This repository contains the TFLint ruleset for Azure Verified Modules.
The azapi_resource_tag rule uses a standalone, embedded snapshot at
internal/tagcapability/data/azapi_tags_v1.json; it does not download schemas
at runtime or depend on the AzAPI provider. The snapshot records its
MIT-licensed upstream sources and exact revisions. The weekly/manual
Update AzAPI Tag Snapshot
workflow regenerates it from azure-rest-api-specs through
bicep-types-az, validates it, and opens or updates a deterministic PR only
when the data changes.
- TFLint v0.62+
- Go v1.26+
You can install a released plugin with tflint --init. Declare a config in .tflint.hcl, replacing X.Y.Z with the release version without the v prefix:
plugin "avm" {
enabled = true
version = "X.Y.Z"
source = "github.com/Azure/tflint-ruleset-avm"
signature = "attestation"
}See RULES.md for the full rules reference (same content, kept in sync automatically).
The full list of rules is generated automatically into RULES.md and mirrored into the ## Rules section above.
To regenerate after adding, removing, or modifying rules, run:
./scripts/update-readme.shThis script:
- Runs
go generate ./..., which executescmd/rulesdocto refreshRULES.mdfromrules.Rules. - Splices the rules table from
RULES.mdinto the<!-- RULES:START -->/<!-- RULES:END -->markers inREADME.md.
A GitHub Actions workflow (.github/workflows/rules-docs-check.yml) runs the same script on pull requests that touch rule sources and fails the build if README.md or RULES.md is out of date, so drift cannot land on main.
Clone the repository locally and run the following command:
makeYou can easily install the built plugin with the following:
make installYou can run the built plugin like the following:
$ cat << EOS > .tflint.hcl
plugin "avm" {
enabled = true
}
EOS
$ tflint- Create and publish a GitHub pre-release with a
vX.Y.Ztag and release notes. - Queue the
tflint-ruleset-avmrelease pipeline ingithub-private/azure/Azure-Verified-Moduleswith that tag. - The pipeline builds every target in
release/targets.json, Authenticode-signs the Windows binaries, packages and validates the assets, replaces the pre-release assets, and promotes the pre-release. - Promotion triggers
sign-checksums.yml, which validates the release assets and creates a GitHub Artifact Attestation forchecksums.txt.
Release pipelines are manually queued and never run from a GitHub push or tag.