Skip to content

tofu-lint

Three independent lint jobs for OpenTofu / Terraform projects, run inside infra-tools:

  • tofu-fmt — tofu fmt -check -recursive.
  • tflint — tflint --init, then tflint --chdir=<dir> --recursive per path in paths.
  • terraform-docs-drift — re-injects terraform-docs output and fails if the working tree diverges from what's committed (i.e. the docs weren't regenerated and committed).

All three can run in parallel within the consumer's lint stage. Each carries an explicit rules: — a rule-less job is skipped on merge-request pipelines, so the gate must opt in explicitly (see Explanation: spec-first development). Change-detected by default — see Explanation: change-detection.

Jobs

Job What it runs
tofu-fmt tofu fmt -check -recursive $[[ inputs.paths ]]
tflint tflint --init, then tflint --chdir="$dir" --recursive per path
terraform-docs-drift terraform-docs --output-mode=inject --output-file=README.md markdown table "$dir" per path, then git diff --exit-code

Inputs

Input Type Default Description
image_version string "v0.3.0" infra-tools image tag. Renovate keeps this current.
stage string lint GitLab CI stage. Consumers declare their own stages: list.
paths string "." Space-separated directories to recurse into (word-split in shell).
changes array ["**/*.tf", "**/*.tfvars", "**/*.tf.json", "**/.tflint.hcl", "**/.terraform.lock.hcl", ".gitlab-ci.yml"] Change-detection paths. The jobs run only when a matching file changed. Set ["**/*"] to always run.

Usage

include:
  - component: gitlab.com/phpboyscout/cicd/[email protected]
    inputs:
      paths: "modules/* examples/*"

See also