33521 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Martin Atkins	ac651e861c	streamapi: Initial wasip1 stub ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-05-19 18:15:28 -07:00
Christian Mesh	d59ad2fb1c	More functionality ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-05-01 09:20:11 -04:00
Christian Mesh	0abfd52e3e	Terrible hacks to get some sort of wasm working ... cp "$(go env GOROOT)/lib/wasm/wasm_exec.js" . GOOS=js GOARCH=wasm go build -ldflags="-X 'main.experimentsAllowed=yes'" -o main.wasm ./cmd/tofu/ Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-30 14:57:01 -04:00
Christian Mesh	9e746cc2d1	Fix panic in validate from replace_triggered_by (#4069) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-29 09:05:32 -04:00
Babur Ayanlar	5ddfb11cbc	tofu plan: mention that empty plan might be caused by incorrect -target ... Signed-off-by: Babur Ayanlar <babur.ayanlar@ableton.com>	2026-04-28 11:40:20 -07:00
Martin Atkins	c2e619ebb9	resources: Unit tests for ManagedResourceType.PlanChanges ... While working through the "walking skeleton" phase of developing the new runtime we intentionally kept the test coverage pretty light so that it'd be easier to make substantial changes to the design if we learned new information as we went along. Since we're now switching to a more incremental mode of development, it'll be helpful to have a little more test coverage. This is a retroactive addition of a unit test suite for the function that encapsulates the interactions with providers for planning changes to managed resource instances, since (FIXMEs and TODOs notwithstanding) this seems pretty unlikely to be refactored significantly in the near future. This establishes a very simple fake provider client implementation that's convenient to use in the tests here. Along with just being much simpler than the one in "package tofu" (no call tracking, etc), including this here also avoids the need for "package resources" to depend on "package tofu", which would therefore make it impossible for the old runtime to call into here. As we add new code to support other resource-related provider operations later the additional tests can hopefully share this fake provider client implementation. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-28 11:03:35 -07:00
Christian Mesh	2cfaa36598	Deprecation diagnostics internal rework (#3996) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-28 07:44:49 -04:00
Martin Atkins	450bd7ca88	CHANGELOG: Entry for opentofu/opentofu#4056 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-27 09:47:58 -07:00
Martin Atkins	787cf165db	go.mod: go get github.com/apparentlymart/go-cidr@v1.1.1 ... This includes an upstream fix for a panic inside HostBig which was observable through OpenTofu's "cidrhost" built-in function. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-27 09:47:58 -07:00
Larry Bordowitz	878e628861	add changelog bugfix ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Larry Bordowitz	f09556ee76	remove magic strings, add dev notes ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Larry Bordowitz	561012e4a9	azurerm: respect audience in request URL ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-27 10:49:54 -05:00
Andrei Ciobanu	0af2e8d521	UIInput must return when the first SIGINT/SIGTERM signal is received (#4051) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-27 17:03:57 +03:00
DongJun Lee	c6f06f8f6d	fix: prevent panic in tofu login OAuth flow due to channel race (#4016) ... Signed-off-by: dongjune8931 <ldj990517@gmail.com>	2026-04-25 10:00:52 -07:00
Martin Atkins	0b5321e870	CHANGELOG: Entry for opentofu/opentofu#4042 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
Martin Atkins	e4af2b454c	lang/funcs: cidrsubnet now allows newbits up to 128 for IPv6 ... The original design for this function seems to have mistakenly thought that the upstream library used to implement the calculations could not accept newbits>32, perhaps due to that having been true for some of its other functions in an earlier release. However, this restriction is not needed in the current version of the upstream library: it performs its calculations on a byte-by-byte basis treating the IP address as a byte-slice, rather than using the Go "int" type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-21 09:29:38 -07:00
krishna sindhur	5b5a0972d0	Failed to load backend configuration (#3961) ... Signed-off-by: krishna sindhur <krishna.sindhur@harness.io>	2026-04-20 11:04:28 +03:00
DongJun Lee	b5161494b1	fix: replace panic with error diagnostics for invalid TF_STATE_PERSIST_INTERVAL (#4034) ... Signed-off-by: dongjune8931 <ldj990517@gmail.com>	2026-04-20 10:19:03 +03:00
Martin Atkins	c240cb72e7	CHANGELOG: Entries for opentofu/opentofu#4043 ... This just echoes the two fixes from the upstream cty upgrade, since OpenTofu exposes these two functions directly in its own language. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
Martin Atkins	26185e988b	go.mod: go get github.com/zclconf/go-cty@v1.18.1 ... This includes minor fixes to two functions that OpenTofu exposes as part of its language: - "contains" now allows its second argument to be null to test whether a collection contains any null values. - "merge" no longer panics when its only argument is a null value of an object type, which is a somewhat-degenerate case because this function has a special case where it treats null values as having no attributes regardless of the actual object type. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-16 17:26:13 -07:00
ogormans-deptstack	6a09262c97	local-exec: propagate TRACEPARENT to child processes ... This allows child processes launched with local-exec to contribute to the same trace that OpenTofu started. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-15 13:40:31 -07:00
Diógenes Fernandes	2c7cd8546c	fix: showSensitive working for provisioners output (#3931) ... Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>	2026-04-15 09:39:53 -03:00
Martin Atkins	192b4c9d60	SECURITY.md: More minor copyediting ... In particular this corrects the error of "an library" instead of "a library", but I also made some other adjustments once I had an excuse to re-review my own earlier writing. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-14 09:41:10 -07:00
Christian Mesh	f4a7c80b0a	Clarify PG backend documentation examples ... Remove example of bad practices and focus on Env vars instead. Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-14 06:28:30 -04:00
Martin Atkins	ffb64bbd16	tools/find-pkg-importer: Tool to find what imports a Go package ... Advisories in the Go vulnerability database often identify specific Go packages or even specific symbols within Go packages that the advisory applies to. Therefore when we are evaluating the impact of an advisory on OpenTofu we often need to ask the question "what parts of OpenTofu are using that affected package?" This new tool is a small wrapper around the "go list" command which takes a package path of interest and returns all of the packages in OpenTofu's package import graph that directly import the given package. The results can include both OpenTofu's own packages and packages from upstream modules or the Go standard library. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 11:26:43 -07:00
Martin Atkins	b0339b83cf	SECURITY.md: Summary of our upstream advisory policy ... Our policy for handling advisories in upstream dependencies was previously documented only in the RFC where we adopted it, which is hard to find for anyone not already familiar with it. We'd like for SECURITY.md to be the one place someone needs to look when they want to learn about our security policy, so this introduces a short summary of the main consequences of the policy from that RFC and then links to the full RFC in case a reader would like to learn the reasons behind those decisions. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-13 10:33:45 -07:00
Christian Mesh	2e3fb16b8b	Add additional panic info and buffer panic message (#4026) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-13 12:11:34 -04:00
Martin Atkins	fb7fc49d8d	CHANGELOG: Entry for opentofu/opentofu#3826 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	82da43c81b	tofu: A better error message for WinRM support being removed ... The previous commit already removed WinRM support and made it return a relatively-terse error message, but during the v1.13 release series we'd like to use a more helpful error message that includes a link to Microsoft's documentation about enabling an OpenSSH server to use as an alternative. This commit is designed to be reverted during the v1.14 period so that we'll just fall back on the error message already implemented in "package communicator". This new message needs to be implemented outside of the communicator abstraction because that old API doesn't support returning diagnostics, but it's not worth the risk to refactor it just for an error message we're intending to remove in the next release series anyway. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	30db471ac0	provisioners: remove WinRM support ... The upstream libraries we use to implement this feature are in various states of unmaintained-ness where we've not been able to upgrade them beyond the old versions we're currently using without them no longer working well together. Therefore we previously made this connection type produce a deprecation warning in OpenTofu v1.12, and now we're making it produce an error instead and so we can remove all of our code that was calling in to those dependencies. Although this is a breaking change, we're justifying it under the "external dependencies" pragmatic exception in our compatibility promises: external software has changed in a way that makes it no longer viable to offer this feature. Modern Windows has built-in support for running an OpenSSH server, and so we expect that most folks who were previously relying on WinRM should be able to migrate to using SSH instead. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-09 13:22:27 -07:00
Martin Atkins	bea94265f3	views: TestStateViews non-hardcoded "terraform_version" ... The "terraform_version" property of the JSON state format (intentionally misnamed for backward-compatibility with our predecessor) changes each time we make a new release, so we'll compare it with the currently-expected version number instead of with a hard-coded value. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 14:53:40 -07:00
Martin Atkins	579930a306	CHANGELOG: Begin the v1.13 development period ... The "main" branch now represents v1.13 development, because v1.12 has diverged into its own maintenance branch. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-08 13:35:40 -07:00
ogormans-deptstack	fb45eceae5	provisioners: thread context.Context through ProvisionResource interface ... This is to give provisioners access to trace span metadata, which we'll make use of in later commits. Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com>	2026-04-08 08:13:51 -07:00
Christian Mesh	6abffb9d5c	Update contributing.release with most recent instructions (#4011) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 10:32:03 -04:00
Christian Mesh	826e5fcd88	Fix release action inputs.prerelease condition ... Warning: Conditional expression contains literal text outside replacement tokens. This will cause the expression to always evaluate to truthy. Did you mean to put the entire expression inside ${{ }}? That lead me to https://github.com/orgs/community/discussions/9343 and was validated by using https://rhysd.github.io/actionlint/ Signed-off-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-08 07:25:53 -04:00
Martin Atkins	23002a02ec	go.mod: Upgrade to Go 1.26.2 ... This is just a minor release fixing a number of bugs that don't seem to have affected OpenTofu, and so this is just a routine upgrade in preparation for the v1.12.0 release. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:16:32 -07:00
Martin Atkins	85e8e539d8	GitHub ACtions: use actions/setup-go v6.4.0 ... The version we were previously using has an incorrect hard-coded URL template for downloading Go versions that are not yet in the action's own manifest file, which means that it can't successfully install any Go version that hasn't been added to the manifest yet. This new version is updated to use an endpoint on https://go.dev/ that is set up to redirect to whatever the correct location is, which was recommended by a member of the Go team in actions/setup-go#665 and so is presumably intended to remain valid. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:15:03 -07:00
Larry Bordowitz	5c0cbf828d	remove powershell warning in docs ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00
Larry Bordowitz	a0354c6f10	remote-exec: fix Powershell - only quote args, not command ... Co-authored-by: Martin Atkins <mart@degeneration.co.uk> Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 13:46:47 -05:00
Larry Bordowitz	6d5c09ded2	go.mod: Upgrade azure dependencies ... Signed-off-by: Larry Bordowitz <laurence.bordowitz@gmail.com>	2026-04-07 14:14:33 -04:00
Martin Atkins	4cca9f1611	instances: Fix data race in GetDeepestExistingModuleInstance ... All of the exported querying methods of Expander are supposed to hold a read lock whenever they Expander.exps, but this particular method was missing those calls and so it could potentially race with calls that write new expansions into the data structure. This seems to be quite hard to hit in practice because it can only arise if you have an "orphan" resource instance whose node happens to execute concurrently with the expansion node for a module or resource, but the race detector can sometimes catch it when executing TestContext2Apply_providerModuleIteration/apply_orphan_destroy from "package tofu". Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-07 14:13:51 -04:00
Andrei Ciobanu	ce59943d99	Remove Ui from the Meta structure (#4000) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org> Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: Christian Mesh <christianmesh1@gmail.com>	2026-04-07 13:38:46 -04:00
Legin	032ec9e542	Add support for Customer Provided Keys and Customer managed keys in AzureRM backend (#3886) ... Signed-off-by: Legin-ML <leginml2004@gmail.com> Signed-off-by: Legin <140829993+Legin-ML@users.noreply.github.com>	2026-04-07 11:11:17 -05:00
Christian Mesh	505f87900a	Deprecated resource blocks attrs (#3973) ... Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org> Co-authored-by: Martin Atkins <mart@degeneration.co.uk> Co-authored-by: Andrei Ciobanu <andreic9203@gmail.com> Co-authored-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-07 10:30:43 -04:00
Andrei Ciobanu	030e34725c	Migrate cloud and remote backends to the views package (#3982) ... Signed-off-by: Andrei Ciobanu <andrei.ciobanu@opentofu.org>	2026-04-07 10:15:05 +03:00
ogormans-deptstack	c1b7229bbd	statemgr: pretty-print local backend state files for readable diffs (#3922) ... Signed-off-by: ogormans-deptstack <sean.ogorman@deptagency.com> Signed-off-by: Martin Atkins <mart@degeneration.co.uk> Co-authored-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-06 07:25:03 -04:00
Christian Mesh	8a7ba57fef	Missed port of: Added OTel docs (#2942) (#3989) ... Signed-off-by: James Humphries <james@james-humphries.co.uk> Signed-off-by: Christian Mesh <christianmesh1@gmail.com> Co-authored-by: James Humphries <James@james-humphries.co.uk>	2026-04-03 11:01:10 -04:00
Martin Atkins	90edf5447f	CHANGELOG: Entry for opentofu/opentofu#3986 ... Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 15:36:25 -07:00
Martin Atkins	b2cac2176a	go.mod: go get github.com/hashicorp/go-getter@v1.8.5 ... This is just a routine upgrade. The upstream changes are mainly just robustness improvements, although there is a notable fix in allowing "s3::http://..." addresses when the specified hostname is not an official AWS hostname, whereas before the S3 getter would just ignore the URL scheme and always use "https" behind the scenes. Signed-off-by: Martin Atkins <mart@degeneration.co.uk>	2026-04-02 15:36:25 -07:00
Diógenes Fernandes	893b41f65c	fix: validation for replace_triggered_by (#3967) ... Signed-off-by: Diogenes Fernandes <diofeher@gmail.com>	2026-04-02 18:40:39 -03:00