feat: add plugin caching (#347)

* feat: add plugin caching

Adds opt-in caching for TFLint plugins to eliminate manual cache setup.

- Add cache, tflint_config_path, plugin_dir inputs
- Implement cache restore/save with @actions/cache
- Add post action to save cache after workflow
- Support glob patterns for monorepo configs
- Cache key: tflint-plugins-{os}-{hash(configs)}
- Restore keys: tflint-plugins-{os}- prefix
- Add integration test for cache functionality

* trigger actions run

* chore: remove leftover dist files

* test: remove placeholder cache tests

* feat: support TFLINT_PLUGIN_DIR env var

Author: bendrucker

.github/workflows/fixtures/.tflint.hcl

@@ -0,0 +1,5 @@
+plugin "terraform" {
+    enabled = true
+    version = "0.13.0"
+    source  = "github.com/terraform-linters/tflint-ruleset-terraform"
+}

.github/workflows/test.yml

@@ -165,3 +165,22 @@ jobs:
           else
             echo "TFLint Exit Code captured."
           fi
+
+  integration-cache:
+    name: 'Integration test: cache'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Use Action
+        uses: ./
+        with:
+          cache: true
+          tflint_config_path: .github/workflows/fixtures/.tflint.hcl
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Init TFLint
+        run: tflint --init --config .github/workflows/fixtures/.tflint.hcl
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify plugin installed
+        run: test -d ~/.tflint.d/plugins

README.md

@@ -37,6 +37,26 @@ Installs a wrapper script to wrap subsequent calls to `tflint` and expose `stdou
 
 Default: `"false"`
 
+### `cache`
+
+Enable caching of TFLint plugins. When enabled, the action will cache the plugin directory and restore it on subsequent runs based on the hash of your TFLint configuration file(s).
+
+Default: `"false"`
+
+### `tflint_config_path`
+
+Glob pattern for TFLint configuration file(s) used to generate the cache key. All matching files will be hashed together to determine cache validity. Supports glob patterns for monorepo setups.
+
+Default: `".tflint.hcl"`
+
+### `plugin_dir`
+
+Directory where TFLint plugins are installed. See [TFLint plugin configuration](https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/config.md#plugin-directory) for details.
+
+Can also be set via `TFLINT_PLUGIN_DIR` environment variable.
+
+Default: `"~/.tflint.d/plugins"`
+
 ## Outputs
 
 The following outputs are available when the `tflint_wrapper` input is enabled:
@@ -66,16 +86,12 @@ jobs:
     - uses: actions/checkout@v4
       name: Checkout source code
 
-    - uses: actions/cache@v4
-      name: Cache plugin dir
-      with:
-        path: ~/.tflint.d/plugins
-        key: ${{ matrix.os }}-tflint-${{ hashFiles('.tflint.hcl') }}
-
     - uses: terraform-linters/setup-tflint@v6
       name: Setup TFLint
       with:
         tflint_version: v0.52.0
+        cache: true
+
     - name: Show version
       run: tflint --version
 
@@ -133,6 +149,35 @@ or specify it explicitly as
   run: echo ${{ steps.tflint.outputs.stdout }}
 ```
 
+### Plugin Caching
+
+```yaml
+- uses: terraform-linters/setup-tflint@v6
+  with:
+    cache: true
+
+- run: tflint --init
+  env:
+    GITHUB_TOKEN: ${{ github.token }}
+
+- run: tflint -f compact
+```
+
+For monorepos with multiple TFLint configurations:
+
+```yaml
+- uses: terraform-linters/setup-tflint@v6
+  with:
+    cache: true
+    tflint_config_path: '**/.tflint.hcl'
+
+- run: tflint --init
+  env:
+    GITHUB_TOKEN: ${{ github.token }}
+
+- run: tflint -f compact
+```
+
 ### Checks
 
 This action supports [Problem Matchers](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) for `--format compact`. You can see annotations in pull requests when TFLint prints issues with the `compact` format.

action.yml

@@ -16,6 +16,18 @@ inputs:
   checksums:
     description: Newline-delimited list of valid checksums (SHA256 hashes) for the downloaded TFLint binary. When set, the action will verify that the binary matches one of these checksums before proceeding.
     required: false
+  cache:
+    description: Enable caching of TFLint plugins
+    default: 'false'
+    required: false
+  tflint_config_path:
+    description: Glob pattern for TFLint config files used to generate cache key
+    default: '.tflint.hcl'
+    required: false
+  plugin_dir:
+    description: Directory where TFLint plugins are installed. Can also be set via TFLINT_PLUGIN_DIR environment variable.
+    default: '~/.tflint.d/plugins'
+    required: false
 outputs:
   stdout:
     description: The output (stdout) produced by the tflint command. Only available if `tflint_wrapper` is set to `true`.
@@ -26,6 +38,8 @@ outputs:
 runs:
   using: 'node24'
   main: 'dist/index.js'
+  post: 'dist/post/index.js'
+  post-if: success()
 branding:
   icon: 'terminal'
   color: 'purple'