fix(ci): validate templates and fix tests#948
Merged
Conversation
Templates under registry/**/templates/** were previously ignored by the Terraform validation script. Detect and validate them alongside modules: - terraform_validate.sh now consumes TEMPLATE_CHANGED_FILES and, on a shared-infra change, validates both modules and templates. - CI adds a 'templates' paths-filter and passes TEMPLATE_CHANGED_FILES to the Run Terraform Validate step.
Validating templates runs 'terraform init', which populates .terraform/ with downloaded child modules. The snake_case variable-name check used a plain 'find ... -name *.tf' that recursed into those directories and flagged variables in third-party module code (e.g. code-server's 'machine-settings'). Prune .terraform/ so only first-party source is checked.
The container-based tests share the ubuntu:20.04 image. Pulling it lazily on the first test could exceed the 5000ms per-test timeout (the Maven test timed out while the image downloaded). Add a beforeAll that pulls the image once up front and route all tests through a shared TEST_IMAGE constant.
phorcys420
changed the title
phorcys420
changed the title
DevelopmentCats
approved these changes
Jul 8, 2026
phorcys420
added a commit
that referenced
this pull request
Jul 8, 2026
## Problem Now that `scripts/terraform_validate.sh` validates templates (from #948), running `terraform validate` across the registry surfaces pre-existing breakages in **14 `coder/*` templates**. This PR fixes all of them so they pass validation. ## Fixes **Unsupported `agent_name` argument** (dominant issue) - Removed `agent_name` from `code-server` / `windows_rdp` module calls and from `coder_app` / `coder_env` / `coder_script` / `coder_agent_instance` resources. Only the `jetbrains` and `filebrowser` modules actually declare an `agent_name` variable, so those usages are left intact. **Invalid `jetbrains` module source** - `registry.coder.com/modules/coder/jetbrains/coder` (5 components — invalid) → `registry.coder.com/coder/jetbrains/coder`. **windows_rdp stray argument** - Removed `resource_id = null` (no longer a supported argument). **aws-devcontainer region module** - Replaced the raw `source = "https://registry.coder.com/modules/aws-region"` URL with the proper registry source `registry.coder.com/coder/aws-region/coder` + `version = "~> 1.0"`. **gcp-devcontainer agent reference** - Fixed module calls referencing the non-existent `coder_agent.main`; the agent in that template is `coder_agent.dev` (count-based), so they now use `coder_agent.dev[0].id`. **incus provider schema drift** - `incus_volume` → `incus_storage_volume` - `incus_cached_image` → `incus_image` (object-form `source_image = { remote, name }`) - Dropped the unsupported `incus_instance_file` resource; the agent token is now delivered via cloud-init `write_files` (consistent with how the init script and systemd units are already delivered). - Moved instance `limits` into `config` (`limits.cpu` / `limits.memory`) and updated `coder_metadata` references accordingly. ## Validation All 14 previously-failing templates now pass `terraform validate`: ``` aws-devcontainer, aws-linux, azure-linux, azure-windows, digitalocean-linux, docker, docker-devcontainer, gcp-devcontainer, gcp-linux, gcp-vm-container, kubernetes, nomad-docker, scratch, incus → all Success ``` `terraform fmt` / prettier applied. No `.terraform` artifacts or lockfiles committed. > [!NOTE] > Changes are confined to template `main.tf` files. The incus rework in particular adapts to the current `lxc/incus` provider schema; the token-via-cloud-init approach matches the sibling `bpmct/incus-*` templates. Generated with [Mux](https://mux.coder.com/).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Terraform templates (
registry/**/templates/**) were never validated by./scripts/terraform_validate.sh. Only modules were detected and checked, so broken template configs could merge undetected.Changes
scripts/terraform_validate.shTEMPLATE_CHANGED_FILESenv var alongsideMODULE_CHANGED_FILES.(modules|templates)/, so a changed file likeregistry/coder/templates/docker/main.tfresolves to its template directory and getsterraform validate+ the snake_case variable-name check.*/modules/*and*/templates/*..terraform/from the snake_casefind. Validating templates runsterraform init, which downloads child modules into.terraform/; without the prune, the check flagged variables in third-party module source (e.g.code-server'smachine-settings)..github/workflows/ci.yamltemplates: registry/**/templates/**paths-filter.TEMPLATE_CHANGED_FILESinto the "Run Terraform Validate" step.Validation
bash -nandshellcheck --severity=warning(the level CI enforces) are clean.SHARED_CHANGED=true ./scripts/terraform_validate.shagainst the full registry to confirm templates are now exercised. This surfaced pre-existing template breakages (unrelated to this PR) — e.g.agent_nameunsupported args and malformedjetbrainsmodule source addresses across severalcoder/*templates — which are exactly the failures this validation is meant to catch going forward.Note
This PR only wires up validation; it does not fix the individual broken templates it now surfaces. Those can be addressed in follow-up PRs.
Generated with Mux.