feat: Add JSON config validation and SDK compatibility shim

This commit enhances JSON configuration support with filename validation,
SDK compatibility handling, and comprehensive integration tests.

## JSON Config Filename Validation

JSON configuration files must now end with "tflint.json" to avoid
confusion with other JSON files like terraform.tfvars.json.

Valid names:
- .tflint.json
- my-tflint.json
- project.tflint.json

Invalid names:
- config.json
- test.json
- terraform.tfvars.json

## SDK Compatibility Shim

Added a compatibility shim for plugins using SDK version < 0.23.0 that
cannot parse JSON config files with the .json extension. The shim:
- Detects plugin SDK versions during initialization
- Re-parses JSON configs with .tf.json extension for older SDKs
- Warns users about compatibility issues
- Ensures all plugin rules work correctly

## Implementation Details

- Added validation in config.go to check JSON filename suffixes
- Implemented ReparseForCompatibility() method for config re-parsing
- Modified launchPlugins() to detect SDK versions and apply shim
- Updated all config tests to use valid JSON filenames
- Added comprehensive integration test for JSON config with plugins
- Applied gofmt formatting across affected files

The compatibility shim is applied transparently when needed, with
appropriate warnings logged to inform users about the compatibility
mode being used.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: rorychatterton

cmd/inspect.go

@@ -113,7 +113,11 @@ func (cli *CLI) inspectModule(opts Options, dir string, filterFiles []string) (t
 	}
 
 	// Launch plugin processes
-	rulesetPlugin, err := launchPlugins(cli.config, opts.Fix)
+	// Note: launchPlugins may return an updated config if JSON files need renaming for SDK compatibility
+	rulesetPlugin, updatedConfig, sdkVersions, err := launchPlugins(cli.config, opts.Fix)
+	if updatedConfig != nil {
+		cli.config = updatedConfig // Update config with re-parsed version (JSON files may be renamed to .tf.json)
+	}
 	if rulesetPlugin != nil {
 		defer rulesetPlugin.Clean()
 		go cli.registerShutdownHandler(func() {
@@ -125,24 +129,6 @@ func (cli *CLI) inspectModule(opts Options, dir string, filterFiles []string) (t
 		return issues, changes, err
 	}
 
-	// Check preconditions
-	sdkVersions := map[string]*version.Version{}
-	for name, ruleset := range rulesetPlugin.RuleSets {
-		sdkVersion, err := ruleset.SDKVersion()
-		if err != nil {
-			if st, ok := status.FromError(err); ok && st.Code() == codes.Unimplemented {
-				// SDKVersion endpoint is available in tflint-plugin-sdk v0.14+.
-				return issues, changes, fmt.Errorf(`Plugin "%s" SDK version is incompatible. Compatible versions: %s`, name, plugin.SDKVersionConstraints)
-			} else {
-				return issues, changes, fmt.Errorf(`Failed to get plugin "%s" SDK version; %w`, name, err)
-			}
-		}
-		if !plugin.SDKVersionConstraints.Check(sdkVersion) {
-			return issues, changes, fmt.Errorf(`Plugin "%s" SDK version (%s) is incompatible. Compatible versions: %s`, name, sdkVersion, plugin.SDKVersionConstraints)
-		}
-		sdkVersions[name] = sdkVersion
-	}
-
 	// Run inspection
 	//
 	// Repeat an inspection until there are no more changes or the limit is reached,
@@ -254,11 +240,37 @@ func (cli *CLI) setupRunners(opts Options, dir string) (*tflint.Runner, []*tflin
 	return runner, moduleRunners, nil
 }
 
