OpenTofu check placement - Jacob P Evans

Keep fast, credential-free checks close to the edit. Keep live infrastructure access inside the homelab control plane.

Placement matrix

Check	Pre-commit	CI mirror	Terrakube
`tofu fmt -check`	yes	yes	optional
`tofu init -backend=false` + `tofu validate`	yes	yes	yes
`tofu test`	yes when fast	yes	provider-dependent tests only
`tflint` and security scans	yes	yes	no
`tofu plan`	no	no live credentials	yes
`tofu apply`	never	never	yes, with the workspace approval policy

Rules

Hooks and CI validation must work without live credentials or access to AWS, Proxmox, or UniFi.
Use tofu init -backend=false for validation.
Do not hide required static checks behind a manual stage.
Do not use continue-on-error on format, validation, or tests.
Never upload a binary plan or tofu show -json artifact to public CI.
Never enable debug or trace logging around live credentials.
Do not copy secrets into CI or workspace variables.

Why plans stay out of public CI

A resolved plan can expose resource names, addresses, internal hostnames, network ranges, and sensitive provider values. Terrakube keeps the plan and its approval record inside the homelab. PR checks prove code quality; the remote run proves live impact.

Anti-patterns

# Wrong: a live plan in a public workflow
- run: tofu plan -no-color

# Wrong: a credential-requiring hook
- id: tofu-plan
  entry: tofu plan

# Wrong: hiding a required static check
- id: tofu-test
  stages: [manual]

CI/CD