@intentius/chant-lexicon-terraform 0.102.0 → 0.104.0

package/dist/plan-digest.d.ts

@@ -0,0 +1,59 @@
+/**
+ * A terraform plan's identity (#2300), kept apart from the activities so the
+ * change-set adapter (`../change-set.ts`, #3181) can import it without the
+ * config loader, the HCL parse or anything else the activities reach. It
+ * imports chant's `lifecycle/plan-digest` subpath and nothing more, which is
+ * what lets terragucci bundle it into one file (#3421).
+ */
+/**
+ * One resource's proposed change, as a plan digest sees it (#2300) — the
+ * projection of a `terraform show -json` `resource_changes` entry that
+ * survives into {@link terraformPlanDigest}.
+ */
+export interface TerraformPlannedChange {
+    address: unknown;
+    mode: unknown;
+    type: unknown;
+    name: unknown;
+    index: unknown;
+    provider_name: unknown;
+    deposed: unknown;
+    actions: unknown;
+    before: unknown;
+    after: unknown;
+    after_unknown: unknown;
+    replace_paths: unknown;
+    importing: unknown;
+}
+/**
+ * The change set a `terraform show -json` plan describes, canonicalised
+ * (#2300): every proposed change, at its address, with the values that would
+ * be written, sorted so two renderings of the same plan project identically.
+ *
+ * Everything else in the document is dropped, and the drops are the point —
+ * see `packages/core/src/lifecycle/plan-digest.ts` for the general rule. Here
+ * that means `timestamp` and `terraform_version` (when the plan was taken and
+ * by which binary), `format_version` (how it was rendered), `prior_state` and
+ * `planned_values` (restatements of the same change set from another angle),
+ * `configuration` (the source that produced it, which can be refactored
+ * without changing a single proposed action) and `checks` / `relevant_
+ * attributes` (diagnostics about the plan, not the plan). What is left is
+ * what applying it would do.
+ */
+export declare function terraformPlanChangeSet(planJson: unknown): {
+    resourceChanges: TerraformPlannedChange[];
+    outputChanges: unknown;
+    actionInvocations?: unknown[];
+};
+/**
+ * The identity of a terraform plan (#2300): {@link terraformPlanChangeSet}
+ * hashed. This is what a `TerraformApplyOp` gate binds its approval to, and
+ * what a later run recomputes and compares.
+ *
+ * Taken over the `show -json` rendering rather than the plan file's bytes on
+ * purpose: the file is an opaque, version-stamped archive, and two runs of
+ * `plan -out` over an unchanged root produce different bytes. The rendering
+ * is the same plan both times.
+ */
+export declare function terraformPlanDigest(planJson: unknown): string;
+//# sourceMappingURL=plan-digest.d.ts.map

package/dist/plan-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-digest.d.ts","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACzD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC/B,CAkCA;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE7D"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAgElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAiQ7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAmElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAqR7B,CAAC"}

package/dist/rules/module-source.ts

@@ -18,14 +18,27 @@
  * recognize, scp-style `git@host:path` addresses, and any source ending in
  * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
  * pinning: a local path cannot be pinned to anything and is never flagged).
+ * `oci` is an OpenTofu `oci://host/repo` source (#3190). OpenTofu selects a
+ * version with `?tag=` or `?digest=` (https://opentofu.org/docs/language/modules/sources/),
+ * and a source naming neither resolves the `latest` tag. The container-image
+ * shapes `repo:tag` and `repo@sha256:...` are read too, so a source written
+ * the way `docker pull` spells it is not misread as unpinned. A `:` inside the
+ * host (a registry port) is never a tag: only a colon in the last path
+ * segment is. The tag and digest rules were checked against the docs page
+ * above; the suffix forms are not documented there and are not verified
+ * against OpenTofu's parser.
  */
 
-export type ModuleSourceKind = "local" | "registry" | "git" | "other";
+export type ModuleSourceKind = "local" | "registry" | "git" | "oci" | "other";
 
 export interface ModuleSourceClassification {
   kind: ModuleSourceKind;
   /** The `?ref=`/`&ref=` value (falling back to `rev`), when `kind` is `"git"`. */
   ref?: string;
+  /** The tag an `oci://` source names, from `?tag=` or a `:tag` suffix on the repository. */
+  tag?: string;
+  /** The digest an `oci://` source names, from `?digest=` or an `@sha256:...` suffix. */
+  digest?: string;
 }
 
 const REGISTRY_NAME = /^[0-9A-Za-z](?:[0-9A-Za-z_-]{0,62}[0-9A-Za-z])?$/;
@@ -77,6 +90,25 @@ function isGitShaped(rest: string): boolean {
   return false;
 }
 
+function classifyOci(base: string, query: string): ModuleSourceClassification {
+  const params = parseQuery(query);
+  let path = stripSubdir(base).replace(/^oci:\/\//i, "");
+  let tag = params.get("tag") || undefined;
+  let digest = params.get("digest") || undefined;
+
+  const at = path.indexOf("@");
+  if (at !== -1) {
+    digest = digest ?? (path.slice(at + 1) || undefined);
+    path = path.slice(0, at);
+  }
+  const lastSlash = path.lastIndexOf("/");
+  const colon = path.indexOf(":", lastSlash + 1); // a port sits before the first slash
+  if (colon !== -1) {
+    tag = tag ?? (path.slice(colon + 1) || undefined);
+  }
+  return { kind: "oci", ...(tag !== undefined ? { tag } : {}), ...(digest !== undefined ? { digest } : {}) };
+}
+
 export function classifyModuleSource(source: string): ModuleSourceClassification {
   const trimmed = source.trim();
   if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith(".\\") || trimmed.startsWith("..\\")) {
@@ -87,6 +119,8 @@ export function classifyModuleSource(source: string): ModuleSourceClassification
   const base = queryIdx === -1 ? trimmed : trimmed.slice(0, queryIdx);
   const query = queryIdx === -1 ? "" : trimmed.slice(queryIdx + 1);
 
+  if (/^oci:\/\//i.test(base)) return classifyOci(base, query);
+
   const forced = /^(git|hg)::/i.exec(base);
   const rest = forced ? base.slice(forced[0].length) : base;
 
@@ -119,3 +153,24 @@ export function isPinnedRef(ref: string): boolean {
 export function isDefaultBranch(ref: string): boolean {
   return DEFAULT_BRANCHES.has(ref);
 }
+
+const MUTABLE_TAGS = new Set(["latest", "main", "master", "develop", "dev", "stable", "edge", "nightly"]);
+
+/**
+ * Is `tag` a name that conventionally moves (`latest`, a branch-like name)
+ * rather than an exact version. Used by TF038. A tag is a mutable pointer in
+ * most registries whatever it looks like, so the rule is a warning and this
+ * only decides what reads as obviously floating.
+ */
+export function isMutableOciTag(tag: string): boolean {
+  return MUTABLE_TAGS.has(tag.toLowerCase());
+}
+
+/**
+ * Is a registry `version` constraint an exact version (`1.4.0`, `= 1.4.0`,
+ * `=1.4.0`) rather than a range (`~> 1.4`, `>= 1.4`, `>= 1.0, < 2.0`). Used
+ * by TF039. A bare version is an exact constraint in Terraform.
+ */
+export function isExactVersionConstraint(version: string): boolean {
+  return /^(?:=\s*)?v?\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version.trim()) && !version.includes(",");
+}

package/dist/rules/terragrunt.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared reading for the Terragrunt rules TF041 to TF045 (#3417).
+ *
+ * These rules look at `terragrunt.hcl` and `root.hcl`, which the parse reads
+ * into their own entity types (`TERRAGRUNT_*_TYPE` in `../../hcl/parse.ts`)
+ * and never into the module types the other TF rules check. Like the module
+ * source rules, they read the literal values hcl2json hands back: an
+ * attribute built from a function or a `local.` reference arrives as a
+ * `"${...}"` string and is treated as not determined, never as a finding.
+ */
+
+import { isResourceDeclarable, type Declarable } from "@intentius/chant/declarable";
+import type { BlockBody } from "../../hcl/parse";
+import { classifyModuleSource } from "./module-source";
+
+/** Entities of one Terragrunt type, with their keys, in map order. */
+export function terragruntEntities(
+  entities: ReadonlyMap<string, Declarable>,
+  entityType: string,
+): Array<{ key: string; address: string; file: string; body: BlockBody }> {
+  const out: Array<{ key: string; address: string; file: string; body: BlockBody }> = [];
+  for (const [key, entity] of entities) {
+    if (entity.entityType !== entityType || !isResourceDeclarable(entity)) continue;
+    const props = entity.props as { address?: unknown; file?: unknown; body?: unknown };
+    out.push({
+      key,
+      address: typeof props.address === "string" ? props.address : key,
+      file: typeof props.file === "string" ? props.file : "terragrunt.hcl",
+      body: (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody,
+    });
+  }
+  return out;
+}
+
+/** An HCL expression hcl2json left as `"${...}"`: its value is not known without evaluating it. */
+export function isExpression(value: unknown): boolean {
+  return typeof value === "string" && value.includes("${");
+}
+
+export type TerragruntSourceKind = "local" | "git" | "tfr" | "oci" | "other";
+
+export interface TerragruntSourceClassification {
+  kind: TerragruntSourceKind;
+  /** Whether the source names a version: `?ref=` for git, `?version=` for `tfr://`, a tag or digest for `oci://`. Undefined for `local` and `other`. */
+  pinned?: boolean;
+}
+
+/**
+ * Classify a unit's `terraform.source`. Git and `oci://` sources go through
+ * {@link classifyModuleSource}, the reader TF005 and TF038 use. `tfr://` is
+ * Terragrunt's own scheme for registry modules and takes its version from the
+ * `?version=` query argument. A source that holds an interpolation, or that
+ * names an absolute path or an archive URL, is `other` or `local` and is
+ * never reported.
+ */
+export function classifyTerragruntSource(source: string): TerragruntSourceClassification {
+  const trimmed = source.trim();
+  if (trimmed.includes("${")) return { kind: "other" };
+  if (/^tfr:\/\//i.test(trimmed)) {
+    const query = trimmed.includes("?") ? trimmed.slice(trimmed.indexOf("?") + 1) : "";
+    const version = new URLSearchParams(query).get("version");
+    return { kind: "tfr", pinned: version !== null && version.trim() !== "" };
+  }
+  if (trimmed.startsWith("/")) return { kind: "local" };
+  const classified = classifyModuleSource(trimmed);
+  switch (classified.kind) {
+    case "local":
+      return { kind: "local" };
+    case "git":
+      return { kind: "git", pinned: classified.ref !== undefined };
+    case "oci":
+      return { kind: "oci", pinned: classified.tag !== undefined || classified.digest !== undefined };
+    default:
+      return { kind: "other" };
+  }
+}

package/dist/rules/tf002.ts

@@ -51,7 +51,7 @@ function providerNameFromType(type: string): string {
 }
 
 /** One implied provider name to the entity key that first implied it in file order. */
-function impliedProviders(entities: PostSynthContext["entities"], root: string): Map<string, string> {
+export function impliedProviders(entities: PostSynthContext["entities"], root: string): Map<string, string> {
   const implied = new Map<string, string>();
   const fromProviderBlock = new Set<string>();
 

package/dist/rules/tf038.ts

@@ -0,0 +1,71 @@
+/**
+ * TF038: an `oci://` module source names no tag and no digest, or a mutable
+ * tag.
+ *
+ * OpenTofu resolves an OCI module source with no `tag` to the `latest` tag
+ * (https://opentofu.org/docs/language/modules/sources/), so an unpinned source
+ * and `?tag=latest` are the same thing: a push to the registry changes what
+ * the root provisions with no diff to review. A digest, or an exact version
+ * tag, holds it. `classifyModuleSource` (`./module-source.ts`) reads the tag
+ * and digest from either spelling.
+ *
+ * A warning rather than an error: a registry can make a version tag
+ * immutable, and a source that names `?tag=1.4.0` is read as pinned here
+ * whether or not the registry enforces that. A digest is the only pin the
+ * registry cannot move, which the message says. A source that names a digest
+ * is never flagged, whatever tag sits beside it.
+ *
+ * Scope: root and child modules alike (#2112), same as TF004 and TF005.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isMutableOciTag } from "./module-source";
+
+export const tf038: PostSynthCheck = {
+  id: "TF038",
+  description: "OCI module source has no tag or digest, or a mutable tag",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown };
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined) continue;
+
+      const classified = classifyModuleSource(source);
+      if (classified.kind !== "oci" || classified.digest) continue;
+
+      const address = typeof props.address === "string" ? props.address : key;
+      let message: string | undefined;
+      if (!classified.tag) {
+        message =
+          `Module "${address}" sources "${source}" with no tag or digest, so OpenTofu pulls the \`latest\` tag. ` +
+          "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+      } else if (isMutableOciTag(classified.tag)) {
+        message =
+          `Module "${address}" sources "${source}" with the mutable tag "${classified.tag}". ` +
+          "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+      }
+      if (!message) continue;
+
+      diagnostics.push({
+        checkId: "TF038",
+        severity: "warning",
+        message,
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf039.ts

