Fix expand pipeline: stale cleanup, tf-plan checkout, terraform fmt

.github/workflows/expand-terraform.yml

@@ -49,6 +49,11 @@ jobs:
             scripts
             terraform/modules
 
+      - uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: "1.7"
+          terraform_wrapper: false
+
       - name: Expand modules from app.yaml
         env:
           APP_SERVICE: ${{ github.event.repository.name }}

.github/workflows/tf-plan.yml

@@ -42,6 +42,8 @@ jobs:
       PLAN_BUCKET: javabin-ci-plan-artifacts-${{ inputs.aws_account_id }}
     steps:
       - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.ref }}
 
       - uses: hashicorp/setup-terraform@v4
         with:

scripts/expand-modules.py

@@ -695,6 +695,20 @@ def main():
                     f.write(f'  {ds["body"]}\n')
                     f.write("}\n")
 
+    # -- Clean up stale generated files --
+    generated_filenames = {"backend.tf", "providers.tf", "outputs.tf"}
+    generated_filenames.update(file_contents.keys())
+
+    for f in os.listdir(tf_root):
+        if not f.endswith(".tf") or f in generated_filenames:
+            continue
+        filepath = os.path.join(tf_root, f)
+        with open(filepath) as fh:
+            first_line = fh.readline()
+        if GENERATED_MARKER in first_line:
+            os.remove(filepath)
+            print(f"  removed stale {f}")
+
     # -- Fingerprint --
     import hashlib
     with open(app_yaml_path, "rb") as f: