feat!: migrate homelab-workspace template toolchain to OpenTofu

.github/compose/compose.yaml

@@ -10,6 +10,14 @@ services:
       KUBECONFIG: /home/coder/.kube/config
     volumes:
     - ${CODER_KUBECONFIG}:/home/coder/.kube/config:ro
+    # provisionerd resolves its provisioning binary by LookPath("terraform") - there is no
+    # OpenTofu-specific config surface at all (see DESIGN.md). This bind-mounts an OpenTofu
+    # binary directly over that lookup path so provisionerd applies the template with tofu
+    # while still finding a binary literally named "terraform". The image's real terraform
+    # binary at that path is root-owned (0755, root:root) and the container runs as uid 1000,
+    # so overwriting it from inside the container is not an option - the bind mount replaces
+    # the mount point at the kernel level regardless of that ownership.
+    - ${CODER_TOFU_BINARY}:/usr/local/bin/terraform:ro
     networks:
       default:
       kind:

.github/renovate.json

@@ -25,7 +25,7 @@
     "github>ppat/renovate-presets#v0.3.0",
     "github>ppat/renovate-presets:dev-tools#v0.3.0",
     "github>ppat/renovate-presets:github-actions#v0.3.0",
-    "github>ppat/coder//.github/renovate/template-terraform-provider",
+    "github>ppat/coder//.github/renovate/template-opentofu-provider",
     "github>ppat/coder//.github/renovate/image-cli-tools",
     "github>ppat/coder//.github/renovate/exceptions"
   ],

.github/renovate/exceptions.json

@@ -2,18 +2,16 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "packageRules": [
     {
-      "commitMessageTopic": "terraform",
-      "description": "group terraform upgrades together",
-      "groupName": "terraform-{{newVersion}}",
+      "commitMessageTopic": "opentofu",
+      "description": "group opentofu upgrades together",
+      "groupName": "opentofu-{{newVersion}}",
       "matchManagers": [
-        "mise",
-        "terraform-version"
+        "mise"
       ],
       "matchPackageNames": [
-        "hashicorp/terraform",
-        "terraform"
+        "opentofu/opentofu"
       ],
-      "semanticCommitScope": "terraform-version"
+      "semanticCommitScope": "opentofu-version"
     },
     {
       "automerge": false,

.github/renovate/template-terraform-provider.json → .github/renovate/template-opentofu-provider.json

@@ -3,7 +3,7 @@
   "packageRules": [
     {
       "addLabels": [
-        "template:terraform-provider"
+        "template:opentofu-provider"
       ],
       "commitMessageTopic": "{{packageName}}",
       "groupName": "{{datasource}}-{{packageName}}",
@@ -13,7 +13,7 @@
       "matchFileNames": [
         "templates/**"
       ],
-      "semanticCommitScope": "terraform-provider",
+      "semanticCommitScope": "opentofu-provider",
       "separateMajorMinor": true,
       "separateMinorPatch": false,
       "separateMultipleMajor": true,

.github/workflows/lint.yaml

@@ -32,7 +32,7 @@ jobs:
         - .github/renovate/**
         shellscripts:
         - '**.sh'
-        terraform:
+        opentofu:
         - '**.tf'
         - '**/.terraform-version'
         - '**/.terraform.lock.hcl'
@@ -41,35 +41,35 @@ jobs:
         - '**.yaml'
       git_ref: ${{ github.head_ref || github.ref }}
 
-  terraform-dirs:
+  opentofu-dirs:
     needs: [detect-changes]
     runs-on: ubuntu-24.04
     timeout-minutes: 2
     outputs:
-      terraform_dirs: ${{ steps.determine-tf-dirs.outputs.dirs }}
+      opentofu_dirs: ${{ steps.determine-tf-dirs.outputs.dirs }}
     steps:
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 1
         persist-credentials: false
 
-    - name: Determine Terraform directories to validate
+    - name: Determine OpenTofu directories to validate
       id: determine-tf-dirs
       # yamllint disable-line rule:indentation
       run: |
         if [[ "${{ github.event_name }}" != "pull_request" ]]; then
-          # For workflow_dispatch, validate all terraform directories
+          # For workflow_dispatch, validate all opentofu directories
           TF_DIRS=$(find templates/ -maxdepth 2 -mindepth 2 -type d -not -name '.*' 2>/dev/null | sort | jq -R -s -c 'split("\n") | map(select(length > 0))')
-        elif [[ "${{ fromJSON(needs.detect-changes.outputs.results).terraform_any_changed }}" == "true" ]]; then
+        elif [[ "${{ fromJSON(needs.detect-changes.outputs.results).opentofu_any_changed }}" == "true" ]]; then
           # For pull requests, check which files changed
-          CHANGED_FILES="${{ fromJSON(needs.detect-changes.outputs.results).terraform_all_changed_files }}"
+          CHANGED_FILES="${{ fromJSON(needs.detect-changes.outputs.results).opentofu_all_changed_files }}"
           TEMPLATE_CHANGES=$(echo "$CHANGED_FILES" | tr ' ' '\n' | grep '^templates/' || true)
           # Otherwise only validate affected templates
           TF_DIRS=$(echo "$TEMPLATE_CHANGES" | grep -o 'templates/[^/]*' | sort | uniq | tr -d ' ' | jq -R -s -c 'split("\n") | map(select(length > 0))')
         else
           TF_DIRS="[]"
-          echo "No Terraform changes detected"
+          echo "No OpenTofu changes detected"
         fi
         echo "dirs=$TF_DIRS" >> "$GITHUB_OUTPUT"
 
