From c4e20b32a40ef9bd29465b61db9d7dfa7e665d82 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Tue, 21 Jul 2026 14:05:41 +0000 Subject: [PATCH 1/7] Added pre-commit hooks for file checks, ShellCheck, Markdown linting, Bandit security checks, and Terraform format/tflint/docs. ([#4913](https://github.com/microsoft/AzureTRE/issues/4913)) --- .devcontainer/Dockerfile | 16 ++++++++++ .devcontainer/scripts/terraform-docs.sh | 23 ++++++++++++++ .devcontainer/scripts/tflint.sh | 23 ++++++++++++++ .pre-commit-config.yaml | 41 +++++++++++++++++++++++++ CHANGELOG.md | 5 +-- 5 files changed, 106 insertions(+), 2 deletions(-) create mode 100644 .devcontainer/scripts/terraform-docs.sh create mode 100644 .devcontainer/scripts/tflint.sh diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index dd858658cf..8f2675b91e 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -28,6 +28,22 @@ ARG TERRAFORM_VERSION="1.14.3" COPY .devcontainer/scripts/terraform.sh /tmp/ RUN bash /tmp/terraform.sh "${TERRAFORM_VERSION}" /usr/bin +# Install tflint +ARG TFLINT_VERSION="0.64.0" +COPY .devcontainer/scripts/tflint.sh /tmp/ +RUN bash /tmp/tflint.sh "${TFLINT_VERSION}" /usr/bin + +# Install terraform-docs +ARG TERRAFORM_DOCS_VERSION="0.19.0" +COPY .devcontainer/scripts/terraform-docs.sh /tmp/ +RUN bash /tmp/terraform-docs.sh "${TERRAFORM_DOCS_VERSION}" /usr/bin + +# Install shellcheck +RUN apt-get update && apt-get install -y shellcheck --no-install-recommends \ + && apt-get clean -y && rm -rf /var/lib/apt/lists/* + + + ARG DOCKER_GROUP_ID COPY .devcontainer/scripts/docker-client.sh /tmp/ RUN /tmp/docker-client.sh $USERNAME diff --git a/.devcontainer/scripts/terraform-docs.sh b/.devcontainer/scripts/terraform-docs.sh new file mode 100644 index 0000000000..3d05a59fdb --- /dev/null +++ b/.devcontainer/scripts/terraform-docs.sh @@ -0,0 +1,23 @@ +#!/bin/bash +set -e + +get_latest_release() { + curl --silent "https://api.github.com/repos/$1/releases/latest" | + grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/' +} + +VERSION=${1:-"$(get_latest_release terraform-docs/terraform-docs)"} +INSTALL_DIR=${2:-"/usr/local/bin"} +CMD=terraform-docs +NAME=terraform-docs + +echo -e "\e[34m»»» 📦 \e[32mInstalling \e[33m$NAME v$VERSION\e[0m ..." + +curl -sSL "https://github.com/terraform-docs/terraform-docs/releases/download/v${VERSION}/terraform-docs-v${VERSION}-linux-amd64.tar.gz" -o /tmp/tfdocs.tar.gz +tar -xzf /tmp/tfdocs.tar.gz -C /tmp > /dev/null +mkdir -p "$INSTALL_DIR" +mv /tmp/terraform-docs "$INSTALL_DIR" +rm -f /tmp/tfdocs.tar.gz + +echo -e "\n\e[34m»»» 💾 \e[32mInstalled to: \e[33m$(which $CMD)" +echo -e "\e[34m»»» 💡 \e[32mVersion details: \e[39m$($CMD --version)" diff --git a/.devcontainer/scripts/tflint.sh b/.devcontainer/scripts/tflint.sh new file mode 100644 index 0000000000..6dc753de9d --- /dev/null +++ b/.devcontainer/scripts/tflint.sh @@ -0,0 +1,23 @@ +#!/bin/bash +set -e + +get_latest_release() { + curl --silent "https://api.github.com/repos/$1/releases/latest" | + grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/' +} + +VERSION=${1:-"$(get_latest_release terraform-linters/tflint)"} +INSTALL_DIR=${2:-"/usr/local/bin"} +CMD=tflint +NAME=TFLint + +echo -e "\e[34m»»» 📦 \e[32mInstalling \e[33m$NAME v$VERSION\e[0m ..." + +curl -sSL "https://github.com/terraform-linters/tflint/releases/download/v${VERSION}/tflint_linux_amd64.zip" -o /tmp/tflint.zip +unzip /tmp/tflint.zip -d /tmp > /dev/null +mkdir -p "$INSTALL_DIR" +mv /tmp/tflint "$INSTALL_DIR" +rm -f /tmp/tflint.zip + +echo -e "\n\e[34m»»» 💾 \e[32mInstalled to: \e[33m$(which $CMD)" +echo -e "\e[34m»»» 💡 \e[32mVersion details: \e[39m$($CMD --version)" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 47bc4b385f..0e794a5756 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,13 +1,54 @@ --- repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: trailing-whitespace + - id: end-of-file-fixer + - id: check-yaml + args: [--unsafe] + - id: check-json + exclude: ^.devcontainer/.