Disable terraform-docs push when on forks and sign commit

.github/workflows/ci.yaml

@@ -5,6 +5,11 @@ on:
 jobs:
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      # Give the default GITHUB_TOKEN write permission to commit and push the
+      # added or changed files to the repository.
+      contents: write
+
     steps:
       # Setup dependencies
       - uses: actions/checkout@v4
@@ -34,5 +39,12 @@ jobs:
           output-method: inject
           fail-on-diff: true
           args: --lockfile=false
-          git-push: "true" # automatically push the changes to the branch
+          git-push: 'false'
+          fail-on-diff: github.repository_owner != 'runatlantis' # Fail on diff for forks
 
+      # Push Terraform-docs changes
+      - uses: stefanzweifel/git-auto-commit-action@v5
+        if: github.repository_owner == 'runatlantis' # skip for forks
+        with:
+          commit_message: "terraform-docs: automated action"
+          file_pattern: 'README.md'

README.md

@@ -247,7 +247,7 @@ You can check the status of the certificate in the Google Cloud Console.
 | <a name="input_iap_backend_security_policy"></a> [iap\_backend\_security\_policy](#input\_iap\_backend\_security\_policy) | Name of the security policy to apply to the IAP backend service | `string` | `null` | no |
 | <a name="input_image"></a> [image](#input\_image) | Docker image. This is most often a reference to a container located in a container registry | `string` | `"ghcr.io/runatlantis/atlantis:latest"` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | Key-value pairs representing labels attaching to instance & instance template | `map(any)` | `{}` | no |
-| <a name="input_machine_image"></a> [machine\_image](#input\_machine\_image) | The machine image to create VMs with, if not specified, latest cos\_cloud/cos\_stable is used | `string` | `null` | no |
+| <a name="input_machine_image"></a> [machine\_image](#input\_machine\_image) | The machine image to create VMs with, if not specified, latest cos\_cloud/cos\_stable is used. To pin to one, use the following format: projects/cos-cloud/global/images/cos-stable-109-17800-147-54 | `string` | `null` | no |
 | <a name="input_machine_type"></a> [machine\_type](#input\_machine\_type) | The machine type to run Atlantis on | `string` | `"n2-standard-2"` | no |
 | <a name="input_name"></a> [name](#input\_name) | Custom name that's used during resource creation | `string` | n/a | yes |
 | <a name="input_network"></a> [network](#input\_network) | Name of the network | `string` | n/a | yes |