33508 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Martin Atkins	d356958bb2	rfc: Behavior Differences in the New OpenTofu Runtime ... This document is an overview of the main behavior differences we're considering accepting for the new runtime in the interests of allowing more flexibility for authors, but at the expense of potentially interpreting situations with ambiguous intent in a different way. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-22 14:25:55 -07:00
Martin Atkins	0b5321e870	CHANGELOG: Entry for opentofu/opentofu#4042 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
Martin Atkins	e4af2b454c	lang/funcs: cidrsubnet now allows newbits up to 128 for IPv6 ... The original design for this function seems to have mistakenly thought that the upstream library used to implement the calculations could not accept newbits>32, perhaps due to that having been true for some of its other functions in an earlier release. However, this restriction is not needed in the current version of the upstream library: it performs its calculations on a byte-by-byte basis treating the IP address as a byte-slice, rather than using the Go "int" type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
krishna sindhur	5b5a0972d0	Failed to load backend configuration (#3961) ... Signed-off-by: krishna sindhur <krishna.sindhur@harness.io>	2026-04-20 11:04:28 +03:00
DongJun Lee	b5161494b1	fix: replace panic with error diagnostics for invalid TF_STATE_PERSIST_INTERVAL (#4034) ... Signed-off-by: dongjune8931 <ldj990517@gmail.com>	2026-04-20 10:19:03 +03:00
Martin Atkins	c240cb72e7	CHANGELOG: Entries for opentofu/opentofu#4043 ... This just echoes the two fixes from the upstream cty upgrade, since OpenTofu exposes these two functions directly in its own language. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
Martin Atkins	26185e988b	go.mod: go get github.com/zclconf/go-cty@v1.18.1 ... This includes minor fixes to two functions that OpenTofu exposes as part of its language: - "contains" now allows its second argument to be null to test whether a collection contains any null values. - "merge" no longer panics when its only argument is a null value of an object type, which is a somewhat-degenerate case because this function has a special case where it treats null values as having no attributes regardless of the actual object type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
ogormans-deptstack	6a09262c97	local-exec: propagate TRACEPARENT to child processes ... This allows child processes launched with local-exec to contribute to the same trace that OpenTofu started. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-15 13:40:31 -07:00
Diógenes Fernandes	2c7cd8546c	fix: showSensitive working for provisioners output (#3931) ... Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>	2026-04-15 09:39:53 -03:00
Martin Atkins	192b4c9d60	SECURITY.md: More minor copyediting ... In particular this corrects the error of "an library" instead of "a library", but I also made some other adjustments once I had an excuse to re-review my own earlier writing. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-14 09:41:10 -07:00
Christian Mesh	f4a7c80b0a	Clarify PG backend documentation examples ... Remove example of bad practices and focus on Env vars instead. Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-14 06:28:30 -04:00
Martin Atkins	ffb64bbd16	tools/find-pkg-importer: Tool to find what imports a Go package ... Advisories in the Go vulnerability database often identify specific Go packages or even specific symbols within Go packages that the advisory applies to. Therefore when we are evaluating the impact of an advisory on OpenTofu we often need to ask the question "what parts of OpenTofu are using that affected package?" This new tool is a small wrapper around the "go list" command which takes a package path of interest and returns all of the packages in OpenTofu's package import graph that directly import the given package. The results can include both OpenTofu's own packages and packages from upstream modules or the Go standard library. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 11:26:43 -07:00
Martin Atkins	b0339b83cf	SECURITY.md: Summary of our upstream advisory policy ... Our policy for handling advisories in upstream dependencies was previously documented only in the RFC where we adopted it, which is hard to find for anyone not already familiar with it. We'd like for SECURITY.md to be the one place someone needs to look when they want to learn about our security policy, so this introduces a short summary of the main consequences of the policy from that RFC and then links to the full RFC in case a reader would like to learn the reasons behind those decisions. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 10:33:45 -07:00
Christian Mesh	2e3fb16b8b	Add additional panic info and buffer panic message (#4026) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-13 12:11:34 -04:00
