From 71d674e3abceaa55c65e23b06677d07ba8c1e918 Mon Sep 17 00:00:00 2001
From: Phorcys <gh@phorcys.net>
Date: Wed, 8 Jul 2026 15:25:43 +0000
Subject: [PATCH] Guard terraform validate on successful init and propagate
 failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two related issues in validate_terraform_directory:

- `terraform validate` requires modules to be installed by
  `terraform init` first. When init failed (e.g. a bad module source),
  the script still ran validate, producing misleading
  "Module not installed" errors that masked the real init failure. Now
  init failure short-circuits with a clear error and skips validate.
- `popd` was the last command in the function, so its exit status
  masked terraform's — the function always returned 0 and real
  validation failures were printed but never recorded in $status
  (the script exited 0 despite failures). Capture terraform's exit
  code and return it explicitly.
---
 scripts/terraform_validate.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/scripts/terraform_validate.sh b/scripts/terraform_validate.sh
index 033189e13..354a92867 100755
--- a/scripts/terraform_validate.sh
+++ b/scripts/terraform_validate.sh
@@ -44,11 +44,24 @@ validate_variable_names() {
 
 validate_terraform_directory() {
   local dir="$1"
+  local rc=0
   echo "Running \`terraform validate\` in $dir"
   pushd "$dir" > /dev/null
-  terraform init -upgrade
-  terraform validate
+
+  # `terraform validate` requires modules to be installed first. If
+  # `terraform init` fails (for example a bad module source), skip validate
+  # so we surface the real init error instead of misleading
+  # "Module not installed" errors.
+  if ! terraform init -upgrade; then
+    echo "  ERROR: \`terraform init\` failed in $dir" >&2
+    popd > /dev/null
+    return 1
+  fi
+
+  terraform validate || rc=1
+
   popd > /dev/null
+  return "$rc"
 }
 
 main() {