README
¶
tfsprout
Static analysis libraries and tooling for Terraform Provider code.
tfsprout runs 90 checks over a Terraform Provider's Go source and reports patterns that cause bugs, fail provider schema validation at runtime, or diverge from Terraform Plugin SDK conventions — missing CheckDestroy in acceptance tests, contradictory schema fields, unstable resource IDs, hand-rolled validators that duplicate helper/validation.
Note: tfsprout is a fork of
tfproviderlint. v0.1.0 is a drop-in replacement — the lint checks and their behavior are unchanged and there are no new features. Only the project name, command names (tfproviderlint->tfsprout,tfproviderlintx->tfsproutx), and Go module path differ. See Migrating from tfproviderlint.v0.1.1 fixes the
internal error: package "context" without types was imported from ...crash that occurs when analyzing providers under Go 1.27. See the CHANGELOG for details.
Quickstart
Install the binary:
go install github.com/jfrappier/tfsprout/cmd/tfsprout@latest
Run it against your provider:
cd /path/to/terraform-provider-example
tfsprout ./...
Findings print to stderr in go vet format, and the process exits 3 if anything was reported:
internal/service/example/resource_thing.go:42:3: AT001: missing CheckDestroy
internal/service/example/schema.go:17:5: S013: schema should configure one of Computed, Optional, or Required
Read what a check means:
tfsprout help AT001
Suppress an individual finding with a comment:
//lintignore:R009 // panic is unreachable, guarded above
panic("unreachable")
That is the whole tool. Everything else is detail.
Documentation
https://jfrappier.github.io/tfsprout/ — searchable, with a page per check.
The same pages live in docs/ if you would rather read them here.
Getting started — What is tfsprout · Migrating from tfproviderlint · Install
Usage — Running tfsprout · Ignoring reports · Automated fixes · CI integration · Troubleshooting
Concepts — How tfsprout works · Checks and categories · Standard vs extra checks · Scope and SDK support
Reference — Check index · CLI reference · Exit codes and output · Removed checks
Contributing — CONTRIBUTING.md
Checks
90 active checks in four categories. The full list, with a page per check, is in the check index — or browse them at https://jfrappier.github.io/tfsprout/reference/checks/.
| Prefix | Category | Count |
|---|---|---|
AT |
Acceptance tests — TestCase and TestStep usage, test function naming |
12 |
R |
Resources — Resource definitions, CRUD functions, ResourceData usage |
18 |
S |
Schemas — Schema definitions and attribute maps |
42 |
V |
Validation — SchemaValidateFunc and helper/validation usage |
7 |
X* |
Extra opt-in checks, available via tfsproutx |
11 |
A further 9 IDs are retained but no longer report, having targeted Terraform Plugin SDK v1 APIs. See Removed checks.
Standard checks are enabled by default in tfsprout. Extra checks require tfsproutx:
go install github.com/jfrappier/tfsprout/cmd/tfsproutx@latest
Scope
tfsprout analyzes Terraform Plugin SDK (helper/schema) provider source code.
It does not analyze Terraform configuration — .tf files are the domain of terraform validate and tflint — and it does not support terraform-plugin-framework providers. Running it against a framework provider exits 0 with no output, which looks like a clean run but is not one. See Scope and SDK support.
Go compatibility
This project follows the Go support policy: the two latest major releases are supported. Currently Go 1.25 or later is required.
GitHub Action
A GitHub Action is available: tfsprout-github-action. See CI integration.
License
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
tfsprout
command
The tfsprout command is a static checker for Terraform Providers.
|
The tfsprout command is a static checker for Terraform Providers. |
|
tfsproutx
command
The tfsproutx command is a static checker for Terraform Providers that includes extra checks.
