mirror of
https://github.com/tofuutils/pre-commit-opentofu.git
synced 2026-07-09 16:14:33 +02:00
Compare commits
No commits in common. "main" and "v2.4.0" have entirely different histories.
9 changed files with 62 additions and 60 deletions
33
.github/workflows/build-image.yaml
vendored
33
.github/workflows/build-image.yaml
vendored
|
|
@ -5,6 +5,8 @@ on:
|
|||
release:
|
||||
types:
|
||||
- created
|
||||
schedule:
|
||||
- cron: '00 00 * * *'
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
|
|
@ -31,6 +33,7 @@ jobs:
|
|||
echo IMAGE_TAG=$([ ${{ github.ref_type }} == 'tag' ] && echo ${{ github.ref_name }} || echo 'latest') >> $GITHUB_ENV
|
||||
|
||||
- name: Build and Push release to ghcr.io
|
||||
if: github.event_name != 'schedule'
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
|
|
@ -46,6 +49,22 @@ jobs:
|
|||
secrets: |
|
||||
"github_token=${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Build and Push nightly to ghcr.io
|
||||
if: github.event_name == 'schedule'
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
build-args: |
|
||||
INSTALL_ALL=true
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
tags: |
|
||||
ghcr.io/${{ github.repository }}:nightly
|
||||
# Fix multi-platform: https://github.com/docker/buildx/issues/1533
|
||||
provenance: false
|
||||
secrets: |
|
||||
"github_token=${{ secrets.GITHUB_TOKEN }}"
|
||||
|
||||
- name: Login to DockerHub Container Registry
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
|
|
@ -54,6 +73,7 @@ jobs:
|
|||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Build and Push release to DockerHub
|
||||
if: github.event_name != 'schedule'
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
|
|
@ -65,3 +85,16 @@ jobs:
|
|||
registry.hub.docker.com/tofuutils/pre-commit-opentofu:${{ env.IMAGE_TAG }}
|
||||
registry.hub.docker.com/tofuutils/pre-commit-opentofu:latest
|
||||
provenance: false
|
||||
|
||||
- name: Build and Push nightly to DockerHub
|
||||
if: github.event_name == 'schedule'
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
build-args: |
|
||||
INSTALL_ALL=true
|
||||
platforms: linux/amd64,linux/arm64
|
||||
push: true
|
||||
tags: |
|
||||
registry.hub.docker.com/tofuutils/pre-commit-opentofu:nightly
|
||||
provenance: false
|
||||
|
|
|
|||
8
.github/workflows/pre-commit.yaml
vendored
8
.github/workflows/pre-commit.yaml
vendored
|
|
@ -27,13 +27,9 @@ jobs:
|
|||
sudo apt update && sudo apt install shellcheck
|
||||
|
||||
- name: Install hadolint
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
run: |
|
||||
gh release download v2.14.0 --repo hadolint/hadolint --pattern "hadolint-linux-x86_64"
|
||||
mv hadolint-linux-x86_64 hadolint
|
||||
chmod +x hadolint
|
||||
sudo mv hadolint /usr/bin/
|
||||
curl -L "$(curl -s https://api.github.com/repos/hadolint/hadolint/releases/latest | grep -o -E -m 1 "https://.+?/hadolint-Linux-x86_64")" > hadolint \
|
||||
&& chmod +x hadolint && sudo mv hadolint /usr/bin/
|
||||
# Need to success pre-commit fix push
|
||||
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
|
||||
with:
|
||||
|
|
|
|||
18
CHANGELOG.md
18
CHANGELOG.md
|
|
@ -2,22 +2,6 @@
|
|||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [2.4.2](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.4.1...v2.4.2) (2026-06-12)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **hooks:** make env var regex portable ([caab3b8](https://github.com/tofuutils/pre-commit-opentofu/commit/caab3b8701405a446489a7864f91a2c9f281eee0))
|
||||
|
||||
## [2.4.1](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.4.0...v2.4.1) (2026-06-01)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* initialize config_file_no_color variable ([b766f82](https://github.com/tofuutils/pre-commit-opentofu/commit/b766f82b087793f75b3ffa61eb22da80031455ce))
|
||||
* typo fixes ([3f263a9](https://github.com/tofuutils/pre-commit-opentofu/commit/3f263a968cd776924c3d1f4981e0fbf1cd79ff4d))
|
||||
* Update hadolint installation ([c9cd4a8](https://github.com/tofuutils/pre-commit-opentofu/commit/c9cd4a805d378516a24dac33278fa51deb98bf2e))
|
||||
|
||||
# [2.4.0](https://github.com/tofuutils/pre-commit-opentofu/compare/v2.3.0...v2.4.0) (2026-05-25)
|
||||
|
||||
|
||||
|
|
@ -64,7 +48,7 @@ All notable changes to this project will be documented in this file.
