Skip to content

docs: clarify dependency upgrade workflow #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 1 commit into from
Aug 14, 2026
Merged

docs: clarify dependency upgrade workflow #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ production publication.

## Canonical Pre-commit Config

`tfroot-runner/pre-commit-config.yaml` is the source of truth for pre-commit hooks across every `tfroot-*` repo. The runner image pre-caches its hook environments; the shared OpenTofu workflow in `shared-workflows` fetches it at CI time. Secret scanning uses Gitleaks alongside `detect-private-key`.
`tfroot-runner/pre-commit-config.yaml` is the source of truth for pre-commit hooks across every `tfroot-*` repo and `terraform-libvirt-domain`. The runner image pre-caches its hook environments; the shared OpenTofu workflow in `shared-workflows` fetches it at CI time. Secret scanning uses Gitleaks alongside `detect-private-key`.

**Do not** edit `.pre-commit-config.yaml` files in individual `tfroot-*` repos — they pull from here.
**Do not** edit `.pre-commit-config.yaml` files in individual `tfroot-*` repos or the generated module config — they pull from here. Merge runner/toolchain updates and verify image publication before merging shared-workflow changes that require the new runner runtime.

## Build Workflow (`buildah.yml`)

Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Container image monorepo. Each subdirectory containing a `Containerfile` is buil
push to main ─▶ detect changed images ─▶ pre-commit + hadolint ─▶ buildah build ─▶ push to GHCR
```

`workflow_dispatch` accepts an optional `image` input to rebuild a single image; with no input it builds all images.
`workflow_dispatch` accepts an optional `image` input to rebuild a single image; with no input it builds all images. Manual dispatch defaults to **build & push**; select **build** for a non-publishing validation run.

The detect step uses the `Makefile` (`make changed-images` / `make list-images-json`) to enumerate directories that contain a `Containerfile`.

Expand All @@ -27,12 +27,12 @@ The detect step uses the `Makefile` (`make changed-images` / `make list-images-j

## Canonical Pre-commit Config

`tfroot-runner/pre-commit-config.yaml` is the **canonical pre-commit configuration** for every `tfroot-*` repository. It is:
`tfroot-runner/pre-commit-config.yaml` is the **canonical pre-commit configuration** for every `tfroot-*` repository and `terraform-libvirt-domain`. It is:

1. Pre-cached into the runner image at build time so hooks don't re-fetch on every CI run
2. Fetched at CI time by the shared OpenTofu workflow in `shared-workflows`

To change pre-commit hooks across all `tfroot-*` repos, edit this file and merge to `main`.
To change these hooks, edit this file and merge it first. Downstream `make test` runs refresh the ignored generated configuration from this source.

## License

Expand Down
Loading