**" >> $GITHUB_STEP_SUMMARY
-          echo "- trailing-whitespace" >> $GITHUB_STEP_SUMMARY
-          echo "- end-of-file-fixer" >> $GITHUB_STEP_SUMMARY
-          echo "- check-yaml" >> $GITHUB_STEP_SUMMARY
-          echo "- terraform_fmt" >> $GITHUB_STEP_SUMMARY
-          echo "- terraform_validate" >> $GITHUB_STEP_SUMMARY
-          echo "- terraform_docs" >> $GITHUB_STEP_SUMMARY
-          echo "- terraform_tflint" >> $GITHUB_STEP_SUMMARY