📄 仓库 README

在 GitHub 查看 ↗

来自 GitHub 仓库自述文件 · 版权归原作者所有

Collection of git hooks for Terraform to be used with pre-commit framework

Maintenance status

pre-commit-terraform provides a collection of Git Hooks for Terraform and related tools and is driven by the pre-commit framework. It helps ensure that Terraform, OpenTofu, and Terragrunt configurations are kept in good shape by automatically running various checks and formatting code before committing changes to version control system. This helps maintain code quality and consistency across the project.

It can be run:

Locally and in CI
As standalone Git hooks or as a Docker image
For the entire repository or just for change-related files (e.g., local git stash, last commit, or all changes in a Pull Request)

Want to contribute? Check open issues and contributing notes.

Table of content

Sponsors
Table of content
How to install
1. Install dependencies
- 1.1 Custom Terraform binaries and OpenTofu support
2. Install the pre-commit hook globally
3. Add configs and hooks
4. Run
Available Hooks
Hooks usage notes and examples
Known limitations
All hooks: Usage of environment variables in --args
All hooks: Usage of __GIT_WORKING_DIR__ placeholder in --args
All hooks: Set env vars inside hook at runtime
All hooks: Disable color output
All hooks: Log levels
Most hooks: Pin a specific tool version
- Keeping pinned versions up-to-date using Renovate
Many hooks: Parallelism
checkov (deprecated) and terraform_checkov
infracost_breakdown
terraform_docs
terraform_docs_replace (deprecated)
terraform_fmt
terraform_providers_lock
terraform_tflint
terraform_tfsec (deprecated)
terraform_trivy
terraform_validate
terraform_wrapper_module_for_each
terrascan
tfupdate
terragrunt_providers_lock
terragrunt_validate
terragrunt_validate_inputs
Docker Usage
About Docker image security
File Permissions
Download Terraform modules from private GitHub repositories
Mount tools cache directory
GitHub Actions
Authors
License
Additional information for users from Russia and Belarus

How to install

1. Install dependencies

Docker

**Pull docker image with all hooks**:

TAG=latest
docker pull ghcr.io/antonbabenko/pre-commit-terraform:$TAG

All available tags [here](https://github.com/antonbabenko/pre-commit-terraform/pkgs/container/pre-commit-terraform/versions). Check [About Docker image security](#about-docker-image-security) section to learn more about possible security issues and why you probably want to build and maintain your own image. **Build from scratch**: > **IMPORTANT** > To build image you need to have [`docker buildx`](https://docs.docker.com/build/install-buildx/) enabled as default builder. > Otherwise - provide `TARGETOS` and `TARGETARCH` as additional `--build-arg`'s to `docker build`. When hooks-related `--build-arg`s are not specified, only the latest version of `pre-commit` and `terraform` will be installed.

git clone git@github.com:antonbabenko/pre-commit-terraform.git
cd pre-commit-terraform
# Install the latest versions of all the tools
docker build -t pre-commit-terraform --build-arg INSTALL_ALL=true .

To install a specific version of individual tools, define it using `--build-arg` arguments or set it to `latest`:

docker build -t pre-commit-terraform \
    --build-arg PRE_COMMIT_VERSION=latest \
    --build-arg OPENTOFU_VERSION=latest \
    --build-arg TERRAFORM_VERSION=1.5.7 \
    --build-arg CHECKOV_VERSION=2.0.405 \
    --build-arg HCLEDIT_VERSION=latest \
    --build-arg INFRACOST_VERSION=latest \
    --build-arg TERRAFORM_DOCS_VERSION=0.15.0 \
    --build-arg TERRAGRUNT_VERSION=latest \
    --build-arg TERRASCAN_VERSION=1.10.0 \
    --build-arg TFLINT_VERSION=0.31.0 \
    --build-arg TFSEC_VERSION=latest \
    --build-arg TFUPDATE_VERSION=latest \
    --build-arg TRIVY_VERSION=latest \
    .

Set `-e PRE_COMMIT_COLOR=never` to disable the color output in `pre-commit`. > **NOTE** > The build install scripts are calling the GitHub API to resolve the release URL. If you need to authenticate those calls, you can pass a GitHub token (the `GITHUB_TOKEN` environment variable is expected to be set with an [access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)): > ```bash > docker build -t pre-commit-terraform --build-arg GITHUB_TOKEN . > ```

MacOS

brew install pre-commit terraform-docs tflint tfsec trivy checkov terrascan infracost tfupdate minamijoyo/hcledit/hcledit jq

Ubuntu 18.04

sudo apt update
sudo apt install -y unzip software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install -y python3.7 python3-pip
python3 -m pip install --upgrade pip
pip3 install --no-cache-dir pre-commit
python3.7 -m pip install -U checkov
curl -L "$(curl -s https://api.github.com/repos/terraform-docs/terraform-docs/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > terraform-docs.tgz && tar -xzf terraform-docs.tgz && rm terraform-docs.tgz && chmod +x terraform-docs && sudo mv terraform-docs /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.zip")" > tflint.zip && unzip tflint.zip && rm tflint.zip && sudo mv tflint /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/aquasecurity/tfsec/releases/latest | grep -o -E -m 1 "https://.+?tfsec-linux-amd64")" > tfsec && chmod +x tfsec && sudo mv tfsec /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | grep -o -E -i -m 1 "https://.+?/trivy_.+?_Linux-64bit.tar.gz")" > trivy.tar.gz && tar -xzf trivy.tar.gz trivy && rm trivy.tar.gz && sudo mv trivy /usr/bin
curl -L "$(curl -s https://api.github.com/repos/tenable/terrascan/releases/latest | grep -o -E -m 1 "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz && tar -xzf terrascan.tar.gz terrascan && rm terrascan.tar.gz && sudo mv terrascan /usr/bin/ && terrascan init
sudo apt install -y jq && \
curl -L "$(curl -s https://api.github.com/repos/infracost/infracost/releases/latest | grep -o -E -m 1 "https://.+?-linux-amd64.tar.gz")" > infracost.tgz && tar -xzf infracost.tgz && rm infracost.tgz && sudo mv infracost-linux-amd64 /usr/bin/infracost && infracost auth login
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/tfupdate/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > tfupdate.tar.gz && tar -xzf tfupdate.tar.gz tfupdate && rm tfupdate.tar.gz && sudo mv tfupdate /usr/bin/
curl -L "$(curl -s https://api.github.com/repos/minamijoyo/hcledit/releases/latest | grep -o -E -m 1 "https://.+?_linux_amd64.tar.gz")" > hcledit.tar.gz && tar -xzf hcledit.tar.gz hcledit && rm hcledit.tar.gz && sudo mv hcledit /usr/bin/

Ubuntu 20.04+

```bash sudo a

📈 近 7 天 Star 趋势

每日新增 Star（柱）与累计 Star（线）· 数据来自 GitHub

🏆 排名变化趋势

在各榜单中的排名历史（数字越小越靠前）

📋 历史上榜记录

每次快照的详细数据

日期	榜单	排名	周期新增	总 STAR