34845 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Sarah French	1dd8e60f15	chore: Bump golang.org/x/crypto dependency, ignore SA4003 linting errors globally (#37901) ... * chore: Upgrade golang.org/x/crypto - `go get golang.org/x/crypto@v0.44.0` * chore: Upgrade golang.org/x/crypto in submodules - `make syncdeps` * chore: Run `make generate` * chore: Ignore SA4003 linter error globally, as `golang.org/x/tools/cmd/stringer` generates code that breaks this rule when it's used with custom types that have unsigned integers or bytes as the underlying type.	2025-11-17 15:01:28 +00:00
Sarah French	ba947dac5c	fix: Stop dependency alert GHA failing when 201 response happens (#37905)	2025-11-17 11:32:11 +00:00
Liam Cervante	cfbfdc5797	providers lock: include test files when loading configuration (#37851)	2025-11-17 08:33:25 +01:00
Daniel Schmidt	1cd08351fb	add test cases for invoking an action in a module	2025-11-14 22:06:59 +01:00
Daniel Schmidt	053738fbf0	add additional warning that providers won't be downloaded	2025-11-12 09:23:17 +01:00
Daniel Schmidt	1b662d78e5	init: skip dependencies declared in development override	2025-11-12 09:23:17 +01:00
Sarah French	f2818db795	PSS : Add fs and inmem state storage implementations to the builtin simplev6 provider, update grpcwrap package, use PSS implementation in E2E test (#37790) ... * feat: Implement `inmem` state store in provider-simple-v6 * feat: Add filesystem state store `fs` in provider-simple-v6, no locking implemented * refactor: Move PSS chunking-related constants into the `pluggable` package, so they can be reused. * feat: Implement PSS-related methods in grpcwrap package * test: Add E2E test checking an init and apply (no plan) workflow is usable with both PSS implementations * fix: Ensure state stores are configured with a suggested chunk size from Core --------- Co-authored-by: Radek Simko <radeksimko@users.noreply.github.com>	2025-11-11 15:30:50 +00:00
Max Qian	078ac7cb21	fix: TestTest_Parallel adds delay to ensure order (#37890) ... Signed-off-by: Max Qian <zq2@illinois.edu>	2025-11-11 13:47:26 +01:00
James Bardin	af0aaba521	Merge pull request #37889 from hashicorp/equivalence-testing/jbardin/state-deep-equal ... Update equivalence test golden files	2025-11-10 16:16:03 -05:00
hc-github-team-tf-core	8632700ff8	Update equivalence test golden files.	2025-11-10 20:42:21 +00:00
James Bardin	64f2b5d9c6	Merge pull request #37886 from hashicorp/jbardin/state-deep-equal ... Implement equality for state objects	2025-11-10 15:38:41 -05:00
James Bardin	f78c64e528	CHANGELOG	2025-11-10 12:44:03 -05:00
James Bardin	55e340c9d2	more equality testing	2025-11-10 12:44:03 -05:00
James Bardin	659d5e2218	remove the use of reflect.DeepEqual for states ... the use of reflect.DeepEqual fails for states, because they contain value which cannot be directly compared for equality. The Equal method is not used much, except to aid in backend migration, so the failure there was rarely noticed. The failure of ManagedResourcesEqual would show up in the CLI after Terraform reported there were no changes, by exiting with a non-zero code because the resource states incorrectly reported as being changed.	2025-11-10 12:44:03 -05:00
Radek Simko	40482337a7	ssh-based provisioner: Re-enable support for PowerShell (#37794) ... * ssh-based provisioner: Re-enable support for PowerShell * add changelog entry	2025-11-06 17:45:13 +00:00
Sarah French	9595517730	Update test for autocompletion of top-level commands (#37853) ... * Update test for autocompletion of top-level commands * Add test coverage for autocompletion of workspace names in `workspace select` subcommand * Remove autocompletion tests for workspace select	2025-11-05 11:24:29 +00:00
Sarah French	f4d0ec5136	PSS: Fix hashing without provider version (#37852) ... * Fix panic hashing backend config when a builtin or reattached provider is used for PSS * Add test showing a nil *version.Version is tolerated by the Hash method, refactor existing test * Protect against provider version data missing when using an un-reattached, un-builtin provider. Add test coverage. * Make reporting errors from reattach.IsProviderReattached more consistent * Run `make syncdeps` * Update tests to show when nil provider data is tolerated	2025-11-05 11:20:36 +00:00
Radek Simko	5001deb4a2	PSS: Ensure experimental backend codepath is isolated + gated correctly (#37868) ... * PSS: Ensure experimental backend codepath is isolated + gated correctly * Update init_run.go Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com> --------- Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>	2025-11-05 09:40:48 +00:00
James Bardin	39eb8c7fb4	Merge pull request #37854 from hashicorp/jbardin/provider-eval-scope ... Allow inconsistent filesystem function results for provider configuration	2025-11-04 13:30:44 -05:00
Daniel Schmidt	3055256140	suggest similarly named action	2025-11-04 13:56:23 +01:00
Daniel Schmidt	b0e7f3ab2e	improve wording and subject of error message	2025-11-04 13:56:23 +01:00
Daniel Banck	6b038754f0	Fix list resource diagnostics check (#37863) ... * Fix list resource diagnostics check * Improve error message on missing identity schema * Add test case for list response diagnostics * Add changelog	2025-11-04 13:43:19 +01:00
