feat(opentofu): add init-backend input for credential-free lint jobs

[nkg]

Summary

A fmt/validate-only job on a configuration that has a backend block cannot run tofu init bare — the S3 backend resolves credentials during init, so the job dies with No valid credential sources found before validate is ever reached. The configuration is fine; the job simply has no business holding state-write credentials in order to lint HCL.

init-backend: false passes -backend=false, which initialises providers and modules and skips the backend entirely.

Surfaced by HordiaLabs/platform moving its OpenTofu state to Cloudflare R2 (HordiaLabs/platform#26): three stacks that had been linting green on local state went red the moment the backend blocks landed. No Linear issue.

Changes

• .github/workflows/opentofu.yml
  • New init-backend boolean input, default true.
  • New guard step: init-backend: false together with run-plan: true is a contradiction (plan needs state), so it now fails fast with an explicit ::error:: rather than surfacing as a confusing failure two steps later.
• CHANGELOG.md — entry under [Unreleased].
• examples/README.md — lint-only example alongside the existing OpenTofu one.

No new dependencies.

Test Plan

• actionlint clean across the repo
• yamllint clean on the changed workflow
• Reproduced the failure locally: tofu init against an R2 backend "s3" with no credentials → No valid credential sources found
• Verified the fix locally: tofu init -backend=false && tofu validate → Success! The configuration is valid. on all three platform stacks
• Consumer run green on HordiaLabs/platform once this is released

Notes for Reviewers

Default is true, so every existing caller produces a byte-identical command line — the new flag is only appended when explicitly set to false. That is the main thing to check.

Needs a v3.2.0 tag after merge: HordiaLabs/platform#26 pins @v3 and passes this input, so it stays red until the floating v3 tag moves.

I did not backport to the v2 line. The release process is tag-from-main, v3 is the current line, and this is a new feature rather than a fix — but say the word if v2.18.0 is wanted too, since most consumers are still on @v2.

🤖 Generated with Claude Code

https://claude.ai/code/session_017EDkXRcCrVDfu2e8V9Yy52