Skip to content

Guard terraform validate on successful init and propagate failures#952

Open
phorcys420 wants to merge 1 commit into
mainfrom
phorcys/validate-init-guard
Open

Guard terraform validate on successful init and propagate failures#952
phorcys420 wants to merge 1 commit into
mainfrom
phorcys/validate-init-guard

Conversation

@phorcys420

Copy link
Copy Markdown
Member

Problem

scripts/terraform_validate.sh had two related issues in validate_terraform_directory:

  1. terraform validate was run even when terraform init failed. validate requires modules to be installed by init first, so an init failure (e.g. a bad module source) produced a cascade of misleading Module not installed errors that hid the real cause.

  2. popd masked the function's exit status. Because popd was the last statement in the function, it always returned 0. Real terraform validate failures were printed but never recorded in $status, so the script exited 0 despite failures — validation could not actually fail CI.

Fix

  • Short-circuit on init failure with a clear terraform init failed error and skip validate, surfacing the real problem.
  • Capture terraform validate's exit code and return it explicitly (after popd), so failures propagate to $status and the script exits non-zero.

Validation

  • bash -n and shellcheck --severity=warning (the level CI enforces) are clean.
  • Functionally tested three cases against the patched function:
    • valid dir → init + validate succeed → returns 0
    • bad module source → init fails → clear error, validate skipped → returns non-zero
    • init-clean but validate-time error → returns non-zero

Generated with Mux.

Two related issues in validate_terraform_directory:

- `terraform validate` requires modules to be installed by
  `terraform init` first. When init failed (e.g. a bad module source),
  the script still ran validate, producing misleading
  "Module not installed" errors that masked the real init failure. Now
  init failure short-circuits with a clear error and skips validate.
- `popd` was the last command in the function, so its exit status
  masked terraform's — the function always returned 0 and real
  validation failures were printed but never recorded in $status
  (the script exited 0 despite failures). Capture terraform's exit
  code and return it explicitly.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant