Merge pull request #74 from RoseSecurity/support-tofu-file-extensions

feat: Support `.tofu` file extensions and pre-commit clean ups

Author: kvendingoldo

.github/workflows/build-image.yaml

@@ -98,4 +98,3 @@ jobs:
           tags: |
             registry.hub.docker.com/tofuutils/pre-commit-opentofu:nightly
           provenance: false
-

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.5.0
+  rev: v6.0.0
   hooks:
     # Git style
     - id: check-added-large-files

.pre-commit-hooks.yaml

@@ -4,15 +4,15 @@
   entry: hooks/infracost_breakdown.sh
   language: script
   require_serial: true
-  files: \.((tf|tofu)(vars)?|hcl)$
+  files: \.(tf|tofu|tfvars|hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_fmt
   name: OpenTofu fmt
   description: Rewrites all OpenTofu configuration files to a canonical format.
   entry: hooks/tofu_fmt.sh
   language: script
-  files: \.(tf|tofu)(vars)?$
+  files: \.(tf|tofu|tfvars|(tftest|tofutest|tfmock|tfquery)\.hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_docs
@@ -23,7 +23,7 @@
   require_serial: true
   entry: hooks/tofu_docs.sh
   language: script
-  files: (\.(tf|tofu)|\.terraform\.lock\.hcl)$
+  files: \.(tf|tofu|terraform\.lock\.hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_docs_without_aggregate_type_defaults
@@ -52,7 +52,7 @@
   require_serial: true
   entry: hooks/tofu_validate.sh
   language: script
-  files: \.(tf|tofu)(vars)?$
+  files: \.(tf|tofu|tfvars|terraform\.lock\.hcl)$
   exclude: \.terraform\/.*$
 
 - id: tofu_providers_lock
@@ -70,7 +70,7 @@
   require_serial: true
   entry: hooks/tofu_tflint.sh
   language: script
-  files: \.(tf|tofu)(vars)?$
+  files: \.(tf|tofu|tfvars)$
   exclude: \.terraform\/.*$
 
 - id: terragrunt_fmt
@@ -104,7 +104,7 @@
     Static analysis of OpenTofu templates to spot potential security issues.
   require_serial: true
   entry: hooks/tofu_tfsec.sh
-  files: \.(tf|tofu)(vars)?$
+  files: \.(tf|tofu|tfvars)$
   language: script
 
 - id: tofu_trivy
@@ -113,7 +113,7 @@
     Static analysis of OpenTofu templates to spot potential security issues.
   require_serial: true
   entry: hooks/tofu_trivy.sh
-  files: \.(tf|tofu)(vars)?$
+  files: \.(tf|tofu|tfvars)$
   language: script
 
 - id: checkov
@@ -123,7 +123,7 @@
   language: python
   pass_filenames: false
   always_run: false
-  files: \.tf$
+  files: \.(tf|tofu)$
   exclude: \.terraform\/.*$
   require_serial: true
 
@@ -145,7 +145,7 @@
   pass_filenames: false
   always_run: false
   require_serial: true
-  files: \.tf$
+  files: \.(tf|tofu)$
   exclude: \.terraform\/.*$
 
 - id: terrascan

Dockerfile

@@ -22,7 +22,7 @@ RUN [ ${PRE_COMMIT_VERSION} = "latest" ] && pip3 install --no-cache-dir pre-comm
 
 RUN curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip \
     && curl -LO https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_SHA256SUMS \
-    && [ $(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ') = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
+    && [ "$(sha256sum "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" | cut -f 1 -d ' ')" = "$(grep "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" tofu_*_SHA256SUMS | cut -f 1 -d ' ')" ] \
     && unzip tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/bin/ \
     && rm "tofu_${TOFU_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \
     && rm "tofu_${TOFU_VERSION}_SHA256SUMS"
@@ -235,4 +235,3 @@ ENV INFRACOST_API_KEY=${INFRACOST_API_KEY:-}
 ENV INFRACOST_SKIP_UPDATE_CHECK=${INFRACOST_SKIP_UPDATE_CHECK:-false}
 
 ENTRYPOINT [ "/entrypoint.sh" ]
-

README.md

@@ -294,7 +294,7 @@ repos:
 
 ## Available Hooks
 
-There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (both `*.tf` and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
+There are several [pre-commit](https://pre-commit.com/) hooks to keep OpenTofu configurations (`*.tf`, `*.tofu`, and `*.tfvars`) and Terragrunt configurations (`*.hcl`) in a good shape:
 
