@intentius/chant-lexicon-terraform 0.102.0 → 0.104.0

package/src/lint/post-synth/tf038.ts

@@ -0,0 +1,71 @@
+/**
+ * TF038: an `oci://` module source names no tag and no digest, or a mutable
+ * tag.
+ *
+ * OpenTofu resolves an OCI module source with no `tag` to the `latest` tag
+ * (https://opentofu.org/docs/language/modules/sources/), so an unpinned source
+ * and `?tag=latest` are the same thing: a push to the registry changes what
+ * the root provisions with no diff to review. A digest, or an exact version
+ * tag, holds it. `classifyModuleSource` (`./module-source.ts`) reads the tag
+ * and digest from either spelling.
+ *
+ * A warning rather than an error: a registry can make a version tag
+ * immutable, and a source that names `?tag=1.4.0` is read as pinned here
+ * whether or not the registry enforces that. A digest is the only pin the
+ * registry cannot move, which the message says. A source that names a digest
+ * is never flagged, whatever tag sits beside it.
+ *
+ * Scope: root and child modules alike (#2112), same as TF004 and TF005.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isMutableOciTag } from "./module-source";
+
+export const tf038: PostSynthCheck = {
+  id: "TF038",
+  description: "OCI module source has no tag or digest, or a mutable tag",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown };
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined) continue;
+
+      const classified = classifyModuleSource(source);
+      if (classified.kind !== "oci" || classified.digest) continue;
+
+      const address = typeof props.address === "string" ? props.address : key;
+      let message: string | undefined;
+      if (!classified.tag) {
+        message =
+          `Module "${address}" sources "${source}" with no tag or digest, so OpenTofu pulls the \`latest\` tag. ` +
+          "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+      } else if (isMutableOciTag(classified.tag)) {
+        message =
+          `Module "${address}" sources "${source}" with the mutable tag "${classified.tag}". ` +
+          "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+      }
+      if (!message) continue;
+
+      diagnostics.push({
+        checkId: "TF038",
+        severity: "warning",
+        message,
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf039.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadFixture } from "./fixtures/load";
+import { tf039 } from "./tf039";
+import { terraformPlugin } from "../../plugin";
+
+async function withVersion(version: string | undefined, source = "terraform-aws-modules/vpc/aws"): Promise<PostSynthContext> {
+  const hcl = `module "vpc" {\n  source = "${source}"\n${version === undefined ? "" : `  version = ${JSON.stringify(version)}\n`}}\n`;
+  const entities = await blocksToEntities([{ name: "main.tf", source: hcl }], "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF039: registry module version is a range", () => {
+  test("flags the documented positive fixture", async () => {
+    expect(tf039.check(await loadFixture("TF039", "positive"))).toHaveLength(1);
+  });
+
+  test.each(["~> 1.4", ">= 1.4", ">= 1.0, < 2.0", "< 2.0", "!= 1.4.0"])("flags %s", async (v) => {
+    const diags = tf039.check(await withVersion(v));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF039", severity: "warning", entity: "app/module.vpc" });
+    expect(diags[0].message).toContain(v);
+  });
+
+  test.each(["1.4.0", "= 1.4.0", "=1.4.0"])("passes %s", async (v) => {
+    expect(tf039.check(await withVersion(v))).toEqual([]);
+  });
+
+  test("leaves a missing version to TF004, and non-registry sources alone", async () => {
+    expect(tf039.check(await withVersion(undefined))).toEqual([]);
+    expect(tf039.check(await withVersion("~> 1.0", "./modules/x"))).toEqual([]);
+  });
+
+  test("is off by default: in the all preset, not in recommended", () => {
+    const presets = terraformPlugin.lintPresets!();
+    expect(presets.all).toContain("TF039");
+    expect(presets.recommended).not.toContain("TF039");
+  });
+});

