tf-analyze ships as a pre-commit hook so every git commit on a Terraform repo is gated automatically.

1. Install pre-commit (once per machine):

   pip install pre-commit
   # or: brew install pre-commit

2. Add .pre-commit-config.yaml to your repo root (or append to an existing one):

   repos:
     - repo: https://github.com/ChrisAdkin8/tf-analyze
       rev: v0.2.6                   # pin to a release tag; bump as new tags ship
       hooks:
         - id: tf-analyze          # all findings, fail on HIGH+

3. Install the hooks into your local git repo:

   pre-commit install

4. Run manually against all staged files:

   pre-commit run tf-analyze

Override args in your .pre-commit-config.yaml:

repos:
  - repo: https://github.com/ChrisAdkin8/tf-analyze
    rev: v0.2.6
    hooks:
      - id: tf-analyze
        args: ["--target", ".", "--fail-on", "MEDIUM"]

hooks:
  - id: tf-analyze
    args: ["--target", ".", "--fail-on", "HIGH", "--section", "security"]

Pre-commit can also run in CI (GitHub Actions, GitLab CI, etc.):

# .github/workflows/pre-commit.yml
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
  with:
    python-version: "3.11"
- run: pip install pre-commit
- run: pre-commit run tf-analyze --all-files

Or use the dedicated GitHub Action from integrations/github-action.yml.

The hook calls:

python3 scripts/detect.py --target . --fail-on HIGH

from the root of the repo. It exits non-zero when any finding meets or exceeds the threshold, blocking the commit.

pass_filenames: false is set because tf-analyze always scans the workspace root (it resolves module boundaries across the corpus).