refactor(opentofu): run pre-commit once per workflow

[xnoto]

Summary

Replace the preliminary selected-hook pass plus full validation pass with one full canonical pre-commit run. If that run changes tracked files on a trusted same-repository PR, later always()-guarded steps mint the existing App token and commit the changes; the push starts the confirmation workflow run. The failed originating pre-commit step keeps the initial run from reaching plan.

No linked issue.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass (shared-workflows CI)
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited (not applicable; no generated files changed)

Representative consumer validation passed through temporary tfroot-aws#35: the candidate workflow generated an App-authored autofix, cancelled the original test run before plan, then a replacement run passed full pre-commit and its credentialed plan. No local OpenTofu operation was run.

Impact and rollout

Canonical producer: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml. The active @main callers in tfroot-aws, tfroot-cloudflare, tfroot-gcp, tfroot-github, tfroot-libvirt, and tfroot-namecheap preserve their inputs, secrets, permissions, runner labels, and apply behavior; each already maps the App key. No caller change is needed.

Clean workflow runs now invoke pre-commit once. Autofix runs deliberately fail their original test step, preventing its plan, then push the autofix to trigger a clean confirmation run and plan. Forks, missing-key PRs, and main pushes still fail on drift and never auto-commit. Merge is the remaining gate; no artifact publication, GitOps selection, reconciliation, or infrastructure apply is involved.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes (revert this commit to restore the previous two-pass sequence)

AI-assisted change. Agent-knowledge topology revision consulted: f3f7228652495d1082bfbdb6f06de7c6ebf1224b. Material caller and runtime relationships were re-verified against current source.

[github-actions]

Shared Workflows CI

Shared workflows CI passed.

View the workflow run.

View run output

[INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Initializing environment for https://github.com/gitleaks/gitleaks.
[INFO] Initializing environment for https://github.com/rhysd/actionlint.
[INFO] Installing environment for https://github.com/pre-commit/pre-commit-hooks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/gitleaks/gitleaks.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
[INFO] Installing environment for https://github.com/rhysd/actionlint.
[INFO] Once installed this environment will be reused.
[INFO] This may take a few minutes...
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
Detect hardcoded secrets.................................................Passed
Lint GitHub Actions workflow files.......................................Passed