package/src/lint/post-synth/tf039.ts

@@ -0,0 +1,64 @@
+/**
+ * TF039: a registry module's `version` is a range, not an exact version.
+ *
+ * TF004 flags a registry module with no `version`; a `version` of `~> 1.4`,
+ * `>= 1.4` or `>= 1.0, < 2.0` passes it, yet an upstream release inside the
+ * range changes what the root provisions with no diff to review. This rule is
+ * for projects that pin modules to one version (`1.4.0` or `= 1.4.0`).
+ *
+ * Off by default: it is a `report-only` catalog entry, so the `recommended`
+ * preset leaves it out and `lint.presets: { terraform: "all" }` (or a
+ * `lint.rules` entry for TF039) turns it on. Ranges are common and often
+ * intended, so a default warning would be noise for most roots. It is a
+ * separate rule from TF004 because a post-synth check receives no options
+ * (`PostSynthCheck.check(ctx)`), while the preset mechanism already carries
+ * exactly this on/off choice per rule id (#3190).
+ *
+ * A module that has no `version` is TF004's finding and is skipped here.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source";
+
+export const tf039: PostSynthCheck = {
+  id: "TF039",
+  description: "Registry module version is a range, not an exact version",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown };
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined || classifyModuleSource(source).kind !== "registry") continue;
+
+      const version = body.version;
+      if (typeof version !== "string" || version.trim() === "") continue;
+      if (isExactVersionConstraint(version)) continue;
+
+      const address = typeof props.address === "string" ? props.address : key;
+      diagnostics.push({
+        checkId: "TF039",
+        severity: "warning",
+        message:
+          `Module "${address}" sources "${source}" with the version range "${version}". ` +
+          "A release inside the range changes what the root provisions with no diff to review. " +
+          'Pin an exact version (`version = "1.4.0"`).',
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf040.test.ts

@@ -0,0 +1,55 @@
+import { afterEach, describe, expect, test } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities, parseTerraformRootDir } from "../../hcl/parse";
+import { tf040 } from "./tf040";
+import { terraformPlugin } from "../../plugin";
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+function root(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), "tf040-"));
+  dirs.push(dir);
+  for (const [name, text] of Object.entries(files)) writeFileSync(join(dir, name), text);
+  return dir;
+}
+
+const MAIN = 'resource "aws_s3_bucket" "b" {\n  bucket = "x"\n}\n';
+
+async function ctxOf(dir: string): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(dir, "app");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF040: root has no committed .terraform.lock.hcl", () => {
+  test("flags a root with providers and no lock file, once", async () => {
+    const diags = tf040.check(await ctxOf(root({ "main.tf": MAIN + MAIN.replace('"b"', '"c"') })));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF040", severity: "warning", lexicon: "terraform" });
+    expect(diags[0].message).toContain('"aws"');
+  });
+
+  test("passes a root with the lock file beside its .tf files", async () => {
+    expect(tf040.check(await ctxOf(root({ "main.tf": MAIN, ".terraform.lock.hcl": "# lock\n" })))).toEqual([]);
+  });
+
+  test("skips a root that implies no provider", async () => {
+    expect(tf040.check(await ctxOf(root({ "main.tf": 'variable "x" {}\n' })))).toEqual([]);
+  });
+
+  test("reports nothing when the parse had no directory (not determined)", async () => {
+    const entities = await blocksToEntities([{ name: "main.tf", source: MAIN }], "app");
+    expect(tf040.check({ outputs: new Map(), entities } as unknown as PostSynthContext)).toEqual([]);
+  });
+
+  test("is off by default: in the all preset, not in recommended", () => {
+    const presets = terraformPlugin.lintPresets!();
+    expect(presets.all).toContain("TF040");
+    expect(presets.recommended).not.toContain("TF040");
+  });
+});

package/src/lint/post-synth/tf040.ts

@@ -0,0 +1,76 @@
+/**
+ * TF040: a root that uses providers has no `.terraform.lock.hcl`.
+ *
+ * The lock file records the provider versions and hashes `terraform init`
+ * selected. Without it, each `init` resolves `required_providers` constraints
+ * afresh, so a provider release changes a plan with no diff. None of
+ * TF001 to TF029 looks at it.
+ *
+ * "Committed" is decided by presence: the file sits beside the root's `.tf`
+ * files in the source tree being parsed (`props.lockFile`, stamped by
+ * `parseTerraformRootDir` and by the local audit path). Whether git tracks it
+ * is not asked, so a lock file that is present but gitignored counts as
+ * committed. A parse with no directory to look in (a fetched repository,
+ * inline source) leaves `lockFile` unset and the rule reports nothing: not
+ * determined, not clean.
+ *
+ * A root that implies no provider (no `provider` block and no resource or data
+ * type) gets no lock file from `init`, so it is skipped, as is a live
+ * choudoufu root, which runs no `init`. One diagnostic per root, anchored on
+ * the first block that implies a provider.
+ *
+ * Off by default in both places: the `report-only` tier keeps it out of a
+ * build's `recommended` preset, and `auditOptIn` keeps it out of `chant audit`.
+ * Many estates run `init` in CI and never commit the file.
+ *
+ * Scope: root modules only (#2112); a child module has no lock file of its own.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LOCK_FILENAME } from "../../hcl/parse";
+import { isRootScoped } from "./scope";
+import { impliedProviders } from "./tf002";
+
+export const tf040: PostSynthCheck = {
+  id: "TF040",
+  description: "Root has no committed .terraform.lock.hcl",
+  // `chant audit` runs every rule, report-only ones included, so without this a
+  // new rule would change every project's audit output. A `lint.rules` entry
+  // for TF040 turns it on in the audit as well as in a build (#3190).
+  auditOptIn: true,
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const missing = new Set<string>();
+
+    for (const entity of ctx.entities.values()) {
+      if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+      const props = entity.props as { root?: unknown; lockFile?: unknown; mode?: unknown };
+      if (props.lockFile !== false || props.mode === "live" || typeof props.root !== "string") continue;
+      missing.add(props.root);
+    }
+
+    for (const root of [...missing].sort()) {
+      const implied = impliedProviders(ctx.entities, root);
+      if (implied.size === 0) continue;
+      const names = [...implied.keys()].sort();
+      diagnostics.push({
+        checkId: "TF040",
+        severity: "warning",
+        message:
+          `Root module "${root}" uses ${names.length === 1 ? "provider" : "providers"} ${names.map((n) => `"${n}"`).join(", ")} ` +
+          `but has no ${LOCK_FILENAME} beside its .tf files. Run \`terraform init\` and commit the file, ` +
+          "so every init selects the same provider versions.",
+        entity: implied.get(names[0]),
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf041.test.ts

