#2424th of 43 in Code review and testing
tflint
Pluggable linter for Terraform configurations
- Stars
- 5.9k
- License
- MPL-2.0
- Last commit
- Nov 2026
- Last release
- Nov 2026
- Language
- Go
5,647 on 22 Apr 20265,854 on 11 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
TFLint is a Go command-line linter for Terraform code. The core is a plugin framework, and rules come from rulesets: one for the Terraform language is bundled, and AWS, Azure and Google Cloud rulesets install with `tflint --init`. It catches things like invalid instance types, deprecated syntax and unused declarations, and outputs default, JSON, checkstyle, JUnit, compact or SARIF.
Who it is for: Terraform users who want linting in local runs and CI pipelines
Strengths
- Plugin rulesets for AWS, Azure and GCP catch provider-specific errors such as invalid instance types
- Custom rules via your own plugin or Rego policies through the OPA ruleset
- Output formats include JSON, SARIF, JUnit and checkstyle for CI; a setup-tflint GitHub Action exists
- Has --fix for automatic fixes, --recursive for multi-directory runs, and a language server mode
Weaknesses
- Cloud provider checks need separate plugins installed through tflint --init
- Release binaries fall under both MPL 2.0 and BUSL 1.1 because of some terraform package files
- Cosign signature verification is deprecated in favor of GitHub attestations
- Not AI-based; rule-driven static checks only, so coverage depends on available rulesets
What it needs
- no GPU
- Docker
- Needs GitHub (plugin download via tflint --init)
What changed
- v0.65.0 ↗ (opens in a new tab)Security fix
“deps: Bump Go version to 1.26.10 by @wata727 in https://github.com/terraform-linters/tflint/pull/2672”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Code review and testing
See all 43| Rank | Project | Score |
|---|---|---|
| 1 | playwrightCross-browser automation and end-to-end test framework for Chromium, Firefox and WebKit | 94 out of 100 |
| 2 | nxMonorepo build system with task caching, affected-only runs and CI integration | 93 out of 100 |
| 3 | open-code-reviewGo CLI that reviews Git diffs with an LLM agent and line-level comments | 92 out of 100 |
| #4 | bendDependent-typed language where AI-written code must prove rules in LAWS.bend | 88 out of 100 |
| #5 | maestroYAML-based UI and end-to-end test framework for Android, iOS and web | 88 out of 100 |