Pre-commit Hooks for Terraform and Python: 6 Tips That Stick
Originally published on kuryzhev.cloud A pull request with forty comments that all say "run terraform fmt" or "remove the unused import" is a familiar sight. Pre-commit hooks move those checks to the developer's machine, before the commit exists. The tips below target repos that mix Terraform and Python, such as infrastructure code plus Lambda handlers or automation scripts. They are independent,…
Pre-commit hooks help catch formatting issues and other problems before developers push changes to a repository, reducing noisy reviews and improving code quality. For projects that combine Terraform infrastructure code with Python scripts, such as Lambda functions or automation scripts, specific pre-commit hooks can streamline the development process.
It's essential to pin the hook revision to a specific tag or commit SHA instead of a branch name to ensure consistency across environments. Regularly updating the hooks using a pre-commit autoupdate command and reviewing the changes like any other dependency update helps maintain a stable coding environment.
Using a combination of Terraform hooks and Python linters like Ruff can help keep the codebase clean and consistent. Ruff covers multiple linting and formatting tasks, reducing the need for multiple tools and simplifying configuration. However, it's important to be aware that newer releases of Ruff may introduce new hook names, so checking the repository's README after an update is necessary to avoid errors.
Starting the Terraform workflow with formatting, tflint, and generated documentation ensures that the codebase is consistent and easy to understand. Terraform_docs can automatically keep the module README in sync with the code, while terraform_validate should only be added after the basic functionality is stable, as it can be slow to run.
Avoid running Terraform plans inside pre-commit hooks, as they require cloud credentials and network access, which are not available locally. Instead, manage credentials properly in the CI pipeline and run plans in the CI environment. Keep pre-commit hooks fast and avoid auto-fixing hooks, which can lead to the commit failing on purpose if the changes are not staged correctly.
Running slow checks, such as security scanners or full Terraform validation, as pre-push stage checks allows developers to catch issues before pushing changes to the repository, while still running them locally during development.
To prevent the accidental inclusion of sensitive information in commits, hooks like detect-private-key and check-added-large-files can help catch secrets before they reach history. Running these checks early in the development process can save time and effort in cleaning up a leaked credential later.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
