bitwise-media-group Terraform validation workflow
Run this loop after editing Terraform and before every commit. Fix findings and repeat until all three stages are clean — never commit with failures.
1. Format
From the repository root:
terraform fmt -recursive
This rewrites files in place. In CI or to check without writing, use
terraform fmt -recursive -check -diff.
2. Validate
Per changed module or root configuration (validation is per-directory, not monorepo-wide):
terraform -chdir=<module-dir> init -backend=false # first run only; downloads providers
terraform -chdir=<module-dir> validate
-backend=false skips state/backend configuration — validation needs providers, not state.
Validate catches type errors, unknown arguments, and missing required attributes.
3. Lint
tflint --init # once per clone; downloads rulesets (needs network)
tflint --chdir=<module-dir>
If the repository has no .tflint.hcl, offer to seed one from this skill's bundled
tflint.hcl — it enables the recommended Terraform preset plus naming-convention,
documented-variables/outputs, unused-declarations, and required-version/providers rules. Add a
provider-specific ruleset (AWS/Azure/GCP) only if the repository targets that provider; the
bundled config keeps it commented out.
4. Repeat
Re-run the loop after fixing findings. The stages are ordered cheapest-first: fmt is instant, validate needs providers, tflint needs rulesets. A module is done when all three pass.
Notes:
terraform validatespawns provider plugins that communicate over local Unix sockets; in sandboxed environments, ensure Unix-socket connections are permitted or run validation outside the sandbox.- tflint enforces several conventions from the
terraform-styleskill mechanically (documented variables/outputs, required version/provider constraints, naming) — treat its findings as style violations, not suggestions.