These aren't OpenTofu itself, but they're part of working in this repo.
tenv - pin the tool versions
.tool-versions declares opentofu 1.12.1 and tflint 0.59.1.
tenv reads that file and installs/uses exactly those versions, so everyone
(and the CI pipeline) runs identical tooling. tenv install sets it up. Pinning
versions prevents "works on my machine" problems caused by version drift.
tflint - the linter
A linter statically checks your code for mistakes and style violations.
.tflint.hcl turns on the Terraform and AWS rule sets plus naming and
documentation rules - for example, requiring snake_case names and requiring every
variable and output to have a description. That's why every variable in this repo
is documented. Run it with make lint.
pre-commit - automatic checks on every commit
pre-commit is a tool that runs checks automatically when you git commit, so
problems are caught before they land. .pre-commit-config.yaml
wires up: tofu fmt -check, tofu validate, tflint, plus general hygiene hooks
(strip trailing whitespace, detect accidentally-committed AWS credentials, check
YAML, etc.). pre-commit install activates it. The same checks also run in CI, so
nothing slips through.
.gitignore - what must never be committed
.gitignore keeps dangerous or noisy files out of git:
.terraform/and*.tfstate*- the local plugin cache and state files (state can hold secrets; never commit it).*.tfvarsexcept*.tfvars.example- real var files hold account IDs and secrets; only the sanitized.exampletemplates are committed.*.tfplan,tfplan.binary- plan artifacts..terraformrc, credentials, editor/OS junk.
This is why the repo is full of *.example files: they're the committed templates;
you copy each to its real name (e.g. terraform.tfvars) and fill in real values
locally, and git ignores your copy.