4399 commits

Author	SHA1	Message	Date
Austin Valle	633e061092	adjust comments	2026-05-27 08:48:43 -04:00
Austin Valle	b611c84b6a	clean up comments and add destroy test	2026-05-27 08:40:14 -04:00
Austin Valle	90705879ca	refactor excludes logic out of targets transformer	2026-05-27 07:21:28 -04:00
Austin Valle	24a54b67c7	split the exclude logic into it's own codepath and adjust logic to actually exclude in the right direction :P	2026-05-26 18:04:00 -04:00
Austin Valle	3beaded932	add tests to show why basic inversing of targeting doesn't work	2026-05-22 18:32:31 -04:00
Austin Valle	7ab5ddba1b	implement a basic inverse of targeting	2026-05-22 18:32:13 -04:00
Austin Valle	8bdd1d1107	add exclude addresses to internal plan struct + planfile	2026-05-22 10:59:00 -04:00
Samsondeen	42fe4265f2	Add policy client and protocol plumbing (#38514)	2026-05-21 13:25:15 +02:00
Daniel Banck	5d289cc1a2	Improve --from-module test coverage ... Clean up and old todo and add a test for the simplified error message.	2026-05-20 19:40:29 +02:00
Sarah French	eb374193aa	fix: Remove unused returned diagnostics (#38617) ... Follow up to https://github.com/hashicorp/terraform/pull/38573, addressing feedback asking to remove the unused diagnostics. As discussed in that PR, the only way to use these returned diags would be to use a combination of named returns and defer functions editing those return values in order to capture those diagnostics. This is brittle and has questionable pay-off, so instead we remove these diags.	2026-05-20 16:13:20 +01:00
Sarah French	deed538ea8	chore: Remove unneeded init test (#38622) ... Follow up to https://github.com/hashicorp/terraform/pull/38391 That PR added tests showing that upgrading the provider used for PSS is blocked in init. There are no other upgrade-related user stories related to PSS in init, as upgrading the state storage provider will only be possible through a new `state migrate` command in future. Therefore these TODOs etc should be removed.	2026-05-20 16:09:56 +01:00
Sarah French	d75460af6d	fix: Prevent provider binary being placed outside of .terraform/providers cache unexpectedly due to use of symlinks. (#38611)	2026-05-20 11:50:10 +02:00
Sarah French	634db2dcc8	PSS: Add parsing of .tfmigrate.hcl files to define state migration operations (#38526) ... * feat: Parsing a configuration directory can include .tfmigrate.hcl files. These files include `state_store_provider` blocks and `from` blocks that contains either a single `backend` or `state_store` block. Validation will enforce that despite multiple .tfmigrate.hcl files being parsed you can only have one state_store_provider or from block, and nested backend/state_store blocks are mutually exclusive. Use of state_store_provider is only valid when state_store is in use, and the single provider described in both blocks must be in agreement. Also, a directory's .tfmigrate.hcl files cannot be empty once combined.	2026-05-19 09:31:27 +01:00
Sarah French	008c92d91f	fix: Append lost warnings in MaybeGetSchemas (#38605)	2026-05-18 16:35:56 +01:00
Sarah French	d174972029	test: Show warning when a -filter flag has an invalid value (#38603) ... * test: Show warning when a test file filter is not valid * Add change file	2026-05-15 20:36:26 +01:00
Sarah French	f6553bae93	fix: Stop discarding diagnostics in internal test providers (#38602)	2026-05-15 20:08:16 +01:00
Sarah French	be22624430	chore: Modernise some code in provisioners packages, add some code comments (#38588)	2026-05-15 14:00:43 +01:00
Kristin Laemmert	abbb650bae	refactor: remove readDiff (#38590) ... readDiff is no longer necessary now that we don't need a schema to read the change - all calls to readDiff were replaced with a single-line call to ctx.Changes, using the same inputs that readDiff used.	2026-05-14 14:25:24 -04:00
Kristin Laemmert	34935295e3	feat(import): support import blocks inside child modules (#38352) ... This PR adds support for import blocks inside child modules. Duplicate blocks will overwrite prior imports (I copied this behavior from the refactoring code, but we could instead return an error if multiple import blocks target the same abs config resource).	2026-05-14 14:17:24 -04:00