@@ -0,0 +1,50 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadTreeFixture } from "./fixtures/load";
+import { tf041 } from "./tf041";
+
+async function withDependency(body: string): Promise<PostSynthContext> {
+  const hcl = `dependency "vpc" {\n  config_path = "../vpc"\n${body}\n}\n`;
+  const entities = await blocksToEntities([{ name: "terragrunt.hcl", source: hcl }], "unit");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF041: Terragrunt dependency lets mock_outputs stand in for apply", () => {
+  test("mocks with no allow-list", async () => {
+    const diags = tf041.check(await loadTreeFixture("TF041", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF041", severity: "warning", entity: "TF041/dependency.vpc", lexicon: "terraform" });
+    expect(diags[0].message).toContain("no `mock_outputs_allowed_terraform_commands`");
+  });
+
+  test("an allow-list that names apply", async () => {
+    const diags = tf041.check(await loadTreeFixture("TF041", "positive-apply"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('lists "apply"');
+  });
+
+  test("a restricted list and a dependency with no mocks pass", async () => {
+    expect(tf041.check(await loadTreeFixture("TF041", "negative"))).toEqual([]);
+  });
+
+  test("an empty list restricts nothing, so it is flagged", async () => {
+    const diags = tf041.check(await withDependency("  mock_outputs = { id = \"x\" }\n  mock_outputs_allowed_terraform_commands = []"));
+    expect(diags).toHaveLength(1);
+  });
+
+  test("a list built from an expression is not determined", async () => {
+    const body = '  mock_outputs = { id = "x" }\n  mock_outputs_allowed_terraform_commands = local.mock_commands';
+    expect(tf041.check(await withDependency(body))).toEqual([]);
+  });
+
+  test("the dependency block records its start line, which anchors chant-ignore", async () => {
+    const ctx = await withDependency('  mock_outputs = { id = "x" }');
+    const entity = ctx.entities.get("unit/dependency.vpc") as unknown as { props: { line?: number } };
+    expect(entity.props.line).toBe(1);
+  });
+
+  test("check metadata", () => {
+    expect(tf041.id).toBe("TF041");
+  });
+});

