feat(allowlist): add HCL/Terraform (.hcl, .tfvars) support - #524
Merged
lizhengfeng101 merged 3 commits intoJul 27, 2026
Conversation
Adds .hcl and .tfvars to the allowlist and maps them, along with the already-supported .tf, to a new dedicated terraform.md review rule doc covering hardcoded secrets/credentials, overly permissive network/IAM access, state file hygiene, and lifecycle protection on stateful resources. .tf previously fell through to the generic default rule set with no Terraform-specific guidance despite already being allowlisted; bringing all three extensions under one doc gives consistent coverage rather than leaving .tf behind. Part of alibaba#470, closes alibaba#522.
Contributor
|
🔍 OpenCodeReview found 1 issue(s) in this PR.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
Same root cause as the sibling Bicep PR (alibaba#525): the local main used to build this branch's working changes predated the Julia support merge (alibaba#501), so restoring those changes onto a branch freshly cut from the current upstream/main silently replaced the newer .jl allowlist entry and its test cases with the stale pre-Julia state instead of adding HCL/Terraform alongside them. Restores .jl in supported_file_types.json, the TestIsAllowedExt and TestIsExcludedPath Julia cases in allowed_ext_test.go, and the Julia resolution cases in system_rules_test.go -- system_rules.json's .jl -> julia.md mapping was already restored in a prior commit on this branch. Now a pure addition of HCL/Terraform support, not a replacement of Julia support.
Contributor
Author
|
my local Fixed in 94f8f1d (on top of the
Verified the diff against |
Githab-capibara
added a commit
to Githab-capibara/open-code-review
that referenced
this pull request
Aug 23, 2026
* feat(allowlist): add HCL/Terraform (.hcl, .tfvars) support Adds .hcl and .tfvars to the allowlist and maps them, along with the already-supported .tf, to a new dedicated terraform.md review rule doc covering hardcoded secrets/credentials, overly permissive network/IAM access, state file hygiene, and lifecycle protection on stateful resources. .tf previously fell through to the generic default rule set with no Terraform-specific guidance despite already being allowlisted; bringing all three extensions under one doc gives consistent coverage rather than leaving .tf behind. Part of alibaba#470, closes alibaba#522. * Update internal/config/rules/system_rules.json Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: restore Julia (.jl) support accidentally removed Same root cause as the sibling Bicep PR (alibaba#525): the local main used to build this branch's working changes predated the Julia support merge (alibaba#501), so restoring those changes onto a branch freshly cut from the current upstream/main silently replaced the newer .jl allowlist entry and its test cases with the stale pre-Julia state instead of adding HCL/Terraform alongside them. Restores .jl in supported_file_types.json, the TestIsAllowedExt and TestIsExcludedPath Julia cases in allowed_ext_test.go, and the Julia resolution cases in system_rules_test.go -- system_rules.json's .jl -> julia.md mapping was already restored in a prior commit on this branch. Now a pure addition of HCL/Terraform support, not a replacement of Julia support. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #522. Part of #470.
What
Adds
.hcland.tfvarsto the code-review allowlist and maps them, along with the already-supported.tf, to a new dedicatedterraform.mdreview-rule doc..tfwas already allowlisted but had no dedicated rule doc — it fell through to the genericdefault.mdrule set. Since.tf/.hcl/.tfvarsare all the same HCL syntax family, this brings all three under one consistent, language-specific ruleset rather than adding rules only for the two new extensions and leaving.tfbehind.Rule doc coverage
terraform.mdfollows the same structure as the existinggraphql.md(precision-over-recall framing, security findings blocking / style non-blocking):.tfvarsvalues, and credential-looking variables missingsensitive = true0.0.0.0/0on sensitive ports) and wildcard IAM policies.tfstate/.tfstate.backupfiles (state can contain secrets in plaintext)lifecycle { prevent_destroy = true }on stateful resourcesTests
allowed_ext_test.go:.hcl/.HCL/.tfvars/.TFVARSallowlist casessystem_rules_test.go: rule-resolution cases for.tf,.hcl,.tfvarsall resolving toterraform.mdVerification
go vet,go build,go teston the two touched packages (internal/config/allowlist,internal/config/rules): clean, all passinggofmt -l: clean