Add Terraform validation workflow with tflint for all modules

[devin-ai-integration]

Summary

Adds a GitHub Actions workflow that runs terraform validate and tflint against every module under terraform/modules/ on each PR. The workflow dynamically discovers modules so new modules are automatically picked up without workflow changes.

What's included:

• .github/workflows/terraform-validate.yml — Three-job workflow: (1) discover modules, (2) matrix terraform fmt -check + terraform init + terraform validate per module via test fixtures, (3) matrix tflint per module with the AWS ruleset.
• terraform/.tflint.hcl — Shared tflint config using the recommended preset and tflint-ruleset-aws v0.35.0. The terraform_required_providers and terraform_required_version rules are explicitly disabled because existing modules don't declare these yet (see comment in file).
• terraform/tests/fixtures/{dns,ecr,eks-cluster,namespaces,networking}/main.tf — Minimal fixture configs per module that declare mock providers (no real credentials needed) and call the module with dummy values, enabling terraform init + validate to run in CI without cloud access.
• terraform/modules/namespaces/variables.tf — Whitespace-only reformatting via terraform fmt to pass the fmt -check step (pre-existing alignment was inconsistent).

Design decisions:

• Fixtures use skip_credentials_validation / mock keys for the AWS provider and a localhost Kubernetes provider so validation can run without secrets.
• Module discovery is automatic (ls terraform/modules/*/), so adding a new module without a corresponding fixture will intentionally fail CI, enforcing test coverage.
• fail-fast: false ensures all modules are checked even if one fails.

Review & Testing Checklist for Human

• Verify the namespaces/variables.tf formatting change is whitespace-only — This PR reformats an existing module file. Diff should show only alignment changes (extra spaces), no semantic changes. Confirm no variable defaults or types were altered.
• Verify mock credentials approach is acceptable — The fixtures contain access_key = "mock-access-key" / secret_key = "mock-secret-key" strings. These are not real secrets and are required for terraform validate without cloud access, but confirm this aligns with your security posture.
• Decide on disabled tflint rules — terraform_required_providers and terraform_required_version are disabled to avoid failing on pre-existing module gaps. Consider whether you'd prefer to fix the modules instead and re-enable these rules.
• Terraform version constraint — The workflow uses ~> 1.5. Confirm this matches the version your team targets (modules don't currently declare required_version).
• Test the workflow end-to-end — Open a separate PR that modifies a file under terraform/ and confirm all three jobs (discover, validate matrix, tflint matrix) trigger and pass. The path filter means PRs not touching terraform/ won't trigger this workflow.

Suggested test plan: Create a trivial PR that adds a comment to one of the modules (e.g., terraform/modules/dns/main.tf). Verify the workflow triggers and all 11 checks (1 discover + 5 validate + 5 tflint) pass. Then introduce an intentional error (e.g., an invalid resource attribute) and confirm the corresponding validate job fails.

Notes

• tflint runs directly against the module source directories (not the fixtures), which is the standard approach since tflint doesn't need initialized providers.
• All 5 fixtures were verified locally: terraform init -backend=false + terraform validate pass for each.
• CI on this PR passes all 12 checks (discover + 5 validate + 5 tflint + Devin Review).

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/f0cb89c9a9b54a62aeee3bbe64c5b70d

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

[devin-ai-integration]

Closing: this PR is older than 3 weeks. Reopen if still needed.