Added pre-commit hooks for file checks, ShellCheck, Markdown linting,…

.devcontainer/Dockerfile

@@ -28,6 +28,22 @@ ARG TERRAFORM_VERSION="1.14.3"
 COPY .devcontainer/scripts/terraform.sh /tmp/
 RUN bash /tmp/terraform.sh "${TERRAFORM_VERSION}" /usr/bin
 
+# Install tflint
+ARG TFLINT_VERSION="0.64.0"
+COPY .devcontainer/scripts/tflint.sh /tmp/
+RUN bash /tmp/tflint.sh "${TFLINT_VERSION}" /usr/bin
+
+# Install terraform-docs
+ARG TERRAFORM_DOCS_VERSION="0.19.0"
+COPY .devcontainer/scripts/terraform-docs.sh /tmp/
+RUN bash /tmp/terraform-docs.sh "${TERRAFORM_DOCS_VERSION}" /usr/bin
+
+# Install shellcheck
+RUN apt-get update && apt-get install -y shellcheck --no-install-recommends \
+    && apt-get clean -y && rm -rf /var/lib/apt/lists/*
+
+
+
 ARG DOCKER_GROUP_ID
 COPY .devcontainer/scripts/docker-client.sh /tmp/
 RUN /tmp/docker-client.sh $USERNAME

.devcontainer/scripts/terraform-docs.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+set -euo pipefail
+
+get_latest_release() {
+  curl --silent "https://api.github.com/repos/$1/releases/latest" |
+  grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/'
+}
+
+VERSION=${1:-"$(get_latest_release terraform-docs/terraform-docs)"}
+INSTALL_DIR=${2:-"/usr/local/bin"}
+CMD=terraform-docs
+NAME=terraform-docs
+
+echo -e "\e[34m»»» 📦 \e[32mInstalling \e[33m$NAME v$VERSION\e[0m ..."
+
+curl -sSL "https://github.com/terraform-docs/terraform-docs/releases/download/v${VERSION}/terraform-docs-v${VERSION}-linux-amd64.tar.gz" -o /tmp/tfdocs.tar.gz
+tar -xzf /tmp/tfdocs.tar.gz -C /tmp > /dev/null
+mkdir -p "$INSTALL_DIR"
+mv /tmp/terraform-docs "$INSTALL_DIR"
+rm -f /tmp/tfdocs.tar.gz
+
+echo -e "\n\e[34m»»» 💾 \e[32mInstalled to: \e[33m$(which $CMD)"
+echo -e "\e[34m»»» 💡 \e[32mVersion details: \e[39m$($CMD --version)"

.devcontainer/scripts/tflint.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+set -euo pipefail
+
+get_latest_release() {
+  curl --silent "https://api.github.com/repos/$1/releases/latest" |
+  grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/'
+}
+
+VERSION=${1:-"$(get_latest_release terraform-linters/tflint)"}
+INSTALL_DIR=${2:-"/usr/local/bin"}
+CMD=tflint
+NAME=TFLint
+
+echo -e "\e[34m»»» 📦 \e[32mInstalling \e[33m$NAME v$VERSION\e[0m ..."
+
+curl -sSL "https://github.com/terraform-linters/tflint/releases/download/v${VERSION}/tflint_linux_amd64.zip" -o /tmp/tflint.zip
+unzip /tmp/tflint.zip -d /tmp > /dev/null
+mkdir -p "$INSTALL_DIR"
+mv /tmp/tflint "$INSTALL_DIR"
+rm -f /tmp/tflint.zip
+
+echo -e "\n\e[34m»»» 💾 \e[32mInstalled to: \e[33m$(which $CMD)"
+echo -e "\e[34m»»» 💡 \e[32mVersion details: \e[39m$($CMD --version)"

.pre-commit-config.yaml

@@ -1,13 +1,53 @@
 ---
 repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        args: [--markdown-linebreak-ext=md]
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+        exclude: ^\.devcontainer/.*\.json$
+      - id: check-merge-conflict
+      - id: check-added-large-files
+        args: ["--maxkb=1000"]
+
   - repo: https://github.com/pycqa/flake8
     rev: 7.3.0
     hooks:
       - id: flake8
+
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.8.3
+    hooks:
+      - id: bandit
+        args: ["-ll"]
+        exclude: (^|/)(tests|e2e_tests)/
+
   - repo: https://github.com/codespell-project/codespell
     rev: v2.4.2
     hooks:
       - id: codespell
+
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.44.0
+    hooks:
+      - id: markdownlint
+
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.97.4
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_tflint
+        args: ["--config=__GIT_WORKING_DIR__/.github/linters/.tflint.hcl"]
+      - id: terraform_docs
+
   - repo: https://github.com/rbubley/mirrors-prettier
     rev: v3.5.0
     hooks:

CHANGELOG.md

@@ -12,6 +12,7 @@ ENHANCEMENTS:
 * Update API, CLI, and UI dependencies to address high-severity Dependabot alerts, including `PyJWT`, `Vite`, `lodash`, `fast-uri`, `flatted`, `immutable`, and `minimatch`.
 * Update dependencies to address Dependabot security alerts: `aiohttp` to 3.14.1, `Pygments` to 2.20.0, `esbuild`, `ws`, `js-yaml`, `@babel/core`, `flatted` (via vitest upgrade), and `react-router-dom`. ([#4950](https://github.com/microsoft/AzureTRE/issues/4950))
 * Added support for formatting UI code via `pre-commit` and fixed existing formatting issues. ([#4955](https://github.com/microsoft/AzureTRE/issues/4955))
+* Added pre-commit hooks for file checks, ShellCheck, Markdown linting, Bandit security checks, and Terraform format/tflint/docs. ([#4986](https://github.com/microsoft/AzureTRE/issues/4986))
 * Updated the version of `super-linter` used in the `build_validation_develop` workflow ([#4957](https://github.com/microsoft/AzureTRE/issues/4957))
 
 BUG FIXES:
@@ -1218,8 +1219,8 @@ COMPONENTS:
 
       If this endpoint is not working in your deployment - include `enable_swagger` in your `config.yaml` (see the sample file), or temporarily activate it via the API resource on azure (named `api-YOUR_TRE-ID`) -> Configuration -> `ENABLE_SWAGGER` item.
       ![Update API setting](./docs/assets/firewall-policy-migrate2.png)
-  
-  
+
+
   :warning: Any custom rules you have added manually will be **lost** and you'll need to add them back after the upgrade has been completed.
 
 FEATURES: