Adds GitHub action for linting documentation

.actrc

@@ -0,0 +1,2 @@
+# Needed for testing our workflows
+-P ubuntu-latest=nektos/act-environments-ubuntu:18.04

.github/workflows/README.md

@@ -17,8 +17,4 @@ steps:
 
 The tool [`act`](https://github.com/nektos/act) can be used to test GitHub workflows locally. The default container [intentionally does not have feature parity](https://github.com/nektos/act#default-runners-are-intentionally-incomplete) with the containers used in GitHub due to the size of a full container.
 
-A fully-featured container can be used by specifying a different container.
-
-```console
-act -P ubuntu-latest=nektos/act-environments-ubuntu:18.04
-```
+The file `./actrc` configures `act` to use a fully-featured container.

.github/workflows/validate-terraform.yml

@@ -0,0 +1,98 @@
+name: Website Checks
+on:
+  push:
+    branches:
+      - master
+      - 'release/**'
+  pull_request:
+    paths:
+      - .github/workflows/validate-terraform.yml
+      - website/docs/**
+
+jobs:
+  validate-code:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/cache@v2
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('go.sum') }}
+      - uses: actions/setup-go@v2
+        with:
+          go-version: "1.14"
+      - name: install terrafmt
+        run: |
+          # go get github.com/katbyte/terrafmt
+          git clone --branch json-output --single-branch https://github.com/gdavison/terrafmt terrafmt
+          cd terrafmt
+          go install
+      - name: install tflint
+        env:
+          TFLINT_VERSION: "v0.18.0"
+        run: |
+          curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | sh
+      - name: lint code
+        shell: bash
+        run: |
+          # Configure the rules for tflint.
+          # The *_invalid_* rules disabled here prevent evaluation of expressions.
+          # Do not disable *_invalid_name rules, since these are good checks for e.g. "%s" formatting verbs
+          # being carried over from test cases.
+          shared_rules=(
+            "--enable-rule=terraform_comment_syntax"
+            "--disable-rule=aws_cognito_user_pool_domain_invalid_domain"
+            "--disable-rule=aws_db_instance_default_parameter_group"
+            "--disable-rule=aws_elasticache_cluster_default_parameter_group"
+            "--disable-rule=aws_iam_saml_provider_invalid_saml_metadata_document"
+            "--disable-rule=aws_iam_server_certificate_invalid_certificate_body"
+            "--disable-rule=aws_iam_server_certificate_invalid_private_key"
+            "--disable-rule=aws_transfer_ssh_key_invalid_body"
+            "--disable-rule=aws_worklink_website_certificate_authority_association_invalid_certificate"
+          )
+          for filename in $(find ./website -type f \( -name '*.md' -o -name '*.markdown' \) | sort -u); do
+            exit_code=0
+            block_number=0
+
+            rules=("${shared_rules[@]}")
+            if [[ "$filename" == "./website/docs/guides/version-2-upgrade.html.md" ]]; then
+              # ./website/docs/guides/version-2-upgrade.html.md should still include pre-0.12 syntax,
+              # since v1.0 does not support Terraform 0.12.
+              rules+=(
+                "--disable-rule=terraform_deprecated_interpolation"
+                "--disable-rule=terraform_deprecated_index"
+              )
+            else
+              rules+=(
+                "--enable-rule=terraform_deprecated_interpolation"
+                "--enable-rule=terraform_deprecated_index"
+              )
+            fi
+
+            while IFS= read -r block ; do
+              ((block_number+=1))
+              start_line=$(echo "$block" | jq '.start_line')
+              end_line=$(echo "$block" | jq '.end_line')
+              text=$(echo "$block" | jq --raw-output '.text')
+
+              td=$(mktemp -d)
+              tf="$td/main.tf"
+
+              echo "$text" > "$tf"
+
+              # We need to capture the output and error code here. We don't want to exit on the first error
+              set +e
+              tflint_output=$(tflint "${rules[@]}" "$tf" 2>&1)
+              tflint_exitcode=$?
+              set -e
+
+              if [ $tflint_exitcode -ne 0 ]; then
+                echo "ERROR: File \"$filename\", block #$block_number (lines $start_line-$end_line):"
+                echo "$tflint_output"
+                echo
+                exit_code=1
+              fi
+            done < <( terrafmt blocks --json "$filename" | jq --compact-output '.blocks[]?' )
+          done
+
+          exit $exit_code