Edit

Share via


Use Bicep linter

The Bicep linter checks Bicep files for syntax errors and best practice violations. The linter helps enforce coding standards by providing guidance during development. You can customize the best practices to use for checking the file.

Linter requirements

The linter is integrated into the Bicep CLI and the Bicep extension for Visual Studio Code. To use it, you must have Bicep CLI version 0.4 or later.

Default rules

The default set of linter rules is minimal and taken from arm-ttk test cases. The extension and Bicep CLI check the following rules, which are set to the warning level.

Linter rule Default level
adminusername-should-not-be-literal warning
artifacts-parameters warning
decompiler-cleanup warning
explicit-values-for-loc-params off
max-asserts error
max-outputs error
max-params error
max-resources error
max-variables error
nested-deployment-template-scoping error
no-conflicting-metadata warning
no-deployments-resources warning
no-hardcoded-env-urls warning
no-hardcoded-___location off
no-loc-expr-outside-params off
no-unnecessary-dependson warning
no-unused-existing-resources warning
no-unused-imports warning
no-unused-params warning
no-unused-vars warning
outputs-should-not-contain-secrets warning
prefer-interpolation warning
prefer-unquoted-property-names warning
protect-commandtoexecute-secrets warning
secure-parameter-default warning
secure-params-in-nested-deploy warning
secure-secrets-in-params warning
simplify-interpolation warning
simplify-json-null warning
use-parent-property warning
use-recent-api-versions off
use-recent-module-versions off
use-resource-id-functions off
use-resource-symbol-reference warning
use-safe-access warning
use-secure-value-for-secure-inputs warning
use-stable-resource-identifiers warning
use-stable-vm-image warning
what-if-short-circuiting off

You can enable or disable all linter rules and control how they are applied using a configuration file. To override the default behavior, create a bicepconfig.json file with your custom settings. For more information about applying those settings, see Add custom settings in the Bicep config file.

Use in Visual Studio Code

The following screenshot shows the linter in Visual Studio Code:

Bicep linter usage in Visual Studio Code.

In the PROBLEMS pane, there are four errors, one warning, and one info message shown in the screenshot. The info message shows the Bicep configuration file that is used. It only shows this piece of information when you set verbose to true in the configuration file.

Hover your mouse cursor to one of the problem areas. Linter gives the details about the error or warning. Select the area, it also shows a blue light bulb:

Bicep linter usage in Visual Studio Code - show quickfix.

Select either the light bulb or the Quick fix link to see the solution:

Bicep linter usage in Visual Studio Code - show quickfix solution.

Select the solution to fix the issue automatically.

Use in Bicep CLI

The following screenshot shows the linter in the command line. The output from the lint command and the build command shows any rule violations.

Bicep linter usage in command line.

You can integrate these checks as a part of your CI/CD pipelines. You can use a GitHub action to attempt a bicep build. Errors will fail the pipelines.

Silencing false positives

Sometimes a rule can have false positives. For example, you might need to include a link to a blob storage directly without using the environment() function. In this case you can disable the warning for one line only, not the entire document, by adding #disable-next-line <rule name> before the line with the warning.

#disable-next-line no-hardcoded-env-urls //Direct download link to my toolset
scriptDownloadUrl: 'https://mytools.blob.core.windows.net/...'

It's good practice to add a comment explaining why the rule doesn't apply to this line.

If you want to suppress a linter rule, you can change the level of the rule to Off in bicepconfig.json. For example, in the following example, the no-deployments-resources rule is suppressed:

{
  "analyzers": {
    "core": {
      "rules": {
        "no-deployments-resources": {
          "level": "off"
        }
      }
    }
  }
}

Next steps