35454 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Sarah French	dcfb4828cc	PSS: Allow users of Terraform in automation to trust the state storage provider when initialising a state store for the first time (#38461) ... Terraform cannot prompt users to establish trust in a newly downloaded provider used for state storage if input is disabled. This commit's changes enable people using Terraform in automation (defined as `-input=false` being set) to establish trust for a provider in the same situation. We expect users to follow this workflow: 1. Practitioner initialises a Terraform project with minimal config describing how they'd like to use PSS in other production configurations. This is done manually, so they get an interactive prompt for approval and create a lock file describing the downloaded provider. 2. Practitioner copies that .terraform.lock.hcl artefact to a location that can be used in their automation environment. 3. Projects being initialised with PSS for the first time (no prior state) in automation are initialised using the command terraform init -state-provider-lock=<path-to-reused-lock-file>. The `-state-provider-lock-file` flag is expected to be a path to a .terraform.lock.hcl file. If the flag is missing it defaults to a path for the project's own lock file. The lock file is expected to describe the provider used for state storage (can be among other locks present in the file) and the version must match the requirements of the config used. Use of the lock file supplied via the flag is at the same point that a user would otherwise interactively approve a provider. If the lock file is insufficient to establish trust it'll be similar to a user declining a prompt to trust a provider.	2026-05-27 17:22:25 +01:00
Sarah French	234ef96aec	init: Make both provider override methods (dev_overrides and reattaching providers) behave same in the context of provider download (#38634) ... This PR makes a few related changes: 1. Construct provider cache Installers so they have knowledge about dev_override providers Prior to this change, providercache.Installer variables were made in the command package with knowledge about reattached/unmanaged providers, but not with knowledge about dev_override providers. Now both sets of overridden providers are present in the installer and can affect installation logic. 2. Make the provider installation logic skip any dev_override providers from being installed from the Registry (or other configured sources) This means that if a provider is first added to a config while someone uses a dev_override an init command will not add that provider to the lock file. If the overridden provider is already in the lock file then the lock will be unchanged. An edge case, that already exists for unmanaged providers, is that if a dev_override is in play while an init -upgrade command is used, only the providers that aren't overridden or unmanaged will be upgraded This change is coupled to another change in the PR described below. 3. Fix the provider download process (in context of init) so that dev_overrides are not removed from the provider requirements. This reverts a change in https://github.com/hashicorp/terraform/pull/37884. The original motivation of that PR was to address a situation where the provider supplied by dev_overrides isn't published to the Registry yet. The config may need to include an entry in required_providers for that provider, which means that init would always fail due to the provider being unavailable in the Registry for download. The prior commit (bfc08b5d96) changed installer logic to skip dev_override providers, which cancels out this commit's changes; dev_override providers will remain in the provider requirements passed to installation logic, but that logic will now ignore them. As a consequence of no longer removing these provider requirements we will retain any pre-existing locks for the provider through the init process. 4. The `providers locks` command will now warn users about any dev_overrides in effect, as these will stop provider locks from being downloaded.	2026-05-27 16:06:40 +01:00
Sarah French	81053e9d70	fix: Block commands from using an invalid workspace name. (#38594) ... We're blocking commands from using an invalid workspace name, as this mitigates some risks if the invalid name attempts to cause path traversal. A workspace is selected if its name is in the .terraform/environment file, and something other than Terraform could change the contents of that file. To fix this, we expect users to use Terraform to update that file via Terraform using the `workspace select` command. This will allow the user to select or create a valid workspace instead, while also removing the bad data from the file without expecting the user to know about that file (it's an implementation detail, not a public API!).	2026-05-27 14:16:03 +01:00
Samsondeen	3b4c2f2427	Fix flaky ordering test (#38650)	2026-05-27 14:55:48 +02:00
Sarah French	95db2b28ee	Refactor E2E tests to use new reattached provider test helper (#38643) ... * test: Update reattachedProviderForTest to return the provider server used, so tests can choose to make assertions against it. Refactor relevant E2E tests to use new reattachedProviderForTest helper function.	2026-05-26 15:58:11 +01:00
