Skip to content

Commit c1dfd0d

Browse files
authored
Merge branch 'master' into add-graph-hook
2 parents 2e6e74f + 3dd96e2 commit c1dfd0d

File tree

8 files changed

+73
-59
lines changed

8 files changed

+73
-59
lines changed

.github/workflows/build-image-test.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838

3939
- name: Get changed Docker related files
4040
id: changed-files-specific
41-
uses: tj-actions/changed-files@2f7c5bfce28377bc069a65ba478de0a74aa0ca32 # v46.0.1
41+
uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
4242
with:
4343
files: |
4444
.dockerignore

.github/workflows/ci-cd.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ jobs:
105105

106106
steps:
107107
- name: Switch to using Python 3.13 by default
108-
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
108+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
109109
with:
110110
python-version: 3.13
111111
- name: Check out src from Git
@@ -161,7 +161,7 @@ jobs:
161161
echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
162162
shell: bash
163163
- name: Set up pip cache
164-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
164+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
165165
with:
166166
path: ${{ steps.pip-cache-dir.outputs.dir }}
167167
key: >-
@@ -274,7 +274,7 @@ jobs:
274274

275275
steps:
276276
- name: Switch to using Python 3.13
277-
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
277+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
278278
with:
279279
python-version: 3.13
280280

@@ -307,7 +307,7 @@ jobs:
307307
run: >-
308308
echo "dir=$(python -m pip cache dir)" >> "${GITHUB_OUTPUT}"
309309
- name: Set up pip cache
310-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
310+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
311311
with:
312312
path: ${{ steps.pip-cache-dir.outputs.dir }}
313313
key: >-
@@ -372,7 +372,7 @@ jobs:
372372
>> "${GITHUB_OUTPUT}"
373373
working-directory: dist
374374
- name: Store the distribution packages
375-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
375+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
376376
with:
377377
name: >-
378378
${{ needs.pre-setup.outputs.dists-artifact-name }}

.github/workflows/codeql.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646

4747
# Initializes the CodeQL tools for scanning.
4848
- name: Initialize CodeQL
49-
uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
49+
uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
5050
with:
5151
languages: ${{ matrix.language }}
5252
# If you wish to specify custom queries, you can do so here or in
@@ -58,7 +58,7 @@ jobs:
5858
# If this step fails, then you should remove it and run the build
5959
# manually (see below)
6060
- name: Autobuild
61-
uses: github/codeql-action/autobuild@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
61+
uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
6262

6363
# ℹ️ Command-line programs to run using the OS shell.
6464
# yamllint disable-line rule:line-length
@@ -73,6 +73,6 @@ jobs:
7373
# ./location_of_script_within_repo/buildscript.sh
7474

7575
- name: Perform CodeQL Analysis
76-
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
76+
uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
7777
with:
7878
category: /language:${{matrix.language}}

.github/workflows/pre-commit.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ jobs:
5656
# https://web.archive.org/web/20210731173012/https://github.community/t/required-check-is-expected-after-automated-push/187545/
5757
ssh-key: ${{ secrets.GHA_AUTOFIX_COMMIT_KEY }}
5858
# Skip terraform_tflint which interferes to commit pre-commit auto-fixes
59-
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
59+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
6060
with:
6161
python-version: '3.13'
6262

.github/workflows/reusable-tox.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ jobs:
158158
Switch to using Python v${{ inputs.python-version }}
159159
by default
160160
id: python-install
161-
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
161+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
162162
with:
163163
python-version: ${{ inputs.python-version }}
164164
@@ -181,7 +181,7 @@ jobs:
181181

182182
- name: Cache pre-commit.com virtualenvs
183183
if: inputs.toxenv == 'pre-commit'
184-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
184+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
185185
with:
186186
path: ~/.cache/pre-commit
187187
key: >-
@@ -239,7 +239,7 @@ jobs:
239239
shell: bash
240240
- name: Set up pip cache
241241
if: fromJSON(steps.py-abi.outputs.is-stable-abi)
242-
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
242+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
243243
with:
244244
path: ${{ steps.pip-cache-dir.outputs.dir }}
245245
key: >-
@@ -266,7 +266,7 @@ jobs:
266266
- name: Download all the dists
267267
if: >-
268268
contains(fromJSON('["metadata-validation", "pytest"]'), inputs.toxenv)
269-
uses: actions/download-artifact@b14cf4c92620c250e1c074ab0a5800e37df86765 # v4.2.0
269+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
270270
with:
271271
name: ${{ inputs.dists-artifact-name }}
272272
path: dist/

.github/workflows/scorecards.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,14 @@ jobs:
6666
# Upload the results as artifacts (optional). Commenting out will disable
6767
# uploads of run results in SARIF format to the repository Actions tab.
6868
- name: Upload artifact
69-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7070
with:
7171
name: SARIF file
7272
path: results.sarif
7373
retention-days: 5
7474

7575
# Upload the results to GitHub's code scanning dashboard.
7676
- name: Upload to code-scanning
77-
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
77+
uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
7878
with:
7979
sarif_file: results.sarif

.pre-commit-config.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ repos:
4343

4444
# Detect hardcoded secrets
4545
- repo: https://github.com/gitleaks/gitleaks
46-
rev: v8.24.2
46+
rev: v8.26.0
4747
hooks:
4848
- id: gitleaks
4949

@@ -66,7 +66,7 @@ repos:
6666
- --implicit_start
6767

6868
- repo: https://github.com/adrienverge/yamllint.git
69-
rev: v1.37.0
69+
rev: v1.37.1
7070
hooks:
7171
- id: yamllint
7272
types:

README.md

Lines changed: 55 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22

33
[![Latest Github tag]](https://github.com/antonbabenko/pre-commit-terraform/releases)
44
![Maintenance status](https://img.shields.io/maintenance/yes/2025.svg)
5-
[![Codetriage - Help Contribute to Open Source Badge]](https://www.codetriage.com/antonbabenko/pre-commit-terraform)
65
[![GHA Tests CI/CD Badge]](https://github.com/antonbabenko/pre-commit-terraform/actions/workflows/ci-cd.yml)
76
[![Codecov pytest Badge]](https://app.codecov.io/gh/antonbabenko/pre-commit-terraform?flags[]=pytest)
87
[![OpenSSF Scorecard Badge]](https://scorecard.dev/viewer/?uri=github.com/antonbabenko/pre-commit-terraform)
8+
[![OpenSSF Best Practices Badge]](https://www.bestpractices.dev/projects/9963)
9+
[![Codetriage - Help Contribute to Open Source Badge]](https://www.codetriage.com/antonbabenko/pre-commit-terraform)
910

1011
[![StandWithUkraine Banner]](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
1112

@@ -29,6 +30,7 @@ and [contributing notes](/.github/CONTRIBUTING.md).
2930
[GHA Tests CI/CD Badge]: https://github.com/antonbabenko/pre-commit-terraform/actions/workflows/ci-cd.yml/badge.svg?branch=master
3031
[Codecov Pytest Badge]: https://codecov.io/gh/antonbabenko/pre-commit-terraform/branch/master/graph/badge.svg?flag=pytest
3132
[OpenSSF Scorecard Badge]: https://api.scorecard.dev/projects/github.com/antonbabenko/pre-commit-terraform/badge
33+
[OpenSSF Best Practices Badge]: https://www.bestpractices.dev/projects/9963/badge
3234
[StandWithUkraine Banner]: https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner-direct.svg
3335

3436
## Sponsors
@@ -81,44 +83,6 @@ If you want to support the development of `pre-commit-terraform` and [many other
8183
## How to install
8284

8385
### 1. Install dependencies
84-
<!-- (Do not remove html tags here) -->
85-
* [`pre-commit`](https://pre-commit.com/#install),
86-
<sub><sup>[`terraform`](https://www.terraform.io/downloads.html) or [`opentofu`](https://opentofu.org/docs/intro/install/),
87-
<sub><sup>[`git`](https://git-scm.com/downloads),
88-
<sub><sup>[BASH `3.2.57` or newer](https://www.gnu.org/software/bash/#download),
89-
<sub><sup>Internet connection (on first run),
90-
<sub><sup>x86_64 or arm64 compatible operating system,
91-
<sub><sup>Some hardware where this OS will run,
92-
<sub><sup>Electricity for hardware and internet connection,
93-
<sub><sup>Some basic physical laws,
94-
<sub><sup>Hope that it all will work.
95-
</sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub><br><br>
96-
* [`checkov`][checkov repo] required for `terraform_checkov` hook
97-
* [`terraform-docs`][terraform-docs repo] 0.12.0+ required for `terraform_docs` hook
98-
* [`terragrunt`][terragrunt repo] required for `terragrunt_validate` and `terragrunt_valid_inputs` hooks
99-
* [`terrascan`][terrascan repo] required for `terrascan` hook
100-
* [`TFLint`][tflint repo] required for `terraform_tflint` hook
101-
* [`TFSec`][tfsec repo] required for `terraform_tfsec` hook
102-
* [`Trivy`][trivy repo] required for `terraform_trivy` hook
103-
* [`infracost`][infracost repo] required for `infracost_breakdown` hook
104-
* [`jq`][jq repo] required for `terraform_validate` with `--retry-once-with-cleanup` flag, and for `infracost_breakdown` hook
105-
* [`tfupdate`][tfupdate repo] required for `tfupdate` hook
106-
* [`graphviz`](https://www.graphviz.org/download) required for `terraform_graph` hook.
107-
* [`hcledit`][hcledit repo] required for `terraform_wrapper_module_for_each` hook
108-
109-
110-
#### 1.1 Custom Terraform binaries and OpenTofu support
111-
112-
It is possible to set custom path to `terraform` binary.
113-
This makes it possible to use [OpenTofu](https://opentofu.org) binary `tofu` instead of `terraform`.
114-
115-
How binary discovery works and how you can redefine it (first matched takes precedence):
116-
117-
1. Check if per hook configuration `--hook-config=--tf-path=<path_to_binary_or_binary_name>` is set
118-
2. Check if `PCT_TFPATH=<path_to_binary_or_binary_name>` environment variable is set
119-
3. Check if `TERRAGRUNT_TFPATH=<path_to_binary_or_binary_name>` environment variable is set
120-
4. Check if `terraform` binary can be found in the user's $PATH
121-
5. Check if `tofu` binary can be found in the user's $PATH
12286

12387
<details><summary><b>Docker</b></summary><br>
12488

@@ -250,6 +214,48 @@ E.g. `C:\Users\USERNAME\AppData\Local\Programs\Python\Python39\Lib\site-packages
250214

251215
</details>
252216

217+
Full list of dependencies and where they are used:
218+
219+
<!-- (Do not remove html tags here) -->
220+
* [`pre-commit`](https://pre-commit.com/#install),
221+
<sub><sup>[`terraform`](https://www.terraform.io/downloads.html) or [`opentofu`](https://opentofu.org/docs/intro/install/),
222+
<sub><sup>[`git`](https://git-scm.com/downloads),
223+
<sub><sup>[BASH `3.2.57` or newer](https://www.gnu.org/software/bash/#download),
224+
<sub><sup>Internet connection (on first run),
225+
<sub><sup>x86_64 or arm64 compatible operating system,
226+
<sub><sup>Some hardware where this OS will run,
227+
<sub><sup>Electricity for hardware and internet connection,
228+
<sub><sup>Some basic physical laws,
229+
<sub><sup>Hope that it all will work.
230+
</sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub></sup></sub><br><br>
231+
* [`checkov`][checkov repo] required for `terraform_checkov` hook
232+
* [`terraform-docs`][terraform-docs repo] 0.12.0+ required for `terraform_docs` hook
233+
* [`terragrunt`][terragrunt repo] required for `terragrunt_validate` and `terragrunt_valid_inputs` hooks
234+
* [`terrascan`][terrascan repo] required for `terrascan` hook
235+
* [`TFLint`][tflint repo] required for `terraform_tflint` hook
236+
* [`TFSec`][tfsec repo] required for `terraform_tfsec` hook
237+
* [`Trivy`][trivy repo] required for `terraform_trivy` hook
238+
* [`infracost`][infracost repo] required for `infracost_breakdown` hook
239+
* [`jq`][jq repo] required for `terraform_validate` with `--retry-once-with-cleanup` flag, and for `infracost_breakdown` hook
240+
* [`tfupdate`][tfupdate repo] required for `tfupdate` hook
241+
* [`graphviz`](https://www.graphviz.org/download) required for `terraform_graph` hook.
242+
* [`hcledit`][hcledit repo] required for `terraform_wrapper_module_for_each` hook
243+
244+
245+
#### 1.1 Custom Terraform binaries and OpenTofu support
246+
247+
It is possible to set custom path to `terraform` binary.
248+
This makes it possible to use [OpenTofu](https://opentofu.org) binary (`tofu`) instead of `terraform`.
249+
250+
How binary discovery works and how you can redefine it (first matched takes precedence):
251+
252+
1. Check if per hook configuration `--hook-config=--tf-path=<path_to_binary_or_binary_name>` is set
253+
2. Check if `PCT_TFPATH=<path_to_binary_or_binary_name>` environment variable is set
254+
3. Check if `TERRAGRUNT_TFPATH=<path_to_binary_or_binary_name>` environment variable is set
255+
4. Check if `terraform` binary can be found in the user's `$PATH`
256+
5. Check if `tofu` binary can be found in the user's `$PATH`
257+
258+
253259
### 2. Install the pre-commit hook globally
254260

255261
> [!NOTE]
@@ -277,6 +283,14 @@ repos:
277283
EOF
278284
```
279285

286+
If this repository was initialized locally via `git init` or `git clone` _before_
287+
you installed the pre-commit hook globally ([step 2](#2-install-the-pre-commit-hook-globally)),
288+
you will need to run:
289+
290+
```bash
291+
pre-commit install
292+
```
293+
280294
### 4. Run
281295

282296
Execute this command to run `pre-commit` on all files in the repository (not only changed files):
@@ -352,10 +366,10 @@ Config example:
352366
- id: terraform_tflint
353367
args:
354368
- --args=--config=${CONFIG_NAME}.${CONFIG_EXT}
355-
- --args=--module
369+
- --args=--call-module-type="all"
356370
```
357371
358-
If for config above set up `export CONFIG_NAME=.tflint; export CONFIG_EXT=hcl` before `pre-commit run`, args will be expanded to `--config=.tflint.hcl --module`.
372+
If for config above set up `export CONFIG_NAME=.tflint; export CONFIG_EXT=hcl` before `pre-commit run`, args will be expanded to `--config=.tflint.hcl --call-module-type="all"`.
359373

360374
### All hooks: Set env vars inside hook at runtime
361375

0 commit comments

Comments
 (0)