Tooling

Build, lint, and code-generation tools used in this repo.

Makefile targets

The Makefile wraps a small number of shell scripts:

Target	What it runs	Purpose
make generate	go generate ./...	Regenerate stringers, mocks, and other go:generate outputs.
make protobuf	go run ./tools/protobuf-compile .	Regenerate the gRPC stubs from docs/plugin-protocol/*.proto. Requires protoc.
make fmtcheck	scripts/gofmtcheck.sh	Fail on gofmt differences.
make importscheck	scripts/goimportscheck.sh	Fail on goimports differences.
make vetcheck	go vet ./...	Standard go vet.
make staticcheck	scripts/staticcheck.sh	Run honnef.co/go/tools/cmd/staticcheck with the project config in staticcheck.conf.
make exhaustive	scripts/exhaustive.sh	Verify enum-style switch statements cover every case.
make copyright	scripts/copyright.sh --plan	Report missing/wrong copyright headers.
make copyrightfix	scripts/copyright.sh	Apply or repair headers in place.
make syncdeps	scripts/syncdeps.sh	Reconcile dependencies (helper for the release pipeline).

scripts/

The scripts/ directory is small and contains the targets above plus a few helpers used by CI:

• gofmtcheck.sh, goimportscheck.sh — format checkers.
• staticcheck.sh — installs staticcheck if missing, then runs with staticcheck.conf.
• exhaustive.sh — installs exhaustive if missing, then runs over the same set of packages.
• copyright.sh — wraps the upstream copywrite tool with the configuration in .copywrite.hcl.
• syncdeps.sh — keeps the dependency lock files (the project's, not Terraform's user-facing one) in sync.

tools/

The tools/ directory holds compiled-as-needed Go programs invoked by the build:

• tools/protobuf-compile/ — the orchestrator behind make protobuf. Runs protoc with pinned versions of protoc-gen-go and protoc-gen-go-grpc, ensuring the generated stubs are reproducible.
• Other small generators used by go generate directives.

Linters and config

File	Used by
staticcheck.conf	make staticcheck — selects the rules and paths covered.
.copywrite.hcl	make copyright / make copyrightfix — author, license SPDX identifier, file globs.
.git-blame-ignore-revs	Tells git blame to skip mass-formatting commits.
.go-version	Pins the production Go toolchain version.
.changie.yaml	Configuration for the changie changelog tool.

CI

GitHub Actions workflows live under .github/workflows/. Notable ones:

• Unit tests, vet, lint, and exhaustive checks on every PR.
• Changelog check that requires either a .changes/v*.md entry or the no-changelog-needed label.
• Cross-platform builds for releases, gated by tags.

PRs from external contributors get a Vercel-preview check that doesn't authenticate correctly; this is expected and ignored by maintainers.

Autocomplete

Terraform's CLI dispatcher (hashicorp/cli) supports installing shell autocomplete:

terraform -install-autocomplete
terraform -uninstall-autocomplete

The hooks for these are in main.go (AutocompleteInstall / AutocompleteUninstall).

changie

The user-facing changelog is built from per-PR files in .changes/v1.XX/ and assembled by changie into CHANGELOG.md at release time. Run npx changie new to create a new entry; changie merge (run by maintainers) collates them into the final changelog. The kinds list (NEW FEATURES, ENHANCEMENTS, BUG FIXES, etc.) is the project's vocabulary for changelog classification — see CONTRIBUTING.md.

Running individual scripts directly

Most of the make targets are thin shells around scripts; you can call them directly:

./scripts/staticcheck.sh
./scripts/exhaustive.sh

This is useful when you want to pass extra flags or scope the run to a single package.