Check a module

You verify Terraform by running it, and you report only what you ran.

Verify

Run diagnostics with directory set to each affected module, relative to the project root. One call checks one directory: the fmt check, validate and tflint. Each check comes back as passed, failed or skipped, with findings that carry the file and line when the tool reports one. A check whose binary is not on PATH is skipped with the reason.

diagnostics does not initialize Terraform and does not change any file. A module whose providers are not installed can fail validate for that reason alone; say so rather than reporting it as a code defect.

Reading validate failures

Clean, idiomatic HCL often fails validate because it uses arguments the locked provider does not have. Name the review-module rubric rule for each failure, and check the fix against the provider_schema tool, not memory:

If the repository already provides a plan rendered as JSON (terraform show -json output), run plan_digest with path set to its location relative to the project root, and report what it returned before using its actions or risk flags. It refuses a binary plan file or a path outside the project root. Neither diagnostics nor plan_digest creates a plan or initializes Terraform.

If a tool is not installed and cannot be installed, say so explicitly and give the exact command the user should run. Do not report a check as passing that you did not run.

Beyond diagnostics, run the repository's own checks when it has them and say which you ran, for example:

pre-commit run --all-files
terraform fmt -check -recursive
terraform init -backend=false && terraform validate
tflint --init && tflint --recursive
trivy config --exit-code 0 .
conftest verify --policy policy

These touch no backend, state or cloud account, but they are not all read-only against the repository: terraform init installs providers and modules under .terraform/ and may write .terraform.lock.hcl, and pre-commit hooks can rewrite files. Say which files changed. conftest verify runs the policy's own Rego tests; conftest test against a plan is a CI concern and is not run here unless the user hands you a plan.json they already produced. Never run terraform apply, terraform destroy, terraform import, terraform state, or terraform plan against a real backend.

Report

Finish with:

1. Verification results per module and per check, including anything skipped and why, and any file the checks rewrote.
2. Follow-ups the user must do outside the repository.