Skip to content

Commit a139b71

Browse files
jmreichajmreicha
authored
feat: Add terragrunt_validate_inputs hook to check unused and undefined inputs (antonbabenko#677)
1 parent 5ed533a commit a139b71

File tree

3 files changed

+106
-1
lines changed

3 files changed

+106
-1
lines changed

‎.pre-commit-hooks.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@
8585
files: (\.hcl)$
8686
exclude: \.terraform/.*$
8787

88+
- id: terragrunt_validate_inputs
89+
name: Terragrunt validate inputs
90+
description: Validates Terragrunt unused and undefined inputs.
91+
entry: hooks/terragrunt_validate_inputs.sh
92+
language: script
93+
files: (\.hcl)$
94+
exclude: \.terraform/.*$
95+
8896
- id: terragrunt_providers_lock
8997
name: Terragrunt providers lock
9098
description: Updates provider signatures in dependency lock files using terragrunt.

‎README.md‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ If you want to support the development of `pre-commit-terraform` and [many other
5050
* [terrascan](#terrascan)
5151
* [tfupdate](#tfupdate)
5252
* [terragrunt\_providers\_lock](#terragrunt_providers_lock)
53+
* [terragrunt\_validate\_inputs](#terragrunt_validate_inputs)
5354
* [Docker Usage](#docker-usage)
5455
* [File Permissions](#file-permissions)
5556
* [Download Terraform modules from private GitHub repositories](#download-terraform-modules-from-private-github-repositories)
@@ -75,7 +76,7 @@ If you want to support the development of `pre-commit-terraform` and [many other
7576
</sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub><br><br>
7677
* [`checkov`](https://github.com/bridgecrewio/checkov) required for `terraform_checkov` hook
7778
* [`terraform-docs`](https://github.com/terraform-docs/terraform-docs) required for `terraform_docs` hook
78-
* [`terragrunt`](https://terragrunt.gruntwork.io/docs/getting-started/install/) required for `terragrunt_validate` hook
79+
* [`terragrunt`](https://terragrunt.gruntwork.io/docs/getting-started/install/) required for `terragrunt_validate` and `terragrunt_valid_inputs` hooks
7980
* [`terrascan`](https://github.com/tenable/terrascan) required for `terrascan` hook
8081
* [`TFLint`](https://github.com/terraform-linters/tflint) required for `terraform_tflint` hook
8182
* [`TFSec`](https://github.com/liamg/tfsec) required for `terraform_tfsec` hook
@@ -295,6 +296,7 @@ There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform
295296
| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | `jq`, only for `--retry-once-with-cleanup` flag |
296297
| `terragrunt_fmt` | Reformat all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | `terragrunt` |
297298
| `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | `terragrunt` |
299+
| `terragrunt_validate_inputs` | Validates [Terragrunt](https://github.com/gruntwork-io/terragrunt) unused and undefined inputs (`*.hcl`)
298300
| `terragrunt_providers_lock` | Generates `.terraform.lock.hcl` files using [Terragrunt](https://github.com/gruntwork-io/terragrunt). | `terragrunt` |
299301
| `terraform_wrapper_module_for_each` | Generates Terraform wrappers with `for_each` in module. [Hook notes](#terraform_wrapper_module_for_each) | `hcledit` |
300302
| `terrascan` | [terrascan](https://github.com/tenable/terrascan) Detect compliance and security violations. [Hook notes](#terrascan) | `terrascan` |
@@ -1121,6 +1123,28 @@ It invokes `terragrunt providers lock` under the hood and terragrunt [does its'
11211123
- --args=-platform=linux_amd64
11221124
```
11231125

1126+
### terragrunt_validate_inputs
1127+
1128+
Validates Terragrunt unused and undefined inputs. This is useful for keeping
1129+
configs clean when module versions change or if configs are copied.
1130+