*\.json$ + - id: check-merge-conflict + - id: check-added-large-files + args: ['--maxkb=1000'] + - repo: https://github.com/pycqa/flake8 rev: 7.3.0 hooks: - id: flake8 + + - repo: https://github.com/PyCQA/bandit + rev: 1.8.3 + hooks: + - id: bandit + args: ["-ll"] + exclude: ^(tests/|e2e_tests/) + - repo: https://github.com/codespell-project/codespell rev: v2.4.2 hooks: - id: codespell + + - repo: https://github.com/shellcheck-py/shellcheck-py + rev: v0.10.0.1 + hooks: + - id: shellcheck + + - repo: https://github.com/igorshubovych/markdownlint-cli + rev: v0.44.0 + hooks: + - id: markdownlint + + - repo: https://github.com/antonbabenko/pre-commit-terraform + rev: v1.97.4 + hooks: + - id: terraform_fmt + - id: terraform_tflint + - id: terraform_docs + + + - repo: https://github.com/rbubley/mirrors-prettier rev: v3.5.0 hooks: diff --git a/CHANGELOG.md b/CHANGELOG.md index 54926d6548..0c8c39be1a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ ENHANCEMENTS: * Update API, CLI, and UI dependencies to address high-severity Dependabot alerts, including `PyJWT`, `Vite`, `lodash`, `fast-uri`, `flatted`, `immutable`, and `minimatch`. * Update dependencies to address Dependabot security alerts: `aiohttp` to 3.14.1, `Pygments` to 2.20.0, `esbuild`, `ws`, `js-yaml`, `@babel/core`, `flatted` (via vitest upgrade), and `react-router-dom`. ([#4950](https://github.com/microsoft/AzureTRE/issues/4950)) * Added support for formatting UI code via `pre-commit` and fixed existing formatting issues. ([#4955](https://github.com/microsoft/AzureTRE/issues/4955)) +* Added pre-commit hooks for file checks, ShellCheck, Markdown linting, Bandit security checks, and Terraform format/tflint/docs. ([#4913](https://github.com/microsoft/AzureTRE/issues/4913)) * Updated the version of `super-linter` used in the `build_validation_develop` workflow ([#4957](https://github.com/microsoft/AzureTRE/issues/4957)) BUG FIXES: @@ -1217,8 +1218,8 @@ COMPONENTS: If this endpoint is not working in your deployment - include `enable_swagger` in your `config.yaml` (see the sample file), or temporarily activate it via the API resource on azure (named `api-YOUR_TRE-ID`) -> Configuration -> `ENABLE_SWAGGER` item. ![Update API setting](./docs/assets/firewall-policy-migrate2.png) - - + + :warning: Any custom rules you have added manually will be **lost** and you'll need to add them back after the upgrade has been completed. FEATURES: From f759a75e688db451b8b738b9d3e4851f5887c1b8 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Tue, 21 Jul 2026 14:10:05 +0000 Subject: [PATCH 2/7] changelog --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c8c39be1a..efac123a75 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,7 +12,7 @@ ENHANCEMENTS: * Update API, CLI, and UI dependencies to address high-severity Dependabot alerts, including `PyJWT`, `Vite`, `lodash`, `fast-uri`, `flatted`, `immutable`, and `minimatch`. * Update dependencies to address Dependabot security alerts: `aiohttp` to 3.14.1, `Pygments` to 2.20.0, `esbuild`, `ws`, `js-yaml`, `@babel/core`, `flatted` (via vitest upgrade), and `react-router-dom`. ([#4950](https://github.com/microsoft/AzureTRE/issues/4950)) * Added support for formatting UI code via `pre-commit` and fixed existing formatting issues. ([#4955](https://github.com/microsoft/AzureTRE/issues/4955)) -* Added pre-commit hooks for file checks, ShellCheck, Markdown linting, Bandit security checks, and Terraform format/tflint/docs. ([#4913](https://github.com/microsoft/AzureTRE/issues/4913)) +* Added pre-commit hooks for file checks, ShellCheck, Markdown linting, Bandit security checks, and Terraform format/tflint/docs. ([#4986](https://github.com/microsoft/AzureTRE/issues/4986)) * Updated the version of `super-linter` used in the `build_validation_develop` workflow ([#4957](https://github.com/microsoft/AzureTRE/issues/4957)) BUG FIXES: From e82dec928bcf45c62929159f9438a3f6826ef981 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Tue, 21 Jul 2026 14:26:01 +0000 Subject: [PATCH 3/7] remove blank lines --- .pre-commit-config.