super-linter: terrascan throws error on terraform moved blocks
Describe the bug
terraform 1.1 introduced a new feature - moved blocks. Read more at https://www.terraform.io/language/modules/develop/refactoring if you wish to understand them.
super-linter is failing when my code includes a moved block with error:
Unsupported block type; Blocks of type “moved” are not expected here.
It is the terrascan linter that is failing.
Expected behavior
moved blocks are valid syntax so terrascan should support them and not throw this error
Steps to Reproduce
- Createa a new repository in github
- Add a file
main.tfwith the following code:
resource "null_resource" "bar" {}
moved {
from = null_resource.foo
to = null_resource.bar
}
- add a file
.githib/workflows/workflow.yamlwith:
name: demo
on:
workflow_dispatch:
jobs:
super-lint:
name: Lint Code Base
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Run Super-Linter
uses: github/super-linter/slim@v4
env:
DEFAULT_BRANCH: main
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- Manually trigger a run of workflow. It will (at the time of writing) fail with the error above.
You can see a repro of this problem at https://github.com/jamiet-msm/demo-super-linter-terrascan-issue/runs/6913423542?check_suite_focus=true#step:4:159
Additional context
Obviously the problem lies with terrascan but as the error is being raised via the use of super-linter I thought better to inform folks here of this issue. According to terrascan’s changelog moved blocks are supported since v1.14.0 (perhaps even earlier)
Closed issues: Blocks of type “moved” not supported https://github.com/accurics/terrascan/issues/1182
and I believe super-linter is using a later version
➜ docker run -it --entrypoint bash ghcr.io/github/super-linter:slim-v4.9.4 -c "terrascan version"
version: v1.15.1
so I’m confused what the issue might be
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 4
- Comments: 21 (10 by maintainers)
Seeing the exact same issue you are having
Would there be any worth in having a toggle to get Super Linter to check Terrascan individual files vs the whole directory? I’ve seen a couple of cases where Terrascan has thrown errors when scanning through Super Linter which I don’t see locally as I run it differently. I realise that Super Linter can be set up to only scan the files which have changed but I think there is value to getting a full Terrascan run.
Look into this code. I think it might be that since superliner individually scans files https://github.com/github/super-linter/blob/1e1f71f145d50ddd3a6e68d49ff3f80a091d9ad4/lib/linter.sh#L968 it throws the error but if you run
terrascan -l terraformin a repo it doesn’t.So basically
terrascan scan -i terraform -t all -f main.tf&terrascan scan -i terraformoutputs are working differently