1131+
See the [Terragrunt docs](https://terragrunt.gruntwork.io/docs/reference/cli-options/#validate-inputs) for more details.
1132+
1133+
Example:
1134+
1135+
```yaml
1136+
- id: terragrunt_validate_inputs
1137+
name: Terragrunt validate inputs
1138+
args:
1139+
# Optionally check for unused inputs
1140+
- --args=--terragrunt-strict-validate
1141+
```
1142+
1143+
> [!NOTE]
1144+
> This hook requires authentication to a given account if defined by config to work properly. For example, if you use a third-party tool to store AWS credentials like `aws-vault` you must be authenticated first.
1145+
>
1146+
> See docs for the [iam_role](https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#iam_role) attribute and [--terragrunt-iam-role](https://terragrunt.gruntwork.io/docs/reference/cli-options/#terragrunt-iam-role) flag for more.
1147+
11241148
## Docker Usage
11251149

11261150
### File Permissions

‎hooks/terragrunt_validate_inputs.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/usr/bin/env bash
2+
set -eo pipefail
3+
4+
# globals variables
5+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
6+
readonly SCRIPT_DIR
7+
# shellcheck source=_common.sh
8+
. "$SCRIPT_DIR/_common.sh"
9+
10+
function main {
11+
common::initialize "$SCRIPT_DIR"
12+
common::parse_cmdline "$@"
13+
common::export_provided_env_vars "${ENV_VARS[@]}"
14+
common::parse_and_export_env_vars
15+
# JFYI: terragrunt validate color already suppressed via PRE_COMMIT_COLOR=never
16+
17+
# shellcheck disable=SC2153 # False positive
18+
common::per_dir_hook "$HOOK_ID" "${#ARGS[@]}" "${ARGS[@]}" "${FILES[@]}"
19+
}
20+
21+
#######################################################################
22+
# Unique part of `common::per_dir_hook`. The function is executed in loop
23+
# on each provided dir path. Run wrapped tool with specified arguments
24+
# Arguments:
25+
# dir_path (string) PATH to dir relative to git repo root.
26+
# Can be used in error logging
27+
# change_dir_in_unique_part (string/false) Modifier which creates
28+
# possibilities to use non-common chdir strategies.
29+
# Availability depends on hook.
30+
# parallelism_disabled (bool) if true - skip lock mechanism
31+
# args (array) arguments that configure wrapped tool behavior
32+
# tf_path (string) PATH to Terraform/OpenTofu binary
33+
# Outputs:
34+
# If failed - print out hook checks status
35+
#######################################################################
36+
function per_dir_hook_unique_part {
37+
# shellcheck disable=SC2034 # Unused var.
38+
local -r dir_path="$1"
39+
# shellcheck disable=SC2034 # Unused var.
40+
local -r change_dir_in_unique_part="$2"
41+
# shellcheck disable=SC2034 # Unused var.
42+
local -r parallelism_disabled="$3"
43+
# shellcheck disable=SC2034 # Unused var.
44+
local -r tf_path="$4"
45+
shift 4
46+
local -a -r args=("$@")
47+
48+
# pass the arguments to hook
49+
terragrunt validate-inputs "${args[@]}"
50+
51+
# return exit code to common::per_dir_hook
52+
local exit_code=$?
53+
return $exit_code
54+
}
55+
56+
#######################################################################
57+
# Unique part of `common::per_dir_hook`. The function is executed one time
58+
# in the root git repo
59+
# Arguments:
60+
# args (array) arguments that configure wrapped tool behavior
61+
#######################################################################
62+
function run_hook_on_whole_repo {
63+
local -a -r args=("$@")
64+
65+
# pass the arguments to hook
66+
terragrunt run-all validate-inputs "${args[@]}"
67+
68+
# return exit code to common::per_dir_hook
69+
local exit_code=$?
70+
return $exit_code
71+
}
72+
73+
[ "${BASH_SOURCE[0]}" != "$0" ] || main "$@"

0 commit comments

Comments
 (0)