 <!-- markdownlint-disable no-inline-html -->
 | Hook name                                              | Description                                                                                                                                                                                                                                  | Dependencies<br><sup>[Install instructions here](#1-install-dependencies)</sup>      |
@@ -326,6 +326,8 @@ Check the [source file](https://github.com/tofuutils/pre-commit-opentofu/blob/ma
 
 OpenTofu operates on a per-dir basis, while `pre-commit` framework only supports files and files that exist. This means if you only remove the TF-related file without any other changes in the same dir, checks will be skipped. Example and details [here](https://github.com/pre-commit/pre-commit/issues/3048).
 
+Hooks match `*.tofu` files where OpenTofu configuration files are supported, but some wrapped third-party tools may lag behind OpenTofu's native `*.tofu` parsing. If a hook runs `terraform-docs`, `tflint`, `tfsec`, `trivy`, `checkov`, `infracost`, or `tfupdate`, make sure the installed tool version supports the file extensions used in your repository.
+
 ### All hooks: Usage of environment variables in `--args`
 
 > All, except deprecated hooks: `checkov`, `tofu_docs_replace`
@@ -930,7 +932,7 @@ To replicate functionality in `tofu_docs` hook:
             require_serial: true
             entry: .generate-providers.sh
             language: script
-            files: \.tf(vars)?$
+            files: \.(tf|tofu|tfvars)$
             pass_filenames: false
 
      - repo: https://github.com/pre-commit/pre-commit-hooks

hooks/_common.sh

@@ -123,7 +123,7 @@ function common::parse_and_export_env_vars {
         # `$arg` will be checked in `if` conditional, `$ARGS` will be used in the next functions.
         # shellcheck disable=SC2016 # '${' should not be expanded
         arg=${arg/'${'$env_var_name'}'/$env_var_value}
-        ARGS[$arg_idx]=$arg
+        ARGS[arg_idx]=$arg
         # shellcheck disable=SC2016 # '${' should not be expanded
         common::colorify "green" 'After ${'"$env_var_name"'} expansion: '"'$arg'\n"
         continue

hooks/terragrunt_validate_inputs.sh

@@ -32,8 +32,8 @@ function normalize_validate_args_for_modern_terragrunt {
 
   for arg_idx in "${!ARGS[@]}"; do
     case "${ARGS[$arg_idx]}" in
-      --terragrunt-strict-validate|--strict-validate)
-        ARGS[$arg_idx]="--strict"
+      --terragrunt-strict-validate | --strict-validate)
+        ARGS[arg_idx]="--strict"
         ;;
     esac
   done
@@ -45,7 +45,7 @@ function terragrunt_version_ge_0_78 {
   local major
   local minor
 
-  version_raw=$(terragrunt --version 2>/dev/null || true)
+  version_raw=$(terragrunt --version 2> /dev/null || true)
   version=$(echo "$version_raw" | sed -E 's/.*v?([0-9]+)\.([0-9]+)\.([0-9]+).*/\1.\2.\3/')
 
   if [[ ! $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -109,8 +109,8 @@ function legacy_unit_dirs_from_files {
   if common::is_hook_run_on_whole_repo "$HOOK_ID" "${FILES[@]}"; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' \
-      | sort -u | while read -r unit_file; do
+      -not -path '*/.terraform/*' |
+      sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return
@@ -137,8 +137,8 @@ function legacy_unit_dirs_from_files {
   if [[ ${#unit_files[@]} -eq 0 ]]; then
     find . -type f -name terragrunt.hcl \
       -not -path '*/.terragrunt-cache/*' \
-      -not -path '*/.terraform/*' \
-      | sort -u | while read -r unit_file; do
+      -not -path '*/.terraform/*' |
+      sort -u | while read -r unit_file; do
       dirname "$unit_file"
     done
     return

hooks/tofu_wrapper_module_for_each.sh

@@ -315,7 +315,7 @@ EOF
     all_tf_content=$(find "${full_module_dir}" -regex '.*\.(tf|tofu)' -maxdepth 1 -type f -exec cat {} +)
 
     if [[ ! $all_tf_content ]]; then
-      common::colorify "yellow" "Skipping ${full_module_dir} because there are no *.(tf|tofu) files."
+      common::colorify "yellow" "Skipping ${full_module_dir} because there are no .tf or .tofu files."
       continue
     fi