Giters

reviewdog / action-tflint

Run tflint with reviewdog on pull requests to enforce best practices

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

tflint produces no warning/error when run with following example

SohamChakraborty opened this issue · comments

commented

Hi,

I am not sure whether I am missing something trivial/important, but FWIW, I am trying to use this action and failing to find out why no output (error/warning) is displayed. When I run tflint locally, I do see error/warning.

My config:

name: reviewdog
on:
  pull_request:
    paths:
      - '**/*.tf'
      - '**/*.tfvars'
      - '**/*.tfvar'
jobs:
  tflint:
    name: runner / tflint
    runs-on: ubuntu-latest

    steps:
      - name: Clone repo
        uses: actions/checkout@v2
      # Minimal example
      - name: tflint
        uses: reviewdog/action-tflint@master
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          filter_mode: nofilter
          level: info

This is what I get:

Run reviewdog/action-tflint@master
  with:
    github_token: ***
    reporter: github-pr-review
    filter_mode: nofilter
    level: info
    fail_on_error: false
    working_directory: .
    tflint_version: latest
    flags: --module
Preparing
  Detected linux running on amd64, will install tools in /tmp/tmp.rf76iJGetb
  Looking up the latest tflint version ...
🐶 Installing reviewdog (v0.12.0) ... https://github.com/reviewdog/reviewdog
  reviewdog/reviewdog info checking GitHub for tag 'v0.12.0'
  reviewdog/reviewdog info found version: 0.12.0 for v0.12.0/Linux/x86_64
  reviewdog/reviewdog info installed /tmp/tmp.rf76iJGetb/reviewdog/reviewdog
 Installing tflint (v0.30.0) ... https://github.com/terraform-linters/tflint
  Archive:  /tmp/tmp.rf76iJGetb/tflint.zip
    inflating: /tmp/tmp.rf76iJGetb/temp-tflint/tflint  
 Print tflint details ...
  TFLint version 0.30.0
 Running tflint with reviewdog 🐶 ...

Although when I run tflint locally, I get this error (among others):

 tflint .
Error: Failed to load configurations: main.tf:44,3-11: Reserved argument name in resource block; The name "for_each" is reserved for use in a future version of Terraform., and 4 other diagnostic(s)

What's going on here?

commented

Hey!

Hm... is your code actually valid Terraform? What happens if you run a terraform validate?

The error you posted is actually a Terraform validation issue, not a tflint rule violation. Looking at the tflint repo, the behavior for invalid terraform files is to just exit early: terraform-linters/tflint#983 which is what we're seeing here.

commented

Right, so when I run validate it works fine.

$ terragrunt validate
Success! The configuration is valid.

When I run tflint it says me this:

$ tflint .
Error: Failed to load configurations: versions.tf:3,11-6,6: Invalid version constraint; A string value is required for aws.

Now, I have deliberately introduced an error here:

$ cat main.tf 
terraform {
  backend "s3" {
    key = "terraform/tflint/terraform.tfstate"
  }
}

provider "aws" {}

resource "aws_instance" "foo" {
  ami           = "ami-0ff8a91507f77f867"
  instance_type = "t1.2xlarge" # invalid type!
}

Strangely, my tfsec action works fine and tells me this:

Resource 'aws_instance.foo' is missing metadata_options block - it is required with http_tokens set to required to make Instance Metadata Service more secure.

And tflint passes without saying anything.

This is tfsec.yml:

 name: tfsec
 on: 
   pull_request:
     paths:
       - '**/*.tf'
 jobs:
   tfsec:
     name: runner / tfsec
     runs-on: ubuntu-latest

     steps:
       - name: Clone repo
         uses: actions/checkout@v2

       - name: tfsec
         uses: reviewdog/action-tfsec@master
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review
           filter_mode: "file" # nofilter option checks all files, not just diff
           fail_on_error: true # fail action if errors are found
           level: error  # change to info for more information

This is tflint.yml:

name: hooks
on: 
  pull_request:
    branches:
      - master
    # paths:
    #   - '**/*.tf'

jobs:
  tflint:
    name: runner / tflint
    runs-on: ubuntu-latest

    steps:
      - name: Clone repo
        uses: actions/checkout@v2

      - name: tflint
        uses: reviewdog/action-tflint@master
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          tflint_version: "v0.24.0"
          filter_mode: "nofilter" # nofilter option checks all files, not just diff
          # fail_on_error: true # fail action if errors are found
          level: info  # change to info for more information

Not really sure what is going on. Thanks for checking @Vlaaaaaaad

commented

@SohamChakraborty can you try without the tflint_version: "v0.24.0" line? That specific version of tflint seems to be for older terraform versions (0.14).

commented

Removed the version. But no luck.

