Does TFLint write HTML?

No. `--format` accepts default, json, checkstyle, junit, compact and sarif. SARIF is the richest and renders well with `sarif-tools`; JUnit is fine if your image already has `junit2html`.

How is this different from a terraform plan?

A plan is what is about to change. TFLint is what is wrong with the code regardless of the plan — deprecated syntax, invalid instance types, missing required providers. They answer different questions and deserve separate reports.

Can I include the AWS/GCP/Azure rulesets?

Yes, and that is where most of the value is. Install the relevant plugin in `.tflint.hcl` and run `tflint --init` before the scan; provider rules catch invalid instance types and deprecated arguments before an apply does.

Should TFLint fail the pipeline?

Keep a separate unmuted `tflint` step as the gate and mute the reporting step with `|| true`, so warnings still publish.

Why publish it rather than annotate the pull request?

Do both. Annotations are for the author; a published report is for the platform team looking across twenty modules, which is the view no pull request gives you.

Share a TFLint report

A Terraform monorepo has a lot of owners. The person who wrote the module is rarely the person running the pipeline, and the platform team that cares about the aggregate — how many modules are still pinned to a deprecated provider argument — has no view at all except by opening twenty CI logs.

SARIF → HTML

tflint --init
tflint --recursive --format sarif > tflint.sarif || true

pip install sarif-tools
sarif html tflint.sarif --output tflint.html

--recursive is the flag that makes this a platform-level report instead of a per-directory one. || true keeps the job alive long enough to publish; keep a separate unmuted tflint step as the gate.

Or JUnit

tflint --recursive --format junit > tflint.xml || true
junit2html tflint.xml tflint.html

Same page, one less dependency if your image already converts JUnit for tests.

Publish it

Drag tflint.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html tflint.html \
        --arg title "TFLint — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

The plugin rules are the point

tflint --init with the AWS ruleset in .tflint.hcl turns the tool from a style checker into something that catches an invalid instance type before an apply does. Those findings are worth a URL because they cross team lines:

Anchored threads on a module's finding, addressed to the team that owns it. See commenting on HTML.
A routine re-running weekly across the whole repo, so provider deprecations surface before the upgrade that forces them.
Access per report — infrastructure findings name your resources; keep the report team-scoped. See the sharing model.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish an infrastructure report →