feat: add Packer composite actions and integration workflow

[posquit0]

CI building blocks for the packer-templates repository, restructured to follow the same convention as the terraform.* actions and integration workflows: the logic lives in composite actions and the workflows only wire them together.

Note

The Ansible half of this pull request (ansible.ansible-lint and ansible.integration.yaml) has been split out into #30 so it can be reviewed and adopted on its own. Nothing was shared between the two halves, so the Packer files here are unchanged by the split.

New composite actions

Action	Purpose
packer.fmt	packer fmt -check -diff, with an optional recursive (default true)
packer.validate	packer init followed by packer validate

Each takes target_dir and, on failure, appends its output to the job summary through github.step-summary, so a failed check is readable without opening the raw log.

packer.validate exports its github_token input as PACKER_GITHUB_API_TOKEN, which the plugin installer uses to avoid the anonymous GitHub API rate limit.

New reusable workflow

Workflow	Jobs	Purpose
packer.templates.integration.yaml	changed, lint, report	Resolve changed directories under builds/**, then fan out fmt and validate per directory

packer.templates.integration.yaml mirrors terraform.modules.integration.yaml: checks run with continue-on-error so one failure does not hide the others, github.matrix-report collects each directory's outcome, and the report job publishes a single table to the job summary and a sticky pull request comment. pr_comment_enabled (default true) turns the comment off.

Changes from the first revision of this PR

The original revision added reusable workflows that each carried their own inline logic. The current one differs in these ways.

• Composite actions instead of inline workflow steps, so packer-templates and any later caller share the same implementation.
• Tools come from mise, replacing hashicorp/setup-packer. Default versions go into a throwaway config under RUNNER_TEMP that MISE_GLOBAL_CONFIG_FILE points at, so a repository's own mise.toml or .tool-versions still wins and a self-hosted runner's real global config is never overwritten. This matters here: packer-templates pins packer 1.15.4 in .tool-versions, and the previous approach would have silently overridden it.
• packer_target_dir is now target_dir, matching every other <tool>.<action> in this repository.

Validation

yamllint (repo config), actionlint, and shellcheck pass.

Beyond the linters, every action's script was executed directly against a checkout of tedilabs/packer-templates:

Case	Result
packer fmt on a formatted directory	Passes
packer fmt on a deliberately unformatted copy	Exits non-zero, diff captured and rendered into the job summary
packer init and packer validate on builds/ubuntu-2604-docker	Pass
packer validate on a directory holding no template	Exits non-zero, error captured

Notes

aws_region defaults to us-east-1 and is exported as AWS_DEFAULT_REGION so an Amazon builder that does not set region explicitly still validates on a runner with no AWS configuration. No credentials are involved. Worth flagging that the current packer-templates builds validated cleanly without it, so this is defensive rather than something reproduced as necessary. It can be dropped if you would rather not carry the input.

Consumed by

tedilabs/packer-templates, which calls this workflow from its own integration workflow, alongside the Ansible workflow in #30.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

GitHub Actions Integration

Repository	actionlint	check-jsonschema (workflows)	check-jsonschema (actions)
tedilabs/github-actions	✅	✅	✅

✅ All 1 passed.

[posquit0]

Rebased onto main at bef73f1 (after #6, #8, #9, #11, #13) and aligned the three check actions with the interface every check action on main now has:

• Outputs skipped, stdout, stderr, exitcode on packer.fmt, packer.validate, and ansible.ansible-lint, matching the Terraform and GitHub Actions checks (and the hashicorp/setup-terraform wrapper). Where a prerequisite step exists (packer init, ansible-galaxy collection install), the outputs describe it when it failed and the main command otherwise, as terraform.validate and terraform.tflint do.
• shell.run replaces the 2>&1 | tee pipelines, so the capture logic lives in one place and the job summary reads its log_file output.
• Resolve step per action: trailing slash stripped, tool version printed there so it stays out of stdout, and skipped=true with a notice when the target holds no Packer HCL files (fmt), no Packer templates (validate), or no YAML files (ansible-lint) instead of a vacuous pass or a confusing failure.
• always() on the failure summary guards. On main the guards without it were being skipped after a failure; fix(actions): run the failure summary steps after a failed step #15 fixes the existing actions.
• packer.templates.integration report reports skipped and drops disabled checks, as the Terraform integration workflows do.

Runner verification: #17 (closed) ran all three actions from this branch against passing, failing, and empty fixtures, run https://github.com/tedilabs/github-actions/actions/runs/35453505149. 11/11 assertions passed, including exitcode=3 with the diff in stdout for an unformatted template and exitcode=2 with the findings for a playbook with issues. Locally: yamllint, actionlint, check-jsonschema, shellcheck, and a simulation of every resolve step. CI is green on the rebased head.

