refactor: use tfroot-runner and fetch canonical pre-commit config

Author: xnoto

.github/workflows/opentofu.yml

@@ -14,7 +14,7 @@ on:
       container:
         description: Container image to use
         type: string
-        default: ghcr.io/makeitworkcloud/runner:latest
+        default: ghcr.io/makeitworkcloud/tfroot-runner:latest
       setup-ssh:
         description: Whether to setup SSH keys
         type: boolean
@@ -56,11 +56,16 @@ jobs:
         if: ${{ inputs.setup-ssh }}
         run: cp -r /root/.ssh /github/home/
 
+      - name: Fetch canonical pre-commit config
+        run: |
+          curl -sSL -o .pre-commit-config.yaml \
+            https://raw.githubusercontent.com/makeitworkcloud/images/main/tfroot-runner/pre-commit-config.yaml
+
       - name: Initialize OpenTofu
         run: tofu init -backend=false
 
       - name: Run tests
-        run: make test
+        run: pre-commit run -a
 
   plan:
     name: OpenTofu Plan

AGENTS.md

@@ -0,0 +1,27 @@
+# Agent Instructions
+
+## Repository Purpose
+
+This repository contains reusable GitHub Actions workflows for the `makeitworkcloud` organization.
+
+## Push Access
+
+Agents are authorized to push directly to `main` in this repository.
+
+## Key Workflows
+
+### opentofu.yml
+
+Reusable workflow for OpenTofu/Terraform root module repositories (`tfroot-*`). It:
+
+1. Fetches canonical pre-commit config from `makeitworkcloud/images` repo
+2. Runs pre-commit tests using the `tfroot-runner` container image
+3. Posts plan output as PR comments
+4. Applies on merge to main
+
+**Pre-commit configuration is centralized** in `makeitworkcloud/images/tfroot-runner/pre-commit-config.yaml`. Do not add `.pre-commit-config.yaml` to individual tfroot repos.
+
+## Related Repositories
+
+- `images` - Contains `tfroot-runner` image and canonical pre-commit config
+- `tfroot-cloudflare`, `tfroot-libvirt`, `tfroot-github`, `tfroot-aws` - Terraform root module repos that consume this workflow