v0.40.0

[wata727]

0.40.0 (2022-09-08)

This release contains major changes to the plugin system. All plugins must be built with tflint-plugin-sdk v0.12.0+ to support this version. See also https://github.com/terraform-linters/tflint-plugin-sdk/releases/tag/v0.12.0

Starting with this version, the built-in rules for the Terraform Language have been cut out into the tflint-ruleset-terraform plugin. Since the plugin is bundled with the TFLint binary, you will still be able to use the rules as before. However, be aware that some default behavior has changed.

GPG key ID: 8CE69160EB3F2FE9

Breaking Changes

• #1470: Remove --loglevel CLI flag (@wata727)
• #1496: plugin: Switch internal Terraform rules to the bundled plugin (@wata727)
  • Rules for the Terraform Language have been cut out into a plugin, allowing you to enable or disable rules in bulk. Just declare the plugin block in .tflint.hcl like any other plugin.
  • The following rules are newly enabled by default. To keep the same behavior as before, these rules should be disabled.
    • terraform_deprecated_index
    • terraform_required_providers
    • terraform_required_version
    • terraform_typed_variables
    • terraform_unused_declarations
  • See also tflint-ruleset-terraform documentation for plugin configuration.

Enhancements

• #1480: plugin: Add support for GetModulePath API (@wata727)
• #1481: plugin: Make GetRuleConfigContent doesn't return an error even if config not found (@wata727)
• #1482: formatter(compact): print hcl.Diagnostics errors in compact format (@bendrucker)
• #1492: annotations: allow ignoring multiple rules (@bendrucker)

BugFixes

• #1501: plugin: Fix an error when evaluating sensitive values (@wata727)

Chores

• #1483: build(deps): Bump github.com/mattn/go-colorable from 0.1.12 to 0.1.13
• #1484: build(deps): Bump alpine from 3.16.1 to 3.16.2
• #1485: build: Improve Go workflows (@wata727)
• #1487: Revert "Add a notice about verification of keyless signing" (@wata727)
• #1489: build(deps): Bump github.com/zclconf/go-cty from 1.10.0 to 1.11.0
• #1490: build(deps): Bump github.com/hashicorp/go-plugin from 1.4.4 to 1.4.5
• #1491: build(deps): Bump sigstore/cosign-installer from 2.5.0 to 2.5.1
• #1499: use mktemp when installing tflint (@dawez)
• #1500: Move cli_test.go to integration test (@wata727)
• #1504: build: Use default cosign version (@wata727)

---

This discussion was created from the release v0.40.0.

[Vermyndax]

According to semantic versioning, you're not supposed to release breaking changes in a minor version increment (0.x.0). Thanks for burning down my work this morning. https://semver.org

[bendrucker]

Major version zero (0.y.z) is for initial development. Anything MAY change at any time. The public API SHOULD NOT be considered stable.

Version 1.0.0 defines the public API. The way in which the version number is incremented after this release is dependent on this public API and how it changes.

Convention is to increment y upon breaking changes for a 0. release to signal the scope of the change to users, even though semver makes no explicit guarantees. That's been the pattern for tflint.

I've applied a 7 day interaction block as a cool-down. Maintainers are volunteers and respect is a requirement.

[TFKIA]

How do I know when to release 1.0.0?
If your software is being used in production, it should probably already be 1.0.0. If you have a stable API on which users have come to depend, you should be 1.0.0. If you’re worrying a lot about backwards compatibility, you should probably already be 1.0.0.

While I understand your reticence, tflint is almost six years and a hundred versions old.

[TFKIA]

Could you please provide clearer instructions for disabling your newly enabled rules? Where is .tflint.hcl located? What do I change to remove these rules?