Run reviewdog/action-tflint@master
  with:
    github_token: ***
    reporter: github-pr-review
    filter_mode: nofilter
    level: info
    fail_on_error: false
    working_directory: .
    tflint_version: latest
    flags: --module
Preparing
  Detected linux running on amd64, will install tools in /tmp/tmp.Y57ZaOoTNL
  Looking up the latest tflint version ...
🐶 Installing reviewdog (v0.12.0) ... https://github.com/reviewdog/reviewdog
  reviewdog/reviewdog info checking GitHub for tag 'v0.12.0'
  reviewdog/reviewdog info found version: 0.12.0 for v0.12.0/Linux/x86_64
  reviewdog/reviewdog info installed /tmp/tmp.Y57ZaOoTNL/reviewdog/reviewdog
 Installing tflint (v0.30.0) ... https://github.com/terraform-linters/tflint
  Archive:  /tmp/tmp.Y57ZaOoTNL/tflint.zip
    inflating: /tmp/tmp.Y57ZaOoTNL/temp-tflint/tflint  
 Print tflint details ...
  TFLint version 0.30.0
 Running tflint with reviewdog 🐶 ...
1s
Post job cleanup.
/usr/bin/git version
git version 2.32.0
/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
/usr/bin/git submodule foreach --recursive git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :
/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
http.https://github.com/.extraheader
/usr/bin/git config --local --unset-all http.https://github.com/.extraheader
/usr/bin/git submodule foreach --recursive git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :

Could it be a working directory problem? Just wild guess.

commented

Hm... it could be. I'll test it in GitHub and report back!

commented

As you can see in Vlaaaaaaad/test-tflint-bug-maybe#1, the following code seems to work:

      - name: tflint
        uses: reviewdog/action-tflint@master
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          filter_mode: "nofilter" # nofilter option checks all files, not just diff
          # fail_on_error: true # fail action if errors are found
          level: info  # change to info for more information

Can you tell me if that works for you? Also, are your Terraform files in the root of the repo, or are you using a subfolder?

commented

The terraform files are not at the root of repo, they are in a subfolder. So, I used your code from the repo and also added paths. The result remained the same.

I will give it a fresh try on another repo and see if something is missing with my configuration.

Give me a couple of days, I will test over the weekend and report back.

Thanks @Vlaaaaaaad

commented

No worries, I am not in a rush!

Setting working_directory to your desired subfolder name should make the action work:

      - name: tflint
        uses: reviewdog/action-tflint@master
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          filter_mode: "nofilter" # nofilter option checks all files, not just diff
          # fail_on_error: true # fail action if errors are found
          level: info  # change to info for more information
          working_directory: subfolder
commented

Hi @Vlaaaaaaad,

Thank you for the time. I checked with various combinations and permutations. But in all cases, my tests are failing. I even moved the defective code to the root of the repository, but it didn't produce any result.

I then moved it back to my original terraform directory structure like this

root of repo --> terraform --> workload --> defective code directory

That also didn't work. I tried multiple tflint.yml structures to no yield:

name: tflint
on: 
  pull_request:
    paths:
      - '**/*.tf'
jobs:
  tflint:
    name: runner / tflint
    runs-on: ubuntu-latest

    steps:
      - name: Clone repo
        uses: actions/checkout@v2

      - name: tflint
        uses: reviewdog/action-tflint@master
        with:
          github_token: ${{ secrets.github_token }}
          reporter: github-pr-review
          filter_mode: "nofilter" # nofilter option checks all files, not just diff
            #fail_on_error: true # fail action if errors are found
          level: info  # change to info for more information

2nd test: Then, added

working_directory: terraform/workload

3rd test: Then removed,

    paths:
      - '**/*.tf'

4th test: Then removed,

working_directory: terraform/workload

5th test: Then added,

working_directory: terraform

6th test: Then added

working_directory: terraform/workload

Each of the tests were repeated with the defective code directory at repo root and at repo_root/terraform/workload.

Then I gave up. I will probably try to see if precommit works in my case.

Thanks for reading :)

commented

@SohamChakraborty I created a new repo and tested how the action performs when the Terraform files are in a directory example/deep, in my case. As you can see here, the action behaves as expected.

Can you maybe share a public repo where you can reproduce the error you're reporting?

commented

@SohamChakraborty any updates on this?

commented

Closing due to a lack of activity! Feel free to re-open if you can share a public repo the error can be reproduced.