hashicorp/terraform-cdkNew scan
90/ 100 · A

A well-known project done right. Strong docs and solid engineering throughout.

Define infrastructure resources using programming constructs and provision them using HashiCorp Terraform

TypeScript5,077 starsMPL-2.0updated 6mo ago
DocumentationREADME, setup, examples, license
96
EngineeringTests, CI, linting, lockfiles
95
Project healthDescription, activity, stars, deps
65

What to fix first

The highest-impact improvements for this repo.

  1. 1
    CI/CD
    EngineeringInfo

    Add `tsc --noEmit`, `mypy`, or `cargo check` to catch type errors before they merge.

  2. 2
    CI/CD
    EngineeringInfo

    Upload coverage to Codecov, Coveralls, or report it with `--coverage` flags.

  3. 3
    Install and run instructions
    DocumentationInfo

    Add a .env.example listing all required environment variables so contributors know what to set up.

Detailed breakdown

Documentation

96
  • README100
    • README is present.
    • README is well structured with multiple sections.
    • README includes screenshots or visuals. Great for first impressions.
    • README has code examples.
    • README links to a live demo or deployed app.
    • README includes status badges.
  • Install and run instructions90
    • README documents how to install the project.
    • README documents how to run the project.
    • If your project uses environment variables, add a .env.example listing them (+10 pts).Add a .env.example listing all required environment variables so contributors know what to set up.
  • License100
    • Licensed under MPL-2.0.
  • Contributing guide95
    • Contributing guide is detailed and thorough.
    • Contributing guide includes setup/install instructions.
    • Contributing guide lacks a code style section (−8 pts).Describe your linting/formatting rules and how to run them (e.g. npm run lint, ruff check .).
    • Contributing guide explains how to run tests.
    • Contributing guide describes the PR/review workflow.
    • Contributing guide includes code examples.
    • Code of conduct present.

Engineering

95
  • Tests100
    • Test files detected (examples/go/google-cloudrun/main_test.go).
  • CI/CD100

    Not applicable?

    • CI is configured (.github/workflows/build.yml).
    • CI workflow runs tests.
    • CI runs on pull requests, not just on pushes to main.
    • CI workflow runs a lint or format check.
    • Optional: add type checking to CI.Add `tsc --noEmit`, `mypy`, or `cargo check` to catch type errors before they merge.
    • Optional: report test coverage in CI.Upload coverage to Codecov, Coveralls, or report it with `--coverage` flags.
    • CI caches dependencies for faster runs.
    • CI tests across multiple environments or versions.
    • CI includes a build step.
  • Linting and formatting75
    • Linter or formatter configured (.prettierrc.json).
    • Lint script wired into package.json.
  • Reproducibility92
    • Lockfile present (yarn.lock). Installs are reproducible.
    • Environment pinned via Dockerfile.
    • Consider using a multi-stage Dockerfile (builder + runtime stage) for smaller, more secure images.Use a multi-stage Dockerfile.
    • Dependabot configured for github-actions.
    • Dependabot only covers one ecosystem (+12 pts; covering 2+ earns +20 pts).Add additional package-ecosystem entries (especially github-actions) to keep all dependencies current.
  • Issue and PR templates90
    • Issue or PR templates present.
    • Optional: add a SECURITY.md.A SECURITY.md explains how to responsibly disclose vulnerabilities. Worth adding once the project has real users.

Project health

65
  • Dependency manifest65
    • Dependency manifest found (package.json).
    • package.json is missing a description (−10 pts).Add a one-line description to package.json. It appears in npm search and on GitHub.
    • package.json has no repository field (−10 pts).Add a `repository` field pointing to the GitHub URL so npm knows where the source lives.
    • package.json has no keywords (−8 pts).Add a `keywords` array to help people find your package on npm.
    • package.json has no homepage field (−7 pts).Add a `homepage` field pointing to your docs or project website.
  • Repository metadata70
    • Repository has a description.
    • Primary language detected: TypeScript.
  • Activity40
    • Last pushed 6–12 months ago.
    • 5,077 stars.
  • Housekeeping100
    • .gitignore present.
Repository files35 root entries
  • .github
    Good: Code of conduct present.
    Good: CI is configured (.github/workflows/build.yml).
    Good: Dependabot configured for github-actions.
    Good: Issue or PR templates present.
  • .husky
  • .vscode
  • cdk.tf
  • docs
  • examples
    Good: Test files detected (examples/go/google-cloudrun/main_test.go).
  • packages
  • test
  • tools
  • website
  • .copywrite.hcl
  • .devcontainer.json
  • .dockerignore
  • .gitattributes
  • .gitignore
    Good: .gitignore present.
  • .mise.toml
  • .npmignore
  • .prettierignore
  • .prettierrc.json
    Good: Linter or formatter configured (.prettierrc.json).
  • .terraform.versions.json
  • .versionrc.json
  • .yarnrc.yml
  • BUGPROCESS.md
  • CHANGELOG.md
    Good: Contributing guide is detailed and thorough.
    Good: Contributing guide includes setup/install instructions.
    Info: Contributing guide lacks a code style section (−8 pts).Fix: Describe your linting/formatting rules and how to run them (e.g. npm run lint, ruff check .).
    Good: Contributing guide explains how to run tests.
    Good: Contributing guide describes the PR/review workflow.
    Good: Contributing guide includes code examples.
  • CONTRIBUTING.md
  • Dockerfile
    Good: Environment pinned via Dockerfile.
  • eslint.config.mjs
  • go.work
  • go.work.sum
  • lerna.json
  • LICENSE
    Good: Licensed under MPL-2.0.
  • nx.json
  • package.json
    Good: Dependency manifest found (package.json).
  • README.md
    Good: README is present.
    Good: README is well structured with multiple sections.
    Good: README includes screenshots or visuals. Great for first impressions.
    Good: README has code examples.
    Good: README links to a live demo or deployed app.
    Good: README includes status badges.
    Good: README documents how to install the project.
    Good: README documents how to run the project.
  • yarn.lock
    Good: Lockfile present (yarn.lock). Installs are reproducible.