add support for linting IaC

[ms280690]

Closes #9. Infrastructure-as-Code lint stage of parent #12. Reuses the shared
lint-precommit.yml from #10; adds the tflint PR gate.

What

File	Purpose
.github/actions/tflint/action.yml	Composite — installs a pinned, checksum-verified tflint v0.63.1 binary; runs --init (plugins) then --recursive --format compact --minimum-failure-severity.
.github/actions/tflint/tflint-matcher.json	Problem matcher — turns tflint compact output into inline PR annotations (native, no reviewdog/SARIF).
.github/workflows/lint-iac.yml	Reusable PR gate. Inputs: directory, minimum-failure-severity, actions-ref. Caches tflint plugins via actions/cache.
.github/workflows/ci.yml	Dogfood tflint job (smoke test — no .tf in this repo).
examples/iac.pre-commit-config.yaml	Reference local config (pre-commit-terraform, SHA-pinned): terraform_fmt / terraform_validate / terraform_tflint.
README.md, docs/approved-actions.md	Usage (AWS/GCP/Azure .tflint.hcl), tooling tracking.

Acceptance criteria (#9)

• lint-iac.yml: installs tflint with plugin support; tflint --recursive from directory; PR annotations; blocks on error-level findings
• directory input (non-root IaC dirs)
• minimum-failure-severity input (default error)
• Plugin caching (actions/cache, keyed on any .tflint.hcl)
• Provider-agnostic — rule sets via consuming-repo .tflint.hcl
• README documents baseline .tflint.hcl for AWS, GCP, Azure

Design notes

• Checksum-verified binary, not setup-tflint — one verified download, no new org-allowlist publisher, zizmor-clean (no GITHUB_PATH write). Consistent with the gitleaks/trufflehog/megalinter pattern.
• PR annotations via a problem matcher (rung 3, native) — not SARIF. Works on private repos with no GitHub Code Security license; SARIF upload would be rejected there.
• Reusable workflow omits harden-runner (caller context / private-repo telemetry) and uses the immutable actions-ref self-reference pattern.
• Cache key hashFiles('**/.tflint.hcl') — invalidates on any config change regardless of directory.

Verified

• Checksum verification passes (caught + fixed a download-name mismatch: tflint.zip vs the checksum's tflint_linux_amd64.zip).
• tflint compact output matches the problem-matcher regex; --minimum-failure-severity error passes on warning-only findings.

Not included

• SARIF upload — annotations cover PR review; private repos can't upload third-party SARIF anyway.
• Real .tf dogfood — none in this repo; the CI job is an install smoke test.

🤖 Generated with Claude Code

[github-actions]

🤖 Hi @ms280690, I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[Copilot]

Pull request overview

Adds first-class Infrastructure-as-Code linting support to this repo by introducing a pinned, checksum-verified TFLint composite action and a reusable Lint IaC workflow intended for Terraform/OpenTofu repos, plus documentation and a CI smoke-test to dogfood it.

Changes:

• Add a reusable workflow (lint-iac.yml) that runs TFLint recursively with plugin caching and PR annotations.
• Add a composite action (.github/actions/tflint) that installs and runs a checksum-verified TFLint binary with a problem matcher.
• Update docs/README and approved-actions allowlist docs; add an IaC-focused pre-commit example config and CI smoke test.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the new Lint IaC reusable workflow and TFLint composite action usage.
examples/iac.pre-commit-config.yaml	Provides a reference pre-commit configuration for Terraform/OpenTofu repos.
docs/approved-actions.md	Adds tflint to the approved actions/binaries list with version and verification notes.
.github/workflows/lint-iac.yml	Introduces the reusable IaC lint workflow (checkout, cache, run TFLint composite).
.github/workflows/ci.yml	Adds a CI smoke-test job to verify the TFLint composite installs and runs.
.github/actions/tflint/tflint-matcher.json	Defines a problem matcher for TFLint compact output to produce PR annotations.
.github/actions/tflint/action.yml	Implements the TFLint composite action (download+checksum verify, init, lint).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[michaelconnor00]

It looks good. Some questions though:

• How is this going to interact with terramate?
• Will it work with OpenTofu? I am guess there will be no issue until they diverge...

[michaelconnor00]

Also, please create better PR descriptions. Not even a link to the issue? I have a claude skill for this if you like.

[ms280690]

Also, please create better PR descriptions. Not even a link to the issue? I have a claude skill for this if you like.

the issue is attached to the PR