pub static TFLINT: ToolSpecExpand description
Terraform deterministic checker.
tflint’s SARIF uri is repo-relative, verified against its real output.
Some of its results carry a physicalLocation with no region; the
SARIF parser already defaults those to line 1.
--recursive is what makes nested modules visible at all: bare tflint
lints only the module in its cwd, so a commit touching modules/*/
produced no findings and passed silently. Verified against the real
binary: the recursive run descends, emits each finding’s uri relative to
the invocation directory, and exits 2 when any module has findings. Each
module’s config is its own - a nested module without a .tflint.hcl is
linted under tflint’s defaults rather than the root config, which is
tflint’s documented per-module resolution, not something drep can
override from here.