Skip to content

Commit 77940fd

Browse files
wzooffwzooff
authored
feat: Add terragrunt_providers_lock hook (#632)
1 parent 385b542 commit 77940fd

File tree

3 files changed

+102
-0
lines changed

3 files changed

+102
-0
lines changed

‎.pre-commit-hooks.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,14 @@
8585
files: (\.hcl)$
8686
exclude: \.terraform/.*$
8787

88+
- id: terragrunt_providers_lock
89+
name: Terragrunt providers lock
90+
description: Updates provider signatures in dependency lock files using terragrunt.
91+
entry: hooks/terragrunt_providers_lock.sh
92+
language: script
93+
files: (terragrunt|\.terraform\.lock)\.hcl$
94+
exclude: \.(terraform/.*|terragrunt-cache)$
95+
8896
- id: terraform_tfsec
8997
name: Terraform validate with tfsec (deprecated, use "terraform_trivy")
9098
description: Static analysis of Terraform templates to spot potential security issues.

‎README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ If you are using `pre-commit-terraform` already or want to support its developme
5252
* [terraform\_wrapper\_module\_for\_each](#terraform_wrapper_module_for_each)
5353
* [terrascan](#terrascan)
5454
* [tfupdate](#tfupdate)
55+
* [terragrunt\_providers\_lock](#terragrunt_providers_lock)
5556
* [Docker Usage](#docker-usage)
5657
* [File Permissions](#file-permissions)
5758
* [Download Terraform modules from private GitHub repositories](#download-terraform-modules-from-private-github-repositories)
@@ -281,6 +282,7 @@ There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform
281282
| `terraform_validate` | Validates all Terraform configuration files. [Hook notes](#terraform_validate) | `jq`, only for `--retry-once-with-cleanup` flag |
282283
| `terragrunt_fmt` | Reformat all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) to a canonical format. | `terragrunt` |
283284
| `terragrunt_validate` | Validates all [Terragrunt](https://github.com/gruntwork-io/terragrunt) configuration files (`*.hcl`) | `terragrunt` |
285+
| `terragrunt_providers_lock` | Generates `.terraform.lock.hcl` files using [Terragrunt](https://github.com/gruntwork-io/terragrunt). | `terragrunt` |
284286
| `terraform_wrapper_module_for_each` | Generates Terraform wrappers with `for_each` in module. [Hook notes](#terraform_wrapper_module_for_each) | `hcledit` |
285287
| `terrascan` | [terrascan](https://github.com/tenable/terrascan) Detect compliance and security violations. [Hook notes](#terrascan) | `terrascan` |
286288
| `tfupdate` | [tfupdate](https://github.com/minamijoyo/tfupdate) Update version constraints of Terraform core, providers, and modules. [Hook notes](#tfupdate) | `tfupdate` |
@@ -1058,6 +1060,28 @@ If the generated name is incorrect, set them by providing the `module-repo-short
10581060
Check [`tfupdate` usage instructions](https://github.com/minamijoyo/tfupdate#usage) for other available options and usage examples.
10591061
No need to pass `--recursive .` as it is added automatically.
10601062

1063+
### terragrunt_providers_lock
1064+
1065+
> [!TIP]
1066+
> Use this hook only in infrastructure repos managed solely by `terragrunt` and do not mix with [`terraform_providers_lock`](#terraform_providers_lock) to avoid conflicts.
1067+
1068+
> [!WARNING]
1069+
> Hook _may_ be very slow, because terragrunt invokes `t init` under the hood.
1070+
1071+
Hook produces same results as [`terraform_providers_lock`](#terraform_providers_lock), but for terragrunt root modules.
1072+
1073+
It invokes `terragrunt providers lock` under the hood and terragrunt [does its' own magic](https://terragrunt.gruntwork.io/docs/features/lock-file-handling/) for handling lock files.
1074+
1075+
1076+
```yaml
1077+
- id: terragrunt_providers_lock
1078+
name: Terragrunt providers lock
1079+
args:
1080+
- --args=-platform=darwin_arm64
1081+
- --args=-platform=darwin_amd64
1082+
- --args=-platform=linux_amd64
1083+
```
1084+
10611085
## Docker Usage
10621086

10631087
### File Permissions

‎hooks/terragrunt_providers_lock.sh‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#!/usr/bin/env bash
2+
set -eo pipefail
3+
4+
# globals variables
5+
# shellcheck disable=SC2155 # No way to assign to readonly variable in separate lines
6+
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
7+
# shellcheck source=_common.sh
8+
. "$SCRIPT_DIR/_common.sh"
9+
10+
function main {
11+
common::initialize "$SCRIPT_DIR"
12+
common::parse_cmdline "$@"
13+
common::export_provided_env_vars "${ENV_VARS[@]}"
14+
common::parse_and_export_env_vars
15+
# JFYI: terragrunt providers lock color already suppressed via PRE_COMMIT_COLOR=never
16+
17+
# shellcheck disable=SC2153 # False positive
18+
common::per_dir_hook "$HOOK_ID" "${#ARGS[@]}" "${ARGS[@]}" "${FILES[@]}"
19+
}
20+
21+
#######################################################################
22+
# Unique part of `common::per_dir_hook`. The function is executed in loop
23+
# on each provided dir path. Run wrapped tool with specified arguments
24+
# Arguments:
25+
# dir_path (string) PATH to dir relative to git repo root.
26+
# Can be used in error logging
27+
# change_dir_in_unique_part (string/false) Modifier which creates
28+
# possibilities to use non-common chdir strategies.
29+
# Availability depends on hook.
30+
# parallelism_disabled (bool) if true - skip lock mechanism
31+
# args (array) arguments that configure wrapped tool behavior
32+
# Outputs:
33+
# If failed - print out hook checks status
34+
#######################################################################
35+
function per_dir_hook_unique_part {
36+
# shellcheck disable=SC2034 # Unused var.
37+
local -r dir_path="$1"
38+
# shellcheck disable=SC2034 # Unused var.
39+
local -r change_dir_in_unique_part="$2"
40+
# shellcheck disable=SC2034 # Unused var.
41+
local -r parallelism_disabled="$3"
42+
shift 3
43+
local -a -r args=("$@")
44+
45+
# pass the arguments to hook
46+
terragrunt providers lock "${args[@]}"
47+
48+
# return exit code to common::per_dir_hook
49+
local exit_code=$?
50+
return $exit_code
51+
}
52+
53+
#######################################################################
54+
# Unique part of `common::per_dir_hook`. The function is executed one time
55+
# in the root git repo
56+
# Arguments:
57+
# args (array) arguments that configure wrapped tool behavior
58+
#######################################################################
59+
function run_hook_on_whole_repo {
60+
local -a -r args=("$@")
61+
62+
# pass the arguments to hook
63+
terragrunt run-all providers lock "${args[@]}"
64+
65+
# return exit code to common::per_dir_hook
66+
local exit_code=$?
67+
return $exit_code
68+
}
69+
70+
[ "${BASH_SOURCE[0]}" != "$0" ] || main "$@"

0 commit comments

Comments
 (0)