From d81544ff83f56961ba8f3000edd20ded041ef07f Mon Sep 17 00:00:00 2001
From: Veronika Gnilitska <veronika.gnilitska@gmail.com>
Date: Mon, 21 Sep 2026 15:44:51 +0300
Subject: [PATCH 1/2] feat: discover and test every module in tf-test workflow

---
 .github/workflows/tf-test.yaml | 64 +++++++++++++++++++++++++++++++---
 1 file changed, 59 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/tf-test.yaml b/.github/workflows/tf-test.yaml
index bb67c64..4ee9f42 100644
--- a/.github/workflows/tf-test.yaml
+++ b/.github/workflows/tf-test.yaml
@@ -5,21 +5,70 @@ on:
     inputs:
       aws_role_arn:
         type: string
-        required: true
+        default: ""
+        description: |
+          AWS role ARN to assume before running the tests. Leave unset for modules that
+          don't touch AWS; the action also falls back to the TF_TEST_AWS_ROLE_ARN org variable.
     secrets:
       SPACELIFT_API_KEY_ENDPOINT:
-        required: true
+        description: |
+          Spacelift account URL, e.g. https://example.app.spacelift.io. Only needed by
+          modules whose tests talk to the Spacelift API.
       SPACELIFT_API_KEY_ID:
-        required: true
+        description: ID of the Spacelift API key used by the tests.
       SPACELIFT_API_KEY_SECRET:
-        required: true
+        description: Secret of the Spacelift API key used by the tests.
 
 permissions: {}
 
 jobs:
+  discover:
+    name: 🔍 discover modules
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      modules: ${{ steps.discover.outputs.modules }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # In pull_request_target, use the base repo's synthetic merge ref to avoid cross-repo clones
+          # and to prevent running fork code with elevated credentials. Otherwise, fall back to sha.
+          ref: ${{ (github.event_name == 'pull_request_target' && format('refs/pull/{0}/merge', github.event.number)) || github.event.pull_request.head.sha || github.sha }}
+          repository: ${{ github.repository }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Discover test directories
+        id: discover
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Terraform picks up *.tftest.hcl from the module directory and from its tests/
+          # subdirectory, so both locations map back to the same module to run from.
+          modules="$(
+            find . -type f -name '*.tftest.hcl' \
+              -not -path './.git/*' \
+              -not -path '*/.terraform/*' \
+              | sed -E 's#/[^/]*$##; s#/tests$##; s#^\./##' \
+              | sort -u \
+              | jq -R -s -c 'split("\n") | map(select(length > 0))'
+          )"
+
+          echo "modules=${modules}" >> "$GITHUB_OUTPUT"
+          echo "Discovered test directories: ${modules}" >> "$GITHUB_STEP_SUMMARY"
+
   tf-test:
-    name: 🧪 ${{ matrix.tf }} test
+    # Modules with tftest.hcl files in the repo root report as "." and would otherwise
+    # rename the existing single-module checks, breaking branch protection rules.
+    name: 🧪 ${{ matrix.tf }} test${{ matrix.module != '.' && format(' ({0})', matrix.module) || '' }}
+    needs: discover
+    if: needs.discover.outputs.modules != '[]'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read # needed by github-action-tf-test to read workflow run context
       checks: write # needed by github-action-tf-test to write check results
@@ -31,11 +80,16 @@ jobs:
       SPACELIFT_API_KEY_ID: ${{ secrets.SPACELIFT_API_KEY_ID }}
       SPACELIFT_API_KEY_SECRET: ${{ secrets.SPACELIFT_API_KEY_SECRET }}
     strategy:
+      fail-fast: false
       matrix:
         tf: [tofu, terraform]
+        module: ${{ fromJSON(needs.discover.outputs.modules) }}
     steps:
+      # TODO: bump to the github-action-tf-test release that adds working_directory.
+      # Until then the input is ignored and every module is tested from the repo root.
       - uses: masterpointio/github-action-tf-test@c1e41998f67925ac3f34e0bbcfcaa4a44d1f0cd9 # v1.0.1
         with:
           tf_type: ${{ matrix.tf }}
+          working_directory: ${{ matrix.module }}
           aws_role_arn: ${{ inputs.aws_role_arn }}
           github_token: ${{ secrets.GITHUB_TOKEN }}

From e621b8d69ef602fd27472257eacbbeb70afd6769 Mon Sep 17 00:00:00 2001
From: Veronika Gnilitska <veronika.gnilitska@gmail.com>
Date: Mon, 21 Sep 2026 17:23:47 +0300
Subject: [PATCH 2/2] chore: bump github-action-tf-test to v1.1.0 for
 working_directory

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/tf-test.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/tf-test.yaml b/.github/workflows/tf-test.yaml
index 4ee9f42..ec39754 100644
--- a/.github/workflows/tf-test.yaml
+++ b/.github/workflows/tf-test.yaml
@@ -85,9 +85,7 @@ jobs:
         tf: [tofu, terraform]
         module: ${{ fromJSON(needs.discover.outputs.modules) }}
     steps:
-      # TODO: bump to the github-action-tf-test release that adds working_directory.
-      # Until then the input is ignored and every module is tested from the repo root.
-      - uses: masterpointio/github-action-tf-test@c1e41998f67925ac3f34e0bbcfcaa4a44d1f0cd9 # v1.0.1
+      - uses: masterpointio/github-action-tf-test@10db248566149eb436274c90e7efb5f26fc697a5 # v1.1.0
         with:
           tf_type: ${{ matrix.tf }}
           working_directory: ${{ matrix.module }}