feat: support fixing code by tflint --fix

README.md

@@ -20,9 +20,16 @@ This GitHub Actions does **not** install tflint, so we can install them outside
 
 ## Requirements
 
-* [tflint](https://github.com/terraform-linters/tflint)
-* [reviewdog](https://github.com/reviewdog/reviewdog)
-* (Optional) [github-comment](https://github.com/suzuki-shunsuke/github-comment)
+- [tflint](https://github.com/terraform-linters/tflint)
+- [reviewdog](https://github.com/reviewdog/reviewdog)
+- (Optional) [github-comment](https://github.com/suzuki-shunsuke/github-comment)
+- (Optional) [ghcp](https://github.com/int128/ghcp): If the input `fix` is true, ghcp is required.
+
+You can install these tools by [aqua](https://aquaproj.github.io/):
+
+```sh
+aqua g -i terraform-linters/tflint reviewdog/reviewdog suzuki-shunsuke/github-comment int128/ghcp
+```
 
 ## Notification with reviewdog
 
@@ -53,8 +60,10 @@ This GitHub Actions does **not** install tflint, so we can install them outside
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     github_token_for_tflint_init: ${{ secrets.GH_TOKEN_FOR_TFLINT_INIT }}
+    github_token_for_fix: ${{ secrets.GH_TOKEN_FOR_FIX }}
     working_directory: foo
-    github_comment: true
+    github_comment: "true"
+    fix: "true"
 ```
 
 ## Inputs
@@ -67,10 +76,12 @@ Nothing.
 
 name | default value | description
 --- | --- | ---
-github_token | `github.token` | GitHub Access Token
-github_token_for_tflint_init | `github_token` | GitHub Access Token for `tflint --init`. It this isn't set, the input `github_token` is used. This input is useful for a GitHub Enterprise Server
+github_token | `github.token` | GitHub Access Token. The permission `pull-requests:write` is required.
+github_token_for_tflint_init | `github_token` | GitHub Access Token for `tflint --init`. It this isn't set, the input `github_token` is used. This input is useful for a GitHub Enterprise Server. The permission `contents:read` is required
+github_token_for_fix | `github_token` | GitHub Access Token for `tflint --fix`. It this isn't set, the input `github_token` is used. The permission `contents:write` is required.
 working_directory | "" (current directory) | Woring Directory
 github_comment | `false` | Whether a comment is posted with github-comment
+fix | false | If this is true, code is fixed by `tflint --fix`. ghcp is required for this
 
 ## Outputs
 

action.yaml

@@ -8,6 +8,9 @@ inputs:
   github_token_for_tflint_init:
     description: GitHub Access Token for tflint --init. If this input isn't set, github_token is used
     required: false
+  github_token_for_fix:
+    description: GitHub Access Token for tflint --fix. If this input isn't set, github_token is used
+    required: false
   working_directory:
     description: 'Working Directory'
     required: false
@@ -16,6 +19,10 @@ inputs:
     description: 'Whether a comment is posted with github-comment'
     required: false
     default: 'false'
+  fix:
+    description: If this is true, tflint --fix is executed
+    required: false
+    default: 'false'
 runs:
   using: node20
   main: dist/index.js

aqua/aqua-checksums.json

@@ -0,0 +1,139 @@
+{
+  "checksums": [
+    {
+      "id": "github_release/github.com/int128/ghcp/v1.13.5/ghcp_darwin_amd64.zip",
+      "checksum": "6728BD668888A64C71BF01D9AFBA373F38D353B79D181B1401A4E5E4B329289D",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/int128/ghcp/v1.13.5/ghcp_linux_amd64.zip",
+      "checksum": "3C808E566F0B663182AD5B5DD6E6B05DC8346610EA5613EA8C22AB19F47A4493",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/int128/ghcp/v1.13.5/ghcp_windows_amd64.zip",
+      "checksum": "1A90AD7927F720EB8996AE143DF5D7AA2DF70689B7B5B9074D6FD32C244D688E",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Darwin_arm64.tar.gz",
+      "checksum": "A7FBF41913CE5B6F1872D10C136139B7A849190F4F1F0DC1ED4BF74C636F22A2",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Darwin_x86_64.tar.gz",
+      "checksum": "056DD0F43ECCB8651FB976B43AA91A1D34B2A0C3934F216997774A7CBC1F7EB1",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Linux_arm64.tar.gz",
+      "checksum": "BD0C4045B8F367F1CA6C0E7CFD80189CCD2A8CEAA22034ECBAD4AF0ACB3A3B82",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Linux_x86_64.tar.gz",
+      "checksum": "2C634DBC00BD4A86E4D4C47029D2AF9185FAB06643A9DF0AE10E7C4D644781B6",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Windows_arm64.tar.gz",
+      "checksum": "2DFD2C151AFF8B7D2DFDFC44FB47706667806AEA92F4F8238932BB89A0461D4A",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/reviewdog/reviewdog/v0.20.3/reviewdog_0.20.3_Windows_x86_64.tar.gz",
+      "checksum": "068726CA98BBEB5E47378AB0B630133741E17BA1FEB5654A24EC5E604446EDEF",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_darwin_amd64.tar.gz",
+      "checksum": "63A3BA90EE2325AFAD3FF2E64A4D80688C261E6C68BE8E6AB91214637BF936B8",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_darwin_arm64.tar.gz",
+      "checksum": "CBD193BB490F598D77E179261D7B76DFEBD049DDDEDE5803BA21CBF6A469AEEE",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_linux_amd64.tar.gz",
+      "checksum": "FC0A6886BBB9A23A39EEEC4B176193CADB54DDBE77CDBB19B637933919545395",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_linux_arm64.tar.gz",
+      "checksum": "EDE03682DC955381D057DDE95BB85CE9CA418122209A8A313B617D4ADEC56416",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_windows_amd64.zip",
+      "checksum": "CEF5EA561B9BE20CFF390301C4062C1D7B260AF2F9963C26B406E57AAF30E4D8",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/rhysd/actionlint/v1.7.4/actionlint_1.7.4_windows_arm64.zip",
+      "checksum": "205A2F99BE1CAA70CF0558561FAE47F099B5EF85CA57B00ABCE18C840452EAF3",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_darwin_amd64.tar.gz",
+      "checksum": "1D05A6A0AFED660C1E8A9399ECD7FD8FD3AFFEE9D95D2E410E350CC1A3DC71AE",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_darwin_arm64.tar.gz",
+      "checksum": "0744E5F79F86F88FEE06C9C1FB2F2304FC5E726A8E615D5039CC96271C50CAAB",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_linux_amd64.tar.gz",
+      "checksum": "626077A9C412759D4ECAEFF083EE931248CD7A69EE7FCE178021574025746626",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_linux_arm64.tar.gz",
+      "checksum": "1FCC7BB8C66EC128310AD757E398D8B93601DC0625CF7B1753B9FFCE089BE765",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_windows_amd64.tar.gz",
+      "checksum": "3461DA9EA91B22D9684E7015133FA46C4B644BBC0D145F18229E69BEA68CA200",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/suzuki-shunsuke/github-comment/v6.3.0/github-comment_6.3.0_windows_arm64.tar.gz",
+      "checksum": "27BD4EAB0B7D5707AFDCF17381FB7C223D7A3FEC457B07E96B7CB1367E98D2C0",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/terraform-linters/tflint/v0.54.0/tflint_darwin_amd64.zip",
+      "checksum": "2049AB0085B8480628C0CFD61582E6922E6BF089568473A38D425D25567FB5D7",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/terraform-linters/tflint/v0.54.0/tflint_darwin_arm64.zip",
+      "checksum": "D96AD0781423DBF74BCC2D24B4026AFF03D914B22F73AA488D3DC3436FA9EBE7",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/terraform-linters/tflint/v0.54.0/tflint_linux_amd64.zip",
+      "checksum": "16D062EBB3D2D199463FB93E17644C27FEB57CB6175BABECBCE3E8D34F4956C6",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/terraform-linters/tflint/v0.54.0/tflint_linux_arm64.zip",
+      "checksum": "D458B92310307A792984E062B464913E3C2EFB3E304FC8448DAF1E06E9E44FDA",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "github_release/github.com/terraform-linters/tflint/v0.54.0/tflint_windows_amd64.zip",
+      "checksum": "E11133209B031CCC055936BF8A1472B3B71993F9658A27E6B5863D793C6873A3",
+      "algorithm": "sha256"
+    },
+    {
+      "id": "registries/github_content/github.com/aquaproj/aqua-registry/v4.275.0/registry.yaml",
+      "checksum": "BA7CBE02842555BEA3C0A2EF84545B769739977FA57F4FA219391C0044EF0870",
+      "algorithm": "sha256"
+    }
+  ]
+}

aqua/aqua.yaml

@@ -1,9 +1,12 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
 # aqua - Declarative CLI Version Manager
 # https://aquaproj.github.io/
+checksum:
+  enabled: true
+  require_checksum: true
 registries:
 - type: standard
   ref: v4.276.0 # renovate: depName=aquaproj/aqua-registry
-
 packages:
   - import: imports/*.yaml

aqua/imports/ghcp.yaml

@@ -0,0 +1,2 @@
+packages:
+  - name: int128/[email protected]

dist/index.js

@@ -30249,6 +30249,8 @@ const main = () => __awaiter(void 0, void 0, void 0, function* () {
         githubToken: core.getInput('github_token', { required: true }),
         githubTokenForTflintInit: core.getInput('github_token_for_tflint_init', { required: false }),
         githubComment: core.getBooleanInput('github_comment', { required: true }),
+        githubTokenForFix: core.getInput('github_token_for_fix', { required: false }),
+        fix: core.getBooleanInput('fix', { required: true }),
     });
 });
 main().catch((e) => core.setFailed(e instanceof Error ? e.message : JSON.stringify(e)));
@@ -30298,6 +30300,7 @@ exports.run = void 0;
 const exec = __importStar(__nccwpck_require__(1514));
 const core = __importStar(__nccwpck_require__(2186));
 const github = __importStar(__nccwpck_require__(5438));
+const path = __importStar(__nccwpck_require__(1017));
 function getSeverity(s) {
     if (s == 'error') {
         return 'ERROR';
@@ -30358,9 +30361,15 @@ function generateTable(diagnostics) {
     return lines.join('\n');
 }
 const run = (inputs) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!inputs.githubToken) {
+        throw new Error('github_token is required');
+    }
     if (!inputs.githubTokenForTflintInit) {
         inputs.githubTokenForTflintInit = inputs.githubToken;
     }
+    if (!inputs.githubTokenForFix) {
+        inputs.githubTokenForFix = inputs.githubToken;
+    }
     core.info('Running tflint --init');
     yield exec.exec('tflint', ['--init'], {
         cwd: inputs.workingDirectory,
@@ -30377,6 +30386,9 @@ const run = (inputs) => __awaiter(void 0, void 0, void 0, function* () {
     else {
         args.push('--module');
     }
+    if (inputs.fix) {
+        args.push('--fix');
+    }
     core.info('Running tflint');
     const out = yield exec.getExecOutput('tflint', args, {
         cwd: inputs.workingDirectory,
@@ -30421,6 +30433,27 @@ const run = (inputs) => __awaiter(void 0, void 0, void 0, function* () {
             diagnostics.push(diagnostic);
         }
     }
+    if (inputs.fix) {
+        const files = new Set(diagnostics.map((d) => path.join(inputs.workingDirectory, d.location.path)));
+        const out = yield exec.getExecOutput('git', [
+            'diff', '--name-only',
+        ].concat([...files]), {
+            ignoreReturnCode: true,
+        });
+        const changedFiles = out.stdout.split('\n').filter(f => f.length > 0);
+        if (changedFiles.length !== 0) {
+            const branch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF || "";
+            yield exec.exec('ghcp', [
+                'commit',
+                '-r', `${github.context.repo.owner}/${github.context.repo.repo}`,
+                '-b', branch,
+                '-m', 'fix(tflint): auto fix',
+            ].concat(changedFiles), {
+                env: Object.assign(Object.assign({}, process.env), { GITHUB_TOKEN: inputs.githubTokenForFix }),
+            });
+            throw new Error("code is fixed by tflint --fix");
+        }
+    }
     if (inputs.githubComment && diagnostics.length > 0) {
         const table = generateTable(diagnostics);
         const githubCommentTemplate = `## :x: tflint error
@@ -30430,7 +30463,9 @@ const run = (inputs) => __awaiter(void 0, void 0, void 0, function* () {
 Working Directory: \`${inputs.workingDirectory}\`
 
 ${table}`;
-        yield exec.exec('github-comment', ['post', '-stdin-template'], {
+        yield exec.exec('github-comment', [
+            'post', '-stdin-template',
+        ], {
             input: Buffer.from(githubCommentTemplate),
             env: Object.assign(Object.assign({}, process.env), { GITHUB_TOKEN: inputs.githubToken }),
         });
@@ -30445,7 +30480,13 @@ ${table}`;
     const reporter = github.context.eventName == 'pull_request' ? 'github-pr-review' : 'github-check';
     core.info(`Reviewdog input: ${reviewDogInput}`);
     core.info('Running reviewdog');
-    const reviewdogArgs = ['-f', 'rdjson', '-name', 'tflint', '-filter-mode', 'nofilter', '-reporter', reporter, '-level', 'warning'];
+    const reviewdogArgs = [
+        '-f', 'rdjson',
+        '-name', 'tflint',
+        '-filter-mode', 'nofilter',
+        '-reporter', reporter,
+        '-level', 'warning',
+    ];
     const reviewdogHelp = yield exec.getExecOutput('reviewdog', ['--help'], {
         cwd: inputs.workingDirectory,
         silent: true,
@@ -30463,7 +30504,7 @@ ${table}`;
         env: Object.assign(Object.assign({}, process.env), { REVIEWDOG_GITHUB_API_TOKEN: inputs.githubToken }),
     });
     if (out.exitCode != 0) {
-        throw "tflint failed";
+        throw new Error("tflint failed");
     }
 });
 exports.run = run;

renovate.json

@@ -2,6 +2,7 @@
   "extends": [
     "github>suzuki-shunsuke/renovate-config#2.5.0",
     "github>aquaproj/aqua-renovate-config#2.6.0",
-    "github>aquaproj/aqua-renovate-config:file#2.6.0(aqua/.*\\.ya?ml)"
+    "github>aquaproj/aqua-renovate-config:file#2.6.0(aqua/.*\\.ya?ml)",
+    "github>aquaproj/aqua-renovate-config:file#2.6.0(action\\.ya?ml)"
   ]
 }

src/index.ts

@@ -7,6 +7,8 @@ const main = async (): Promise<void> => {
     githubToken: core.getInput('github_token', { required: true }),
     githubTokenForTflintInit: core.getInput('github_token_for_tflint_init', { required: false }),
     githubComment: core.getBooleanInput('github_comment', { required: true }),
+    githubTokenForFix: core.getInput('github_token_for_fix', { required: false }),
+    fix: core.getBooleanInput('fix', { required: true }),
   })
 }