feat(terraform): let validate and test run on a configuration in a subdirectory

[patrick-hermann-sva]

call-validate-terraform and call-terraform-test always run at the repository root. A repository that keeps its Terraform in a subdirectory — stuttgart-things/schmetterpause has it in terraform/, beside the application — gets green jobs over no configuration at all. And the validate job runs terraform fmt without -check, so it rewrites the runner's checkout and cannot fail on formatting anywhere.

Changes

call-validate-terraform

• working-directory (default ".") — both the validate and the tflint step run there.
• fmt-check (default false) — adds -check -diff -recursive to terraform fmt.

call-terraform-test

• working-directory (default ".") — -test-directory is resolved against it, as terraform test does anyway.
• Fix: verbose is a boolean, and inputs.verbose == 'true' coerces both sides to numbers (1 against NaN), so -verbose was never passed.

Existing callers

Unchanged. Every current caller pins @main, which is why both new inputs default to the old behaviour:

• vault-base-setup — validate and test
• vsphere-vm, proxmox-vm — validate

fmt-check is opt-in for that reason: switching it on for them unasked could fail a repository that has never been held to fmt. Worth a follow-up per repository once each is known to be formatted.

Verification

• pre-commit run over both files passes, including check-github-workflows.
• actionlint reports nothing on the changed lines. It does report the existing required: true inputs that also carry a default, which are unused for that reason — left as they are, since changing required is a separate decision.
• The intended caller's configuration is clean under both steps: terraform fmt -check -recursive, validate and test (7/7) pass in schmetterpause/terraform, and tflint --recursive v0.55.1 reports nothing there.

Not verified: no workflow run has used the new inputs yet — draft until one has. The planned first caller is stuttgart-things/schmetterpause#207:

terraform-validate:
  uses: stuttgart-things/github-workflow-templates/.github/workflows/call-validate-terraform.yaml@<sha>
  with:
    runs-on: ubuntu-latest
    environment-name: k8s
    terraform-version: 1.14.8
    tflint-version: v0.55.1
    continue-error: false
    working-directory: terraform
    fmt-check: true

🤖 Generated with Claude Code

https://claude.ai/code/session_01GoGGkGh5RLytzKMJ3PqLYa

[patrick-hermann-sva]

First caller run, pinned to this branch's head (947c80d): https://github.com/stuttgart-things/schmetterpause/actions/runs/34477527801 (stuttgart-things/schmetterpause#207)

With working-directory: terraform and fmt-check: true:

• Terraform-Validate — ran in terraform/, installed azurerm v4.81.0 from that directory's lock file, ran terraform fmt -check -diff -recursive, validate passed.
• Terraform-Lint — tflint --recursive in terraform/ (the ls -lta shows main.tf), clean.
• Terraform-Test — terraform test in terraform/, 7 passed, 0 failed.

The verbose fix is not exercised by that run; the caller does not set it.

🤖 Generated with Claude Code