.pre-commit-hooks.yaml

- id: infracost_breakdown
  name: Infracost breakdown
  description: Check terraform infrastructure cost
  entry: hooks/infracost_breakdown.sh
  language: script
  require_serial: true
  files: \.(tf|tofu|tfvars|hcl)$
  exclude: \.terraform/.*$

- id: terraform_fmt
  name: Terraform fmt
  description: >-
    Rewrites all Terraform configuration files to a canonical format.
  entry: hooks/terraform_fmt.sh
  language: script
  # Supported extensions by Terraform specified in
  # https://github.com/hashicorp/terraform/blob/0c63fb2b097edcd5cb1a91322765a414206fbea2/internal/command/fmt.go#L30-L35
  files: \.(tf|tofu|tfvars|tftest\.hcl|tfmock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_docs
  name: Terraform docs
  description: >-
    Inserts input and output documentation into README.md
    (using terraform-docs).
  require_serial: true
  entry: hooks/terraform_docs.sh
  language: script
  files: \.(tf|tofu|terraform\.lock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_docs_without_aggregate_type_defaults
  name: Terraform docs (without aggregate type defaults)
  description: >-
    Inserts input and output documentation into README.md
    (using terraform-docs). Identical to terraform_docs.
  require_serial: true
  entry: hooks/terraform_docs.sh
  language: script
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$

- id: terraform_docs_replace
  name: Terraform docs (overwrite README.md)
  description: Overwrite content of README.md with terraform-docs.
  require_serial: true
  entry: python -Im pre_commit_terraform replace-docs
  language: python
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$

- id: terraform_validate
  name: Terraform validate
  description: Validates all Terraform configuration files.
  require_serial: true
  entry: hooks/terraform_validate.sh
  language: script
  files: \.(tf|tofu|tfvars|terraform\.lock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_providers_lock
  name: Lock terraform provider versions
  description: Updates provider signatures in dependency lock files.
  require_serial: true
  entry: hooks/terraform_providers_lock.sh
  language: script
  files: (\.terraform\.lock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_tflint
  name: Terraform validate with tflint
  description: Validates all Terraform configuration files with TFLint.
  require_serial: true
  entry: hooks/terraform_tflint.sh
  language: script
  files: \.(tf|tofu|tfvars)$
  exclude: \.terraform/.*$

- id: terragrunt_fmt
  name: Terragrunt fmt
  description: >-
    Rewrites all Terragrunt configuration files to a canonical format.
  entry: hooks/terragrunt_fmt.sh
  language: script
  files: (\.hcl)$
  exclude: \.terraform/.*$

- id: terragrunt_validate
  name: Terragrunt validate
  description: Validates all Terragrunt configuration files.
  entry: hooks/terragrunt_validate.sh
  language: script
  files: (\.hcl)$
  exclude: \.terraform/.*$

- id: terragrunt_validate_inputs
  name: Terragrunt validate inputs
  description: Validates Terragrunt unused and undefined inputs.
  entry: hooks/terragrunt_validate_inputs.sh
  language: script
  files: (\.hcl)$
  exclude: \.terraform/.*$

- id: terragrunt_providers_lock
  name: Terragrunt providers lock
  description: >-
    Updates provider signatures in dependency lock files using terragrunt.
  entry: hooks/terragrunt_providers_lock.sh
  language: script
  files: (terragrunt|\.terraform\.lock)\.hcl$
  exclude: \.(terraform/.*|terragrunt-cache)$

- id: terraform_tfsec
  name: Terraform validate with tfsec (deprecated, use "terraform_trivy")
  description: >-
    Static analysis of Terraform templates to spot potential security issues.
  require_serial: true
  entry: hooks/terraform_tfsec.sh
  files: \.(tf|tofu|tfvars)$
  language: script

- id: terraform_trivy
  name: Terraform validate with trivy
  description: >-
    Static analysis of Terraform templates to spot potential security issues.
  require_serial: true
  entry: hooks/terraform_trivy.sh
  files: \.(tf|tofu|tfvars)$
  language: script

- id: checkov
  name: checkov (deprecated, use "terraform_checkov")
  description: Runs checkov on Terraform templates.
  entry: checkov -d .
  language: python
  pass_filenames: false
  always_run: false
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$
  require_serial: true

- id: terraform_checkov
  name: Checkov
  description: Runs checkov on Terraform templates.
  entry: hooks/terraform_checkov.sh
  language: script
  always_run: false
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$
  require_serial: true

- id: terraform_wrapper_module_for_each
  name: Terraform wrapper with for_each in module
  description: Generate Terraform wrappers with for_each in module.
  entry: hooks/terraform_wrapper_module_for_each.sh
  language: script
  pass_filenames: false
  always_run: false
  require_serial: true
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$

- id: terrascan
  name: terrascan
  description: Runs terrascan on Terraform templates.
  language: script
  entry: hooks/terrascan.sh
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$
  require_serial: true

- id: tfupdate
  name: tfupdate
  description: Runs tfupdate on Terraform templates.
  language: script
  entry: hooks/tfupdate.sh
  args:
  - --args=terraform
  files: \.(tf|tofu)$
  require_serial: true

# Docker-based versions of hooks (non-breaking additions)
- id: terraform_fmt_docker
  name: Terraform fmt (Docker)
  description: >-
    Rewrites all Terraform configuration files to a canonical format using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [terraform, fmt]
  files: \.(tf|tofu|tfvars|tftest\.hcl|tfmock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_validate_docker
  name: Terraform validate (Docker)
  description: >-
    Validates all Terraform configuration files using Docker.
    Automatically runs 'terraform init' and retries validation if provider/module
    errors are detected.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  require_serial: true
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args:
  - /usr/bin/hooks/terraform_validate.sh
  - --hook-config=--retry-once-with-cleanup=true
  - --hook-config=--parallelism-ci-cpu-cores=2
  - --
  - .
  pass_filenames: false
  files: \.(tf|tofu|tfvars|terraform\.lock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_tflint_docker
  name: Terraform validate with tflint (Docker)
  description: >-
    Validates all Terraform configuration files with TFLint using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  require_serial: true
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [tflint, --chdir=.]
  pass_filenames: false
  files: \.(tf|tofu|tfvars)$
  exclude: \.terraform/.*$

- id: terraform_docs_docker
  name: Terraform docs (Docker)
  description: >-
    Inserts input and output documentation into README.md using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  require_serial: true
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [terraform-docs, markdown, table, ., --output-file, README.md]
  pass_filenames: false
  files: \.(tf|tofu|terraform\.lock\.hcl)$
  exclude: \.terraform/.*$

- id: terraform_checkov_docker
  name: Checkov (Docker)
  description: >-
    Runs checkov on Terraform templates using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [checkov, -d, .]
  pass_filenames: false
  always_run: false
  files: \.(tf|tofu)$
  exclude: \.terraform/.*$
  require_serial: true

- id: terraform_trivy_docker
  name: Terraform validate with trivy (Docker)
  description: >-
    Static analysis of Terraform templates to spot potential security issues
    using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  require_serial: true
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [trivy, config, .]
  pass_filenames: false
  files: \.(tf|tofu|tfvars)$
  exclude: \.terraform/.*$

- id: infracost_breakdown_docker
  name: Infracost breakdown (Docker)
  description: >-
    Check terraform infrastructure cost using Docker.
    NOTE: Requires Docker to be available. Use 'skip' in .pre-commit-config.yaml
    if running on pre-commit.ci or other environments without Docker.
  entry: ghcr.io/actuarysailor/pre-commit-terraform-tools:latest
  language: docker_image
  args: [infracost, breakdown, --path, .]
  pass_filenames: false
  require_serial: true
  files: \.(tf|tofu|tfvars|hcl)$
  exclude: \.terraform/.*$