Sarah French	f5a28cfa8b	PSS: Update how commands access backends, so both backend and state_store configuration can be used (#37569) ... * Add a generic method for loading an operations backend in non-init commands * Refactor commands to use new prepareBackend method: group 1 * Refactor commands to use new prepareBackend method: group 2, where config parsing needs to be explicitly added * Refactor commands to use new prepareBackend method: group 3, where we can use already parsed config * Additional, more nested, places where logic for accessing backends needs to be refactored * Remove duplicated comment * Add test coverage of `(m *Meta) prepareBackend()` * Add TODO related to using plans for backend/state_store config in apply commands * Add `testStateStoreMockWithChunkNegotiation` test helper * Add assertions to tests about the backend (remote-state, local, etc) in use within operations backend * Stop prepareBackend taking locks as argument * Code comment in prepareBackend * Replace c.Meta.prepareBackend with c.prepareBackend * Change `c.Meta.loadSingleModule` to `c.loadSingleModule` * Rename (Meta).prepareBackend to (Meta).backend, update godoc comment to make relationship to (Meta).Backend more obvious. * Revert change from config.Module to config.Root.Module * Update `(m *Meta) backend` method to parse config itself, and also to adhere to calling code's viewtype instructions * Update all tests and calling code following previous commit * Change how an operations backend is obtained by autocomplete code * Update autocomplete to return nil if no workspace names are returned from the backend * Add test coverage for autocompleting workspace names when using a pluggable state store * Fix output command: pass view type data to new `backend` method * Fix in plan command: pass correct view type to `backend` method * Fix `providers schema` command to use correct viewtype when preparing a backend	2025-11-03 17:57:20 +00:00
James Bardin	4934006982	CHANGELOG	2025-11-03 11:22:00 -05:00
dependabot[bot]	f0a2953bd0	build(deps): bump the github-actions-breaking group with 2 updates (#37856) ... Bumps the github-actions-breaking group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact). Updates `actions/upload-artifact` from 4.6.2 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](ea165f8d65...330a01c490) Updates `actions/download-artifact` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](634f93cb29...018cc2cf5b) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-breaking - dependency-name: actions/download-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-breaking ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-11-03 14:59:40 +00:00
James Bardin	4ce205da74	provider eval scope test	2025-10-31 13:07:04 -04:00
James Bardin	eaf225a871	allow inconsistent function results for providers ... Due to the inherently ephemeral nature of provider configuration, inconsistent function results were tolerated while evaluating provider config. This loophole was found to be used by a number of configurations, which took advantage of it to create the equivalent of ephemeral values before they formally existed in the language. In order to work around this, we create a special evaluation scope just for providers, allowing us to override the results check for filesystem functions. I've opted to not further clutter the EvalContext interface since this is intended to be a temporary workaround, and does not contribute to the testing of that interface (the interface is solely for internal unit tests anyway).	2025-10-31 13:07:04 -04:00
Liam Cervante	e44b870b8b	don't write ephemeral outputs to state (#37821)	2025-10-31 09:54:11 +01:00
Liam Cervante	7ac2b7938e	Stacks: temporarily disable ephemeral outputs in Stack components (#37823)	2025-10-31 09:52:48 +01:00
James Bardin	f8ae45cfc8	Merge pull request #37833 from hashicorp/jbardin/force-replace-instance ... Don't carry all `-replace` addresses through to every instance	2025-10-30 15:30:32 -04:00
Kevin Vu	26f289aeb5	testing: include file-level errors in JUnit skipped elements (#37806) ... * testing: include file-level errors in JUnit skipped elements Fixes #37801 * testing: use suite-level system-err for file errors	2025-10-30 09:17:08 +00:00
James Bardin	cfbde8e5fa	CHANGELOG	2025-10-29 18:00:55 -04:00
James Bardin	cac484da16	don't carry all replace addresses through instances ... Once we have a resource instance we no longer need to have all possible forceReplace addresses available within that instance. We can determine immediately if the instance address is in the set if replacement addresses. This avoids bugs caused by sharing the `-replace` flag addresses across all resource nodes.	2025-10-29 14:46:21 -04:00
alanpchua	b221cc0095	PSP-3163: update scan config to enable osv (#37817)	2025-10-28 10:17:23 +00:00
Liam Cervante	411f18e6ac	ephemerals: allow root ephemeral outputs in stacks and test (#37813) ... * ephemerals: allow root ephemeral outputs in stacks and test * remember to set new opt for apply stage	2025-10-28 09:29:44 +01:00
