# Share a TFLint Report — Terraform Findings as a Link

Canonical: https://commareports.com/share-tflint-report
Published: 2026-09-15

> TFLint emits SARIF, JUnit and Checkstyle. Render one, publish it to Comma, and module findings reach the people who own the modules instead of scrolling past in CI.

# Share a TFLint report

A Terraform monorepo has a lot of owners. The person who wrote the module is
rarely the person running the pipeline, and the platform team that cares about
the aggregate — how many modules are still pinned to a deprecated provider
argument — has no view at all except by opening twenty CI logs.

## SARIF → HTML

```bash
tflint --init
tflint --recursive --format sarif > tflint.sarif || true

pip install sarif-tools
sarif html tflint.sarif --output tflint.html
```

`--recursive` is the flag that makes this a platform-level report instead of a
per-directory one. `|| true` keeps the job alive long enough to publish; keep
a separate unmuted `tflint` step as the gate.

## Or JUnit

```bash
tflint --recursive --format junit > tflint.xml || true
junit2html tflint.xml tflint.html
```

Same page, one less dependency if your image already converts JUnit for tests.

## Publish it

Drag `tflint.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html tflint.html \
        --arg title "TFLint — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

## The plugin rules are the point

`tflint --init` with the AWS ruleset in `.tflint.hcl` turns the tool from a
style checker into something that catches an invalid instance type before an
apply does. Those findings are worth a URL because they cross team lines:

- **Anchored threads** on a module's finding, addressed to the team that owns
  it. See [commenting on HTML](/comment-on-html).
- **A [routine](/features/routines/scheduled-html-reports)** re-running weekly
  across the whole repo, so provider deprecations surface before the upgrade
  that forces them.
- **Access per report** — infrastructure findings name your resources; keep
  the report team-scoped. See the [sharing model](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish an infrastructure report →](https://commareports.com/)**

### Related

- [Share a Terraform plan](/share-terraform-plan) · [Share a tfsec report](/share-tfsec-report)
- [Share a Terrascan report](/share-terrascan-report) · [Share a Checkov report](/share-checkov-report)
- [Share an Infracost report](/share-infracost-report) · [Publish from CI](/docs/ci)