|
|||
|
||||
### Features
|
||||
|
||||
* support .tofu files ([#6](https://github.com/tofuutils/pre-commit-opentofu/issues/6)) ([e059c58](https://github.com/tofuutils/pre-commit-opentofu/commit/e059c5859bceddf1ca018f55851f6940ad51f1c2))
|
||||
* spport .tofu files ([#6](https://github.com/tofuutils/pre-commit-opentofu/issues/6)) ([e059c58](https://github.com/tofuutils/pre-commit-opentofu/commit/e059c5859bceddf1ca018f55851f6940ad51f1c2))
|
||||
|
||||
# [2.0.0](https://github.com/tofuutils/pre-commit-opentofu/compare/v1.0.4...v2.0.0) (2024-09-25)
|
||||
|
||||
|
|
|
|||
24
README.md
24
README.md
|
|
@ -1,6 +1,6 @@
|
|||
# Collection of git hooks for OpenTofu to be used with [pre-commit framework](http://pre-commit.com/)
|
||||
|
||||
[](https://github.com/tofuutils/pre-commit-opentofu/releases)  [](https://www.codetriage.com/tofuutils/pre-commit-opentofu)
|
||||
[](https://github.com/tofuutils/pre-commit-opentofu/releases)  [](https://www.codetriage.com/tofuutils/pre-commit-opentofu)
|
||||
|
||||
Want to contribute? Check [open issues](https://github.com/tofuutils/pre-commit-opentofu/issues?q=label%3A%22good+first+issue%22+is%3Aopen+sort%3Aupdated-desc) and [contributing notes](/.github/CONTRIBUTING.md).
|
||||
|
||||
|
|
@ -37,7 +37,7 @@ If you are using `pre-commit-opentofu` already or want to support its developmen
|
|||
* [tfupdate](#tfupdate)
|
||||
* [Docker Usage](#docker-usage)
|
||||
* [File Permissions](#file-permissions)
|
||||
* [Download OpenTofu modules from private GitHub repositories](#download-opentofu-modules-from-private-github-repositories)
|
||||
* [Download OpenTofu modules from private GitHub repositories](#download-tofu-modules-from-private-github-repositories)
|
||||
* [Authors](#authors)
|
||||
* [License](#license)
|
||||
|
||||
|
|
@ -301,19 +301,19 @@ There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu c
|
|||
| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
|
||||
| `checkov` and `tofu_checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of OpenTofu templates to spot potential security issues. [Hook notes](#checkov-deprecated-and-tofu_checkov) | `checkov`<br>Ubuntu deps: `python3`, `python3-pip` |
|
||||
| `infracost_breakdown` | Check how much your infra costs with [infracost](https://github.com/infracost/infracost). [Hook notes](#infracost_breakdown) | `infracost`, `jq`, [Infracost API key](https://www.infracost.io/docs/#2-get-api-key) |
|
||||
| `tofu_docs` | Inserts input and output documentation into `README.md`. Recommended. [Hook notes](#tofu_docs) | `terraform-docs` |
|
||||
| `tofu_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md. **DEPRECATED**. [Hook notes](#tofu_docs_replace-deprecated) | `python3`, `terraform-docs` |
|
||||
| `tofu_docs_without_`<br>`aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. Hook notes same as for [tofu_docs](#tofu_docs) | `tofu-docs` |
|
||||
| `tofu_fmt` | Reformat all OpenTofu configuration files to a canonical format. [Hook notes](#tofu_fmt) | - |
|
||||
| `tofu_providers_lock` | Updates provider signatures in [dependency lock files](https://www.terraform.io/docs/cli/commands/providers/lock.html). [Hook notes](#tofu_providers_lock) | - |
|
||||
| `tofu_tflint` | Validates all OpenTofu configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#tofu_tflint). | `tflint` |
|
||||