package/src/lint/post-synth/tf041.ts

@@ -0,0 +1,56 @@
+/**
+ * TF041: a Terragrunt `dependency` has `mock_outputs` and lets them stand in
+ * for `apply`.
+ *
+ * `mock_outputs` is what a dependency returns when it has no outputs yet.
+ * `mock_outputs_allowed_terraform_commands` limits which commands may use
+ * them. Terragrunt reads a missing list and an empty list the same way, as no
+ * limit (`shouldReturnMockOutputs` in `pkg/config/dependency.go`, v1.1.6:
+ * `nil || len == 0 || slices.Contains(list, command)`). So a dependency with
+ * mocks and no list, or a list that names `apply`, can apply the mock values
+ * to real state when the upstream unit has not been applied, and the apply
+ * reports success. The usual list is `["validate", "plan"]`.
+ *
+ * A list that is an expression (`local.mock_commands`) is not determined and
+ * passes. A dependency with `enabled = false` returns its mocks whatever the
+ * list says; that is a different decision and is not reported here.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse";
+import { isExpression, terragruntEntities } from "./terragrunt";
+
+export const tf041: PostSynthCheck = {
+  id: "TF041",
+  description: "Terragrunt dependency lets mock_outputs stand in for apply",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+      if (dep.body.mock_outputs === undefined) continue;
+      const allowed = dep.body.mock_outputs_allowed_terraform_commands;
+      if (isExpression(allowed)) continue;
+
+      let problem: string | undefined;
+      if (allowed === undefined || (Array.isArray(allowed) && allowed.length === 0)) {
+        problem =
+          "sets no `mock_outputs_allowed_terraform_commands`, and Terragrunt reads a missing or empty list as every command";
+      } else if (Array.isArray(allowed) && allowed.includes("apply")) {
+        problem = 'lists "apply" in `mock_outputs_allowed_terraform_commands`';
+      }
+      if (problem === undefined) continue;
+
+      diagnostics.push({
+        checkId: "TF041",
+        severity: "warning",
+        message:
+          `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`mock_outputs\` and ${problem}. ` +
+          "An apply that runs before the upstream unit is applied writes the mock values to real state. " +
+          'Set `mock_outputs_allowed_terraform_commands = ["validate", "plan"]`.',
+        entity: dep.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf042.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "vitest";
+import { loadTreeFixture } from "./fixtures/load";
+import { tf042 } from "./tf042";
+
+describe("TF042: Terragrunt dependency sets skip_outputs together with mock_outputs", () => {
+  test("flags the pair", async () => {
+    const diags = tf042.check(await loadTreeFixture("TF042", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF042", severity: "warning", entity: "TF042/dependency.vpc", lexicon: "terraform" });
+  });
+
+  test("skip_outputs alone, and skip_outputs = false with mocks, pass", async () => {
+    expect(tf042.check(await loadTreeFixture("TF042", "negative"))).toEqual([]);
+  });
+
+  test("check metadata", () => {
+    expect(tf042.id).toBe("TF042");
+  });
+});

package/src/lint/post-synth/tf042.ts

@@ -0,0 +1,42 @@
+/**
+ * TF042: a Terragrunt `dependency` sets `skip_outputs = true` and
+ * `mock_outputs`.
+ *
+ * With `skip_outputs = true` Terragrunt never reads the upstream unit's
+ * outputs (`shouldGetOutputs` in `pkg/config/dependency.go`, v1.1.6), so the
+ * only values the dependency can return are the mocks. Every plan and apply
+ * the mocks are allowed for runs on them, however far the upstream unit has
+ * been applied. The pair is sometimes meant, to break a cycle or to avoid
+ * reading state, and then the mock values are the configuration; that is
+ * worth writing as inputs, which a reader of the unit can see.
+ *
+ * Only a literal `skip_outputs = true` is reported. A `skip_outputs` built
+ * from an expression is not determined.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse";
+import { terragruntEntities } from "./terragrunt";
+
+export const tf042: PostSynthCheck = {
+  id: "TF042",
+  description: "Terragrunt dependency sets skip_outputs together with mock_outputs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+      if (dep.body.skip_outputs !== true || dep.body.mock_outputs === undefined) continue;
+      diagnostics.push({
+        checkId: "TF042",
+        severity: "warning",
+        message:
+          `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`skip_outputs = true\` with \`mock_outputs\`. ` +
+          "Terragrunt then never reads the upstream unit's outputs, so every plan and apply runs on the mock values. " +
+          "Drop `skip_outputs`, or pass the values as `inputs` so they are visible as configuration.",
+        entity: dep.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf043.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { blocksToEntities } from "../../hcl/parse";
+import { loadTreeFixture } from "./fixtures/load";
+import { classifyTerragruntSource } from "./terragrunt";
+import { tf043 } from "./tf043";
+
+async function withSource(source: string): Promise<PostSynthContext> {
+  const hcl = `terraform {\n  source = ${JSON.stringify(source)}\n}\n`;
+  const entities = await blocksToEntities([{ name: "terragrunt.hcl", source: hcl }], "unit");
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF043: Terragrunt terraform.source names no version", () => {
+  test.each([
+    ["positive-git", "?ref="],
+    ["positive-tfr", "?version="],
+    ["positive-oci", "?digest="],
+  ])("flags the %s fixture", async (name, fix) => {
+    const diags = tf043.check(await loadTreeFixture("TF043", name));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF043", severity: "warning", entity: "TF043/terragrunt.terraform", lexicon: "terraform" });
+    expect(diags[0].message).toContain(fix);
+  });
+
+  test("a pinned git source and an interpolated source pass", async () => {
+    expect(tf043.check(await loadTreeFixture("TF043", "negative"))).toEqual([]);
+    expect(tf043.check(await loadTreeFixture("TF043", "negative-other"))).toEqual([]);
+  });
+
+  test.each([
+    "github.com/example/modules//vpc",
+    "git@github.com:example/modules.git//vpc",
+    "git::ssh://git@example.com/org/modules.git",
+    "tfr://registry.example.com/terraform-aws-modules/vpc/aws",
+    "tfr:///terraform-aws-modules/vpc/aws?version=",
+    "oci://registry.example.com:5000/org/mod",
+  ])("flags %s", async (source) => {
+    expect(tf043.check(await withSource(source))).toHaveLength(1);
+  });
+
+  test.each([
+    "github.com/example/modules//vpc?ref=v1.0.0",
+    "git::https://example.com/org/modules.git//vpc?ref=0123456789abcdef0123456789abcdef01234567",
+    "tfr:///terraform-aws-modules/vpc/aws?version=5.1.0",
+    "tfr:///terraform-aws-modules/vpc/aws//modules/x?version=5.1.0",
+    "oci://registry.example.com/org/mod?tag=1.4.0",
+    "oci://registry.example.com/org/mod@sha256:abc123",
+    "../modules/vpc",
+    "/abs/modules/vpc",
+    "${local.base}//vpc",
+    "https://example.com/modules.zip",
+  ])("passes %s", async (source) => {
+    expect(tf043.check(await withSource(source))).toEqual([]);
+  });
+
+  test("classification", () => {
+    expect(classifyTerragruntSource("tfr:///a/b/c?version=1.0.0")).toEqual({ kind: "tfr", pinned: true });
+    expect(classifyTerragruntSource("./x")).toEqual({ kind: "local" });
+  });
+
+  test("check metadata", () => {
+    expect(tf043.id).toBe("TF043");
+  });
+});

