From 77b4ec7e3e2edea88afbb5f4f7d805eba0c79032 Mon Sep 17 00:00:00 2001
From: yeonigi <whdusdlr2015@gmail.com>
Date: Fri, 7 Aug 2026 11:34:31 +0900
Subject: [PATCH] ci: validate bundled infra/ Terraform with fmt + validate
 (#54)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

infra/ ships inside the npm package (dist/templates/infra/), so its HCL is a
released artifact just like the JS — yet CI only ran build/typecheck/test,
leaving the HCL unverified. A typo or dangling reference would break every
user's `hostdoc provision`.

`fmt -check` and `validate` (after `init -backend=false`) need no AWS
credentials and make no AWS calls — only a provider download — so this widens
artifact coverage to HCL without breaking the "CI never touches live AWS" rule.
`plan`/`apply` remain local-only.

Verified on a clean `git archive` copy of infra/: fmt + validate pass with no
credentials; an unsupported argument fails validate (exit 1) and misaligned HCL
fails fmt -check (exit 3).

Closes #54

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JgrcpuSKPkvUE4xYity9ua
---
 .github/workflows/ci.yml | 12 ++++++++++++
 CLAUDE.md                |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d27a103..8a771b7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,3 +17,15 @@ jobs:
       - run: npm run build
       - run: npm run typecheck
       - run: npm test
+
+  # infra/ ships inside the npm package (dist/templates/infra/), so the HCL is a
+  # released artifact like the JS. fmt/validate need no AWS credentials and make
+  # no AWS calls (provider download only) — plan/apply stay local-only.
+  terraform-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v4
+      - run: terraform -chdir=infra fmt -check -diff
+      - run: terraform -chdir=infra init -backend=false
+      - run: terraform -chdir=infra validate
diff --git a/CLAUDE.md b/CLAUDE.md
index 1360522..8522513 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -9,7 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `npm run typecheck` — `tsgo --noEmit` (type-check only; tsgo can't emit, so `build` stays on `tsc`).
 - `npm test` · `npx vitest run test/x.test.ts` · `npx vitest run -t "name"` — tests (AWS mocked).
 - `npm run dev` — run the CLI from source without building.
-- CI runs build→typecheck→test with **no AWS creds and no Terraform**; keep it that way.
+- CI runs build→typecheck→test plus `terraform fmt -check`/`validate` on `infra/`, with **no AWS creds and no `plan`/`apply`**; keep it that way (`validate` only downloads the provider — it never touches live AWS).
 
 ## Architecture
 - **Two hosting modes, one code path.** Upload (file/folder → `<code>/` prefix, Content-Type, `_meta/<code>.json` sidecar) is mode-common; only the URL builder, CloudFront invalidation, and provisioning differ. Mode is *derived* in `resolveConfig()` (`src/lib/config.ts`), never stored: `domain`+`distributionId` → `cloudfront` (private S3+OAC+CloudFront, HTTPS, Terraform-provisioned); else `bucket`+`region` → `s3-website` (public bucket, HTTP, CLI `setup`).