.github/workflows/build-image.yaml

@@ -98,3 +98,4 @@ jobs:
           tags: |
             registry.hub.docker.com/tofuutils/pre-commit-opentofu:nightly
           provenance: false
+

.github/workflows/pre-commit.yaml

@@ -27,13 +27,9 @@ jobs:
         sudo apt update && sudo apt install shellcheck
 
     - name: Install hadolint
-      env:
-        GH_TOKEN: ${{ github.token }}
       run: |
-        gh release download v2.14.0 --repo hadolint/hadolint --pattern "hadolint-linux-x86_64"
+        curl -L "$(curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest | grep -o -E -m 1 "https://.+?/hadolint-Linux-x86_64")" > hadolint \
-        mv hadolint-linux-x86_64 hadolint
+        && chmod +x hadolint && sudo mv hadolint /usr/bin/
-        chmod +x hadolint
-        sudo mv hadolint /usr/bin/
     # Need to success pre-commit fix push
     - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v6.0.0
+  rev: v4.5.0
   hooks:
     # Git style
     - id: check-added-large-files

.pre-commit-hooks.yaml

@@ -4,7 +4,7 @@
   entry: hooks/infracost_breakdown.sh
   language: script
   require_serial: true
-  files: \.(tf|tofu|tfvars|hcl)$
+  files: \.((tf|tofu)(vars)?|hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_fmt
@@ -12,7 +12,7 @@
   description: Rewrites all OpenTofu configuration files to a canonical format.
   entry: hooks/tofu_fmt.sh
   language: script
-  files: \.(tf|tofu|tfvars|(tftest|tofutest|tfmock|tfquery)\.hcl)$
+  files: \.(tf|tofu)(vars)?$
   exclude: \.terraform\/.*$
 
 - id: tofu_docs
@@ -23,7 +23,7 @@
   require_serial: true
   entry: hooks/tofu_docs.sh
   language: script
-  files: \.(tf|tofu|terraform\.lock\.hcl)$
+  files: (\.(tf|tofu)|\.terraform\.lock\.hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_docs_without_aggregate_type_defaults
@@ -52,7 +52,7 @@
   require_serial: true
   entry: hooks/tofu_validate.sh
   language: script
-  files: \.(tf|tofu|tfvars|terraform\.lock\.hcl)$
+  files: \.(tf|tofu)(vars)?$
   exclude: \.terraform\/.*$
 
 - id: tofu_providers_lock
@@ -70,7 +70,7 @@
   require_serial: true
   entry: hooks/tofu_tflint.sh
   language: script
-  files: \.(tf|tofu|tfvars)$
+  files: \.(tf|tofu)(vars)?$
   exclude: \.terraform\/.*$
 
 - id: terragrunt_fmt
@@ -104,7 +104,7 @@
     Static analysis of OpenTofu templates to spot potential security issues.
   require_serial: true
   entry: hooks/tofu_tfsec.sh
-  files: \.(tf|tofu|tfvars)$
+  files: \.(tf|tofu)(vars)?$
   language: script
 
 - id: tofu_trivy
@@ -113,7 +113,7 @@
     Static analysis of OpenTofu templates to spot potential security issues.
   require_serial: true
   entry: hooks/tofu_trivy.sh
-  files: \.(tf|tofu|tfvars)$
+  files: \.(tf|tofu)(vars)?$
   language: script
 
 - id: checkov
@@ -123,7 +123,7 @@
   language: python
   pass_filenames: false
   always_run: false
-  files: \.(tf|tofu)$
+  files: \.tf$
   exclude: \.terraform\/.*$
   require_serial: true
 
@@ -145,7 +145,7 @@
   pass_filenames: false
   always_run: false
   require_serial: true
-  files: \.(tf|tofu)$
+  files: \.tf$
   exclude: \.terraform\/.*$
 
 - id: terrascan

CHANGELOG.md

@@ -2,27 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [2.4.1](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.4.0...v2.4.1) (2026-06-01)
-
-
-### Bug Fixes
-
-* initialize config_file_no_color variable ([b766f82](https://github.com/tofuutils/pre-commit-opentofu/commit/b766f82b087793f75b3ffa61eb22da80031455ce))
-* typo fixes ([3f263a9](https://github.com/tofuutils/pre-commit-opentofu/commit/3f263a968cd776924c3d1f4981e0fbf1cd79ff4d))
-* Update hadolint installation ([c9cd4a8](https://github.com/tofuutils/pre-commit-opentofu/commit/c9cd4a805d378516a24dac33278fa51deb98bf2e))
-
-# [2.4.0](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.3.0...v2.4.0) (2026-05-25)
-
-
-### Bug Fixes
-
-* expand file extension patterns for tofu hooks ([451aaa5](https://github.com/tofuutils/pre-commit-opentofu/commit/451aaa59b552eb3913629c835af8b6b568aab120))
-
-
-### Features
-
-* support .tofu file extension and update hooks/tools ([9624cc8](https://github.com/tofuutils/pre-commit-opentofu/commit/9624cc8f24177378449203194b4f0ee71bc6c1a0))
-
 # [2.3.0](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.2.2...v2.3.0) (2026-04-21)
 
