A team wants obvious configuration mistakes, such as invalid references, unformatted files and known insecure settings, caught on every pull request before any terraform plan runs or any cloud credentials are used. Which addition to the CI pipeline meets this goal?
Select an answer to reveal the explanation.
Short Explanation
Catch the cheap stuff cheaply. Formatting, validation and a static scanner run in seconds on the code alone, no credentials, no plan, so you're not waiting on a full run just to learn you misspelled a reference.
Full Explanation
Static checks operate on configuration files alone. terraform fmt -check returns a non-zero exit code when files are not in canonical format, terraform validate checks syntax and internal consistency such as references and argument types without accessing remote services or state, and a static analysis scanner inspects HCL for known insecure patterns. Together they give fast, credential-free feedback on every pull request and stop obvious errors before a plan is ever requested. Sentinel policies in HCP Terraform evaluate after the plan is produced, so they cannot act as a pre-plan gate, even when a policy inspects configuration data. A post-apply run task inspects resources that already exist, which is the latest and most expensive point to find a misconfiguration. Postcondition blocks are evaluated during plan or apply, after the provider has computed values, and they validate assumptions about results rather than performing static analysis of the code. Exam caveat: static checks complement, rather than replace, plan-time policy, because many risks such as replacements depend on state and planned values. Operational check: confirm the pipeline job runs without cloud credentials, that a deliberately broken reference fails validate, and that the job is a required status check on the protected branch.