@@ -0,0 +1,64 @@
+/**
+ * TF039: a registry module's `version` is a range, not an exact version.
+ *
+ * TF004 flags a registry module with no `version`; a `version` of `~> 1.4`,
+ * `>= 1.4` or `>= 1.0, < 2.0` passes it, yet an upstream release inside the
+ * range changes what the root provisions with no diff to review. This rule is
+ * for projects that pin modules to one version (`1.4.0` or `= 1.4.0`).
+ *
+ * Off by default: it is a `report-only` catalog entry, so the `recommended`
+ * preset leaves it out and `lint.presets: { terraform: "all" }` (or a
+ * `lint.rules` entry for TF039) turns it on. Ranges are common and often
+ * intended, so a default warning would be noise for most roots. It is a
+ * separate rule from TF004 because a post-synth check receives no options
+ * (`PostSynthCheck.check(ctx)`), while the preset mechanism already carries
+ * exactly this on/off choice per rule id (#3190).
+ *
+ * A module that has no `version` is TF004's finding and is skipped here.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source";
+
+export const tf039: PostSynthCheck = {
+  id: "TF039",
+  description: "Registry module version is a range, not an exact version",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown };
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined || classifyModuleSource(source).kind !== "registry") continue;
+
+      const version = body.version;
+      if (typeof version !== "string" || version.trim() === "") continue;
+      if (isExactVersionConstraint(version)) continue;
+
+      const address = typeof props.address === "string" ? props.address : key;
+      diagnostics.push({
+        checkId: "TF039",
+        severity: "warning",
+        message:
+          `Module "${address}" sources "${source}" with the version range "${version}". ` +
+          "A release inside the range changes what the root provisions with no diff to review. " +
+          'Pin an exact version (`version = "1.4.0"`).',
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf040.ts

@@ -0,0 +1,76 @@
+/**
+ * TF040: a root that uses providers has no `.terraform.lock.hcl`.
+ *
+ * The lock file records the provider versions and hashes `terraform init`
+ * selected. Without it, each `init` resolves `required_providers` constraints
+ * afresh, so a provider release changes a plan with no diff. None of
+ * TF001 to TF029 looks at it.
+ *
+ * "Committed" is decided by presence: the file sits beside the root's `.tf`
+ * files in the source tree being parsed (`props.lockFile`, stamped by
+ * `parseTerraformRootDir` and by the local audit path). Whether git tracks it
+ * is not asked, so a lock file that is present but gitignored counts as
+ * committed. A parse with no directory to look in (a fetched repository,
+ * inline source) leaves `lockFile` unset and the rule reports nothing: not
+ * determined, not clean.
+ *
+ * A root that implies no provider (no `provider` block and no resource or data
+ * type) gets no lock file from `init`, so it is skipped, as is a live
+ * choudoufu root, which runs no `init`. One diagnostic per root, anchored on
+ * the first block that implies a provider.
+ *
+ * Off by default in both places: the `report-only` tier keeps it out of a
+ * build's `recommended` preset, and `auditOptIn` keeps it out of `chant audit`.
+ * Many estates run `init` in CI and never commit the file.
+ *
+ * Scope: root modules only (#2112); a child module has no lock file of its own.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LOCK_FILENAME } from "../../hcl/parse";
+import { isRootScoped } from "./scope";
+import { impliedProviders } from "./tf002";
+
+export const tf040: PostSynthCheck = {
+  id: "TF040",
+  description: "Root has no committed .terraform.lock.hcl",
+  // `chant audit` runs every rule, report-only ones included, so without this a
+  // new rule would change every project's audit output. A `lint.rules` entry
+  // for TF040 turns it on in the audit as well as in a build (#3190).
+  auditOptIn: true,
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const missing = new Set<string>();
+
+    for (const entity of ctx.entities.values()) {
+      if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+      const props = entity.props as { root?: unknown; lockFile?: unknown; mode?: unknown };
+      if (props.lockFile !== false || props.mode === "live" || typeof props.root !== "string") continue;
+      missing.add(props.root);
+    }
+
+    for (const root of [...missing].sort()) {
+      const implied = impliedProviders(ctx.entities, root);
+      if (implied.size === 0) continue;
+      const names = [...implied.keys()].sort();
+      diagnostics.push({
+        checkId: "TF040",
+        severity: "warning",
+        message:
+          `Root module "${root}" uses ${names.length === 1 ? "provider" : "providers"} ${names.map((n) => `"${n}"`).join(", ")} ` +
+          `but has no ${LOCK_FILENAME} beside its .tf files. Run \`terraform init\` and commit the file, ` +
+          "so every init selects the same provider versions.",
+        entity: implied.get(names[0]),
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/tf041.ts