 
@@ -57,7 +36,7 @@ All notable changes to this project will be documented in this file.
 
 ### Features
 
-* support .tofu files ([#6](https://github.com/tofuutils/pre-commit-opentofu/issues/6)) ([e059c58](https://github.com/tofuutils/pre-commit-opentofu/commit/e059c5859bceddf1ca018f55851f6940ad51f1c2))
+* spport .tofu files ([#6](https://github.com/tofuutils/pre-commit-opentofu/issues/6)) ([e059c58](https://github.com/tofuutils/pre-commit-opentofu/commit/e059c5859bceddf1ca018f55851f6940ad51f1c2))
 
 # [2.0.0](https://github.com/tofuutils/pre-commit-opentofu/compare/v1.0.4...v2.0.0) (2024-09-25)
 

Dockerfile

@@ -22,7 +22,7 @@ RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-comm
 
 RUN curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip \
     && curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_SHA256SUMS \
-    && [ "$(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ')" = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
+    && [ $(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ') = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
     && unzip tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/bin/ \
     && rm "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \
     && rm "tofu_${TOFU_VERSION}_SHA256SUMS"
@@ -235,3 +235,4 @@ ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-}
 ENV INFRACOST_SKIP_UPDATE_CHECK=${INFRACOST_SKIP_UPDATE_CHECK:-false}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
+

README.md

@@ -294,7 +294,7 @@ repos:
 
 ## Available Hooks
 
-There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (`*.tf`, `*.tofu`, and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
+There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
 
 <!-- markdownlint-disable no-inline-html -->
 | Hook name                                              | Description                                                                                                                                                                                                                                  | Dependencies<br><sup>[Install instructions here](#1-install-dependencies)</sup>      |
@@ -326,8 +326,6 @@ Check the [source file](https://github.com/tofuutils/pre-commit-opentofu/blob/ma
 
 OpenTofu operates on a per-dir basis, while `pre-commit` framework only supports files and files that exist. This means if you only remove the TF-related file without any other changes in the same dir, checks will be skipped. Example and details [here](https://github.com/pre-commit/pre-commit/issues/3048).
 
-Hooks match `*.tofu` files where OpenTofu configuration files are supported, but some wrapped third-party tools may lag behind OpenTofu's native `*.tofu` parsing. If a hook runs `terraform-docs`, `tflint`, `tfsec`, `trivy`, `checkov`, `infracost`, or `tfupdate`, make sure the installed tool version supports the file extensions used in your repository.
-
 ### All hooks: Usage of environment variables in `--args`
 
 > All, except deprecated hooks: `checkov`, `tofu_docs_replace`
@@ -718,7 +716,7 @@ To replicate functionality in `tofu_docs` hook:
         - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
     ```
 
-3. By default, pre-commit-opentofu performs directory switching into the OpenTofu modules for you. If you want to delegate the directory changing to the binary - this will allow tflint to determine the full paths for error/warning messages, rather than just module relative paths. *Note: this requires `tflint>=0.44.0`.* For example:
+3. By default, pre-commit-opentofu performs directory switching into the OpenTofu modules for you. If you want to delgate the directory changing to the binary - this will allow tflint to determine the full paths for error/warning messages, rather than just module relative paths. *Note: this requires `tflint>=0.44.0`.* For example:
 
     ```yaml
     - id: tofu_tflint
@@ -932,7 +930,7 @@ To replicate functionality in `tofu_docs` hook:
             require_serial: true
             entry: .generate-providers.sh
             language: script
-            files: \.(tf|tofu|tfvars)$
+            files: \.tf(vars)?$
             pass_filenames: false
 