|
The tfsproutx command is a static checker for Terraform Providers that includes extra checks. |
|
helper
|
|
|
AT001
Package AT001 defines an Analyzer that checks for TestCase missing CheckDestroy
|
Package AT001 defines an Analyzer that checks for TestCase missing CheckDestroy |
|
AT002
Package AT002 defines an Analyzer that checks for acceptance test names including the word import
|
Package AT002 defines an Analyzer that checks for acceptance test names including the word import |
|
AT003
Package AT003 defines an Analyzer that checks for acceptance test names missing an underscore
|
Package AT003 defines an Analyzer that checks for acceptance test names missing an underscore |
|
AT004
Package AT004 defines an Analyzer that checks for TestStep Config containing provider configuration
|
Package AT004 defines an Analyzer that checks for TestStep Config containing provider configuration |
|
AT005
Package AT005 defines an Analyzer that checks for acceptance tests prefixed with Test but not TestAcc
|
Package AT005 defines an Analyzer that checks for acceptance tests prefixed with Test but not TestAcc |
|
AT006
Package AT006 defines an Analyzer that checks for acceptance tests containing multiple resource.Test() invocations
|
Package AT006 defines an Analyzer that checks for acceptance tests containing multiple resource.Test() invocations |
|
AT007
Package AT007 defines an Analyzer that checks for acceptance tests containing multiple resource.ParallelTest() invocations
|
Package AT007 defines an Analyzer that checks for acceptance tests containing multiple resource.ParallelTest() invocations |
|
R001
Package R001 defines an Analyzer that checks for ResourceData.Set() calls using complex key argument
|
Package R001 defines an Analyzer that checks for ResourceData.Set() calls using complex key argument |
|
R002
Package R002 defines an Analyzer that checks for ResourceData.Set() calls using * dereferences
|
Package R002 defines an Analyzer that checks for ResourceData.Set() calls using * dereferences |
|
R003
Package R003 defines an Analyzer that checks for Resource having Exists functions
|
Package R003 defines an Analyzer that checks for Resource having Exists functions |
|
R004
Package R004 defines an Analyzer that checks for ResourceData.Set() calls using incompatible value types
|
Package R004 defines an Analyzer that checks for ResourceData.Set() calls using incompatible value types |
|
R005
Package R005 defines an Analyzer that checks for ResourceData.HasChange() calls that can be combined into a single HasChanges() call.
|
Package R005 defines an Analyzer that checks for ResourceData.HasChange() calls that can be combined into a single HasChanges() call. |
|
R006
Package R006 defines an Analyzer that checks for RetryFunc that omit retryable errors
|
Package R006 defines an Analyzer that checks for RetryFunc that omit retryable errors |
|
S001
Package S001 defines an Analyzer that checks for Schema of TypeList or TypeSet missing Elem
|
Package S001 defines an Analyzer that checks for Schema of TypeList or TypeSet missing Elem |
|
S002
Package S002 defines an Analyzer that checks for Schema with both Required and Optional enabled
|
Package S002 defines an Analyzer that checks for Schema with both Required and Optional enabled |
|
S003
Package S003 defines an Analyzer that checks for Schema with both Required and Computed enabled
|
Package S003 defines an Analyzer that checks for Schema with both Required and Computed enabled |
|
S004
Package S004 defines an Analyzer that checks for Schema with Required enabled and Default configured
|
Package S004 defines an Analyzer that checks for Schema with Required enabled and Default configured |
|
S005
Package S005 defines an Analyzer that checks for Schema with Computed enabled and Default configured
|
Package S005 defines an Analyzer that checks for Schema with Computed enabled and Default configured |
|
S006
Package S006 defines an Analyzer that checks for Schema of TypeMap missing Elem
|
Package S006 defines an Analyzer that checks for Schema of TypeMap missing Elem |
|
S007
Package S007 defines an Analyzer that checks for Schema with Required enabled and ConflictsWith configured
|
Package S007 defines an Analyzer that checks for Schema with Required enabled and ConflictsWith configured |
|
S008
Package S008 defines an Analyzer that checks for Schema of TypeList or TypeSet with Default configured
|
Package S008 defines an Analyzer that checks for Schema of TypeList or TypeSet with Default configured |
|
S009
Package S009 defines an Analyzer that checks for Schema of TypeList or TypeSet with ValidateFunc or ValidateDiagFunc configured
|
Package S009 defines an Analyzer that checks for Schema of TypeList or TypeSet with ValidateFunc or ValidateDiagFunc configured |
|
S010
Package S010 defines an Analyzer that checks for Schema with only Computed enabled and ValidateFunc configured
|
Package S010 defines an Analyzer that checks for Schema with only Computed enabled and ValidateFunc configured |
|
S011
Package S011 defines an Analyzer that checks for Schema with only Computed enabled and DiffSuppressFunc configured
|
