Allow repository to be used in GitHub Actions

.github/super-linter.env

@@ -0,0 +1,11 @@
+FIX_MARKDOWN=true
+FIX_YAML_PRETTIER=true
+VALIDATE_CHECKOV=true
+VALIDATE_GITHUB_ACTIONS=true
+VALIDATE_GITHUB_ACTIONS_ZIZMOR=true
+VALIDATE_GITLEAKS=true
+VALIDATE_GIT_MERGE_CONFLICT_MARKERS=true
+VALIDATE_GO=true
+VALIDATE_MARKDOWN=true
+VALIDATE_YAML=true
+VALIDATE_YAML_PRETTIER=true

.github/workflows/ci.yml

@@ -2,20 +2,23 @@ name: Continuous Integration
 
 on:
   push:
-    branches: [ "main" ]
   pull_request:
-    branches: [ "main" ]
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: "1.24"
 
       - name: Install dependencies
         run: make deps
@@ -25,3 +28,43 @@ jobs:
 
       - name: Test
         run: make test
+
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Format code
+        run: make fmt
+
+      - name: Check if code is formatted
+        run: |
+          if [[ -n $(git status --porcelain) ]]; then
+            echo "::error::Code is not formatted. Please run 'make fmt' and commit the changes."
+            git --no-pager diff
+            exit 1
+          fi
+
+  lint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
+      issues: write
+      pull-requests: write
+      statuses: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Load super-linter configuration
+        run: grep -v '^#' .github/super-linter.env >> "$GITHUB_ENV"
+
+      - name: Super-linter
+        uses: super-linter/super-linter@v8.5.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -3,7 +3,10 @@ name: CLI Tool Releases
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -35,11 +38,14 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
-          go-version: '1.24'
+          go-version: "1.24"
+          cache: false
 
       - name: Install dependencies
         run: make deps
@@ -67,6 +73,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Download all artifacts
         uses: actions/download-artifact@v6
@@ -78,11 +86,11 @@ jobs:
           VERSION: ${{ github.ref_name }}
         run: |
           mkdir -p release
-          cp artifacts/tfdocs-extras-linux-amd64/tfdocs-extras release/tfdocs-extras-${VERSION}-linux-amd64
-          cp artifacts/tfdocs-extras-linux-arm64/tfdocs-extras release/tfdocs-extras-${VERSION}-linux-arm64
-          cp artifacts/tfdocs-extras-darwin-amd64/tfdocs-extras release/tfdocs-extras-${VERSION}-darwin-amd64
-          cp artifacts/tfdocs-extras-darwin-arm64/tfdocs-extras release/tfdocs-extras-${VERSION}-darwin-arm64
-          cp artifacts/tfdocs-extras-windows-amd64/tfdocs-extras.exe release/tfdocs-extras-${VERSION}-windows-amd64.exe
+          cp "artifacts/tfdocs-extras-linux-amd64/tfdocs-extras" "release/tfdocs-extras-${VERSION}-linux-amd64"
+          cp "artifacts/tfdocs-extras-linux-arm64/tfdocs-extras" "release/tfdocs-extras-${VERSION}-linux-arm64"
+          cp "artifacts/tfdocs-extras-darwin-amd64/tfdocs-extras" "release/tfdocs-extras-${VERSION}-darwin-amd64"
+          cp "artifacts/tfdocs-extras-darwin-arm64/tfdocs-extras" "release/tfdocs-extras-${VERSION}-darwin-arm64"
+          cp "artifacts/tfdocs-extras-windows-amd64/tfdocs-extras.exe" "release/tfdocs-extras-${VERSION}-windows-amd64.exe"
 
       - name: Create Release
         uses: softprops/action-gh-release@v2

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help build test coverage clean fmt deps
+.PHONY: help build test coverage clean fmt deps lint
 
 # Variables
 GO := go
@@ -7,6 +7,7 @@ BINARY_NAME := tfdocs-extras
 BIN_DIR := bin
 COVERAGE_FILE := coverage.out
 COVERAGE_HTML := coverage.html
+SUPER_LINTER_VERSION := v8.5.0
 
 # Default target
 help:
@@ -17,6 +18,7 @@ help:
 	@echo "  make clean           - Remove build artifacts"
 	@echo "  make fmt             - Format code"
 	@echo "  make deps            - Download dependencies"
+	@echo "  make lint            - Run super-linter locally (fix mode)"
 	@echo "  make all             - Build and test"
 
 build:
@@ -45,3 +47,12 @@ deps:
 
 all: fmt test build
 	@echo "Build and test completed successfully!"
+
+lint:
+	@docker run --rm \
+	  -e RUN_LOCAL=true \
+	  -e DEFAULT_BRANCH=main \
+	  -e FIX_MODE=true \
+	  --env-file ".github/super-linter.env" \
+	  -v "$$(pwd)":/tmp/lint \
+	  ghcr.io/super-linter/super-linter:$(SUPER_LINTER_VERSION)