From e05f97bc00ad4db977a2c2bbc2956587c895ce5f Mon Sep 17 00:00:00 2001 From: Copilot Date: Mon, 11 May 2026 20:36:30 -0400 Subject: [PATCH] chore: enable tflint-ruleset-azurerm rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 4 of POps-Rox Go-To-Market. Enables Azure-specific tflint rules that were installed in Phase 0b. Rule selection is conservative to start — high-noise rules remain disabled with TODO comments for later enablement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .tflint.hcl | 38 ++++++++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/.tflint.hcl b/.tflint.hcl index 5684481..1838520 100644 --- a/.tflint.hcl +++ b/.tflint.hcl @@ -1,13 +1,39 @@ +plugin "azurerm" { + enabled = true + version = "0.28.0" + source = "github.com/terraform-linters/tflint-ruleset-azurerm" +} + +# Azure resource validation — fail CI on invalid azurerm config values we just +# migrated to in the 3.x → 4.x cutover. Names that did not exist in +# tflint-ruleset-azurerm v0.28.0 (e.g. *_invalid_account_tier, +# *_invalid_account_replication_type) are tracked as TODO so we can revisit +# when the upstream ruleset adds them. +rule "azurerm_storage_account_invalid_access_tier" { + enabled = true +} +rule "azurerm_storage_account_invalid_account_kind" { + enabled = true +} +rule "azurerm_resource_missing_tags" { + enabled = false # TODO: flip to true after fleet-wide tag policy is defined +} + +# Standard terraform plugin rules plugin "terraform" { enabled = true preset = "recommended" } -plugin "azurerm" { +rule "terraform_required_version" { enabled = true - version = "0.28.0" - source = "github.com/terraform-linters/tflint-ruleset-azurerm" } - -# Azurerm rules — installed but NOT enforced yet. Enablement deferred to Phase 4. -# Individual rule enables go here after Phase 1 4.x migration is complete. +rule "terraform_required_providers" { + enabled = true +} +rule "terraform_documented_variables" { + enabled = false # TODO: too noisy for module surfaces; revisit per repo +} +rule "terraform_documented_outputs" { + enabled = false # TODO: too noisy; revisit per repo +}