Improve linting for DNS Concourse job

[Dan Shick]

Yoz's addition to the vote.gov DNS failed with the following error:

* aws_route53_record.vote_gov_www_vote_gov_a: provider.aws: aws_route53_record: www.vote.gov: "ttl": required field is not set

That should get checked in the PR stage.

[Aidan Feldman]

Sounds like a good issue/pull request for terraform validate.

[Dan Shick]

Indeed @afeld , although I note that in this DNS repo, we don't have a CI testing step at all. @alain-hoang also notes that https://github.com/wata727/tflint exists for supposedly even finer linting.

[Aidan Feldman]

we don't have a CI testing step at all

We do it through Travis rather than Concourse:

• https://github.com/18F/dns/blob/deploy/.travis.yml
• https://travis-ci.org/18F/dns

[Dan Shick]

@afeld Thanks! I knew we used Travis generally, and I sure missed the .travis.yml file, but most importantly to this issue, I didn't see the testing happening in the first place. Shouldn't I see a step where Travis is validating changes in PRs like this?: #62

(PS: I see that terraform validate already gets run in that yml file)

[Aidan Feldman]

Shouldn't I see a step where Travis is validating changes in PRs like this?

Is that what you mean?

[Dan Shick]

D'oh! Sorry about that, I completely missed those checks. In my (lame) defense, I was expecting it to look like this:

So I guess the real problem is that terraform validate is not catching errors like Yoz's.

[Dan Shick]

Okay, tflint doesn't understand Yoz's error either. Trying some other terraform linters.

[Dan Shick]

And furthermore, it doesn't seem like third-party linters are able to do the job. We need one of the following (both of which are hard):

• Hashicorp enhances terraform validate to dry-run everything that it does when it runs against the backend provider, as discussed in #71 (comment)
• Concourse sends error output to the submitter of the PR

Since we don't have any control over the first one, I'm going to look into Concourse options.

[Dan Shick]

#76