A team wants merge requests to be blocked automatically when any .tf file anywhere in the repository, including module subdirectories, is not in canonical HCL format. The check must not modify files in the job. Which command should the pipeline run?
Select an answer to reveal the explanation.
Short Explanation
Think of -check as a spell-checker that underlines but never corrects. It tells the pipeline 'something's off' with a non-zero exit, and -recursive makes sure it reads every folder, not just the top one. Leave off -check and fmt quietly fixes the files, and your gate never fails.
Full Explanation
terraform fmt rewrites configuration files into canonical style. With -check, it does not write anything; it exits with status 0 when every file is already formatted and with a non-zero status otherwise, listing the offending file names, which is exactly what a pipeline gate needs. By default fmt processes only the current directory, so -recursive is required to include module subdirectories. Plain fmt -recursive rewrites the files in the job workspace and reports success, so the merge request passes while the committed code stays unformatted. terraform validate checks syntax, references and types against provider schemas; it does not evaluate formatting at all. The -diff option displays the changes fmt would make, but without -check or -write=false fmt still writes the files, and it does not turn formatting problems into a failing exit code by itself. Exam caveat: fmt -check can be combined with -diff so the job log shows what needs changing while still failing the gate. Operational check: commit a deliberately misindented file in a module subdirectory to a test branch and confirm the pipeline job fails and names that file.