fix(opentofu): commit automatic pre-commit fixes

[xnoto]

Summary

Run the canonical auto-fixing pre-commit hooks before validation and commit their tracked changes to same-repository pull-request branches through the existing GitHub App token. This extends the existing Terraform-docs behavior to terraform_fmt, end-of-file, line-ending, and trailing-whitespace fixes without changing the reusable workflow interface.

No linked issue.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass (ci run 113)
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited (not applicable; this change does not modify generated files)

CI is the validation environment. No local OpenTofu operation was run. The PR check validates workflow syntax and this repository's pre-commit configuration; it cannot exercise a consumer pull request that receives an autofix.

Impact and rollout

Canonical producer: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml. On merge, existing callers that reference @main receive the behavior on future runs; current source was checked in tfroot-aws, tfroot-cloudflare, tfroot-gcp, tfroot-github, tfroot-libvirt, and tfroot-namecheap. Each maps the existing CHART_UPDATER_GITHUB_APP_PRIVATE_KEY; no caller changes are required.

The workflow still commits only on same-repository pull requests with that key. Forks and runs without the key fail on detected drift; pushes to main do not auto-commit and remain blocked before apply. Inputs, permissions, runner label, plan behavior, and environment-gated apply behavior are unchanged. Merging is the remaining gate; no artifact publication, GitOps selection, reconciliation, or runtime rollout is involved.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes (no irreversible effects; revert this workflow commit to restore README-only autofixes)

AI-assisted change. Agent-knowledge topology revision consulted: f3f7228652495d1082bfbdb6f06de7c6ebf1224b. Material producer/consumer relationships were re-verified against current repository guidance and caller workflows.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed