tofulint

TofuLint

A pluggable OpenTofu linter inspired by TFLint.

⚠️ Disclaimer

TofuLint is an experimental fork of TFLint that replaces Terraform internals with OpenTofu.
It is highly experimental and not production-ready. Use at your own risk.

Features

TofuLint is a modular framework where each feature is provided via plugins. Key features include:

• Detect potential errors (e.g., invalid instance types) for major cloud providers: AWS, Azure, GCP.
• Warn about deprecated syntax and unused declarations.
• Enforce best practices and naming conventions.

Installation

Currently, only one installation method is available:

Bash (Linux)

curl -s https://raw.githubusercontent.com/SoeldnerConsult/tofulint/master/install_linux.sh | bash

Verification

At this stage, no releases are verified or signed.

Docker

A Docker-based installation will be available in a future release.

Getting Started

TofuLint comes bundled with a Terraform language ruleset, enabling recommended rules by default.

Enabling the Opentofu Plugin

Declare the plugin block in your .tflint.hcl or .tofulint.hcl:

plugin "opentofu" {
  enabled = true
  version = "0.0.7"
  source = "github.com/SoeldnerConsult/tofulint-ruleset-opentofu"
}

Even though tofulint currently comes with the opentofu plugin pre-packaged, it is still necessary to enable th plugin manually with the given plugin source. This is due to a bug in tofulint source code.

More details: TFLint Terraform Ruleset Configuration

Cloud Provider Plugins

If you use a cloud provider, install the corresponding plugin:

• AWS
• GCP

Other plugins can be added via .tflint.hcl and installed with:

tofulint --init

Write your own plugins

To write your own plugins the syntax and workflow is the same as in tflint. This also enables to modify existing tflint plugins to work with tofulint. Therefor fork the wanted plugin, enable all github-actions via th github web interface, and replace all terraform-linters/tflint-plugin-sdk with SoeldnerConsult/tofulint-plugin-sdk. Also replace all terraform-linters/tofulint-plugin-<pluginName> occurances with the new repository where the plugin is located now, as well as the version in project/main.go. Commit and push the changes, create a new tag or empty release with the Syntax vX.X.X (best wopuld be to use the same Version as above) and the rest will be handled by the corresponsing actions.

Use the plugin by including the following in your .tofulint.hcl / .tflint.hcl file:

plugin "<pluginName>" {
  enabled = true
  version = "version (z.B. 0.0.7)"
  source = "github.com/<owner>/tofulint-ruleset-<pluginName>"
}

Install with

tofulint --init

Example Plugin Configuration

plugin "foo" {
  enabled = true
  version = "0.1.0"
  source  = "github.com/org/tflint-ruleset-foo"

  signing_key = <<-KEY
  -----BEGIN PGP PUBLIC KEY BLOCK-----
  ...
  KEY
}

For custom rules, create your own plugin or use Rego policies:

• Writing Plugins

Usage

By default, TofuLint inspects files in the current directory. Example options:

$ tofulint --help
Usage:
  tofulint --chdir=DIR/--recursive [OPTIONS]

Application Options:
  -v, --version                         Print TofuLint version
      --init                            Install plugins
      --langserver                      Start language server
  -f, --format=[default|json|checkstyle|junit|compact|sarif] Output format
  -c, --config=FILE                     Config file name (default: .tflint.hcl)
      --ignore-module=SOURCE            Ignore module sources
      --enable-rule=RULE_NAME           Enable rules from the command line
      --disable-rule=RULE_NAME          Disable rules from the command line
      --only=RULE_NAME                  Enable only this rule
      --enable-plugin=PLUGIN_NAME       Enable plugins from the command line
      --var-file=FILE                    Terraform variable file
      --var='foo=bar'                    Set a Terraform variable
      --call-module-type=[all|local|none] Types of module to call (default: local)
      --chdir=DIR                        Change working directory
      --recursive                        Run recursively in subdirectories
      --filter=FILE                       Filter issues by file names/globs
      --force                             Return zero exit code even if issues found
      --minimum-failure-severity=[error|warning|notice] Minimum severity for non-zero exit
      --color                             Enable colorized output
      --no-color                          Disable colorized output
      --fix                               Automatically fix issues
      --no-parallel-runners               Disable parallelism

Help Options:
  -h, --help                             Show this help message

See User Guide for more details.

Debugging

Enable detailed logs using the TFLINT_LOG environment variable:

$ TFLINT_LOG=debug tofulint

Developing

See Developer Guide for instructions on contributing and building plugins.

Security

For reporting security issues, refer to our security policy.