feat: add Cursor Rule for generating tf tests in child modules #1
Conversation
WalkthroughAdded an Apache 2.0 LICENSE, expanded README with rule-tool usage and branding, introduced a comprehensive Terraform/Tofu child-module testing spec, added a GitHub Actions lint workflow, and added Trunk CI configuration and ignore rules under .trunk. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Repo as Project Repo
participant Rules as Central Rules Repo
participant Tool as rule-tool (CLI)
Dev ->> Repo: git clone project
Dev ->> Rules: git clone shared-prompts (central rules)
Dev ->> Tool: set RULE_TOOL_PATH env var
Dev ->> Tool: run rule-tool (interactive / --non-interactive)
Tool ->> Rules: read rules/ directory
Tool ->> Repo: create symlinks from Rules/rules/... to Repo/rules/
Repo ->> Dev: project now references centralized Cursor Rules via symlinks
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
rules/tf-testing-child-module.mdc (1)
1-880: Add language identifiers to all fenced code blocks (hcl / bash / text)I ran the requested check — 23 unlabeled fenced code blocks were found:
- rules/tf-testing-child-module.mdc:66, 136, 166, 182, 210, 232, 291, 331, 371, 437, 440, 481, 504, 526, 568, 642, 667, 761, 829, 870, 879
- README.md:12, 28
Please update each opening
to include the appropriate language (e.g.,hcl for HCL examples,bash for shell, ortext if unsure). Example: change→hcl.
🧹 Nitpick comments (9)
README.md (4)
12-28: Add a language to the fenced code block (markdownlint MD040).Specify a language for the directory tree block to satisfy linters and improve rendering.
Apply this diff:
-``` +```text shared-prompts/ └── rules/ ├── dockerfile-best-practices.mdc ├── tf-root-module-layout.mdc └── tf-testing-child-module.mdc project-A/.cursorrules/ ├── tf-testing-child-module.mdc → ../../shared-prompts/rules/tf-testing-child-module.mdc ├── tf-root-module-layout.mdc → ../../shared-prompts/rules/tf-root-module-layout.mdc └── ... project-B/.cursorrules/ ├── dockerfile-best-practices.mdc → ../../shared-prompts/rules/dockerfile-best-practices.mdc ├── tf-testing-child-module.mdc → ../../shared-prompts/rules/tf-testing-child-module.mdc └── ...--- `30-31`: **Minor punctuation: use a colon after the lead-in.** Readability nit: a colon fits better after this lead-in phrase. Apply this diff: ```diff -To start using `rule-tool`, +To start using `rule-tool`:
32-32: Stabilize GitHub link: avoid UI-specific query params.The “tab=readme-ov-file” param is UI-specific and brittle. Link directly to the anchor.
Apply this diff:
-1. Install rule-tool following [these instructions](https://github.com/circleci-petri/rule-tool?tab=readme-ov-file#usage). +1. Install rule-tool following [these instructions](https://github.com/circleci-petri/rule-tool#usage).
69-70: Stabilize GitHub link (non-interactive mode).Same as above—remove UI-specific query param.
Apply this diff:
-# See: https://github.com/circleci-petri/rule-tool?tab=readme-ov-file#non-interactive-mode +# See: https://github.com/circleci-petri/rule-tool#non-interactive-moderules/tf-testing-child-module.mdc (5)
39-39: Typo: “majorithy” → “majority”.Minor spelling fix.
Apply this diff:
-**Default Choice**: Use `command = plan` for the majorithy of child module tests. +**Default Choice**: Use `command = plan` for the majority of child module tests.
440-440: Add language to fenced code block (markdownlint MD040).Mark the block as HCL like the others.
Apply this diff:
-``` +```hcl
876-876: Gitleaks false-positive risk: replace example API key with a non-secret placeholder.Gitleaks flags this as a Generic API Key. Use an obviously fake value to avoid scanner noise.
Apply this diff:
- defaults = { key = "tskey-test-123456789" } + # Example placeholder value, not a real key + defaults = { key = "tskey-example-000000000" }
750-753: Plan-time unknowns: availability_zone may not be known during plan.Relying on instance.availability_zone in plan tests can be flaky/non-deterministic. Prefer plan-known data (e.g., counts, keys, or locals) or mock explicit defaults.
Consider one of:
- Assert distribution by deriving from input subnets or desired capacity.
- If keeping AZ checks, ensure the mock sets AZs for instances consistently so values are known at plan time.
417-527: Validate resource addressing style consistency.Several assertions index resources like lists (e.g., aws_lb.main[0]) which only works with count; with for_each, keys must be used. Ensure examples match the intended resource declarations to avoid confusion.
Would you like me to normalize the examples to either count or for_each semantics throughout for consistency?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these settings in your CodeRabbit configuration.
📒 Files selected for processing (3)
LICENSE(1 hunks)README.md(1 hunks)rules/tf-testing-child-module.mdc(1 hunks)
🧰 Additional context used
🪛 Gitleaks (8.27.2)
rules/tf-testing-child-module.mdc
876-876: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 LanguageTool
README.md
[grammar] ~4-~4: There might be a mistake here.
Context: ...more effective workflows. ## How to Use You can keep it basic and copy individua...
(QB_NEW_EN)
🪛 markdownlint-cli2 (0.17.2)
README.md
12-12: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (1)
LICENSE (1)
190-203: LGTM: Correct Apache 2.0 license boilerplate and attribution.The license text and copyright notice look correct for Apache-2.0. No issues.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (5)
.trunk/configs/.markdownlint.yaml (1)
1-2: Optional: add a root-level .markdownlint.yaml for better editor/tooling discovery.Some local tools/editors look for the config at repo root. You can forward it to the Trunk-managed location.
Create a forwarding config at the repo root:
+--- /dev/null ++++ b/.markdownlint.yaml +extends: .trunk/configs/.markdownlint.yaml.trunk/trunk.yaml (2)
19-26: Consider enabling Terraform-focused linters to align with repo goals.Given the PR’s Terraform testing focus, consider adding:
- tflint (Terraform best practices and provider-specific checks)
- terraform fmt (format enforcement)
- terraform-docs (if you want module docs consistency)
17-26: Optional: add ignores to speed up lint runs and reduce noise.If/when these dirs exist, add ignores so linters don’t traverse them.
Example:
lint: enabled: - [email protected] - [email protected] - git-diff-check - [email protected] - [email protected] - [email protected] - [email protected] + ignore: + - path: node_modules/** + - path: dist/** + - path: build/** + - path: venv/** + - path: .git/**.github/workflows/lint.yml (2)
25-27: Fetch full history to improve git-diff-based checks.actions/checkout defaults to shallow fetch. Some diff-aware tools (e.g., git-diff-check) benefit from full history to compute merge-base accurately.
- name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4 + with: + fetch-depth: 0
13-18: Optional: trigger on PR events you care about explicitly.If you want to avoid runs for draft PRs or add explicit event types, tighten the trigger. Default is fine; this is purely optional.
Example:
pull_request: - branches: [main] + branches: [main] + types: [opened, synchronize, reopened, ready_for_review]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these settings in your CodeRabbit configuration.
📒 Files selected for processing (6)
.github/workflows/lint.yml(1 hunks).trunk/.gitignore(1 hunks).trunk/configs/.markdownlint.yaml(1 hunks).trunk/configs/.yamllint.yaml(1 hunks).trunk/trunk.yaml(1 hunks)README.md(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- .trunk/configs/.yamllint.yaml
- .trunk/.gitignore
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
🔇 Additional comments (2)
.trunk/configs/.markdownlint.yaml (1)
1-2: LGTM: Prettier-friendly markdownlint config is correct and minimal.Using the shareable style via “extends: markdownlint/style/prettier” is a solid default for teams relying on Prettier.
.trunk/trunk.yaml (1)
1-6: LGTM: Baseline Trunk config is sound and versions are pinned.Good defaults, explicit CLI version, and stable plugin source pinning.
| - name: Trunk Check | ||
| uses: trunk-io/trunk-action@v1 | ||
| with: | ||
| check-mode: all |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the Trunk Action to a commit SHA for supply-chain hardening.
GitHub recommends pinning actions to a commit SHA to prevent supply-chain attacks. Keep @v1 in a comment for tracking, but use a SHA in the “uses” line.
Example:
- - name: Trunk Check
- uses: trunk-io/trunk-action@v1
+ - name: Trunk Check
+ # v1 @ <commit-sha> (https://github.com/trunk-io/trunk-action/commits)
+ uses: trunk-io/trunk-action@<COMMIT_SHA>
with:
check-mode: all📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Trunk Check | |
| uses: trunk-io/trunk-action@v1 | |
| with: | |
| check-mode: all | |
| - name: Trunk Check | |
| # v1 @ <commit-sha> (https://github.com/trunk-io/trunk-action/commits) | |
| uses: trunk-io/trunk-action@<COMMIT_SHA> | |
| with: | |
| check-mode: all |
🤖 Prompt for AI Agents
.github/workflows/lint.yml lines 28-31: the workflow uses
trunk-io/trunk-action@v1 which should be pinned to a commit SHA for supply-chain
hardening; update the "uses" value to the specific commit SHA (e.g.
trunk-io/trunk-action@<commit-sha>) and keep the @v1 tag in a comment for
tracking, ensuring the workflow continues to reference the same action version
while also using the immutable SHA.
what
Summary by CodeRabbit