-func launchPlugins(config *tflint.Config, fix bool) (*plugin.Plugin, error) {
+func launchPlugins(config *tflint.Config, fix bool) (*plugin.Plugin, *tflint.Config, map[string]*version.Version, error) {
 	// Lookup plugins
 	rulesetPlugin, err := plugin.Discovery(config)
 	if err != nil {
-		return nil, fmt.Errorf("Failed to initialize plugins; %w", err)
+		return nil, nil, nil, fmt.Errorf("Failed to initialize plugins; %w", err)
+	}
+
+	// First, collect SDK versions from all plugins
+	sdkVersions := map[string]*version.Version{}
+	for name, ruleset := range rulesetPlugin.RuleSets {
+		sdkVersion, err := ruleset.SDKVersion()
+		if err != nil {
+			if st, ok := status.FromError(err); ok && st.Code() == codes.Unimplemented {
+				// SDKVersion endpoint is available in tflint-plugin-sdk v0.14+.
+				// Assume old version for compatibility checking
+				sdkVersions[name] = version.Must(version.NewVersion("0.13.0"))
+			} else {
+				return nil, nil, nil, fmt.Errorf(`Failed to get plugin "%s" SDK version; %w`, name, err)
+			}
+		}
+		// Check SDK version compatibility
+		if !plugin.SDKVersionConstraints.Check(sdkVersion) {
+			return nil, nil, nil, fmt.Errorf(`Plugin "%s" SDK version (%s) is incompatible. Compatible versions: %s`, name, sdkVersion, plugin.SDKVersionConstraints)
+		}
+		sdkVersions[name] = sdkVersion
+	}
+
+	// Apply compatibility shim if needed by re-parsing config
+	config, err = config.ReparseForCompatibility(sdkVersions)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("Failed to apply compatibility shim: %w", err)
 	}
 
 	rulesets := []tflint.RuleSet{}
@@ -271,44 +283,44 @@ func launchPlugins(config *tflint.Config, fix bool) (*plugin.Plugin, error) {
 		if err != nil {
 			if st, ok := status.FromError(err); ok && st.Code() == codes.Unimplemented {
 				// VersionConstraints endpoint is available in tflint-plugin-sdk v0.14+.
-				return rulesetPlugin, fmt.Errorf(`Plugin "%s" SDK version is incompatible. Compatible versions: %s`, name, plugin.SDKVersionConstraints)
+				return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Plugin "%s" SDK version is incompatible. Compatible versions: %s`, name, plugin.SDKVersionConstraints)
 			} else {
-				return rulesetPlugin, fmt.Errorf(`Failed to get TFLint version constraints to "%s" plugin; %w`, name, err)
+				return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Failed to get TFLint version constraints to "%s" plugin; %w`, name, err)
 			}
 		}
 		if !constraints.Check(tflint.Version) {
-			return rulesetPlugin, fmt.Errorf("Failed to satisfy version constraints; tflint-ruleset-%s requires %s, but TFLint version is %s", name, constraints, tflint.Version)
+			return rulesetPlugin, config, sdkVersions, fmt.Errorf("Failed to satisfy version constraints; tflint-ruleset-%s requires %s, but TFLint version is %s", name, constraints, tflint.Version)
 		}
 
 		if err := ruleset.ApplyGlobalConfig(pluginConf); err != nil {
-			return rulesetPlugin, fmt.Errorf(`Failed to apply global config to "%s" plugin; %w`, name, err)
+			return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Failed to apply global config to "%s" plugin; %w`, name, err)
 		}
 		configSchema, err := ruleset.ConfigSchema()
 		if err != nil {
-			return rulesetPlugin, fmt.Errorf(`Failed to fetch config schema from "%s" plugin; %w`, name, err)
+			return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Failed to fetch config schema from "%s" plugin; %w`, name, err)
 		}
 		content := &hclext.BodyContent{}
 		if plugin, exists := config.Plugins[name]; exists {
 			var diags hcl.Diagnostics
 			content, diags = plugin.Content(configSchema)
 			if diags.HasErrors() {
-				return rulesetPlugin, fmt.Errorf(`Failed to parse "%s" plugin config; %w`, name, diags)
+				return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Failed to parse "%s" plugin config; %w`, name, diags)
 			}
 		}
 		err = ruleset.ApplyConfig(content, config.Sources())
 		if err != nil {
-			return rulesetPlugin, fmt.Errorf(`Failed to apply config to "%s" plugin; %w`, name, err)
+			return rulesetPlugin, config, sdkVersions, fmt.Errorf(`Failed to apply config to "%s" plugin; %w`, name, err)
 		}
 
 		rulesets = append(rulesets, ruleset)
 	}
 
 	// Validate config for plugins
 	if err := config.ValidateRules(rulesets...); err != nil {
-		return rulesetPlugin, fmt.Errorf("Failed to check rule config; %w", err)
+		return rulesetPlugin, config, sdkVersions, fmt.Errorf("Failed to check rule config; %w", err)
 	}
 