| `tofu_tfsec` | [TFSec](https://github.com/aquasecurity/tfsec) static analysis of terraform templates to spot potential security issues. **DEPRECATED**, use `tofu_trivy`. [Hook notes](#tofu_tfsec-deprecated) | `tfsec` |
|
||||
| `tofu_trivy` | [Trivy](https://github.com/aquasecurity/trivy) static analysis of terraform templates to spot potential security issues. [Hook notes](#tofu_trivy) | `trivy` |
|
||||
| `tofu_docs` | Inserts input and output documentation into `README.md`. Recommended. [Hook notes](#terraform_docs) | `terraform-docs` |
|
||||
| `tofu_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md. **DEPRECATED**. [Hook notes](#terraform_docs_replace-deprecated) | `python3`, `terraform-docs` |
|
||||
| `tofu_docs_without_`<br>`aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. Hook notes same as for [tofu_docs](#terraform_docs) | `tofu-docs` |
|
||||
| `tofu_fmt` | Reformat all OpenTofu configuration files to a canonical format. [Hook notes](#terraform_fmt) | - |
|
||||
| `tofu_providers_lock` | Updates provider signatures in [dependency lock files](https://www.terraform.io/docs/cli/commands/providers/lock.html). [Hook notes](#terraform_providers_lock) | - |
|
||||
| `tofu_tflint` | Validates all OpenTofu configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#terraform_tflint). | `tflint` |
|
||||
| `tofu_tfsec` | [TFSec](https://github.com/aquasecurity/tfsec) static analysis of terraform templates to spot potential security issues. **DEPRECATED**, use `tofu_trivy`. [Hook notes](#terraform_tfsec-deprecated) | `tfsec` |
|
||||
| `tofu_trivy` | [Trivy](https://github.com/aquasecurity/trivy) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_trivy) | `trivy` |
|
||||
| `tofu_validate` | Validates all Terraform configuration files. [Hook notes](#tofu_validate) | `jq`, only for `--retry-once-with-cleanup` flag |
|
||||
| `terragrunt_fmt` | Reformat all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | `terragrunt` |
|
||||
| `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | `terragrunt` |
|
||||
| `terragrunt_validate_inputs` | Validates Terragrunt unused and undefined inputs. | `terragrunt` |
|
||||
| `tofu_wrapper_module_for_each` | Generates OpenTofu wrappers with `for_each` in module. [Hook notes](#tofu_wrapper_module_for_each) | `hcledit` |
|
||||
| `tofu_wrapper_module_for_each` | Generates OpenTofu wrappers with `for_each` in module. [Hook notes](#terraform_wrapper_module_for_each) | `hcledit` |
|
||||
| `terrascan` | [terrascan](https://github.com/tenable/terrascan) Detect compliance and security violations. [Hook notes](#terrascan) | `terrascan` |
|
||||
| `tfupdate` | [tfupdate](https://github.com/minamijoyo/tfupdate) Update version constraints of OpenTofu core, providers, and modules. [Hook notes](#tfupdate) | `tfupdate` |
|
||||
<!-- markdownlint-enable no-inline-html -->
|
||||
|
|
@ -718,7 +718,7 @@ To replicate functionality in `tofu_docs` hook:
|
|||
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
|
||||
```
|
||||
|
||||
3. By default, pre-commit-opentofu performs directory switching into the OpenTofu modules for you. If you want to delegate the directory changing to the binary - this will allow tflint to determine the full paths for error/warning messages, rather than just module relative paths. *Note: this requires `tflint>=0.44.0`.* For example:
|
