From f710c2255812bd56cbeb74f4fb15e6bd99301b3f Mon Sep 17 00:00:00 2001
From: John Ko <279736+johnko@users.noreply.github.com>
Date: Sun, 16 Nov 2025 23:34:05 -0500
Subject: [PATCH 1/3] Add .github/opentofu-validate.sh

---
 .github/opentofu-validate.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/opentofu-validate.sh b/.github/opentofu-validate.sh
index e945618..0b0f54d 100644
--- a/.github/opentofu-validate.sh
+++ b/.github/opentofu-validate.sh
@@ -16,6 +16,8 @@ if [[ "true" == "$CI" ]]; then
       $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
     fi
   fi
+else
+  CI=false
 fi
 set -u
 
@@ -23,6 +25,10 @@ export IAC_BIN=tofu
 
 $IAC_BIN version
 
-for WORKSPACE in $(find . \( -name '*.tf' -o -name '*.otf' \) -not -path '*/docs/*/example/*' -print0 | xargs -0 -I{} dirname {} | sort -u); do
+for WORKSPACE in $(find . \( -name '*.tf' -o -name '*.otf' \) -not -path '*/.terraform/*' -not -path '*/docs/*/example/*' -print0 | xargs -0 -I{} dirname {} | sort -u); do
   bash -e .github/tf.sh "$WORKSPACE" validate
+  if [[ "true" == "$CI" ]]; then
+    # Git will refuse to modify untracked nested git repositories (directories with a .git subdirectory) unless a second -f is given.
+    git clean -ffxd .
+  fi
 done

From 73514b29ce59f831251bc7e1424b64cac31b0112 Mon Sep 17 00:00:00 2001
From: John Ko <279736+johnko@users.noreply.github.com>
Date: Sun, 16 Nov 2025 23:34:07 -0500
Subject: [PATCH 2/3] Add .github/tf.sh

---
 .github/tf.sh | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/tf.sh b/.github/tf.sh
index cdc537f..cfbdcaa 100644
--- a/.github/tf.sh
+++ b/.github/tf.sh
@@ -54,21 +54,30 @@ if [[ "FMT" == "$SAFE_ACTION" ]]; then
 fi
 
 set -x
+set +e
 $IAC_BIN init
-
+TF_INIT_EXIT_CODE=$?
 set +x
 if [[ "INIT" == "$SAFE_ACTION" ]]; then
   set -x
-  exit 0
+  exit $TF_INIT_EXIT_CODE
+elif [[ "0" != "$TF_INIT_EXIT_CODE" ]]; then
+  $IAC_BIN providers
+  set -e
+  exit $TF_INIT_EXIT_CODE
 fi
 
 set -x
+set +e
 $IAC_BIN validate
-
+TF_VALIDATE_EXIT_CODE=$?
 set +x
 if [[ "VALIDATE" == "$SAFE_ACTION" ]]; then
   set -x
-  exit 0
+  exit $TF_VALIDATE_EXIT_CODE
+elif [[ "0" != "$TF_VALIDATE_EXIT_CODE" ]]; then
+  set -e
+  exit $TF_VALIDATE_EXIT_CODE
 fi
 
 set +x

From f798775a0258fae7aac12919010162b863925efd Mon Sep 17 00:00:00 2001
From: John Ko <279736+johnko@users.noreply.github.com>
Date: Sun, 16 Nov 2025 23:34:09 -0500
Subject: [PATCH 3/3] Add .github/terraform-validate.sh

---
 .github/terraform-validate.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/terraform-validate.sh b/.github/terraform-validate.sh
index 5aac710..1a61dac 100644
--- a/.github/terraform-validate.sh
+++ b/.github/terraform-validate.sh
@@ -24,6 +24,8 @@ if [[ "true" == "$CI" ]]; then
       $INSTALL_COMMAND || $SUDO $INSTALL_COMMAND
     fi
   fi
+else
+  CI=false
 fi
 set -u
 
@@ -31,6 +33,10 @@ export IAC_BIN=terraform
 
 $IAC_BIN version
 
-for WORKSPACE in $(find . -name '*.tf' -not -path '*/docs/*/example/*' -print0 | xargs -0 -I{} dirname {} | sort -u); do
+for WORKSPACE in $(find . -name '*.tf' -not -path '*/.terraform/*' -not -path '*/docs/*/example/*' -print0 | xargs -0 -I{} dirname {} | sort -u); do
   bash -e .github/tf.sh "$WORKSPACE" validate
+  if [[ "true" == "$CI" ]]; then
+    # Git will refuse to modify untracked nested git repositories (directories with a .git subdirectory) unless a second -f is given.
+    git clean -ffxd .
+  fi
 done