sarj-iac-lint

Custom Terraform / IaC lint rules — stdlib only, line/block based, pre-commit-friendly. Mined from recurring infra review comments across the org.

uv tool install sarj-iac-lint

Rules

Code	Rule	What it flags
SARJ201	`require-deletion-protection`	A stateful resource (Cloud SQL, GKE, BigQuery, Spanner, AlloyDB, Bigtable, RDS, DynamoDB, ElastiCache, DocumentDB, Neptune, Azure databases, Cosmos DB, ...) without `deletion_protection = true`.
SARJ202	`no-comment-cruft`	Commented-out Terraform/HCL and section-banner / divider comments.
SARJ203	`require-prevent-destroy-on-irreplaceable`	A bucket, Secret Manager secret, or artifact registry — which expose no `deletion_protection` argument at all — without `lifecycle { prevent_destroy = true }`.

.tf, .hcl, and .tfvars files are scanned by all rules; .yaml/.yml (Helm/k8s/Compose) are scanned by no-comment-cruft for banners only.

Pre-commit

- repo: https://github.com/sarj-ai/standards
  rev: iac-v0.2.0
  hooks:
    - id: sarj-require-deletion-protection
    - id: sarj-no-comment-cruft-iac
    - id: sarj-require-prevent-destroy-on-irreplaceable

CLI

sarj-iac-lint check --rule require-deletion-protection iac/
sarj-iac-lint list-rules

Diagnostic format is path:line:col: CODE message — Ruff-compatible. --exit-zero reports without failing (warn mode).

Adoption

All three rules have ~zero false positives — run them as hard (blocking) hooks.

require-deletion-protection treats variable/expression-gated protection (deletion_protection = var.enabled) and lifecycle { prevent_destroy = true } as protected — only a literal = false or a total absence is flagged. Protection must sit on the resource itself: a flag nested in settings { ... } is the API-side switch and does not stop terraform destroy.

require-prevent-destroy-on-irreplaceable covers the stores SARJ201 cannot, because they have no protection argument to check. It exempts anything declared disposable via force_destroy, and any secret whose value a *_secret_version resource in the same file reconstructs.

Suppression

Inline # sarj-noqa: SARJ201 — <reason> on the offending line (the resource line for SARJ201 and SARJ203).

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sarj_iac_lint-0.4.0.tar.gz (17.9 kB view details)

Uploaded Jul 31, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

sarj_iac_lint-0.4.0-py3-none-any.whl (23.3 kB view details)

Uploaded Jul 31, 2026 Python 3

File details

Details for the file sarj_iac_lint-0.4.0.tar.gz.

File metadata

Download URL: sarj_iac_lint-0.4.0.tar.gz
Upload date: Jul 31, 2026
Size: 17.9 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for sarj_iac_lint-0.4.0.tar.gz
Algorithm	Hash digest
SHA256	`6305890ca69370eeb0f89576406aa6ca5118841a324b3f377a90796e4068374d`
MD5	`49f7810bc9909b30c87e5a75f833303e`
BLAKE2b-256	`ba711b972f9b9e8a20c924c739ebef85208ce6c2deb7919e7330fac86088538f`

See more details on using hashes here.

Provenance

The following attestation bundles were made for sarj_iac_lint-0.4.0.tar.gz:

Publisher: release.yml on sarj-ai/standards

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: sarj_iac_lint-0.4.0.tar.gz
- Subject digest: 6305890ca69370eeb0f89576406aa6ca5118841a324b3f377a90796e4068374d
- Sigstore transparency entry: 2299621707
- Sigstore integration time: Jul 31, 2026
Source repository:
- Permalink: sarj-ai/standards@731636943fbdd73644306cdbb6dfdb61c057a2ed
- Branch / Tag: refs/heads/main
- Owner: https://github.com/sarj-ai
- Access: internal
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: release.yml@731636943fbdd73644306cdbb6dfdb61c057a2ed
- Trigger Event: push