Example: Terraform IaC

jobs:
  terraform:
    uses: dataready-ai/nexa-ci/.github/workflows/terraform-ci.yml@v1
    with:
      roots: |
        environments/dev
        environments/test
        environments/prod
      terraform-version: '1.9'
      tflint-version: '0.55.1'
    secrets: inherit

The reusable workflow runs formatting globally, then initializes and validates each root without its remote backend, runs TFLint, and scans configuration with Trivy. Plans and applies remain separate environment workflows with stronger permissions and approval controls.

Root discovery and permissions

Each listed root must be independently initializable with its backend disabled. CI validation requires no production write credentials. Separate plan/apply workflows use environment-specific OIDC roles and approval controls.

Reusable modules are validated through fixture roots so provider requirements and variable contracts are exercised. Trivy findings and TFLint rules are managed centrally, while repository-specific exclusions identify the exact resource, reason, owner, and expiry.