ci: add Terraform CI and release automation

[mamayer19]

Summary

• add PR-only Terraform CI on blacksmith-2vcpu-ubuntu-2404
• check formatting, run TFLint, initialize without a backend, and validate the root module
• add release-please v5 using its native Terraform-module strategy
• seed release state from the existing published v0.7.2 GitHub Release/tag

Release authority

• future Conventional Commits maintain a reviewed release PR and changelog
• merging that release PR creates one GitHub Release and bare vX.Y.Z tag
• Terraform Registry remains tag-driven through its existing GitHub integration; there is no second publisher
• component-prefixed tags and .github-only version bumps are disabled
• the repository GITHUB_TOKEN is used; CI on bot-created release PRs requires maintainer workflow approval

Registry safety

• no Terraform module source, examples, tests, documentation, existing tags, or existing releases changed
• no Registry API call, upload, release asset, private token, internal tooling, plan, apply, or destroy path was added
• actions are full-SHA pinned and default workflow permissions are read-only
• version tags can be created but remain protected from update and deletion

Validation

• release-please config and manifest pass the pinned 17.6.0 schemas
• Terraform format/init/validate: passed
• TFLint 0.64.0 with Google ruleset 0.39.0: passed with no findings
• both workflows pass actionlint 1.7.12
• independent CI and release reviews: PASS with no findings

The existing plan-based Terraform tests require Google authentication and remain outside this credential-free gate.

Summary by CodeRabbit

• New Features

  • Added automated checks for Terraform formatting, linting, initialization, and validation on pull requests.
  • Added automated release preparation when changes are pushed to the main branch.
  • Configured version tracking and release metadata for the Terraform module.

• Chores

  • Updated Terraform linting rules and refreshed Google Cloud validation checks.
  • Set the current package version to 0.7.2.
  • Added configuration for automated workflow validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 8a9d7263-d532-4e54-9d58-e1320f1b007e

📥 Commits

Reviewing files that changed from the base of the PR and between c6fc074 and 282127d.

📒 Files selected for processing (1)

• .github/actionlint.yaml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.

---

📝 Walkthrough

Walkthrough

Changes

Repository automation

Layer / File(s)	Summary
Terraform pull-request validation .github/workflows/ci.yml, .tflint.hcl, .github/actionlint.yaml	The pull-request workflow runs Terraform formatting, initialization, TFLint, and validation. TFLint uses local module calls, Google ruleset version 0.39.0, and the GKE invalid machine-type rule. The workflow uses the configured self-hosted runner.
Release Please management .github/workflows/release-please.yml, release-please-config.json, .release-please-manifest.json	Release Please runs on pushes to main. The configuration defines the root Terraform module, v-prefixed releases, excluded .github paths, and version 0.7.2.

Merge Risk: ⚪ Minimal · up to 28212

This PR adds Terraform CI and release automation without changing Terraform module behavior or existing releases; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: Terraform CI and release automation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task-basic-ci

---

_{Comment @coderabbitai help to get the list of available commands.}