@@ -0,0 +1,56 @@
+/**
+ * TF041: a Terragrunt `dependency` has `mock_outputs` and lets them stand in
+ * for `apply`.
+ *
+ * `mock_outputs` is what a dependency returns when it has no outputs yet.
+ * `mock_outputs_allowed_terraform_commands` limits which commands may use
+ * them. Terragrunt reads a missing list and an empty list the same way, as no
+ * limit (`shouldReturnMockOutputs` in `pkg/config/dependency.go`, v1.1.6:
+ * `nil || len == 0 || slices.Contains(list, command)`). So a dependency with
+ * mocks and no list, or a list that names `apply`, can apply the mock values
+ * to real state when the upstream unit has not been applied, and the apply
+ * reports success. The usual list is `["validate", "plan"]`.
+ *
+ * A list that is an expression (`local.mock_commands`) is not determined and
+ * passes. A dependency with `enabled = false` returns its mocks whatever the
+ * list says; that is a different decision and is not reported here.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse";
+import { isExpression, terragruntEntities } from "./terragrunt";
+
+export const tf041: PostSynthCheck = {
+  id: "TF041",
+  description: "Terragrunt dependency lets mock_outputs stand in for apply",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+      if (dep.body.mock_outputs === undefined) continue;
+      const allowed = dep.body.mock_outputs_allowed_terraform_commands;
+      if (isExpression(allowed)) continue;
+
+      let problem: string | undefined;
+      if (allowed === undefined || (Array.isArray(allowed) && allowed.length === 0)) {
+        problem =
+          "sets no `mock_outputs_allowed_terraform_commands`, and Terragrunt reads a missing or empty list as every command";
+      } else if (Array.isArray(allowed) && allowed.includes("apply")) {
+        problem = 'lists "apply" in `mock_outputs_allowed_terraform_commands`';
+      }
+      if (problem === undefined) continue;
+
+      diagnostics.push({
+        checkId: "TF041",
+        severity: "warning",
+        message:
+          `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`mock_outputs\` and ${problem}. ` +
+          "An apply that runs before the upstream unit is applied writes the mock values to real state. " +
+          'Set `mock_outputs_allowed_terraform_commands = ["validate", "plan"]`.',
+        entity: dep.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/dist/rules/tf042.ts

@@ -0,0 +1,42 @@
+/**
+ * TF042: a Terragrunt `dependency` sets `skip_outputs = true` and
+ * `mock_outputs`.
+ *
+ * With `skip_outputs = true` Terragrunt never reads the upstream unit's
+ * outputs (`shouldGetOutputs` in `pkg/config/dependency.go`, v1.1.6), so the
+ * only values the dependency can return are the mocks. Every plan and apply
+ * the mocks are allowed for runs on them, however far the upstream unit has
+ * been applied. The pair is sometimes meant, to break a cycle or to avoid
+ * reading state, and then the mock values are the configuration; that is
+ * worth writing as inputs, which a reader of the unit can see.
+ *
+ * Only a literal `skip_outputs = true` is reported. A `skip_outputs` built
+ * from an expression is not determined.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse";
+import { terragruntEntities } from "./terragrunt";
+
+export const tf042: PostSynthCheck = {
+  id: "TF042",
+  description: "Terragrunt dependency sets skip_outputs together with mock_outputs",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+      if (dep.body.skip_outputs !== true || dep.body.mock_outputs === undefined) continue;
+      diagnostics.push({
+        checkId: "TF042",
+        severity: "warning",
+        message:
+          `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`skip_outputs = true\` with \`mock_outputs\`. ` +
+          "Terragrunt then never reads the upstream unit's outputs, so every plan and apply runs on the mock values. " +
+          "Drop `skip_outputs`, or pass the values as `inputs` so they are visible as configuration.",
+        entity: dep.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/dist/rules/tf043.ts

