[zigzago]

Shared by motis-mcp-app and amap-en-ligne, which have drifted apart (setup-terraform v4.0.1 / v3.1.2, Terraform ~1.16 / ~1.11).

• Pins Terraform to an exact version (1.16.7), in one place: Dependabot does not update the terraform_version input.
• Runs terraform init -input=false -lockfile=readonly: init fails when .terraform.lock.hcl does not match the constraints, instead of resolving other provider versions.
• state-bucket input for the S3 backend; the credentials stay in the callers, as the roles differ between jobs.
• The CI checks the installed version, and that init fails without a lock file.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the shared Terraform setup action.

No open issues 🎉

What changed in this PR

Adds a shared Terraform setup action to reduce version drift between consuming repositories and initialize providers using the committed lock file.

Changes:

• Defaults to Terraform 1.16.7, with configurable working directory, S3 state bucket, and wrapper behavior.
• Runs non-interactive initialization with -lockfile=readonly.
• Adds CI checks for the installed version and rejection of provider configuration without a lock file, plus usage documentation.

File	Description
README.md	Documents action usage, credential setup, lock-file requirements, and version updates.
.github/​workflows/​ci.yml	Checks the Terraform version and missing-lock-file failure.
.github/​actions/​setup-terraform/​action.yml	Defines the shared setup action and read-only lock-file initialization.

_{Review effort: Balanced}