OpenTofu, the open-source Infrastructure-as-Code tool built by the community as an alternative to Terraform, is adding built-in linting support. The first experimental version will be part of the upcoming OpenTofu 1.13 release.
According to devs, during planning, OpenTofu evaluates expressions and talks to providers to see what changes are expected, so some checks can only be done once this extra information is available.
For version 1.13, OpenTofu is starting with a small set of features. You can try the early experimental linting by using the new -lint command-line option with the validate, plan, and apply commands. For example: tofu plan -lint=all.
Using all turns on every available linting rule. You can also list specific checks, separated by commas, to enable only the ones you want.
The first version includes four built-in rules. core:no-type-variable finds input variables without a declared type. core:count-instead-enabled points out when you could use the newer enabled feature instead of the older conditional count method.
The other two rules look for unused configuration elements. core:unused-variable finds input variables that are declared but never used. core:unused-local does the same for local values.
At the same time, the team has bigger plans for the future beyond these built-in checks. OpenTofu is looking into letting users define custom lint and policy rules using a language similar to what they already use for OpenTofu configurations.
More complex checks might also work with provider plugins. This would let rules get outside information or do checks that are hard to express with a simple configuration.
Rules could be set as blocking or non-blocking. Blocking rules would stop the operation, while non-blocking ones would just show a warning. The team is also considering reusable rulesets that could be shared like OpenTofu modules.
More information is available in the OpenTofu project’s announcement.
