Provider linting
PYVIDER LINTING · OPENTOFU 1.13.0-RC1 EXPERIMENTAL VALIDATION
Three checked recordings from the terraform-provider-pyvider v0.6.1 release show what the OpenTofu experimental validation lane reaches, what Pyvider validates directly, and how to reproduce both results from the same fixture.
Watch in order
- 01 OpenTofu experimental validation lane · 4 of 7 paths
- 02 Direct provider evidence · all 7 validation surfaces
- 03 Full walkthrough · install, OpenTofu lane, direct lane
Playback is paced for readability. The terminal output is captured from the checked CI run; only the timing between lines is expanded.
01 · OPENTOFU EXPERIMENTAL VALIDATION LANE
OpenTofu 1.13.0-rc1 — experimental validation lane
Runtime: 34 seconds · 4 of 7 provider validation paths · provider configuration, managed resources, data sources, and ephemeral resources.
Run:
soup lint tests/e2e/provider-linting/lint.soup.toml --provider "$provider" --opentofu "$tofu" --lane opentofuThis lane is OpenTofu 1.13.0-rc1 evidence only. OpenTofu reaches these four paths through ordinary validation RPCs; the lane does not claim direct provider coverage.
02 · DIRECT PROVIDER EVIDENCE
Direct provider validation — all seven surfaces
Runtime: 37 seconds · 7 of 7 provider validation surfaces · all seven first-party rules.
Run:
soup lint tests/e2e/provider-linting/lint.soup.toml --provider "$provider" --lane directThe second recording runs the same packaged provider through TofuSoup's direct validation lane and covers all seven Pyvider validation surfaces, including list resources, actions, and state stores.
03 · REPRODUCIBLE WALKTHROUGH
Run it yourself — reproducible walkthrough
Runtime: 40 seconds · both lanes against the checked fixture · 7 rules kept distinct by scope.
- 01 Install the released TofuSoup tool
- 02 Run the OpenTofu experimental validation lane
- 03 Run the direct seven-surface lane
Source: provide-io/terraform-provider-pyvider v0.6.1 · 🏗️ Build Provider Binary · run 35809105555 · checksum-verified release assets
Build guidance into your provider
Pyvider’s author-facing lint API is supported today. Provider authors can return clear, namespaced findings alongside normal validation, without making those findings block a plan or apply.
Choose guidance for your project
Provider rules are off by default. Turn on the rules you want for one validation:
PYVIDER_LINT=provide-io/pyvider:all tofu validate
Use the namespaced security group, or enable everything except one exact rule:
PYVIDER_LINT=provide-io/pyvider:security tofu validate
PYVIDER_LINT='provide-io/pyvider:all,!provide-io/pyvider:insecure-http' tofu validate
An explicitly empty environment value overrides the file and disables provider linting for that process:
PYVIDER_LINT='' tofu validate
For persistent project selection, add pyvider.toml beside the OpenTofu configuration:
[lint]
rules = ["provide-io/pyvider:all", "!provide-io/pyvider:insecure-http"]
Seven first-party rules
Every finding is advice: validation continues, the rule ID stays visible, and an exact rule can be excluded when the configuration is intentional.
| Configuration path | Rule | Group | Trigger |
|---|---|---|---|
| Provider configuration | provide-io/pyvider:insecure-tls | security | TLS verification is explicitly disabled |
| Managed resource | provide-io/pyvider:world-writable-directory | security | directory permissions include the other-write bit |
| Data source | provide-io/pyvider:insecure-http | security | an endpoint starts with http:// |
| Ephemeral resource | provide-io/pyvider:long-lived-lease | reliability | a lease lasts longer than one hour |
| List resource | provide-io/pyvider:include-hidden-files | security | hidden files are explicitly included |
| Action | provide-io/pyvider:long-action-timeout | reliability | an action timeout exceeds five minutes |
| State store | provide-io/pyvider:relative-state-store-path | reliability | a filesystem state path is relative |
What Pyvider proves
The opening recording runs the packaged provider through OpenTofu 1.13.0-rc1. OpenTofu’s experimental validation lane reaches provider configuration, managed resources, data sources, and ephemeral resources through ordinary validation RPCs. The direct recording and full walkthrough show the remaining validation surfaces without presenting them as an OpenTofu result.
| Validation path | OpenTofu experimental validation lane | Direct provider validation |
|---|---|---|
| Provider configuration | Yes | Yes |
| Managed resource | Yes | Yes |
| Data source | Yes | Yes |
| Ephemeral resource | Yes | Yes |
| List resource | Direct check only | Yes |
| Action | Direct check only | Yes |
| State store | Direct check only | Yes |
All three recordings and their manifest came from one successful proof job. They are published as assets of the terraform-provider-pyvider v0.6.1 release. This site copy was checked against that release’s SHA256SUMS before it was installed. The manifest pins the provider source, the Pyvider 0.8.1 and pyvider-components 0.8.0 wheels from PyPI, the OpenTofu archive, the packaged binary, the published provider archive, and all three cast checksums.
OpenTofu integration status — 22 September 2026
As of 22 September 2026, the newest OpenTofu 1.13 tag is v1.13.0-rc1, a pre-release published on 17 September 2026; OpenTofu 1.13.0 is not generally available yet. Its built-in linter is experimental, and OpenTofu 1.13 has no provider-lint transport: the rc1 plugin protocol carries no lint messages, and the linting RFC leaves provider-defined rules to a future protocol. Pyvider findings therefore reach OpenTofu as warnings through ordinary validation RPCs. This page keeps the OpenTofu experimental validation lane and Pyvider’s direct provider validation separate, then uses the walkthrough to run both in order. Proofs through provider 0.5.0 used OpenTofu 1.13.0-beta1.
Follow the built-in linter RFC, implementation tracker, initial implementation, linting documentation, and the v1.13.0-rc1 pre-release used for the recording.
Implementation notes
Pyvider reports structured warning diagnostics through ordinary validation RPCs because no provider lint protocol has been released upstream. If one ships, the transport may change, but the rules, IDs, groups, and selectors stay stable.