Terraform: `tofu -chdir=<dir> validate` / `fmt -check` with -chdir before the subcommand is not matched; .tftpl/.tpl templates are unrecognised; clowdhaus/terraform-min-max versions

Start in project_validator/ecosystems/terraform.py: the _CLI tuple near line 34, the flagged(*_commands("fmt")) rule near lines 47-50, the analyses=when(starts(*_commands("validate")...)) rule near line 63, and the source_suffixes/ambiguous_suffixes mapping near lines 171-172. Done means tofu -chdir=<dir> validate and fmt -check in a GitLab job are recognised, and .tftpl/.tpl files are classed as templates rather than unrecognised. The min/max version expression case is a separate, larger design question.

kubespray's seven GitLab jobs run OpenTofu validate and fmt -check -diff as tofu -chdir="contrib/terraform/$PROVIDER" validate; starts(("tofu", "validate")) fails because -chdir= precedes the subcommand → code-formatting and static-analysis FAIL. .tftpl is Terraform's documented template suffix (templatefile()), .tpl the older convention. The terraform-aws-modules' min/max Terraform versions come from clowdhaus/terraform-min-max (two versions) and read as "0 Terraform versions".

Evidence from the corpus audit

kubernetes-sigs/kubespray / code-formatting, static-analysis (Terraform)

• kind: FALSE_NEGATIVE
• actual: code-formatting FAIL "Terraform: CI never runs terraform fmt; its formatting is not enforced";
  static-analysis FAIL "Terraform: no static analyzer runs"; .map.json jobs
  .gitlab-ci/terraform.yml: terraform_validate (openstack|aws|exoscale|hetzner|vsphere|opennebula|upcloud) all have
  ecosystems: [].
• expected: PASS for both: seven GitLab CI jobs run OpenTofu validate and fmt -check -diff on every
  contrib/terraform/<provider>. The validator supports tofu (terraform.py:34: _CLI = ("terraform", "tofu"))
  but matches starts(("tofu", "validate")) / flagged(("tofu", "fmt"), checks=("-check",)), and here the global
  option -chdir=<dir> sits between tofu and the subcommand.
• evidence: .gitlab-ci/terraform.yml:19: - tofu -chdir="contrib/terraform/$PROVIDER" init;
  :26: - tofu -chdir="contrib/terraform/$PROVIDER" validate;
  :27: - tofu -chdir="contrib/terraform/$PROVIDER" fmt -check -diff; .gitlab-ci.yml:68-71: include: ...
  - .gitlab-ci/terraform.yml (the jobs were read: they appear in .map.json).
  Validator: project_validator/ecosystems/terraform.py:47-50: flagged(*_commands("fmt"), checks=("-check",));
  :63: analyses=when(starts(*_commands("validate"), ("terraform_validate",)), analysed).
• repro: main.tf + .gitlab-ci.yml job script: - tofu -chdir=infra validate / - tofu -chdir=infra fmt -check
  (same for terraform -chdir=infra validate).
• confidence: high

terraform-aws-modules/terraform-aws-vpc, -eks, -lambda / platform-matrix, detection (ci)

• kind: UNSUPPORTED
• actual: FAIL: platform-matrix: CI covers 0 OS(es) (none), 0 Terraform version(s) (none) ... Min TF pre-commit (matrix computed by an expression): linux / no Terraform version
• expected: ERROR: the Terraform version is an expression from clowdhaus/terraform-min-max (min and max of required_version, i.e. 2 versions); the composite action and the min-max action are the standard CI of the ~60 terraform-aws-modules repositories and deserve either modelling or an honest "unknown".
• evidence: .github/workflows/pre-commit.yml:79: terraform-version: ${{ steps.minMax.outputs.minVersion }}, :169: terraform-version: ${{ steps.minMax.outputs.maxVersion }}; versions.tf:2: required_version = ">= 1.0".
• repro: the same workflow; expect "Terraform version: unknown (an expression)" rather than "no Terraform version".
• confidence: medium

terraform-google-modules/terraform-google-kubernetes-engine, terraform-aws-modules/terraform-aws-eks / detection (suffixes)

• kind: UNSUPPORTED
• actual: map unrecognised_suffixes: [{".tmpl": 16}, {".tftpl": 1}] (GKE), [{".tpl": 8}] (eks)
• expected: .tftpl is Terraform's documented template-file suffix (for templatefile()), and .tpl is its older convention; a Terraform profile should claim them (as templates, role template).
• evidence: examples/safer_cluster_iap_bastion/templates/startup-script.tftpl; eks templates/al2023_user_data.tpl. Validator: ecosystems/terraform.py:171-172: source_suffixes={".tf": ..., ".tofu": ..., ".tfvars": ...}, ambiguous_suffixes={".hcl": TERRAFORM}.
• repro: templates/x.tftpl in a Terraform project; expect it recognised, not listed as unrecognised.
• confidence: medium

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt