feat(terraform): add module check for commit hash revision usage

[gruebel]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

• adding the first module check 🍻
• instead of using a tag to reference the version of a module, it is recommend to use the actual git URL + commit hash revision to pin it to an immutable state

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[tobias-netacea]

Question on this one. Seems checks for the ref= does not take local modules into account e.g.

module "my_module" {
  source = "../modules/foo"
}

Any chance this can be improved to only apply when the source is a URL and not a local path?

[gruebel]

hey @tobias-netacea ,

you are right 🙈 I don't know, why I forgot to test the new check against local modules. Will create a fix for it.

[richardgavel-ordinaryexperts]

#5267

[benedekmol]

Hi,
We referenced a tag like this:
git::ssh://[email protected]/gitrepo//.?ref=0.25.0

And this feature broke it beacuse the regex doesn't allow . characters.

[tomcsi]

I have same issue

[benedekmol]

Using the general git source. This broke the tag reference.

[gruebel]

@tomcsi @benedekmol feel free to read this comment, then you understand the reasoning of this new check #5265 (comment)

[rajaganeshej]

Hi , I am also facing this issue. so if only commit hash then only I can use this?.. I am referring some feature branch and it's requesting the commit hash.

Could you please help me on this?

[JamesWoolfenden]

Hi , I am also facing this issue. so if only commit hash then only I can use this?.. I am referring some feature branch and it's requesting the commit hash.

Could you please help me on this?

The feature branch should still have a commit hash.