@@ -0,0 +1,49 @@
+/**
+ * TF043: a Terragrunt unit's `terraform.source` names no version.
+ *
+ * A git source with no `?ref=` follows the default branch, a `tfr://` source
+ * with no `?version=` follows the registry's latest release, and an `oci://`
+ * source with no tag or digest pulls `latest`. A push or a release changes
+ * what the unit provisions with no diff to review. TF005 and TF038 do the same
+ * for `module` blocks; a Terragrunt unit has no `module` block, its source is
+ * the `source` argument of the `terraform` block.
+ *
+ * A local path and a source built from an expression (`${local.base}//x`) are
+ * not determined and pass. A mutable `?ref=main` is not judged
+ * here: the rule asks only whether a version is named.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_SOURCE_TYPE } from "../../hcl/parse";
+import { classifyTerragruntSource, terragruntEntities } from "./terragrunt";
+
+const FIX: Record<string, string> = {
+  git: "Add `?ref=` with a tag or commit SHA.",
+  tfr: "Add `?version=` with an exact version.",
+  oci: "Add `?digest=sha256:...` or `?tag=` with an exact version tag.",
+};
+
+export const tf043: PostSynthCheck = {
+  id: "TF043",
+  description: "Terragrunt terraform.source names no version (git ref, tfr version or oci tag)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_SOURCE_TYPE)) {
+      const source = block.body.source;
+      if (typeof source !== "string") continue;
+      const classified = classifyTerragruntSource(source);
+      if (classified.pinned !== false) continue;
+      diagnostics.push({
+        checkId: "TF043",
+        severity: "warning",
+        message:
+          `The \`terraform\` block in ${block.file} sources "${source}" with no version, so a push or a release changes the unit with no diff to review. ` +
+          FIX[classified.kind],
+        entity: block.key,
+        lexicon: "terraform",
+      });
+    }
+    return diagnostics;
+  },
+};

package/dist/rules/tf044.ts

@@ -0,0 +1,51 @@
+/**
+ * TF044: a Terragrunt config keeps state in a local backend.
+ *
+ * Read from `remote_state { backend = "local" }` and from a `generate` block
+ * whose `contents` declare `backend "local"`. State on the runner's disk is
+ * gone when the job ends, a second job cannot read what the first applied, and
+ * a git-range run, which checks out each side in a temporary directory, never
+ * sees state at all. A shared backend (S3, GCS, azurerm, a Terraform HTTP
+ * backend) holds it.
+ *
+ * A backend named by an expression is not determined and passes. A local
+ * backend is sometimes right for a throwaway sandbox; suppress the rule there
+ * with `# chant-ignore TF044`.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { TERRAGRUNT_GENERATE_TYPE, TERRAGRUNT_REMOTE_STATE_TYPE } from "../../hcl/parse";
+import { terragruntEntities } from "./terragrunt";
+
+const LOCAL_BACKEND_BLOCK = /\bbackend\s+"local"/;
+
+export const tf044: PostSynthCheck = {
+  id: "TF044",
+  description: "Terragrunt config keeps state in a local backend",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const report = (key: string, file: string, how: string): void => {
+      diagnostics.push({
+        checkId: "TF044",
+        severity: "warning",
+        message:
+          `${how} in ${file} keeps state in a local backend. The state lives on the runner's disk, so a later job cannot read it ` +
+          "and a git-range run, which checks out each side in a temporary directory, never sees it. Use a shared backend such as S3 or GCS.",
+        entity: key,
+        lexicon: "terraform",
+      });
+    };
+
+    for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_REMOTE_STATE_TYPE)) {
+      if (block.body.backend === "local") report(block.key, block.file, "`remote_state` sets `backend = \"local\"`");
+    }
+    for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_GENERATE_TYPE)) {
+      const contents = block.body.contents;
+      if (typeof contents === "string" && LOCAL_BACKEND_BLOCK.test(contents)) {
+        report(block.key, block.file, `\`generate "${block.address.replace(/^generate\./, "")}"\` writes a \`backend "local"\` block`);
+      }
+    }
+    return diagnostics;
+  },
+};