Install OpenTofu 1.8 or newer, Python 3 and, for the policy tests, OPA 1.21.0, then:

# cost gate: totals the planned resources and compares with docs/stages/approved.json
python3 -I scripts/cost_check.py --root .

# the settings page must match docs/settings.json
python3 -I scripts/gen_settings_doc.py --check
python3 -I scripts/gen_project_status.py --check

# the repository tests (needs a virtualenv with pytest and pyyaml installed)
python3 -I -m pytest tests -q

# no cloud account ids in tracked files
python3 -I scripts/identifier_check.py --root .

# tests for the Spacelift push policy
opa test .spacelift/policies -v

# tests for one module or stack (no cloud account needed, providers are mocked)
tofu -chdir=modules/firewall init -backend=false
tofu -chdir=modules/firewall test

Run the last pair for each directory in the directories list of the tofu job in .github/workflows/ci.yml: modules/vpc, modules/firewall, modules/twingate-bootstrap, modules/twingate-connector, modules/edge-host, modules/docker-host, modules/spaces-bucket, modules/aws/vpc, modules/aws/firewall, modules/aws/twingate-connector, stacks/00-foundation, stacks/10-access, stacks/20-telemetry, stacks/30-workloads, stacks/50-edge, stacks/aws/00-foundation and stacks/aws/10-access. CI runs all of it through git-your-ship-together's shared workflows; the only job this repository defines itself is the CI green gate.