      - repo: https://github.com/pre-commit/pre-commit-hooks

hooks/_common.sh

@@ -123,7 +123,7 @@ function common::parse_and_export_env_vars {
         # `$arg` will be checked in `if` conditional, `$ARGS` will be used in the next functions.
         # shellcheck disable=SC2016 # '${' should not be expanded
         arg=${arg/'${'$env_var_name'}'/$env_var_value}
-        ARGS[arg_idx]=$arg
+        ARGS[$arg_idx]=$arg
         # shellcheck disable=SC2016 # '${' should not be expanded
         common::colorify "green" 'After ${'"$env_var_name"'} expansion: '"'$arg'\n"
         continue

hooks/terragrunt_validate_inputs.sh

@@ -33,7 +33,7 @@ function normalize_validate_args_for_modern_terragrunt {
   for arg_idx in "${!ARGS[@]}"; do
     case "${ARGS[$arg_idx]}" in
       --terragrunt-strict-validate|--strict-validate)
-        ARGS[arg_idx]="--strict"
+        ARGS[$arg_idx]="--strict"
         ;;
     esac
   done
@@ -109,8 +109,8 @@ function legacy_unit_dirs_from_files {
   if common::is_hook_run_on_whole_repo "$HOOK_ID" "${FILES[@]}"; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' |
+      -not -path '*/.terraform/*' \
-      sort -u | while read -r unit_file; do
+      | sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return
@@ -137,8 +137,8 @@ function legacy_unit_dirs_from_files {
   if [[ ${#unit_files[@]} -eq 0 ]]; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' |
+      -not -path '*/.terraform/*' \
-      sort -u | while read -r unit_file; do
+      | sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return

hooks/tofu_docs.sh

@@ -69,7 +69,6 @@ function tofu_docs {
   local -a -r files=("$@")
 
   local -a paths
-  local config_file_no_color=""
 
   local index=0
   local file_with_path

hooks/tofu_docs_replace.py

@@ -36,14 +36,13 @@ def main(argv=None):
     args = parser.parse_args(argv)
 
     dirs = []
-    seen_dirs = set()
     for filename in args.filenames:
-        if filename.endswith((".tf", ".tofu", ".tfvars")):
+        if os.path.realpath(filename) not in dirs and (
-            dir_path = os.path.dirname(filename)
+            filename.endswith(".tf")
-            dir_key = os.path.realpath(dir_path)
+            or filename.endswith(".tofu")
-            if dir_key not in seen_dirs:
+            or filename.endswith(".tfvars")
-                seen_dirs.add(dir_key)
+        ):
-                dirs.append(dir_path)
+            dirs.append(os.path.dirname(filename))
 
     retval = 0
 

hooks/tofu_validate.sh

@@ -128,18 +128,12 @@ function per_dir_hook_unique_part {
 
   if [ "$retry_once_with_cleanup" != "true" ]; then
     # tofu validate only
-    if validate_output=$(tofu validate "${args[@]}" 2>&1); then
+    validate_output=$(tofu validate "${args[@]}" 2>&1)
-      exit_code=0
-    else
     exit_code=$?
-    fi
   else
     # tofu validate, plus capture possible errors
-    if validate_output=$(tofu validate -json "${args[@]}" 2>&1); then
+    validate_output=$(tofu validate -json "${args[@]}" 2>&1)
-      exit_code=0
-    else
     exit_code=$?
-    fi
 
     # Match specific validation errors
     local -i validate_errors_matched
@@ -161,13 +155,10 @@ function per_dir_hook_unique_part {
         return $exit_code
       }
 
-      if validate_output=$(tofu validate "${args[@]}" 2>&1); then
+      validate_output=$(tofu validate "${args[@]}" 2>&1)
-        exit_code=0
-      else
       exit_code=$?
     fi
   fi
-  fi
 
   if [ $exit_code -ne 0 ]; then
     common::colorify "red" "Validation failed: $dir_path"

hooks/tofu_wrapper_module_for_each.sh

@@ -315,7 +315,7 @@ EOF
     all_tf_content=$(find "${full_module_dir}" -regex '.*\.(tf|tofu)' -maxdepth 1 -type f -exec cat {} +)
 
     if [[ ! $all_tf_content ]]; then
-      common::colorify "yellow" "Skipping ${full_module_dir} because there are no .tf or .tofu files."
+      common::colorify "yellow" "Skipping ${full_module_dir} because there are no *.(tf|tofu) files."
       continue
     fi
 

lib_getopt

@@ -360,7 +360,7 @@ getopt() {
   }
 
   _getopt_resolve_abbrev() {
-    # Resolves an abbreviation from a list of possibilities.
+    # Resolves an abbrevation from a list of possibilities.
     # If the abbreviation is unambiguous, echoes the expansion on stdout
     # and returns 0.  If the abbreviation is ambiguous, prints a message on
     # stderr and returns 1. (For first parse this should convert to exit