Sarah French	8410263caa	test: Add tests defining how provider installation behaviour is affected by providers that are either reattached or dev_overrides (#38633) ... * test: Add test coverage to provider installer logic defining how providers being unmanaged/reattached or dev_overrides impacts the provider installation process These tests show that the two methods of overriding a provider behave differently. This is due to how reattached/unmanaged providers are skipped during the provider installation process whereas development overrides are removed from the provider requirements passed into the installation logic. This results in Terraform treating dev_override providers similarly to a provider that's been completely removed from a configuration. I believe this is a bug and will fix in a future commit, but these tests help to highlight the current problem.	2026-05-26 15:41:27 +01:00
Daniel Banck	c4dda736bf	Add changelog	2026-05-26 15:14:44 +02:00
Daniel Banck	a22d91b65b	terraform: Handle missing source in nodeInstallModule	2026-05-26 15:14:44 +02:00
Daniel Banck	d8aedeaf4a	command: Test init with invalid configuration	2026-05-26 15:14:44 +02:00
Daniel Banck	fd454a061d	Add changelog	2026-05-26 12:57:28 +02:00
Daniel Banck	23ba5d5364	Check if module version evaluates to something != null ... Instead of assuming a registry module when a version attribute is set, Terraform now checks if the expression evaluates to a valid constraints and only then treats the source as a registry module.	2026-05-26 12:57:28 +02:00
Daniel Banck	e9e554957f	Add init test cases where version = null	2026-05-26 12:57:28 +02:00
Daniel Banck	040d053eea	Fix Context Init Test to check version constraints	2026-05-26 12:57:28 +02:00
Sarah French	ecb1350623	chore: Bump golang.org/x/net to v0.55.0 ... https://pkg.go.dev/vuln/GO-2026-5026	2026-05-26 11:09:05 +01:00
Sarah French	9762e96734	chore: Bump golang.org/x/crypto to v0.52.0 ... https://pkg.go.dev/vuln/GO-2026-5018?q	2026-05-26 11:09:05 +01:00
Sarah French	a2ad11c4f1	fix: Make sure the backend state file is valid if a user introduces PSS to a pre-existing project via init -reconfigure. ... The -reconfigure flag makes Terraform ignore the backend state file when deciding what scenario is happening, which leads to Terraform acting like it's initialising a working dir for the first time. However downstream code then needs to be prepared for both of these scenarios: - The work dir has never been initialised before and the backend state file doesn't exist yet - The work dir has been used before but Terraform is being forced to treat it as new. This change helps with the second point - we need to remove any old descriptions of a Backend to avoid a situation where the backend state file describes both a backend and state_store.	2026-05-23 18:39:35 +01:00
Adam Snyder	c78b2c2f22	fix: Fix panic on deposed object with precondition and nop change	2026-05-22 14:30:17 -04:00
Kristin Laemmert	4d8ecf9d23	chore: add a test for import duplication ... I woke up in a cold sweat about not testing the assertion that imports in parent modules take precedence when there are duplicates. I'm genuinely revlieved this Just Worked	2026-05-22 11:46:04 -04:00
Samsondeen	42fe4265f2	Add policy client and protocol plumbing (#38514)	2026-05-21 13:25:15 +02:00
Daniel Banck	5d289cc1a2	Improve --from-module test coverage ... Clean up and old todo and add a test for the simplified error message.	2026-05-20 19:40:29 +02:00
Sarah French	eb374193aa	fix: Remove unused returned diagnostics (#38617) ... Follow up to https://github.com/hashicorp/terraform/pull/38573, addressing feedback asking to remove the unused diagnostics. As discussed in that PR, the only way to use these returned diags would be to use a combination of named returns and defer functions editing those return values in order to capture those diagnostics. This is brittle and has questionable pay-off, so instead we remove these diags.	2026-05-20 16:13:20 +01:00
Sarah French	deed538ea8	chore: Remove unneeded init test (#38622) ... Follow up to https://github.com/hashicorp/terraform/pull/38391 That PR added tests showing that upgrading the provider used for PSS is blocked in init. There are no other upgrade-related user stories related to PSS in init, as upgrading the state storage provider will only be possible through a new `state migrate` command in future. Therefore these TODOs etc should be removed.	2026-05-20 16:09:56 +01:00
Sarah French	d75460af6d	fix: Prevent provider binary being placed outside of .terraform/providers cache unexpectedly due to use of symlinks. (#38611)	2026-05-20 11:50:10 +02:00
Sarah French	b046d8a010	ci: Add (tfdiags.Diagnostics).Append checker to PR checks (#38606) ... * tool: Go analyzer made with Copilot that detects when calls to tfdiags.Diagnostics.Append ignores the returned value. * ci: Update script to be able to identify newly-added instances of the defect in a PR context aware way * ci: Tool only identifies new occurrences of defect when run in CI on a PR	2026-05-19 10:32:10 +01:00
Sarah French	634db2dcc8	PSS: Add parsing of .tfmigrate.hcl files to define state migration operations (#38526) ... * feat: Parsing a configuration directory can include .tfmigrate.hcl files. These files include `state_store_provider` blocks and `from` blocks that contains either a single `backend` or `state_store` block. Validation will enforce that despite multiple .tfmigrate.hcl files being parsed you can only have one state_store_provider or from block, and nested backend/state_store blocks are mutually exclusive. Use of state_store_provider is only valid when state_store is in use, and the single provider described in both blocks must be in agreement. Also, a directory's .tfmigrate.hcl files cannot be empty once combined.	2026-05-19 09:31:27 +01:00
