Add CI checks

[IlyaasK]

What changed

• Added a GitHub Actions CI workflow for PRs and pushes to main.
• Added scripts/check-docs.sh to regenerate and validate Terraform docs from the real provider schema.
• Made PR CI follow the eblog-style fast-test boundary with go test -short -timeout=2m ./....
• Kept Docker out of this CI slice because the provider ships a Go plugin binary, not a container image.
• Updated docs/teach.md with the CI/test-speed lesson.

Intentionally unsupported

• No browser/session runtime operations: acquire, release, flush, app invocation, logs, screenshots, live view, or force recovery.
• No acceptance tests in default CI; real Kernel acceptance remains opt-in via TF_ACC=1, KERNEL_ACC=1, and Kernel credentials.
• No Docker build, registry push, release signing, or GoReleaser wiring in this slice. Release/security checklist work stays in the next PR.

Tests run

• bash -n scripts/check-docs.sh
• terraform fmt -check -recursive examples
• GOCACHE=/private/tmp/terraform-provider-kernel-ci-go-cache go test -short -timeout=2m ./...
• GOCACHE=/private/tmp/terraform-provider-kernel-ci-go-cache go vet ./...
• files="$(gofmt -l cmd internal)"; if [ -n "$files" ]; then echo "$files"; exit 1; fi
• git diff --check generated-terraform-docs
• bash scripts/check-docs.sh

Review gates

All five gates passed after the accepted autoreview fix:

• deslop
• autoreview
• thermo-nuclear-code-quality-review
• dave-cheney-go-review
• eblog-code-review

---

Note

Low Risk
CI and documentation drift checks only; no runtime, auth, or provider behavior changes in this diff.

Overview
Adds GitHub Actions CI on pull requests and pushes to main with read-only repo permissions and a 10-minute job timeout.

The workflow runs Go formatting (gofmt on cmd and internal), Terraform example formatting, go test -short -timeout=2m ./..., go vet, and a generated docs gate via new scripts/check-docs.sh. That script regenerates provider docs through scripts/generate-docs.sh and fails CI if docs/index.md, docs/resources, or docs/data-sources drift from what’s committed.

^{Reviewed by Cursor Bugbot for commit 48e3b33. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

PRs in the kernel, infra, hypeman, and hypeship repos. kernel is a ~mono repo with many logical services underneath, ensure to focus on the implicated service for the PR

Reason: PR targets the generated-terraform-docs branch and appears to be for a Terraform provider repository, not one of the specified repos (kernel, infra, hypeman, hypeship); please opt in manually if deploy monitoring is needed.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9dad510. Configure here.}

[cursor]

Docs drift check misses paths

Medium Severity

The generated-docs gate only runs git status on docs/index.md, docs/resources, and docs/data-sources. tfplugindocs can also write under docs/guides, docs/functions, and docs/ephemeral-resources, so new or changed files there would not fail CI despite the PR describing detection of any new generated docs.

 

^{Reviewed by Cursor Bugbot for commit 9dad510. Configure here.}