Sebastien Tardif	3c94ef65b3	Fix resource leaks in provisioners and commands (#38585) ... * Fix resource leaks in provisioners and commands Close file handles, HTTP response bodies, and pipe ends that were previously leaked on certain code paths: - workspace_new.go: Close state file opened via os.Open - file/resource_provisioner.go: Close temp file handle before returning the file path to caller - login.go: Move defer resp.Body.Close() before ioutil.ReadAll so the body is closed even when ReadAll fails - local-exec/resource_provisioner.go: Close the read end of os.Pipe after the copy goroutine completes --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>	2026-05-14 17:36:12 +01:00
Sarah French	820f37b35f	test: Proof of path traversals not being accepted workspaces (#38589)	2026-05-14 16:15:46 +01:00
Sarah French	c56ec2943d	refactor: Move validation of init's -upgrade and -lockfile=readonly flags to the arguments package. (#38561) ... The `-upgrade` and `-lockfile=readonly` flags are mutually exclusive, and this is now enforced by the arguments package. This refactor has also fixed a historical bug where that validation error was output twice. The getProvidersFromConfig code now depends on the flag validation happening in the calling code. However there is another check in downstream code, in `saveDependencyLockFile` when we overwrite the dependency lock file's contents. There, an error occurs if a diff in the locks is detected during `readonly` mode. This protects against incorrect use of `getProvidersFromConfig` with unvalidated inputs, if that happens in future.	2026-05-14 14:42:31 +01:00
Sarah French	2e5a89ab6f	Update command help text for state migrate command (#38571) ... Added details about the default behaviour for the lock-file CLI flags, and made it clearer that the upgrade flag only enables upgrading the provider used for state storage.	2026-05-14 13:31:48 +01:00
Sarah French	adcf9a9cb3	PSS: Make sure to close supplementary instances of a store that are intended to be used temporarily. (#38573) ... * feat : Add Close method to Pluggable struct, use method to close supplementary provider processes that are launched during init.	2026-05-14 08:24:11 -04:00
James Bardin	c29cb25f86	remove old resource phase addressing ... At one point there was an attempt to connect the destroy nodes in the apply graph by using special addressing and manipulating the references for resources. This doesn't work for a few reasons, but in particular, destroy nodes are entirely built from their state, they do not reference anything, and they cannot be referenced.	2026-05-13 14:12:38 -04:00
Daniel Banck	7ac3e2ec19	Return SafeInitActionNotRelevant on empty config	2026-05-13 08:17:40 +02:00
Daniel Banck	94a640a1a5	Add test case for variable value without config	2026-05-13 08:17:40 +02:00
Daniel Banck	74084a7705	Return early during provider installation if there is no config	2026-05-13 08:17:40 +02:00
Sarah French	7a960db553	PSS: Add interactive confirmation of state storage provider trust when initialising a state store for the first time (#38395) ... * refactor: Replace use of prepareInstallerEvents method. This will allow finer control of callbacks when implementing security related features * feat: Users are prompted to approve a provider used for PSS on first use, and only if downloaded via HTTP. Prompts include signer details and key ID data. * test: Users see "Authentication: unauthenticated" in prompt if network mirror doesn't include hashes They'll see authentication data in all other prompt scenarios. There's no auth when using an fs mirror, but when those are in use we trust the providers already and no prompts are raised. * refactor: Simplify how we prepare installation event callbacks by defining reused callbacks * refactor: Remove unused parameters from `getProvidersFromState`	2026-05-12 10:42:26 -04:00
Michael Yocca	a941456484	patch remote-state/cos go.sum	2026-05-12 09:13:26 +02:00
Michael Yocca	ee165f07f1	fix: go.mod syncdeps	2026-05-12 09:13:26 +02:00
Michael Yocca	ffa0a98da1	test: add test case for flag determining	2026-05-12 09:13:26 +02:00
Michael Yocca	5dd7e55d9b	feat: pass generate-config-out to go-tfe client request	2026-05-12 09:13:26 +02:00
Michael Yocca	fb6f6f1c40	fix: update tfe client mocks	2026-05-12 09:13:26 +02:00
Daniel Schmidt	2cd5cacacd	run make syncdeps	2026-05-11 15:27:42 +02:00