[posquit0]

Rebased onto main at d9539d0 (after #18, #20, #22, #23, #24), no conflicts, and brought the three checks onto the annotations_enabled interface that #24 and #26 give the Terraform and GitHub Actions checks:

• packer.fmt reads file and hunk line from the captured diff (+++ new/<file>, @@ -a,b +c,d @@); paths are already repository-relative because the directory is passed as an argument.
• packer.validate pairs each Error: <summary> line with the following on <file> line <n> line, since packer has no machine-readable output.
• ansible.ansible-lint turns the tool's own GitHub annotations off in the main run (GITHUB_ACTIONS=false), because their paths are relative to the project directory and their titles carry no tool name, and re-runs with -f json after a failure to emit annotations with target_dir prefixed and ansible-lint · <rule> as the title. Severity maps minor → warning, info → notice, anything else → error.

Runner verification: #28 (closed) ran all three against failing fixtures, run https://github.com/tedilabs/github-actions/actions/runs/35524387836:

Level	Location	Title
error	fixtures/annotations3/pk-fmt/build.pkr.hcl:1	packer fmt · Not formatted
error	fixtures/annotations3/pk-validate/build.pkr.hcl:3	packer validate · Unsupported argument
error	fixtures/annotations3/ansible/playbook.yml:4	ansible-lint · name[missing] / no-free-form
error	fixtures/annotations3/ansible/playbook.yml	ansible-lint · name[play] / fqcn[action-core]

stdout of the ansible-lint step carries no ::error lines, and annotations_enabled: "false" adds nothing. CI is green on the new head.

[posquit0]

Split the Ansible half out into #30 (ansible.ansible-lint composite action and ansible.integration.yaml), so it can be reviewed and adopted separately. Force-pushed this branch, rebased onto main at 8b38c0b (after #26), with the two Ansible commits dropped and the two mixed commits (refactor(actions): align …, feat(actions): annotate findings …) reapplied with only their Packer changes. The three Packer files are byte-identical to the previous head at 425a22c; only the two commit messages were reworded to drop the Ansible mentions.

[posquit0]

Good catch on -machine-readable — the comment was wrong and is now fixed, but I kept parsing the text output. Checked what the flag actually emits (packer 1.16.0 locally, on a template with two errors):

1789972601,,ui,error,Error: Unsupported argument\n\n  on multi.pkr.hcl line 3:\n ... \n\nError: Unsupported argument\n\n  on multi.pkr.hcl line 8:\n ...

It is the legacy Packer 1.x stream format (timestamp,target,type,data): every diagnostic of the run lands in a single ui,error record as the same human-readable text with \n escaped, with no file or line field, and commas inside the message are mangled — a Host must be specified%!(PACKER_COMMA) please reference your communicator documentation. Strictly worse than the text output for both annotations and the job summary, so the comment now says that instead.

While testing I found a real gap: a diagnostic that names no file, such as Error: Unset variable "needed", produced no annotation at all, because the summary was only emitted once an on <file> line <n> line followed it. It now falls back to a location-less annotation.

On the other flags — packer-templates has a default on every variable, no data blocks, one source per build directory, and .auto.pkrvars.hcl loads on its own, so -var/-var-file/-only/-except have nothing to do here yet; I left them out until a caller needs them. -evaluate-datasources I would rather not expose: Packer's own help says it may incur costs, and on a pull-request validate it would also want cloud credentials, so off is a property worth keeping. Added -syntax-only only, as syntax_only (default false), which also skips packer init — verified that a syntax-only check passes with no plugins installed while a full validate fails with Missing plugins, which is the situation that makes the flag worth having.

Not wired into packer.templates.integration.yaml, matching how recursive and annotations_enabled are action-level only there. Say the word if you want it on the workflow too.

Verified: annotator re-run against real packer validate logs for the location-less, two-diagnostic, comma-bearing, mixed, and empty cases; builds/ubuntu-2604-docker still passes both -syntax-only and a full validate; yamllint and shellcheck pass.

[posquit0]

Right — install_args was missing. Fixed in 1ee644e: the mise step now passes install_args: packer.

The cost was real: packer-templates/.tool-versions pins terraform 1.15.6 next to packer 1.15.4, so every leg of the matrix was installing Terraform that this workflow never runs. Both checks need packer and nothing else, so it is passed unconditionally rather than keyed off fmt_enabled / validate_enabled — an empty install_args falls back to installing everything, which is the case worth avoiding.

One difference from the Terraform integration workflows I left alone: they also pass working_directory: ${{ matrix.path }} so a mise.toml inside the module directory overrides the repository-wide one. packer-templates has no per-build mise config today, so I did not add it here. Happy to wire it up if you want the workflows symmetric.

[posquit0]

Agreed on both counts — 97c91d3.

• default-tools removed, along with the packer_version input. It was a workflow-side default written to a throwaway global mise config, which is exactly the thing feat(workflows)!: take Terraform tool versions from the repository's mise config #18 took out of the Terraform integration workflows; neither of them has an equivalent step or a version input today. Versions now come only from the calling repository's mise.toml / .tool-versions.
• working_directory: ${{ matrix.path }} added, so a mise.toml inside a build directory overrides the repository-wide one, same as the Terraform workflows pass the module directory. Safe against deleted directories, since the matrix is fed from changed.outputs.directories, which already drops paths that no longer exist in the checkout.

Companion change on the consumer side: tedilabs/packer-templates#17 folds .tool-versions into mise.toml, keeping packer 1.15.4 and terraform 1.15.6 as they were.