terraform fmt in CI, so the diff is about intent

Infrastructure code accumulates whitespace disagreements faster than application code, because it is edited rarely and by different people each time.

$ terraform fmt -recursive -check -diff
main.tf
--- old/main.tf
+++ new/main.tf
@@ -12,7 +12,7 @@
-  instance_type = "t3.medium"
+  instance_type = "t3.medium"

$ echo $?
3        # non-zero, so CI fails

# and the pre-commit hook that means CI never sees it

-check makes it a gate rather than a rewrite, which is what belongs in a pipeline; the rewriting version belongs in a hook or an editor. The value is not tidiness — it is that a plan reviewed by somebody who does not work on this daily should show only the change, and an eleven-line diff where two lines are meaningful gets approved without being read. terraform validate in the same job costs nothing and catches a missing variable before the plan does.