Package S011 defines an Analyzer that checks for Schema with only Computed enabled and DiffSuppressFunc configured |
|
S012
Package S012 defines an Analyzer that checks for Schema that Type is configured
|
Package S012 defines an Analyzer that checks for Schema that Type is configured |
|
S013
Package S013 defines an Analyzer that checks for Schema that one of Computed, Optional, or Required is not configured
|
Package S013 defines an Analyzer that checks for Schema that one of Computed, Optional, or Required is not configured |
|
S014
Package S014 defines an Analyzer that checks for Schema that within Elem, Computed, Optional, and Required are not configured
|
Package S014 defines an Analyzer that checks for Schema that within Elem, Computed, Optional, and Required are not configured |
|
S015
Package S015 defines an Analyzer that checks for Schema that attribute names contain only lowercase alphanumerics and underscores
|
Package S015 defines an Analyzer that checks for Schema that attribute names contain only lowercase alphanumerics and underscores |
|
S016
Package S016 defines an Analyzer that checks for Schema including Set without TypeSet
|
Package S016 defines an Analyzer that checks for Schema including Set without TypeSet |
|
S017
Package S017 defines an Analyzer that checks for Schema including MaxItems or MinItems without TypeList, TypeMap, or TypeSet
|
Package S017 defines an Analyzer that checks for Schema including MaxItems or MinItems without TypeList, TypeMap, or TypeSet |
|
S018
Package S018 defines an Analyzer that checks for Schema that should prefer TypeList with MaxItems 1
|
Package S018 defines an Analyzer that checks for Schema that should prefer TypeList with MaxItems 1 |
|
S019
Package S019 defines an Analyzer that checks for Schema that should omit Computed, Optional, or Required set to false
|
Package S019 defines an Analyzer that checks for Schema that should omit Computed, Optional, or Required set to false |
|
S020
Package S020 defines an Analyzer that checks for Schema with only Computed enabled and ValidateFunc configured
|
Package S020 defines an Analyzer that checks for Schema with only Computed enabled and ValidateFunc configured |
|
S021
Package S021 defines an Analyzer that checks for Schema that should omit ComputedWhen
|
Package S021 defines an Analyzer that checks for Schema that should omit ComputedWhen |
|
S022
Package S022 defines an Analyzer that checks for Schema of TypeMap with invalid Elem of *schema.Resource
|
Package S022 defines an Analyzer that checks for Schema of TypeMap with invalid Elem of *schema.Resource |
|
S023
Package S023 defines an Analyzer that checks for Schema that should omit Elem with incompatible Type
|
Package S023 defines an Analyzer that checks for Schema that should omit Elem with incompatible Type |
|
S038
Package S038 defines an Analyzer that checks for Schema with both ValidateFunc and ValidateDiagFunc configured
|
Package S038 defines an Analyzer that checks for Schema with both ValidateFunc and ValidateDiagFunc configured |
|
S039
Package S039 defines an Analyzer that checks for Schema with invalid resource identity configuration
|
Package S039 defines an Analyzer that checks for Schema with invalid resource identity configuration |
|
S040
Package S040 defines an Analyzer that checks for Schema with only Computed enabled and ValidateDiagFunc configured
|
Package S040 defines an Analyzer that checks for Schema with only Computed enabled and ValidateDiagFunc configured |
|
S041
Package S041 defines an Analyzer that checks for Schema with WriteOnly and an incompatible field configured
|
Package S041 defines an Analyzer that checks for Schema with WriteOnly and an incompatible field configured |
|
S042
Package S042 defines an Analyzer that checks for Schema of TypeList, TypeMap, or TypeSet with WriteOnly enabled
|
Package S042 defines an Analyzer that checks for Schema of TypeList, TypeMap, or TypeSet with WriteOnly enabled |
|
S043
Package S043 defines an Analyzer that checks for Schema of TypeSet or Computed block containing WriteOnly attributes
|
Package S043 defines an Analyzer that checks for Schema of TypeSet or Computed block containing WriteOnly attributes |
|
V001
Package V001 defines an Analyzer that checks for custom SchemaValidateFunc that implement validation.StringMatch()
|
Package V001 defines an Analyzer that checks for custom SchemaValidateFunc that implement validation.StringMatch() |
|
XR001
Package XR001 defines an Analyzer that checks for ResourceData.Set() calls using * dereferences
|
Package XR001 defines an Analyzer that checks for ResourceData.Set() calls using * dereferences |
|
XR004
Package XR004 defines an Analyzer that checks for ResourceData.Set() calls missing error checking with complex types
|
Package XR004 defines an Analyzer that checks for ResourceData.Set() calls missing error checking with complex types |
|
XS001
Package XS001 defines an Analyzer that checks for Schema that Description is configured
|
Package XS001 defines an Analyzer that checks for Schema that Description is configured |
Click to show internal directories.
Click to hide internal directories.