Martin Atkins	fb7fc49d8d	CHANGELOG: Entry for opentofu/opentofu#3826 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	82da43c81b	tofu: A better error message for WinRM support being removed ... The previous commit already removed WinRM support and made it return a relatively-terse error message, but during the v1.13 release series we'd like to use a more helpful error message that includes a link to Microsoft's documentation about enabling an OpenSSH server to use as an alternative. This commit is designed to be reverted during the v1.14 period so that we'll just fall back on the error message already implemented in "package communicator". This new message needs to be implemented outside of the communicator abstraction because that old API doesn't support returning diagnostics, but it's not worth the risk to refactor it just for an error message we're intending to remove in the next release series anyway. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	30db471ac0	provisioners: remove WinRM support ... The upstream libraries we use to implement this feature are in various states of unmaintained-ness where we've not been able to upgrade them beyond the old versions we're currently using without them no longer working well together. Therefore we previously made this connection type produce a deprecation warning in OpenTofu v1.12, and now we're making it produce an error instead and so we can remove all of our code that was calling in to those dependencies. Although this is a breaking change, we're justifying it under the "external dependencies" pragmatic exception in our compatibility promises: external software has changed in a way that makes it no longer viable to offer this feature. Modern Windows has built-in support for running an OpenSSH server, and so we expect that most folks who were previously relying on WinRM should be able to migrate to using SSH instead. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	bea94265f3	views: TestStateViews non-hardcoded "terraform_version" ... The "terraform_version" property of the JSON state format (intentionally misnamed for backward-compatibility with our predecessor) changes each time we make a new release, so we'll compare it with the currently-expected version number instead of with a hard-coded value. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 14:53:40 -07:00
Martin Atkins	579930a306	CHANGELOG: Begin the v1.13 development period ... The "main" branch now represents v1.13 development, because v1.12 has diverged into its own maintenance branch. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 13:35:40 -07:00
ogormans-deptstack	fb45eceae5	provisioners: thread context.Context through ProvisionResource interface ... This is to give provisioners access to trace span metadata, which we'll make use of in later commits. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-08 08:13:51 -07:00
Christian Mesh	6abffb9d5c	Update contributing.release with most recent instructions (#4011) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 10:32:03 -04:00
Christian Mesh	826e5fcd88	Fix release action inputs.prerelease condition ... Warning: Conditional expression contains literal text outside replacement tokens. This will cause the expression to always evaluate to truthy. Did you mean to put the entire expression inside ${{ }}? That lead me to https://github.com/orgs/community/discussions/9343 and was validated by using https://rhysd.github.io/actionlint/ Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 07:25:53 -04:00
Martin Atkins	23002a02ec	go.mod: Upgrade to Go 1.26.2 ... This is just a minor release fixing a number of bugs that don't seem to have affected OpenTofu, and so this is just a routine upgrade in preparation for the v1.12.0 release. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:16:32 -07:00
Martin Atkins	85e8e539d8	GitHub ACtions: use actions/setup-go v6.4.0 ... The version we were previously using has an incorrect hard-coded URL template for downloading Go versions that are not yet in the action's own manifest file, which means that it can't successfully install any Go version that hasn't been added to the manifest yet. This new version is updated to use an endpoint on https://go.dev/ that is set up to redirect to whatever the correct location is, which was recommended by a member of the Go team in actions/setup-go#665 and so is presumably intended to remain valid. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:15:03 -07:00
Larry Bordowitz	5c0cbf828d	remove powershell warning in docs ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00
Larry Bordowitz	a0354c6f10	remote-exec: fix Powershell - only quote args, not command ... Co-authored-by: Martin Atkins <mart@degeneration.co.uk> Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00
Larry Bordowitz	6d5c09ded2	go.mod: Upgrade azure dependencies ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 14:14:33 -04:00
Martin Atkins	4cca9f1611	instances: Fix data race in GetDeepestExistingModuleInstance ... All of the exported querying methods of Expander are supposed to hold a read lock whenever they Expander.exps, but this particular method was missing those calls and so it could potentially race with calls that write new expansions into the data structure. This seems to be quite hard to hit in practice because it can only arise if you have an "orphan" resource instance whose node happens to execute concurrently with the expansion node for a module or resource, but the race detector can sometimes catch it when executing TestContext2Apply_providerModuleIteration/apply_orphan_destroy from "package tofu". Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:13:51 -04:00
Andrei Ciobanu	ce59943d99	Remove Ui from the Meta structure (#4000) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org> Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-07 13:38:46 -04:00
Legin	032ec9e542	Add support for Customer Provided Keys and Customer managed keys in AzureRM backend (#3886) ... Signed-off-by: Legin-ML <leginml2004@gmail.com> Signed-off-by: Legin <140829993+Legin-ML@users.noreply.github.com>	2026-04-07 11:11:17 -05:00
Christian Mesh	505f87900a	Deprecated resource blocks attrs (#3973) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org> Co-authored-by: Martin Atkins <mart@degeneration.co.uk> Co-authored-by: Andrei Ciobanu <andreic9203@gmail.com> Co-authored-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-07 10:30:43 -04:00
Andrei Ciobanu	030e34725c	Migrate cloud and remote backends to the views package (#3982) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-07 10:15:05 +03:00
ogormans-deptstack	c1b7229bbd	statemgr: pretty-print local backend state files for readable diffs (#3922) ... Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com> Signed-off-by: Martin Atkins <mart@degeneration.co.uk> Co-authored-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-06 07:25:03 -04:00
Christian Mesh	8a7ba57fef	Missed port of: Added OTel docs (#2942) (#3989) ... Signed-off-by: James Humphries <james@james-humphries.co.uk> Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: James Humphries <James@james-humphries.co.uk>	2026-04-03 11:01:10 -04:00
Martin Atkins	90edf5447f	CHANGELOG: Entry for opentofu/opentofu#3986 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 15:36:25 -07:00
Martin Atkins	b2cac2176a	go.mod: go get github.com/hashicorp/go-getter@v1.8.5 ... This is just a routine upgrade. The upstream changes are mainly just robustness improvements, although there is a notable fix in allowing "s3::http://..." addresses when the specified hostname is not an official AWS hostname, whereas before the S3 getter would just ignore the URL scheme and always use "https" behind the scenes. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 15:36:25 -07:00
Diógenes Fernandes	893b41f65c	fix: validation for replace_triggered_by (#3967) ... Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>	2026-04-02 18:40:39 -03:00
Christian Mesh	ff2957f08e	go.mod: Bump google deps (#3984) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Signed-off-by: Martin Atkins <mart@degeneration.co.uk> Co-authored-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 14:40:43 -04:00
Andrei Ciobanu	7cd55e4b9a	go.mod: go get github.com/hashicorp/go-tfe@v1.101.0 (#3977) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-02 08:47:13 -04:00
Christian Mesh	55ef1669b2	Support const variables in static eval (#3946) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 07:39:54 -04:00
Christian Mesh	1fb9cb43ba	Add warning when provider symlinks fail (#3974) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 07:36:10 -04:00
James Humphries	c874a1c8fd	Fix flaky TestJsonIntoStream by not comparing elapsed durations between runs ... Signed-off-by: James Humphries <james@james-humphries.co.uk>	2026-04-02 07:11:07 -04:00
James Humphries	f81a5fca52	Improve resource identity rendering in plan output and import hooks (#3883) ... Signed-off-by: James Humphries <james@james-humphries.co.uk>	2026-04-02 12:08:04 +01:00
Andrei Ciobanu	04f0688500	Fix internal/cloud tests that were missed from being updated when the changes that broke these were added (#3975) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-02 07:52:03 +03:00
Martin Atkins	ef4a93bb72	states: Improve confusing comment for DeepCopy of local values ... The comment here was trying to say that we don't need to _deep-copy_ cty.Value values, but it wasn't clear about that and so it seemed weird to have a comment saying that copying isn't needed right before a call to a function called "Copy". This updates the comment to be more explicit, and also takes the opportunity to simplify to use maps.Clone instead of maps.Copy, since we have no need for the intermediate empty map we were previously creating prior to the Copy call. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-01 11:48:31 -07:00
Martin Atkins	a803f4cc2f	states: go fix various files that changed recently ... We already changed these files considerably in opentofu/opentofu#3671, so we'll take this opportunity to modernize the rest of the code while the likelihood of successful clean backporting from this file is pretty low anyway. In the case of instance_object_src_test.go some additional editing was required because uint64Ptr becomes unused when we adopt the built-in "new" function, which would cause this file to fail the dead code lint. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-01 11:48:31 -07:00
Christian Mesh	4ccf87ebee	Update plugin protos to 5.10 and 6.10 ... This is from the MPL2.0 licensed source Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-01 11:43:57 -04:00
James Humphries	c88018bac0	Add resource identity schemas to tofu provider schemas output (#3898) ... Signed-off-by: James Humphries <james@james-humphries.co.uk>	2026-04-01 15:50:12 +01:00
Andrei Ciobanu	498a572242	Always return null value for write-only attributes from the mock provider for 'tofu test' (#3965) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-01 16:01:33 +03:00
Martin Atkins	45e203998b	plugin+plugin6: go fix grpc_provider.go and its tests ... We already changed these files considerably in opentofu/opentofu#3671, so we'll take this opportunity to modernize the rest of the code while the likelihood of successful clean backporting from this file is pretty low anyway. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-01 06:36:02 -04:00