package/src/lint/post-synth/tf043.ts

@@ -0,0 +1,49 @@
+/**
+ * TF043: a Terragrunt unit's `terraform.source` names no version.
+ *
+ * A git source with no `?ref=` follows the default branch, a `tfr://` source
+ * with no `?version=` follows the registry's latest release, and an `oci://`
+ * source with no tag or digest pulls `latest`. A push or a release changes
+ * what the unit provisions with no diff to review. TF005 and TF038 do the same
+ * for `module` blocks; a Terragrunt unit has no `module` block, its source is
+ * the `source` argument of the `terraform` block.
+ *
+ * A local path and a source built from an expression (`${local.base}//x`) are
+ * not determined and pass. A mutable `?ref=main` is not judged
+ * here: the rule asks only whether a version is named.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_SOURCE_TYPE } from "../../hcl/parse";
+import { classifyTerragruntSource, terragruntEntities } from "./terragrunt";
+
+const FIX: Record<string, string> = {
+  git: "Add `?ref=` with a tag or commit SHA.",
+  tfr: "Add `?version=` with an exact version.",
+  oci: "Add `?digest=sha256:...` or `?tag=` with an exact version tag.",
+};
+
+export const tf043: PostSynthCheck = {
+  id: "TF043",
+  description: "Terragrunt terraform.source names no version (git ref, tfr version or oci tag)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_SOURCE_TYPE)) {
+      const source = block.body.source;
+      if (typeof source !== "string") continue;
+      const classified = classifyTerragruntSource(source);
+      if (classified.pinned !== false) continue;
+      diagnostics.push({
+        checkId: "TF043",
+        severity: "warning",
+        message:
+          `The \`terraform\` block in ${block.file} sources "${source}" with no version, so a push or a release changes the unit with no diff to review. ` +
+          FIX[classified.kind],
+        entity: block.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf044.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "vitest";
+import { loadTreeFixture } from "./fixtures/load";
+import { tf044 } from "./tf044";
+
+describe("TF044: Terragrunt config keeps state in a local backend", () => {
+  test("flags remote_state with backend = local", async () => {
+    const diags = tf044.check(await loadTreeFixture("TF044", "positive"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "TF044", severity: "warning", entity: "TF044/remote_state", lexicon: "terraform" });
+    expect(diags[0].message).toContain("remote_state");
+  });
+
+  test("flags a generate block that writes a local backend", async () => {
+    const diags = tf044.check(await loadTreeFixture("TF044", "positive-generate"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("TF044/generate.backend");
+    expect(diags[0].message).toContain('generate "backend"');
+  });
+
+  test("an s3 backend passes", async () => {
+    expect(tf044.check(await loadTreeFixture("TF044", "negative"))).toEqual([]);
+  });
+
+  test("check metadata", () => {
+    expect(tf044.id).toBe("TF044");
+  });
+});