Home/Using the templates/How templates are checked
How templates are checked
Every template runs through the same checks on every change, and again once a week.
The weekly run matters more than it sounds. Providers retire arguments and change defaults, so a template that passed in March can fail in June with nobody touching it. The weekly run is how that gets noticed.
Terraform
| Check | What it catches | Command |
|---|---|---|
| Formatting | The code is formatted the standard way, so diffs stay readable. | terraform fmt -check -diff |
| Valid | Terraform can read it and every reference resolves. | terraform init -backend=false && terraform validate |
| Lint | Unused declarations, untyped variables, missing version constraints, and deprecated syntax. | tflint --minimum-failure-severity=warning |
| Security scan | No public storage, no missing encryption, no firewall rules open to everyone. | checkov -d . --framework terraform |
Ansible and Argo CD
Ansible
| Check | What it catches | Command |
|---|---|---|
| Ansible lint | Steps that are not safe to run twice, retired module names, missing names on tasks. | ansible-lint |
| Syntax | Ansible can read the playbook and every module referenced exists. | ansible-playbook --syntax-check |
Argo CD
| Check | What it catches | Command |
|---|---|---|
| Kubernetes schema | Every manifest matches the schema for the kind it claims to be. | kubeconform -strict -summary |
| Builds | The folder produces valid output before Argo CD ever sees it. | kustomize build |
Three that need nothing installed
These run in seconds without Terraform, Ansible, or a cluster, so they work as a pre-commit hook or in a locked-down environment.
| Check | What it catches | Command |
|---|---|---|
| parse | Every file parses. Runs without Terraform installed. | python tools/parsecheck.py outcomes |
| refcheck | Every setting used is declared, every setting declared is used, and quick-start templates stay one file. | python tools/refcheck.py outcomes |
| registrycheck | The site and the repo agree, and every template with code carries its explanation: what you need, what it creates, what catches people, and how to undo it. | python tools/registrycheck.py registry/templates.yml |
How a template earns its label
Ready means every check for its tool passed on the main branch. The label is changed by hand after someone reads the green run, so it cannot flip on its own by accident.
Draft means the code exists and at least one check has not run or has not passed. Planned means there is no code yet.
The registry check also refuses a template that has code and no explanation. A page here always tells you what you need first, what gets created, what catches people, and how to undo it.
What the checks cannot tell you
They show the code is well formed, uses settings that exist, and creates nothing obviously unsafe. They say nothing about your account, your permissions, or your policies. The check at the end of each template page is there for that.