feat: support .tofu file extension and update hooks/tools

Add support for the `.tofu` file extension in OpenTofu config
matching and documentation. Update pre-commit hooks, regex, and
README to reflect support for `.tofu` files alongside `.tf` and
`.tfvars`. Fix minor shell quoting and array assignment issues.
Upgrade pre-commit-hooks to v6.0.0.

Signed-off-by: Michael Rosenfeld <michael@rosesecurity.com>

.github/workflows/build-image.yaml

@@ -98,4 +98,3 @@ jobs:
           tags: |
             registry.hub.docker.com/tofuutils/pre-commit-opentofu:nightly
           provenance: false
-

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.5.0
+  rev: v6.0.0
   hooks:
     # Git style
     - id: check-added-large-files

Dockerfile

@@ -22,7 +22,7 @@ RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-comm
 
 RUN curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip \
     && curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_SHA256SUMS \
-    && [ $(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ') = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
+    && [ "$(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ')" = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
     && unzip tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/bin/ \
     && rm "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \
     && rm "tofu_${TOFU_VERSION}_SHA256SUMS"
@@ -235,4 +235,3 @@ ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-}
 ENV INFRACOST_SKIP_UPDATE_CHECK=${INFRACOST_SKIP_UPDATE_CHECK:-false}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
-

README.md

@@ -294,7 +294,7 @@ repos:
 
 ## Available Hooks
 
-There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
+There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (`*.tf`, `*.tofu`, and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
 
 <!-- markdownlint-disable no-inline-html -->
 | Hook name                                              | Description                                                                                                                                                                                                                                  | Dependencies<br><sup>[Install instructions here](#1-install-dependencies)</sup>      |
@@ -326,6 +326,8 @@ Check the [source file](https://github.com/tofuutils/pre-commit-opentofu/blob/ma
 
 OpenTofu operates on a per-dir basis, while `pre-commit` framework only supports files and files that exist. This means if you only remove the TF-related file without any other changes in the same dir, checks will be skipped. Example and details [here](https://github.com/pre-commit/pre-commit/issues/3048).
 
+Hooks match `*.tofu` files where OpenTofu configuration files are supported, but some wrapped third-party tools may lag behind OpenTofu's native `*.tofu` parsing. If a hook runs `terraform-docs`, `tflint`, `tfsec`, `trivy`, `checkov`, `infracost`, or `tfupdate`, make sure the installed tool version supports the file extensions used in your repository.
+
 ### All hooks: Usage of environment variables in `--args`
 
 > All, except deprecated hooks: `checkov`, `tofu_docs_replace`
@@ -930,7 +932,7 @@ To replicate functionality in `tofu_docs` hook:
             require_serial: true
             entry: .generate-providers.sh
             language: script
-            files: \.tf(vars)?$
+            files: \.(tf|tofu|tfvars)$
             pass_filenames: false
 
      - repo: https://github.com/pre-commit/pre-commit-hooks

hooks/_common.sh

@@ -123,7 +123,7 @@ function common::parse_and_export_env_vars {
         # `$arg` will be checked in `if` conditional, `$ARGS` will be used in the next functions.
         # shellcheck disable=SC2016 # '${' should not be expanded
         arg=${arg/'${'$env_var_name'}'/$env_var_value}
-        ARGS[$arg_idx]=$arg
+        ARGS[arg_idx]=$arg
         # shellcheck disable=SC2016 # '${' should not be expanded
         common::colorify "green" 'After ${'"$env_var_name"'} expansion: '"'$arg'\n"
         continue

hooks/terragrunt_validate_inputs.sh

@@ -32,8 +32,8 @@ function normalize_validate_args_for_modern_terragrunt {
 
   for arg_idx in "${!ARGS[@]}"; do
     case "${ARGS[$arg_idx]}" in
-      --terragrunt-strict-validate|--strict-validate)
-        ARGS[$arg_idx]="--strict"
+      --terragrunt-strict-validate | --strict-validate)
+        ARGS[arg_idx]="--strict"
         ;;
     esac
   done
@@ -45,7 +45,7 @@ function terragrunt_version_ge_0_78 {
   local major
   local minor
 
-  version_raw=$(terragrunt --version 2>/dev/null || true)
+  version_raw=$(terragrunt --version 2> /dev/null || true)
   version=$(echo "$version_raw" | sed -E 's/.*v?([0-9]+)\.([0-9]+)\.([0-9]+).*/\1.\2.\3/')
 
   if [[ ! $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -109,8 +109,8 @@ function legacy_unit_dirs_from_files {
   if common::is_hook_run_on_whole_repo "$HOOK_ID" "${FILES[@]}"; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' \
-      | sort -u | while read -r unit_file; do
+      -not -path '*/.terraform/*' |
+      sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return
@@ -137,8 +137,8 @@ function legacy_unit_dirs_from_files {
   if [[ ${#unit_files[@]} -eq 0 ]]; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' \
-      | sort -u | while read -r unit_file; do
+      -not -path '*/.terraform/*' |
+      sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return