tfsprout

Static analysis for Terraform Provider source code.

90 checks over a provider's Go source, reporting the patterns that cause bugs, fail schema validation at runtime, or drift from Terraform Plugin SDK conventions.

Install Browse the checks Coming from tfproviderlint?

Sixty-second start

go install github.com/jfrappier/tfsprout/cmd/tfsprout@latest
cd /path/to/terraform-provider-example
tfsprout ./...

Findings print to stderr in go vet format, and the process exits 3 if anything was reported:

internal/service/example/resource_thing.go:42:3: AT001: missing CheckDestroy
internal/service/example/schema.go:17:5: S013: schema should configure one of Computed, Optional, or Required

Read what a check means with tfsprout help AT001, and silence a single finding with a comment:

//lintignore:R009 // panic is unreachable, guarded above
panic("unreachable")

That is the whole tool. Everything below is detail.

What tfsprout checks

Acceptance tests 12

TestCase and TestStep usage, missing CheckDestroy, test function naming, provider configuration leaking into a step's Config.

Resources 18

ResourceData.Set() misuse, deprecated Exists and MigrateState, RetryFunc that swallow retryable errors, unstable IDs, Go panic usage.

Schemas 42

Contradictory field combinations, missing Elem on TypeList/TypeSet/TypeMap, invalid ConflictsWith references, invalid attribute names.

Validation 7

Hand-rolled SchemaValidateFunc that duplicate something already in helper/validation, and StringMatch() calls with an empty message.

A further 11 extra checks are opt-in through tfsproutx, and 9 IDs are retained but no longer report.

Find your way around

Get started

Usage

Concepts

Reference

Before you trust a clean run

tfsprout only reads Terraform Plugin SDK providers

Checks match on helper/schema types. A provider written against terraform-plugin-framework contains none of them, so tfsprout exits 0 with no output — which looks like a clean run but is not one. It also says nothing about .tf files; that is the domain of terraform validate and tflint. See Scope and SDK support.

Contributing

The contributing guide covers building from source, adding an analyzer end to end, testing with analysistest, and building your own lint tool from tfsprout's analyzers.