@@ -128,13 +128,13 @@ jobs:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).shellscripts_all_changed_files }}
 
-  terraform:
-    needs: [terraform-dirs]
-    if: ${{ github.event_name != 'pull_request' || needs.terraform-dirs.outputs.terraform_dirs != '[]' }}
-    uses: ppat/github-workflows/.github/workflows/lint-terraform.yaml@5a96ced8ceefd58062f6b91ee9d6f3a31cd06e1c # v6.0.0
+  opentofu:
+    needs: [opentofu-dirs]
+    if: ${{ github.event_name != 'pull_request' || needs.opentofu-dirs.outputs.opentofu_dirs != '[]' }}
+    uses: ppat/github-workflows/.github/workflows/lint-opentofu.yaml@54ce2e4ac00927d6164d032b321f0142aab01c69 # v6.1.0
     with:
       git_ref: ${{ github.head_ref || github.ref }}
-      tf_dirs: ${{ needs.terraform-dirs.outputs.terraform_dirs }}
+      tofu_dirs: ${{ needs.opentofu-dirs.outputs.opentofu_dirs }}
 
   yaml:
     needs: [detect-changes]

.github/workflows/test-template.yaml

@@ -18,7 +18,7 @@ permissions:
 
 env:
   CODER_URL: http://localhost:7080
-  COMPOSE_FILE: .github/compose/compose.yaml
+  COMPOSE_FILE: current/.github/compose/compose.yaml
   KIND_CLUSTER: coder-template-test
   TEMPLATE_NAME: homelab-workspace-test
   WORKSPACE_NAME: template-test
@@ -28,11 +28,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Setup repository and tools
+      # Checks the repo out into current/ (hence the current/ prefix on every path
+      # reference below) and, with no mise_toml override, installs straight from
+      # current/mise.toml - the same `opentofu` pin the authoring toolchain uses
+      # locally, so there's no second version string to drift from it.
+      uses: ppat/homelab-ops-actions/actions/setup-repository-tools@f66c9acb40309305e0e1fd3179406b85647aa54c # v2.3.2
       with:
-        fetch-depth: 1
-        persist-credentials: false
+        current_git_ref: ${{ github.head_ref || github.ref }}
+        current_repository: ${{ github.repository }}
+        token: ${{ github.token }}
 
     - name: Create Kubernetes test cluster
       run: kind create cluster --name "${KIND_CLUSTER}"
@@ -55,6 +60,20 @@ jobs:
         sed -Ei "s#https://127\\.0\\.0\\.1:[0-9]+#https://${KIND_CLUSTER}-control-plane:6443#" "${CODER_KUBECONFIG}"
         chmod 644 "${CODER_KUBECONFIG}"
         echo "CODER_KUBECONFIG=${CODER_KUBECONFIG}" >> "${GITHUB_ENV}"
+        # $GITHUB_ENV only takes effect for steps that run AFTER this one - it does
+        # nothing for the `docker compose up` a few lines below, in this same step,
+        # which is why CODER_KUBECONFIG above works (it's this step's own `env:`,
+        # set from the start) while a same-step echo-then-use of CODER_TOFU_BINARY
+        # silently resolved empty and produced docker compose's opaque "invalid
+        # spec: empty section between colons". Exporting it directly makes it visible
+        # to this step's own `docker compose up`; the $GITHUB_ENV write is still needed
+        # so later steps' `docker compose exec`/`logs` calls see it too, since compose
+        # re-resolves the whole file - volumes included - on every subcommand.
+        # cd'd into current/ for this one command only - that's where mise.toml
+        # actually is, unlike this step's own default working directory.
+        CODER_TOFU_BINARY="$(cd current && mise which tofu)"
+        export CODER_TOFU_BINARY
+        echo "CODER_TOFU_BINARY=${CODER_TOFU_BINARY}" >> "${GITHUB_ENV}"
         docker compose -f "${COMPOSE_FILE}" up --detach
 
     - name: Wait for local Coder
@@ -72,7 +91,7 @@ jobs:
         coder server create-admin-user --username ci --email ci@example.invalid --password ci-password
 
     - name: Install and log in to Coder CLI
-      uses: ./actions/coder-cli-login
+      uses: ./current/actions/coder-cli-login
       with:
         coder_url: ${{ env.CODER_URL }}
         coder_email: ci@example.invalid
@@ -88,9 +107,9 @@ jobs:
         echo "workspace_image=ghcr.io/ppat/coder-workspace:${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
 
     - name: Publish template
-      uses: ./actions/coder-template-push
+      uses: ./current/actions/coder-template-push
       with:
-        template_dir: templates/kubernetes/homelab-workspace
+        template_dir: current/templates/kubernetes/homelab-workspace
         template_name: ${{ env.TEMPLATE_NAME }}
         template_version: ${{ github.sha }}
         workspace_image: ${{ steps.image.outputs.workspace_image }}

.pre-commit-config.yaml

@@ -52,8 +52,8 @@ repos:
 - repo: https://github.com/gruntwork-io/pre-commit
   rev: v0.1.30
   hooks:
-  - id: terraform-fmt
-  - id: terraform-validate
+  - id: tofu-fmt
+  - id: tofu-validate
   - id: tflint
     args:
     - "--config=__GIT_ROOT__/.tflint.hcl"