Add CI checks

Author: IlyaasK

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Go and docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: "1.15.5"
+          terraform_wrapper: false
+
+      - name: Check Go formatting
+        run: |
+          files="$(gofmt -l cmd internal)"
+          if [ -n "$files" ]; then
+            echo "$files"
+            exit 1
+          fi
+
+      - name: Check Terraform examples
+        run: terraform fmt -check -recursive examples
+
+      - name: Test
+        run: go test -short -timeout=2m ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Check generated docs
+        run: bash scripts/check-docs.sh

docs/teach.md

@@ -207,6 +207,14 @@ This repo's provider entrypoint lives in `cmd/terraform-provider-kernel`, so the
 
 `terraform providers schema -json` emits the full provider address `registry.terraform.io/kernel/kernel`. `tfplugindocs` expects the short provider name for rendering stable file names, so the temporary schema key is normalized to `kernel` before docs generation. That is a docs-tool adapter only; it does not change provider registration or Terraform runtime behavior.
 
+### PR12a CI Lesson
+
+CI should run the same boring checks a maintainer can run locally. ELI5: GitHub Actions is not a separate source of truth; it just repeats Go formatting, short Go tests, Go vet, Terraform example formatting, and generated-docs drift checks on every PR.
+
+The eblog-style fast-test boundary is explicit: PR CI runs `go test -short -timeout=2m ./...`; real Kernel acceptance tests stay behind `TF_ACC=1` and `KERNEL_ACC=1`. The docs check builds a temporary provider binary, asks Terraform for the provider schema, regenerates docs with `tfplugindocs`, validates the rendered docs, and then fails if generated docs changed or new generated docs appeared.
+
+The eblog-style Docker boundary is also explicit: this provider repo does not build a Docker image in CI because it ships a Go plugin binary, not a container. The docs check uses the runner's normal Go caches instead of forcing a throwaway cache, keeping the feedback path closer to Dockerfast's least-work/reuse-cache principle.
+
 ## Reviewer Learning Targets
 
 - Terraform state represents durable desired config, not temporary Kernel runtime state.

scripts/check-docs.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+workdir="$(mktemp -d "${TMPDIR:-/tmp}/kernel-tfdocs.XXXXXX")"
+tfplugindocs_version="${TFPLUGINDOCS_VERSION:-v0.25.0}"
+
+cleanup() {
+	rm -rf "$workdir"
+}
+trap cleanup EXIT
+
+command -v terraform >/dev/null || {
+	echo "terraform is required to check generated docs" >&2
+	exit 1
+}
+
+command -v jq >/dev/null || {
+	echo "jq is required to normalize the provider schema for tfplugindocs" >&2
+	exit 1
+}
+
+mkdir -p "$workdir/plugins" "$workdir/work"
+
+cd "$root"
+go build -o "$workdir/plugins/terraform-provider-kernel" ./cmd/terraform-provider-kernel
+
+cat >"$workdir/work/main.tf" <<'EOF'
+terraform {
+  required_providers {
+    kernel = {
+      source = "kernel/kernel"
+    }
+  }
+}
+
+provider "kernel" {
+  api_key = "placeholder"
+}
+EOF
+
+cat >"$workdir/terraformrc" <<EOF
+provider_installation {
+  dev_overrides {
+    "kernel/kernel" = "$workdir/plugins"
+  }
+
+  direct {}
+}
+EOF
+
+(
+	cd "$workdir/work"
+	TMPDIR="$workdir" TF_CLI_CONFIG_FILE="$workdir/terraformrc" CHECKPOINT_DISABLE=1 \
+		terraform providers schema -json >"$workdir/schema.json"
+)
+
+jq '.provider_schemas.kernel = .provider_schemas["registry.terraform.io/kernel/kernel"] | del(.provider_schemas["registry.terraform.io/kernel/kernel"])' \
+	"$workdir/schema.json" >"$workdir/schema-tfplugindocs.json"
+
+go run "github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@${tfplugindocs_version}" generate \
+	--provider-name kernel \
+	--rendered-provider-name Kernel \
+	--providers-schema "$workdir/schema-tfplugindocs.json"
+
+go run "github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@${tfplugindocs_version}" validate \
+	--provider-name kernel \
+	--providers-schema "$workdir/schema-tfplugindocs.json"
+
+doc_status="$(git status --porcelain -- docs/index.md docs/resources docs/data-sources)"
+if [ -n "$doc_status" ]; then
+	echo "$doc_status"
+	git diff -- docs/index.md docs/resources docs/data-sources
+	exit 1
+fi