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0e794a5756..0aaff4696f 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -11,7 +11,7 @@ repos: exclude: ^.devcontainer/.*\.json$ - id: check-merge-conflict - id: check-added-large-files - args: ['--maxkb=1000'] + args: ["--maxkb=1000"] - repo: https://github.com/pycqa/flake8 rev: 7.3.0 @@ -47,8 +47,6 @@ repos: - id: terraform_tflint - id: terraform_docs - - - repo: https://github.com/rbubley/mirrors-prettier rev: v3.5.0 hooks: From edf7b890dd7344b1ead3bff8c24906ec5364e903 Mon Sep 17 00:00:00 2001 From: James Chapman Date: Tue, 21 Jul 2026 14:29:46 +0000 Subject: [PATCH 4/7] make scripts executable --- .devcontainer/scripts/terraform-docs.sh | 0 .devcontainer/scripts/tflint.sh | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 .devcontainer/scripts/terraform-docs.sh mode change 100644 => 100755 .devcontainer/scripts/tflint.sh diff --git a/.devcontainer/scripts/terraform-docs.sh b/.devcontainer/scripts/terraform-docs.sh old mode 100644 new mode 100755 diff --git a/.devcontainer/scripts/tflint.sh b/.devcontainer/scripts/tflint.sh old mode 100644 new mode 100755 From df8b848125e17955501fc3b25b67ad73d3cb7281 Mon Sep 17 00:00:00 2001 From: James Chapman <196318169+JC-wk@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:28:57 +0100 Subject: [PATCH 5/7] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .pre-commit-config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0aaff4696f..2db65b7932 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -4,6 +4,7 @@ repos: rev: v5.0.0 hooks: - id: trailing-whitespace + args: [--markdown-linebreak-ext=md] - id: end-of-file-fixer - id: check-yaml args: [--unsafe] @@ -45,6 +46,7 @@ repos: hooks: - id: terraform_fmt - id: terraform_tflint + args: ["--config=__GIT_WORKING_DIR__/.github/linters/.tflint.hcl"] - id: terraform_docs - repo: https://github.com/rbubley/mirrors-prettier From 1c2563cdc0d0f77a057f906d1168facfd9c76148 Mon Sep 17 00:00:00 2001 From: James Chapman <196318169+JC-wk@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:41:00 +0100 Subject: [PATCH 6/7] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 2db65b7932..c10d0f99e1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -9,7 +9,7 @@ repos: - id: check-yaml args: [--unsafe] - id: check-json - exclude: ^.devcontainer/.*\.json$ + exclude: ^\.devcontainer/.*\.json$ - id: check-merge-conflict - id: check-added-large-files args: ["--maxkb=1000"] From e7dfcf104bc3ba13f1a3cd9301bd43069ecd5e87 Mon Sep 17 00:00:00 2001 From: James Chapman <196318169+JC-wk@users.noreply.github.com> Date: Fri, 24 Jul 2026 10:56:32 +0100 Subject: [PATCH 7/7] Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .devcontainer/scripts/terraform-docs.sh | 2 +- .devcontainer/scripts/tflint.sh | 2 +- .pre-commit-config.yaml | 3 +-- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.devcontainer/scripts/terraform-docs.sh b/.devcontainer/scripts/terraform-docs.sh index 3d05a59fdb..da34d7523e 100755 --- a/.devcontainer/scripts/terraform-docs.sh +++ b/.devcontainer/scripts/terraform-docs.sh @@ -1,5 +1,5 @@ #!/bin/bash -set -e +set -euo pipefail get_latest_release() { curl --silent "https://api.github.com/repos/$1/releases/latest" | diff --git a/.devcontainer/scripts/tflint.sh b/.devcontainer/scripts/tflint.sh index 6dc753de9d..6f7b4fb294 100755 --- a/.devcontainer/scripts/tflint.sh +++ b/.devcontainer/scripts/tflint.sh @@ -1,5 +1,5 @@ #!/bin/bash -set -e +set -euo pipefail get_latest_release() { curl --silent "https://api.github.com/repos/$1/releases/latest" | diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index c10d0f99e1..e46a023f62 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -7,7 +7,6 @@ repos: args: [--markdown-linebreak-ext=md] - id: end-of-file-fixer - id: check-yaml - args: [--unsafe] - id: check-json exclude: ^\.devcontainer/.*\.json$ - id: check-merge-conflict @@ -24,7 +23,7 @@ repos: hooks: - id: bandit args: ["-ll"] - exclude: ^(tests/|e2e_tests/) + exclude: (^|/)(tests|e2e_tests)/ - repo: https://github.com/codespell-project/codespell rev: v2.4.2