||||
3. By default, pre-commit-opentofu performs directory switching into the OpenTofu modules for you. If you want to delgate the directory changing to the binary - this will allow tflint to determine the full paths for error/warning messages, rather than just module relative paths. *Note: this requires `tflint>=0.44.0`.* For example:
|
||||
|
||||
```yaml
|
||||
- id: tofu_tflint
|
||||
|
|
|
|||
|
|
@ -112,7 +112,7 @@ function common::parse_and_export_env_vars {
|
|||
while true; do
|
||||
# Check if at least 1 env var exists in `$arg`
|
||||
# shellcheck disable=SC2016 # '${' should not be expanded
|
||||
if [[ "$arg" =~ '${'[A-Z_][A-Za-z0-9_]*'}' ]]; then
|
||||
if [[ "$arg" =~ .*'${'[A-Z_][A-Z0-9_]*'}'.* ]]; then
|
||||
# Get `ENV_VAR` from `.*${ENV_VAR}.*`
|
||||
local env_var_name=${arg#*$\{}
|
||||
env_var_name=${env_var_name%%\}*}
|
||||
|
|
|
|||
|
|
@ -69,7 +69,6 @@ function tofu_docs {
|
|||
local -a -r files=("$@")
|
||||
|
||||
local -a paths
|
||||
local config_file_no_color=""
|
||||
|
||||
local index=0
|
||||
local file_with_path
|
||||
|
|
|
|||
|
|
@ -36,14 +36,13 @@ def main(argv=None):
|
|||
args = parser.parse_args(argv)
|
||||
|
||||
dirs = []
|
||||
seen_dirs = set()
|
||||
for filename in args.filenames:
|
||||
if filename.endswith((".tf", ".tofu", ".tfvars")):
|
||||
dir_path = os.path.dirname(filename)
|
||||
dir_key = os.path.realpath(dir_path)
|
||||
if dir_key not in seen_dirs:
|
||||
seen_dirs.add(dir_key)
|
||||
dirs.append(dir_path)
|
||||
if os.path.realpath(filename) not in dirs and (
|
||||
filename.endswith(".tf")
|
||||
or filename.endswith(".tofu")
|
||||
or filename.endswith(".tfvars")
|
||||
):
|
||||
dirs.append(os.path.dirname(filename))
|
||||
|
||||
retval = 0
|
||||
|
||||
|
|
|
|||
|
|
@ -128,18 +128,12 @@ function per_dir_hook_unique_part {
|
|||
|
||||
if [ "$retry_once_with_cleanup" != "true" ]; then
|
||||
# tofu validate only
|
||||
if validate_output=$(tofu validate "${args[@]}" 2>&1); then
|
||||
exit_code=0
|
||||
else
|
||||
exit_code=$?
|
||||
fi
|
||||
validate_output=$(tofu validate "${args[@]}" 2>&1)
|
||||
exit_code=$?
|
||||
else
|
||||
# tofu validate, plus capture possible errors
|
||||
if validate_output=$(tofu validate -json "${args[@]}" 2>&1); then
|
||||
exit_code=0
|
||||
else
|
||||
exit_code=$?
|
||||
fi
|
||||
validate_output=$(tofu validate -json "${args[@]}" 2>&1)
|
||||
exit_code=$?
|
||||
|
||||
# Match specific validation errors
|
||||
local -i validate_errors_matched
|
||||
|
|
@ -161,11 +155,8 @@ function per_dir_hook_unique_part {
|
|||
return $exit_code
|
||||
}
|
||||
|
||||
if validate_output=$(tofu validate "${args[@]}" 2>&1); then
|
||||
exit_code=0
|
||||
else
|
||||
exit_code=$?
|
||||
fi
|
||||
validate_output=$(tofu validate "${args[@]}" 2>&1)
|
||||
exit_code=$?
|
||||
fi
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -360,7 +360,7 @@ getopt() {
|
|||
}
|
||||
|
||||
_getopt_resolve_abbrev() {
|
||||
# Resolves an abbreviation from a list of possibilities.
|
||||
# Resolves an abbrevation from a list of possibilities.
|
||||
# If the abbreviation is unambiguous, echoes the expansion on stdout
|
||||
# and returns 0. If the abbreviation is ambiguous, prints a message on
|
||||
# stderr and returns 1. (For first parse this should convert to exit
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue