pre-commit-terraform VS terraform-provider-sops

repos: - repo: https://github.com/pre-commit/pre-commit-hooks rev: v4.3.0 hooks: - id: end-of-file-fixer - id: trailing-whitespace - repo: https://github.com/antonbabenko/pre-commit-terraform rev: v1.72.2 hooks: - id: terraform_fmt - id: terraform_tflint - id: infracost_breakdown args: - --args=--path=./ verbose: true # Always show costs - id: terraform_validate

repos: # pre-commit install --hook-type pre-push - repo: https://github.com/pre-commit/pre-commit-hooks # Generic review/format rev: v4.6.0 hooks: - id: end-of-file-fixer - id: no-commit-to-branch args: ["--branch", "master"] - id: trailing-whitespace - repo: https://github.com/igorshubovych/markdownlint-cli # Format markdown rev: v0.40.0 hooks: - id: markdownlint args: ["--fix", "--disable", "MD036"] - repo: https://github.com/antonbabenko/pre-commit-terraform rev: v1.89.1 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt - id: terraform_tflint - id: terraform_validate args: - --args=-json - --args=-no-color - id: terraform_docs args: - --hook-config=--path-to-file=README.md - --hook-config=--add-to-existing-file=true

Personally I use pre-commit with some of these hooks in addition to some default hooks. It's basically a localised CI pipeline, and also means every commit has passed checks so keeps your commit history neat. Way faster to develop infrastructure code and fix issues than having to keep pushing to the remote repo and waiting for an Action to run.

https://github.com/antonbabenko/pre-commit-terraform because Terraform/Terragrunt configs should be documented, tidy and valid all the time :)

Local testing with pre-commit-terraform. Formats code with terraform fmt Validates code with terraform validate Automatic README updates with terraform-docs. Static code analysis with TFLint, tfsec and checkov.

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ca47c31..3e5cfef 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -22,7 +22,10 @@ repos: rev: v2.7.1 hooks: - id: prettier - types_or: [yaml, markdown, json] + types_or: [yaml, markdown, json, html] + additional_dependencies: + - "[email protected]" + - "[email protected]" - repo: https://github.com/antonbabenko/pre-commit-terraform rev: v1.74.1 hooks:

pre-commit-terraform – Pre-commit git hooks for automation

Let me share a shameless plug (as an author of the pre-commit-terraform). I will show these hooks in action and answer questions during my live stream on Friday 29th of October - https://www.youtube.com/watch?v=ziJK79tI6tY

Supposing it's actually stored raw in the service (which I assume it won't be), I plan to just use my current Terraform configuration that uses kubernetes_service and SOPS. I've avoided storing secrets within the code (which is the absolute worst, I know lol), but then they're stored rawly in the service.

"https://github.com/carlpett/terraform-provider-sops/releases..."

I like using sops + terraform-provider-sops for storing secrets alongside my code in a GitOps fashion. That has been a great workflow for me and allows you to treat your secrets as code which has a lot of benefits.