Sarah French	008c92d91f	fix: Append lost warnings in MaybeGetSchemas (#38605)	2026-05-18 16:35:56 +01:00
Austin Valle	ee8a91d85c	chore: Move changelog validation to pull_request trigger (#38607)	2026-05-18 09:19:57 -04:00
Sarah French	d174972029	test: Show warning when a -filter flag has an invalid value (#38603) ... * test: Show warning when a test file filter is not valid * Add change file	2026-05-15 20:36:26 +01:00
Sarah French	f6553bae93	fix: Stop discarding diagnostics in internal test providers (#38602)	2026-05-15 20:08:16 +01:00
Austin Valle	74be5f114e	chore: Adjust the title of the validate changelog job (#38601) ... * adding a malformed changelog * adjust name of validate changelog job * remove malformed changelog	2026-05-15 15:03:48 +00:00
Austin Valle	a3ad084492	chore: Adjust changelog validation to use head_ref (#38599) ... * add malformed changelog * Use head_ref explicitly to checkout PR branch	2026-05-15 10:39:05 -04:00
Austin Valle	05d0ce481e	chore: Update changelog validation to use the PR branch (#38598) ... * test a malformed changelog * move validation to a new job using the right branch * remove malformed changelog since we can't test in the same PR we make the workflow update in	2026-05-15 10:20:20 -04:00
Sarah French	7d5441c41f	Update change file contents (#38597)	2026-05-15 13:23:46 +00:00
Sarah French	c7087b00d3	Fix change file formatting (#38596)	2026-05-15 13:10:09 +00:00
Sarah French	be22624430	chore: Modernise some code in provisioners packages, add some code comments (#38588)	2026-05-15 14:00:43 +01:00
hc-github-team-tf-core	e1bab732d8	Cleanup after 1.16.0-alpha20260513 release (#38570)	2026-05-15 13:59:33 +01:00
Kristin Laemmert	abbb650bae	refactor: remove readDiff (#38590) ... readDiff is no longer necessary now that we don't need a schema to read the change - all calls to readDiff were replaced with a single-line call to ctx.Changes, using the same inputs that readDiff used.	2026-05-14 14:25:24 -04:00
Kristin Laemmert	34935295e3	feat(import): support import blocks inside child modules (#38352) ... This PR adds support for import blocks inside child modules. Duplicate blocks will overwrite prior imports (I copied this behavior from the refactoring code, but we could instead return an error if multiple import blocks target the same abs config resource).	2026-05-14 14:17:24 -04:00
Sebastien Tardif	3c94ef65b3	Fix resource leaks in provisioners and commands (#38585) ... * Fix resource leaks in provisioners and commands Close file handles, HTTP response bodies, and pipe ends that were previously leaked on certain code paths: - workspace_new.go: Close state file opened via os.Open - file/resource_provisioner.go: Close temp file handle before returning the file path to caller - login.go: Move defer resp.Body.Close() before ioutil.ReadAll so the body is closed even when ReadAll fails - local-exec/resource_provisioner.go: Close the read end of os.Pipe after the copy goroutine completes --------- Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>	2026-05-14 17:36:12 +01:00
Sarah French	820f37b35f	test: Proof of path traversals not being accepted workspaces (#38589)	2026-05-14 16:15:46 +01:00
Sarah French	c56ec2943d	refactor: Move validation of init's -upgrade and -lockfile=readonly flags to the arguments package. (#38561) ... The `-upgrade` and `-lockfile=readonly` flags are mutually exclusive, and this is now enforced by the arguments package. This refactor has also fixed a historical bug where that validation error was output twice. The getProvidersFromConfig code now depends on the flag validation happening in the calling code. However there is another check in downstream code, in `saveDependencyLockFile` when we overwrite the dependency lock file's contents. There, an error occurs if a diff in the locks is detected during `readonly` mode. This protects against incorrect use of `getProvidersFromConfig` with unvalidated inputs, if that happens in future.	2026-05-14 14:42:31 +01:00
Sarah French	2e5a89ab6f	Update command help text for state migrate command (#38571) ... Added details about the default behaviour for the lock-file CLI flags, and made it clearer that the upgrade flag only enables upgrading the provider used for state storage.	2026-05-14 13:31:48 +01:00
Sarah French	adcf9a9cb3	PSS: Make sure to close supplementary instances of a store that are intended to be used temporarily. (#38573) ... * feat : Add Close method to Pluggable struct, use method to close supplementary provider processes that are launched during init.	2026-05-14 08:24:11 -04:00
James Bardin	93b0eae736	Merge pull request #38572 from hashicorp/jbardin/phase-out ... remove old resource phase addressing	2026-05-13 15:40:36 -04:00
James Bardin	c29cb25f86	remove old resource phase addressing ... At one point there was an attempt to connect the destroy nodes in the apply graph by using special addressing and manipulating the references for resources. This doesn't work for a few reasons, but in particular, destroy nodes are entirely built from their state, they do not reference anything, and they cannot be referenced.	2026-05-13 14:12:38 -04:00
hc-github-team-tf-core	3ba027e9d4	Prepare before 1.16.0-alpha20260513 release	2026-05-13 12:38:18 +02:00
Radek Simko	6dac3a30e1	build: Produce docker image for s390x	2026-05-13 12:29:08 +02:00
Radek Simko	5ea5ae1528	add changelog entry	2026-05-13 12:29:08 +02:00
Radek Simko	0f5c23823d	build: Produce a linux/s390x binary	2026-05-13 12:29:08 +02:00
Daniel Banck	7ac3e2ec19	Return SafeInitActionNotRelevant on empty config	2026-05-13 08:17:40 +02:00