You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Collection of git hooks for Terraform to be used with [pre-commit framework](http://pre-commit.com/)
2
2
3
-
[](https://github.com/antonbabenko/pre-commit-terraform/releases)[](https://www.codetriage.com/antonbabenko/pre-commit-terraform)
3
+
[](https://github.com/antonbabenko/pre-commit-terraform/releases)[](https://www.codetriage.com/antonbabenko/pre-commit-terraform)
or you can also build and use the provided Docker container, which wraps all dependencies by
111
+
74
112
```bash
75
113
# first building it
76
114
docker build -t pre-commit .
@@ -83,80 +121,88 @@ docker run -v $(pwd):/lint -w /lint pre-commit run -a
83
121
84
122
There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
|`terraform_fmt`| Rewrites all Terraform configuration files to a canonical format. [Hook notes](#terraform_docs)|
127
+
|`terraform_validate`| Validates all Terraform configuration files. [Hook notes](#terraform_validate)|
128
+
|`terraform_docs`| Inserts input and output documentation into `README.md`. Recommended. |
129
+
|`terraform_docs_without_aggregate_type_defaults`| Inserts input and output documentation into `README.md` without aggregate type defaults. |
130
+
|`terraform_docs_replace`| Runs `terraform-docs` and pipes the output directly to README.md |
131
+
|`terraform_tflint`| Validates all Terraform configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Hook notes](#terraform_tflint).|
132
+
|`terragrunt_fmt`| Rewrites all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. |
133
+
|`terragrunt_validate`| Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) |
134
+
|`terraform_tfsec`|[TFSec](https://github.com/liamg/tfsec) static analysis of terraform templates to spot potential security issues. [Hook notes](#terraform_tfsec)|
135
+
|`checkov`|[checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues.|
136
+
|`terrascan`|[terrascan](https://github.com/accurics/terrascan) Detect compliance and security violations.|
99
137
100
138
Check the [source file](https://github.com/antonbabenko/pre-commit-terraform/blob/master/.pre-commit-hooks.yaml) to know arguments used for each hook.
101
139
102
-
## Notes about terraform_docs hooks
140
+
## Hooks notes
141
+
142
+
### terraform_docs
103
143
104
144
1.`terraform_docs` and `terraform_docs_without_aggregate_type_defaults` will insert/update documentation generated by [terraform-docs](https://github.com/terraform-docs/terraform-docs) framed by markers:
105
-
```txt
106
-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
107
145
108
-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
109
-
```
110
-
if they are present in `README.md`.
146
+
```txt
147
+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
148
+
149
+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
150
+
```
151
+
152
+
if they are present in `README.md`.
111
153
112
-
1.`terraform_docs_replace` replaces the entire README.md rather than doing string replacement between markers. Put your additional documentation at the top of your `main.tf` for it to be pulled in. The optional `--dest` argument lets you change the name of the file that gets created/modified. This hook requires terraform-docs v0.10.0 or later.
154
+
2. `terraform_docs_replace` replaces the entire README.md rather than doing string replacement between markers. Put your additional documentation at the top of your `main.tf` for it to be pulled in. The optional `--dest` argument lets you change the name of the file that gets created/modified.
155
+
156
+
Example:
113
157
114
-
1. Example:
115
158
```yaml
116
159
hooks:
117
160
- id: terraform_docs_replace
118
161
args: ['--sort-by-required', '--dest=TEST.md']
119
162
```
120
163
121
-
1. It is possible to pass additional arguments to shell scripts when using `terraform_docs` and `terraform_docs_without_aggregate_type_defaults`. Send pull-request with the new hook if there is something missing.
164
+
3. It is possible to pass additional arguments to shell scripts when using `terraform_docs` and `terraform_docs_without_aggregate_type_defaults`. Send pull-request with the new hook if there is something missing.
122
165
123
-
## Notes about terraform_tflint hooks
166
+
### terraform_tflint
124
167
125
168
1. `terraform_tflint` supports custom arguments so you can enable module inspection, deep check mode etc.
126
169
127
-
1. Example:
170
+
Example:
171
+
128
172
```yaml
129
173
hooks:
130
174
- id: terraform_tflint
131
175
args: ['--args=--deep']
132
176
```
133
177
134
178
In order to pass multiple args, try the following:
1. When you have multiple directories and want to run `tflint` in all of them and share single config file it is impractical to hard-code the path to `.tflint.hcl` file. The solution is to use `__GIT_WORKING_DIR__` placeholder which will be replaced by `terraform_tflint` hooks with Git working directory (repo root) at run time. For example:
187
+
3. When you have multiple directories and want to run `tflint` in all of them and share single config file it is impractical to hard-code the path to `.tflint.hcl` file. The solution is to use `__GIT_WORKING_DIR__` placeholder which will be replaced by `terraform_tflint` hooks with Git working directory (repo root) at run time. For example:
1. `terraform_validate` supports custom arguments so you can pass supported no-color or json flags.
183
231
184
-
1. Example:
232
+
Example:
233
+
185
234
```yaml
186
235
hooks:
187
236
- id: terraform_validate
188
237
args: ['--args=-json']
189
238
```
190
239
191
240
In order to pass multiple args, try the following:
241
+
192
242
```yaml
193
243
- id: terraform_validate
194
244
args:
195
245
- '--args=-json'
196
246
- '--args=-no-color'
197
247
```
198
-
1. `terraform_validate` also supports custom environment variables passed to the pre-commit runtime
199
248
200
-
1. Example:
249
+
2. `terraform_validate` also supports custom environment variables passed to the pre-commit runtime
250
+
251
+
Example:
252
+
201
253
```yaml
202
254
hooks:
203
255
- id: terraform_validate
204
256
args: ['--envs=AWS_DEFAULT_REGION="us-west-2"']
205
257
```
206
258
207
259
In order to pass multiple args, try the following:
260
+
208
261
```yaml
209
262
- id: terraform_validate
210
263
args:
@@ -213,22 +266,37 @@ if they are present in `README.md`.
213
266
- '--envs=AWS_SECRET_ACCESS_KEY="asecretkey"'
214
267
```
215
268
216
-
1. It may happen that Terraform working directory (`.terraform`) already exists but not in the best condition (eg, not initialized modules, wrong version of Terraform, etc). To solve this problem you can find and delete all `.terraform` directories in your repository using this command:
269
+
3. It may happen that Terraform working directory (`.terraform`) already exists but not in the best condition (eg, not initialized modules, wrong version of Terraform, etc). To solve this problem you can find and delete all `.terraform` directories in your repository using this command:
pre-commit try-repo /mnt/c/Users/tf/pre-commit-terraform terraform_fmt # Run only `terraform_fmt` check
295
+
pre-commit try-repo -a ~/pre-commit-terraform # run all existing checks from repo
296
+
```
297
+
298
+
Running `pre-commit` with `try-repo` ignores all arguments specified in `.pre-commit-config.yaml`.
299
+
232
300
## Authors
233
301
234
302
This repository is managed by [Anton Babenko](https://github.com/antonbabenko) with help from [these awesome contributors](https://github.com/antonbabenko/pre-commit-terraform/graphs/contributors).
0 commit comments