ci: update GitHub workflows and PR template

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,12 +1,88 @@
-## what
-* Describe high-level what changed as a result of these commits (i.e. in plain-english, what do these changes mean?)
-* Use bullet points to be concise and to the point.
-
-## why
-* Provide the justifications for the changes (e.g. business case).
-* Describe why these changes were made (e.g. why do these commits fix the problem?)
-* Use bullet points to be concise and to the point.
-
-## references
-* Link to any supporting jira issues or helpful documentation to add some context (e.g. stackoverflow).
-* Use `closes #123`, if this PR closes a Jira issue `#123`
+## 📌 Description
+
+<!-- Provide a clear and concise summary of the changes in this PR, including the problem it solves and the approach taken -->
+
+---
+
+## 🔄 Type of Change
+
+<!-- Select all applicable options -->
+
+* [ ] 🐛 Bug fix (non-breaking change)
+* [ ] ✨ New resource / feature
+* [ ] ♻️ Refactoring
+* [ ] ⚡ Performance improvement
+* [ ] 🔒 Security improvement
+* [ ] 📝 Documentation update
+* [ ] ⚠️ BREAKING CHANGE
+* [ ] ⚙️ CI/CD update
+
+---
+
+## 🌍 Terraform Scope
+
+<!-- Indicate the area impacted by this PR -->
+
+* [ ] New resource added
+* [ ] Existing resource updated
+* [ ] Variable(s) modified
+* [ ] Output(s) modified
+* [ ] Provider / backend configuration change
+* [ ] CI/CD (Terraform workflow) update
+* [ ] Examples / usage updated
+
+---
+
+## ✅ Checklist
+
+<!-- Ensure all items are completed before requesting review -->
+
+* [ ] Code follows Terraform best practices
+* [ ] `terraform fmt -recursive` and `terraform validate` have been executed
+* [ ] `terraform plan` has been reviewed and changes are expected
+* [ ] Changes are backward compatible (or breaking changes are clearly documented)
+* [ ] Documentation has been updated (README, examples, etc.)
+* [ ] Variables and outputs are properly defined and documented
+* [ ] No sensitive data (secrets, credentials, keys) is exposed
+
+---
+
+## 🧩 Terraform Version & Providers
+
+<!-- Specify versions used for validation/testing -->
+
+* Terraform Version:
+* Provider(s):
+
+---
+
+## 🧪 Testing
+
+<!-- Describe how you validated your changes -->
+
+* [ ] Tested locally using `terraform plan` / `apply`
+* [ ] Tested in a staging / sandbox environment (if applicable)
+
+**Test Details:**
+
+<!-- Include commands, environment details, or notes -->
+
+---
+
+## 📸 Screenshots / Documentation
+
+<!-- Add screenshots or documentation references if applicable -->
+
+---
+
+## 🔗 Related Issues
+
+<!-- Link related issues using #issue_number -->
+
+Closes #
+
+---
+
+## 📝 Additional Notes
+
+<!-- Add any additional context, limitations, or reviewer guidance -->

.github/workflows/automerge.yml

@@ -1,3 +1,4 @@
+---
 name: Auto merge
 
 on:
@@ -17,3 +18,4 @@ jobs:
       tfchecks_azure: '["tf-lint / tflint"]'
     secrets:
       GITHUB: ${{ secrets.GITHUB }}
+...

.github/workflows/auto_assignee.yml → .github/workflows/pr-auto-assignee.yml

@@ -1,12 +1,16 @@
+---
 name: Auto Assign PRs
+
 on:
   pull_request:
     types: [opened, reopened]
+
   workflow_dispatch:
 jobs:
   assignee:
-    uses: clouddrove/github-shared-workflows/.github/workflows/auto_assignee.yml@master
+    uses: clouddrove/github-shared-workflows/.github/workflows/pr-auto-assignee.yml@v2
     secrets:
-      GITHUB: ${{ secrets.GITHUB }}
+      GITHUB: ${{ secrets.GITHUB_TOKEN }}
     with:
       assignees: 'clouddrove-ci'
+...

.github/workflows/pr-check.yml

@@ -0,0 +1,11 @@
+---
+name: 🔍 PR Checks
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+jobs:
+  pr-validation:
+    if: github.actor != 'dependabot[bot]'
+    uses: clouddrove/github-shared-workflows/.github/workflows/pr-checks.yml@v2
+...

.github/workflows/pre-commit.yml

@@ -1,3 +1,4 @@
+---
 name: pre-commit
 on:
   pull_request:
@@ -35,3 +36,4 @@ jobs:
 
       - name: Run pre-commit
         run: SKIP=terraform_validate,terraform_tflint pre-commit run -a --show-diff-on-failure || true
+...

.github/workflows/readme.yml

@@ -1,15 +1,16 @@
+---
 name: Readme Workflow
 on:
   push:
     branches:
       - master
     paths-ignore:
       - 'README.md'
-      - 'docs/**'
   workflow_dispatch:
 jobs:
   README:
-    uses: clouddrove/github-shared-workflows/.github/workflows/readme.yml@master
+    uses: clouddrove/github-shared-workflows/.github/workflows/readme.yml@v2
     secrets:
       TOKEN : ${{ secrets.GITHUB }}
       SLACK_WEBHOOK_TERRAFORM: ${{ secrets.SLACK_WEBHOOK_TERRAFORM }}
+...

.github/workflows/release-changelog.yml

@@ -0,0 +1,15 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  changelog:
+    uses: clouddrove/github-shared-workflows/.github/workflows/release-changelog.yml@v2
+    with:
+      branch: master
+      tag_format: vX.Y.Z
+      release_tag: ${{ github.ref_name }}
+    secrets:
+      GITHUB: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-tfsec.yml

@@ -0,0 +1,17 @@
+---
+name: tfsec
+permissions: write-all
+on:
+  pull_request:
+    paths:
+      - '**/*.tf'
+      - '*.tf'
+  workflow_dispatch:
+jobs:
+  tfsec:
+    if: github.actor != 'dependabot[bot]'
+    uses: clouddrove/github-shared-workflows/.github/workflows/security-tfsec.yml@v2
+    secrets: inherit
+    with:
+      working_directory: '.'
+...

.github/workflows/tf-checks.yml

@@ -1,17 +1,32 @@
+---
 name: tf-checks
+permissions:
+  id-token: write
+  contents: read
 on:
-  push:
-    branches: [ master ]
   pull_request:
-  workflow_dispatch:
+    paths:
+      - '**/*.tf'
+      - '*.tf'
 jobs:
   single-account-example:
-    uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master
+    if: github.actor != 'dependabot[bot]'
+    uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@v2
     with:
       working_directory: './examples/complete/'
-      provider: none
+      provider: aws
+      enable_plan: true
+      show_plan: false
+    secrets:
+      BUILD_ROLE: ${{ secrets.BUILD_ROLE }}
   main-account-example:
-    uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@master
+    if: github.actor != 'dependabot[bot]'
+    uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@v2
     with:
       working_directory: './examples/ecr_dashboard/'
-      provider: none
+      provider: aws
+      enable_plan: true
+      show_plan: false
+    secrets:
+      BUILD_ROLE: ${{ secrets.BUILD_ROLE }}
+...

.github/workflows/tflint.yml

@@ -1,11 +1,14 @@
+---
 name: tf-lint
 on:
-  push:
-    branches: [ master ]
   pull_request:
-  workflow_dispatch:
+    paths:
+      - '**/*.tf'
+      - '*.tf'
 jobs:
   tf-lint:
-    uses: clouddrove/github-shared-workflows/.github/workflows/tf-lint.yml@master
+    if: github.actor != 'dependabot[bot]'
+    uses: clouddrove/github-shared-workflows/.github/workflows/tf-lint.yml@v2
     secrets:
-      GITHUB: ${{ secrets.GITHUB }}
+      GITHUB: ${{ secrets.GITHUB_TOKEN }}
+...

commitlint.config.cjs

@@ -0,0 +1,12 @@
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'type-enum': [2, 'always', [
+      'fix', 'feat', 'docs', 'ci', 'chore', 'test', 'refactor', 'style', 'perf', 'build', 'revert',
+      'Fix', 'Feat', 'Docs', 'Ci', 'Chore', 'Test', 'Refactor', 'Style', 'Perf', 'Build', 'Revert' 
+      ]],
+    'header-max-length': [2, 'always', 150],
+    'subject-case': [0],
+    'type-case': [0],
+  }
+};