Daniel Schmidt	6e8052393c	update go version	2026-05-11 15:27:42 +02:00
Austin Valle	527402d3fe	stackmigrate: Fix recursive provider config resolution for resource instances in deeply nested modules (#38528) ... * stackmigrate: fix recursive provider config resolution for resource instances in deeply nested modules * added additional test for implict provider configs in deeply nested modules * add changelog * move changelog to 1.15	2026-05-07 08:35:03 -04:00
Radek Simko	badc70c93d	command/output: Ignore warnings in JSON mode (#38530) ... * command/output: Ignore warnings in JSON mode * add changelog entry	2026-05-06 10:26:40 +01:00
Daniel Schmidt	bdcac1b2e4	stacks: add output values to plan component instance change descriptions	2026-05-05 17:39:34 +02:00
Daniel Banck	f34ee96558	Remove outdated value source comment	2026-05-05 17:31:25 +02:00
Sarah French	6554bda227	refactor: Update workspace select and new subcommands to use the arguments package for parsing arguments and flags (#38430) ... * refactor: Move method `ValidWorkspaceName` and related const into arguments package, update references This function is primarily used to validate arguments, but it's used once (in (m *Meta) Workspace) in a different context, so I've left the original function signature in the command package. * feat: Add `workspace new`-related code to arguments package * refactor: Update `workspace new` to use the arguments package when parsing arguments Note that this changes the format of errors returned when arg parsing fails - this is now wrapped in a diagnostic so now starts with `\nError: ` and has an extra trailing newline. * feat: Add `workspace select`-related code to arguments package * refactor: Update `workspace select` to use the arguments package when parsing arguments Note that this changes the format of errors returned when arg parsing fails - this is now wrapped in a diagnostic so now starts with `\nError: ` and has an extra trailing newline.	2026-05-01 16:39:54 +01:00
Sarah French	dd35f66105	fix: warnings against using terraform env list are shown in JSON format when the -json flag is present (#38469)	2026-05-01 13:53:50 +01:00
Sarah French	559233329e	Fix: Re-enable using prerelease providers in the new two-step provider download in init (#38502) ... * test: Add pre-release to available providers. Existing tests don't use it because the configuration doesn't specify the prerelease as the version constraint. This was the gap in my understanding - prerelease providers are handled differently in the installer logic. I believe it boils down to this: 29863fd2ba/versions/set_released.go (L5-L7) * test: Add failing tests that show expected behaviour when a pre-release of a provider is used * fix: Ensure that any relevant version constraints from the config are available to use when installing providers present in the state * test: Add test defining pre-release download behaviour that was present before v1.15 * test: Update test to reflect that 2 step init is no longer experimental or specific to the PSS project	2026-05-01 10:12:32 +00:00
Austin Valle	a316444e23	add test for variable validation transformer	2026-04-30 16:34:44 -04:00
Austin Valle	6428b2bdbc	add provider source back to success tests	2026-04-30 16:07:32 -04:00
James Bardin	e480b016f8	remove the extra logic to detect prov funcs ... We can't detect why a provider function is missing is all cases, so get rid of the extra logic trying to do that. We also admit here that we need to allow a provider function within a variable validation condition, because that is not the only way these could fail during init, and it's otherwise valid during the next phase.	2026-04-30 15:55:29 -04:00
James Bardin	c6b61bf731	simplify error messages for dynamic source ... We can't fully detect why a module source or version might be unknown, so instead use a simpler error that covers all possible reasons. If we do find a way to get more specific in the future, we can extent it then, but the current errors were trying to be specific when they couldn't.	2026-04-30 15:55:26 -04:00
Austin Valle	19972a4606	adjust tests	2026-04-30 15:32:30 -04:00
Austin Valle	1c88535ac0	add test for validation reference to non-const variable	2026-04-30 15:19:51 -04:00
Austin Valle	d2c9214081	prune validate nodes	2026-04-30 15:01:37 -04:00