feat(actions): annotate findings from terraform fmt, terraform-docs, and check-jsonschema

[posquit0]

👋 Background

• feat(actions): annotate the failing lines from validate, tflint, and actionlint #24 gave terraform.validate, terraform.tflint, and github-actions.actionlint line annotations with the tool named in the title. This PR brings the remaining three check actions on main onto the same annotations_enabled interface. The Packer and Ansible checks follow in feat: add Packer composite actions and integration workflow #1.

🔗 Related Issues

• Follow-up to feat(actions): annotate the failing lines from validate, tflint, and actionlint #24.

⚙️ Description

All three gain annotations_enabled (default true) and an Annotate Findings step that runs only after a failure and never fails the action.

Action	Source of the annotation	Line	Title
terraform.fmt	the captured diff: +++ new/<file> names the file, @@ -a,b +c,d @@ the first changed line of each hunk	yes	terraform fmt · Not formatted
terraform.docs	the captured Error: <path> is out of date line (only with check: true)	no, file-level	terraform-docs · Out of date
github-actions.check-jsonschema	re-run with --output-format json; errors[].filename and path	no, file-level; schema validation has no line numbers	check-jsonschema · <schema_type> with the JSON path in the message

• terraform and terraform-docs print paths relative to the module, so target_dir is prefixed; check-jsonschema reports the repository-relative files it was given.
• terraform.fmt and terraform.docs need no re-run since the captured output already carries the information.

Verification

• yamllint, check-jsonschema, and shellcheck pass.
• Each annotate script was run locally against real tool output (Terraform 1.16.3, terraform-docs 0.24.0, check-jsonschema 0.38.0): a recursive fmt diff yields one annotation per hunk with the module prefix, a recursive docs check names the stale submodule README, and a broken workflow yields a file annotation carrying $.jobs.x and the schema message.
• Runner verification through a temporary PR is linked in a comment below.

---

🚨 To Reviewers

• terraform-docs stops at the first stale file, so at most one annotation per check run.
• The 10-per-level cap per step from feat(actions): annotate the failing lines from validate, tflint, and actionlint #24 applies here too; a large fmt diff annotates its first ten hunks.

[github-actions]

GitHub Actions Integration

Repository	actionlint	check-jsonschema (workflows)	check-jsonschema (actions)
tedilabs/github-actions	✅	✅	✅

✅ All 1 passed.

[posquit0]

Runner verification: #27 (closed) ran the three actions from this branch against failing fixtures, run https://github.com/tedilabs/github-actions/actions/runs/35524249993. Annotations recorded on the job:

Level	Location	Title	Message
error	fixtures/annotations2/tf/main.tf:1	terraform fmt · Not formatted	Run terraform fmt to format this file.
error	fixtures/annotations2/tf/sub/out.tf:1	terraform fmt · Not formatted	Run terraform fmt to format this file.
error	fixtures/annotations2/docs/README.md	terraform-docs · Out of date	Regenerate this file with terraform-docs.
error	fixtures/annotations2/workflows/bad.yaml	check-jsonschema · workflows	$.jobs.x: … is not valid under any of the given schemas
error	fixtures/annotations2/actions/bad/action.yaml	check-jsonschema · actions	$: 'description' is a required property
error	fixtures/annotations2/actions/bad/action.yaml	check-jsonschema · actions	$.runs: … is not valid under any of the given schemas

fmt ran a second time with annotations_enabled: "false" and added nothing.