Skip to content

tofu-lint

Three independent lint jobs for OpenTofu / Terraform projects, run inside tofu-tools:

  • tofu-fmt — tofu fmt -check -recursive.
  • tflint — tflint --init, then tflint --chdir=<dir> --recursive per path in paths.
  • terraform-docs-drift — re-injects terraform-docs output and fails if the working tree diverges from what's committed (i.e. the docs weren't regenerated and committed).

All three can run in parallel within the consumer's lint stage. Each carries an explicit rules: — a rule-less job is skipped on merge-request pipelines, so the gate must opt in explicitly (see Explanation: spec-first development). Change-detected by default — see Explanation: change-detection.

Jobs

Job What it runs
tofu-fmt tofu fmt -check -recursive $[[ inputs.paths ]]
tflint tflint --init, then tflint --chdir="$dir" --recursive per path
terraform-docs-drift terraform-docs --output-mode=inject --output-file=README.md markdown table "$dir" per path, then git diff --exit-code

Inputs

Input Type Default Description
image_version string "v0.1.0" tofu-tools image tag. Renovate keeps this current.
stage string lint GitLab CI stage. Consumers declare their own stages: list.
paths string "." Space-separated directories to recurse into (word-split in shell).
changes array ["**/*.tf", "**/*.tfvars", "**/*.tf.json", "**/.tflint.hcl", "**/.terraform.lock.hcl", ".gitlab-ci.yml"] Change-detection paths. The jobs run only when a matching file changed. Set ["**/*"] to always run.
github_token string "$GITHUB_COM_TOKEN" GitHub token for tflint --init's ruleset lookup, exported as GITHUB_TOKEN. Only used when the consumer's .tflint.hcl pins a ruleset version the image does not pre-bake — then tflint resolves it from api.github.com, which is rate-limited per source IP and 403s regularly on a shared runner. Harmless if unset (falls back to an unauthenticated request). A read-only, public-repo token is sufficient.

Usage

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      paths: "modules/* examples/*"

See also