diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml index 3bf9105..a79e218 100644 --- a/.github/workflows/build-image.yaml +++ b/.github/workflows/build-image.yaml @@ -98,4 +98,3 @@ jobs: tags: | registry.hub.docker.com/tofuutils/pre-commit-opentofu:nightly provenance: false - diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 17fc5a6..e801df2 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.5.0 + rev: v6.0.0 hooks: # Git style - id: check-added-large-files diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml index 8af3d6e..d60a3e5 100644 --- a/.pre-commit-hooks.yaml +++ b/.pre-commit-hooks.yaml @@ -4,7 +4,7 @@ entry: hooks/infracost_breakdown.sh language: script require_serial: true - files: \.((tf|tofu)(vars)?|hcl)$ + files: \.(tf|tofu|tfvars|hcl)$ exclude: \.terraform\/.*$ - id: tofu_fmt @@ -12,7 +12,7 @@ description: Rewrites all OpenTofu configuration files to a canonical format. entry: hooks/tofu_fmt.sh language: script - files: \.(tf|tofu)(vars)?$ + files: \.(tf|tofu|tfvars|(tftest|tofutest|tfmock|tfquery)\.hcl)$ exclude: \.terraform\/.*$ - id: tofu_docs @@ -23,7 +23,7 @@ require_serial: true entry: hooks/tofu_docs.sh language: script - files: (\.(tf|tofu)|\.terraform\.lock\.hcl)$ + files: \.(tf|tofu|terraform\.lock\.hcl)$ exclude: \.terraform\/.*$ - id: tofu_docs_without_aggregate_type_defaults @@ -52,7 +52,7 @@ require_serial: true entry: hooks/tofu_validate.sh language: script - files: \.(tf|tofu)(vars)?$ + files: \.(tf|tofu|tfvars|terraform\.lock\.hcl)$ exclude: \.terraform\/.*$ - id: tofu_providers_lock @@ -70,7 +70,7 @@ require_serial: true entry: hooks/tofu_tflint.sh language: script - files: \.(tf|tofu)(vars)?$ + files: \.(tf|tofu|tfvars)$ exclude: \.terraform\/.*$ - id: terragrunt_fmt @@ -104,7 +104,7 @@ Static analysis of OpenTofu templates to spot potential security issues. require_serial: true entry: hooks/tofu_tfsec.sh - files: \.(tf|tofu)(vars)?$ + files: \.(tf|tofu|tfvars)$ language: script - id: tofu_trivy @@ -113,7 +113,7 @@ Static analysis of OpenTofu templates to spot potential security issues. require_serial: true entry: hooks/tofu_trivy.sh - files: \.(tf|tofu)(vars)?$ + files: \.(tf|tofu|tfvars)$ language: script - id: checkov @@ -123,7 +123,7 @@ language: python pass_filenames: false always_run: false - files: \.tf$ + files: \.(tf|tofu)$ exclude: \.terraform\/.*$ require_serial: true @@ -145,7 +145,7 @@ pass_filenames: false always_run: false require_serial: true - files: \.tf$ + files: \.(tf|tofu)$ exclude: \.terraform\/.*$ - id: terrascan diff --git a/Dockerfile b/Dockerfile index 1616bfd..6699cb2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,7 +22,7 @@ RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-comm RUN curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip \ && curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_SHA256SUMS \ - && [ $(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ') = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \ + && [ "$(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ')" = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \ && unzip tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/bin/ \ && rm "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \ && rm "tofu_${TOFU_VERSION}_SHA256SUMS" @@ -235,4 +235,3 @@ ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-} ENV INFRACOST_SKIP_UPDATE_CHECK=${INFRACOST_SKIP_UPDATE_CHECK:-false} ENTRYPOINT [ "/entrypoint.sh" ] - diff --git a/README.md b/README.md index afb9387..c5f25a9 100644 --- a/README.md +++ b/README.md @@ -294,7 +294,7 @@ repos: ## Available Hooks -There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape: +There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (`*.tf`, `*.tofu`, and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape: | Hook name | Description | Dependencies
[Install instructions here](#1-install-dependencies) | @@ -326,6 +326,8 @@ Check the [source file](https://github.com/tofuutils/pre-commit-opentofu/blob/ma OpenTofu operates on a per-dir basis, while `pre-commit` framework only supports files and files that exist. This means if you only remove the TF-related file without any other changes in the same dir, checks will be skipped. Example and details [here](https://github.com/pre-commit/pre-commit/issues/3048). +Hooks match `*.tofu` files where OpenTofu configuration files are supported, but some wrapped third-party tools may lag behind OpenTofu's native `*.tofu` parsing. If a hook runs `terraform-docs`, `tflint`, `tfsec`, `trivy`, `checkov`, `infracost`, or `tfupdate`, make sure the installed tool version supports the file extensions used in your repository. + ### All hooks: Usage of environment variables in `--args` > All, except deprecated hooks: `checkov`, `tofu_docs_replace` @@ -930,7 +932,7 @@ To replicate functionality in `tofu_docs` hook: require_serial: true entry: .generate-providers.sh language: script - files: \.tf(vars)?$ + files: \.(tf|tofu|tfvars)$ pass_filenames: false - repo: https://github.com/pre-commit/pre-commit-hooks diff --git a/hooks/_common.sh b/hooks/_common.sh index 3f4bdc4..5808c19 100644 --- a/hooks/_common.sh +++ b/hooks/_common.sh @@ -123,7 +123,7 @@ function common::parse_and_export_env_vars { # `$arg` will be checked in `if` conditional, `$ARGS` will be used in the next functions. # shellcheck disable=SC2016 # '${' should not be expanded arg=${arg/'${'$env_var_name'}'/$env_var_value} - ARGS[$arg_idx]=$arg + ARGS[arg_idx]=$arg # shellcheck disable=SC2016 # '${' should not be expanded common::colorify "green" 'After ${'"$env_var_name"'} expansion: '"'$arg'\n" continue diff --git a/hooks/terragrunt_validate_inputs.sh b/hooks/terragrunt_validate_inputs.sh index a7b0f78..a406324 100755 --- a/hooks/terragrunt_validate_inputs.sh +++ b/hooks/terragrunt_validate_inputs.sh @@ -32,8 +32,8 @@ function normalize_validate_args_for_modern_terragrunt { for arg_idx in "${!ARGS[@]}"; do case "${ARGS[$arg_idx]}" in - --terragrunt-strict-validate|--strict-validate) - ARGS[$arg_idx]="--strict" + --terragrunt-strict-validate | --strict-validate) + ARGS[arg_idx]="--strict" ;; esac done @@ -45,7 +45,7 @@ function terragrunt_version_ge_0_78 { local major local minor - version_raw=$(terragrunt --version 2>/dev/null || true) + version_raw=$(terragrunt --version 2> /dev/null || true) version=$(echo "$version_raw" | sed -E 's/.*v?([0-9]+)\.([0-9]+)\.([0-9]+).*/\1.\2.\3/') if [[ ! $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then @@ -109,8 +109,8 @@ function legacy_unit_dirs_from_files { if common::is_hook_run_on_whole_repo "$HOOK_ID" "${FILES[@]}"; then find . -type f -name terragrunt.hcl \ -not -path '*/.terragrunt-cache/*' \ - -not -path '*/.terraform/*' \ - | sort -u | while read -r unit_file; do + -not -path '*/.terraform/*' | + sort -u | while read -r unit_file; do dirname "$unit_file" done return @@ -137,8 +137,8 @@ function legacy_unit_dirs_from_files { if [[ ${#unit_files[@]} -eq 0 ]]; then find . -type f -name terragrunt.hcl \ -not -path '*/.terragrunt-cache/*' \ - -not -path '*/.terraform/*' \ - | sort -u | while read -r unit_file; do + -not -path '*/.terraform/*' | + sort -u | while read -r unit_file; do dirname "$unit_file" done return diff --git a/hooks/tofu_wrapper_module_for_each.sh b/hooks/tofu_wrapper_module_for_each.sh index c87db22..4572b58 100755 --- a/hooks/tofu_wrapper_module_for_each.sh +++ b/hooks/tofu_wrapper_module_for_each.sh @@ -315,7 +315,7 @@ EOF all_tf_content=$(find "${full_module_dir}" -regex '.*\.(tf|tofu)' -maxdepth 1 -type f -exec cat {} +) if [[ ! $all_tf_content ]]; then - common::colorify "yellow" "Skipping ${full_module_dir} because there are no *.(tf|tofu) files." + common::colorify "yellow" "Skipping ${full_module_dir} because there are no .tf or .tofu files." continue fi