-	return rulesetPlugin, nil
+	return rulesetPlugin, config, sdkVersions, nil
 }
 
 func writeChanges(changes map[string][]byte) error {

integrationtest/inspection/inspection_test.go

@@ -80,6 +80,11 @@ func TestIntegration(t *testing.T) {
 			Command: "./tflint --format json",
 			Dir:     "jsonsyntax",
 		},
+		{
+			Name:    "json config with complex plugin settings",
+			Command: "./tflint --format json",
+			Dir:     "json-config",
+		},
 		{
 			Name:    "path",
 			Command: "./tflint --format json",

integrationtest/inspection/json-config/.tflint.d/plugins/.gitkeep

@@ -0,0 +1,31 @@
+{
+  "config": {
+    "call_module_type": "local",
+    "force": false,
+    "disabled_by_default": false,
+    "ignore_module": {
+      "./ignore": true
+    }
+  },
+  "plugin": {
+    "terraform": {
+      "enabled": true,
+      "preset": "recommended"
+    }
+  },
+  "rule": {
+    "terraform_naming_convention": {
+      "enabled": true
+    },
+    "terraform_documented_outputs": {
+      "enabled": false
+    },
+    "terraform_module_pinned_source": {
+      "enabled": true,
+      "style": "flexible"
+    },
+    "terraform_standard_module_structure": {
+      "enabled": true
+    }
+  }
+}

integrationtest/inspection/json-config/.tflint.json

@@ -0,0 +1,2 @@
+# Example tfvars file referenced in .tflint.json
+test_var = "value1"

integrationtest/inspection/json-config/example1.tfvars

@@ -0,0 +1,2 @@
+# Example tfvars file referenced in .tflint.json
+test_var = "value2"

integrationtest/inspection/json-config/example2.tfvars

@@ -0,0 +1,9 @@
+# This module should be ignored by TFLint
+
+variable "ignored_input" {
+  type = string
+}
+
+output "ignored_output" {
+  value = var.ignored_input
+}

integrationtest/inspection/json-config/ignore/main.tf

@@ -0,0 +1,59 @@
+terraform {
+  required_version = ">= 1.0"
+}
+
+# This variable name should trigger terraform_naming_convention rule
+variable "TestVariable" {
+  type        = string
+  description = "A test variable with improper naming"
+}
+
+# This output lacks documentation (but rule is disabled in config)
+output "undocumented_output" {
+  value = "test"
+}
+
+# This output has documentation
+output "documented_output" {
+  description = "A properly documented output"
+  value       = var.TestVariable
+}
+
+# Module with pinned source - should pass with flexible style
+module "pinned_module" {
+  source = "terraform-aws-modules/vpc/aws"
+  version = "3.14.0"
+}
+
+# Module without pinned source - should fail
+module "unpinned_module" {
+  source = "./modules/local"
+}
+
+# Module that should be ignored
+module "ignored_module" {
+  source = "./ignore"
+}
+
+# Resource with proper naming
+resource "aws_instance" "example_instance" {
+  ami           = "ami-12345678"
+  instance_type = "t2.micro"
+}
+
+# Resource with improper naming (mixed case)
+resource "aws_s3_bucket" "TestBucket" {
+  bucket = "my-test-bucket"
+}
+
+# Data source with improper naming
+data "aws_ami" "LatestAmi" {
+  most_recent = true
+  owners      = ["amazon"]
+}
+
+# Local value with improper naming
+locals {
+  MixedCaseLocal = "value"
+  proper_local   = "another_value"
+}

integrationtest/inspection/json-config/main.tf

@@ -0,0 +1,9 @@
+# Local module for testing
+variable "input" {
+  type = string
+  default = "test"
+}
+
+output "output" {
+  value = var.input
+}

integrationtest/inspection/json-config/modules/local/main.tf

@@ -0,0 +1,12 @@
+# Standard module structure test file
+# This file should satisfy the terraform_standard_module_structure rule
+
+output "vpc_id" {
+  description = "The ID of the VPC"
+  value       = "vpc-12345678"
+}
+
+output "instance_id" {
+  description = "The ID of the EC2 instance"
+  value       = aws_instance.example_instance.id
+}