Kristin Laemmert	d4e8f17ded	actions: remove unused variable (+ minor typos & comment cleanup) (#37804) ... * actions: remove unused variable * fix minor comments and logged typos	2025-10-27 08:44:14 -04:00
James Bardin	a7e2c9f6b2	Merge pull request #37810 from hashicorp/jbardin/unknown-pure-results ... filesystem functions, don't cache unknown function results	2025-10-24 10:36:32 -04:00
James Bardin	2227441f7d	don't cache unknown function results ... The CheckPrior function results validation did not take into account unknown values, because unknown values were not originally allowed in the plugin protocol from which this check was adapted. The test is simple, in that we can just reverse the check which originally didn't allow this change in value. Provider function return values types are defined by the protocol, and should be validated at that call site. The CheckPrior code paths should only be used for the exact purpose of detecting invalid changes in the return value between successive phases of execution.	2025-10-24 09:52:37 -04:00
Sarah French	620264e2c5	GHA to prompt reviewers to think about dependency changes when backporting (#37800)	2025-10-23 12:14:57 +01:00
Sarah French	2e5b5dee5d	Upgrade protoc and protoc-gen-go-grpc versions to matching terraform-plugin-go (#37647) ... * Update protoc version in downloader script * go get google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 This matched terraform-plugin-go * make protobuf * Run `make protobuf` * Update generator to handle generic types from google.golang.org/grpc Looks like this was added in v1.69.3 in https://github.com/grpc/grpc-go/pull/7057 ? * Run `make generate` * Fix "cannot infer Res" compile error - more usage of generics * More fixing compile errors due to switching to use of a generic * Make putting `google.golang.org/grpc` import into generated files conditional * Run `make generate` * Update more places where generics now need to be used * Update generator to handle any types from google.golang.org/grpc in same switch case.	2025-10-22 14:46:18 +01:00
Liam Cervante	edf0cd66dd	actions: fail invoke plans when action configurations are unknown (#37793)	2025-10-21 23:13:25 +02:00
Sarah French	88e4c9e3d3	Update inaccurate comment (#37789)	2025-10-20 20:16:49 +01:00
Sarah French	efb2a1c567	PSS: Let the init command recognise when there are no changes in configuration. (#37777) ... * Pull determining of PSS provider's version from current locks into a separate method * Add code for identifying when config and provider version match existing backend state (i.e. no changes) * Update test - locks are now needed before it hits expected error diag return * Add test showing successful init when no config changes are detected. * Update `getStateStorageProviderVersion` to return nil versions for builtin and re-attached providers. This makes comparison easier when determining if config has changed since last init. * Add test coverage for `getStateStorageProviderVersion` * Move testing fixtures around, preparing for different types of changed state_store config changes being tested * Add test showing that changing the state_store config is detected as a change, but handling this scenario isn't implemented yet * Update hashes in test fixture backend state file to be accurate Previously dummy values were fine, but as tests using hashes to identify changes these values need to be accurate! * Update existing test cases so that Terraform uses the same test provider version as described in the backend state file fixture for the test. * Add test showing that changing the PSS provider's config is detected as a change, but handling this scenario isn't implemented yet * Add test showing that swapping to a different state storage implementation in the same provider is detected as a change, but handling this scenario isn't implemented yet * Add test showing that changing the provider used for PSS is detected as a change, but handling this scenario isn't implemented yet * Add test showing that upgrading a provider is detected as a change, but handling this scenario isn't implemented yet * Update test to use v1.2.3 for consistency with other tests Just to avoid any confusion if copy-pasting happens in future. * More corrections to existing test fixtures - unset config should be null, and replace dummy hash values with correct values. * Fix test for using -reconfigure with state_store; the default workspace would already exist in this scenario * Update TestInit_stateStore_configUnchanged to assert that init was a no-op for backend state * Remove unused fixture * Remove test that's replaced by new tests in command/init_test.go * Replace old references to deleted "state-store-changed" test fixture & update test to not expect a value for region attr in provider config * Make test fixture coupling a little more understandable * Refactor detection of no need to migrate into a function * Add TODO about more involved provider version change tests We will allow downgrades to succeed as long as the schema version number is unchanged * Update (configs.StateStore)Hash method to return a single hash that's impacted by: state store config, provider config, state store type, provider source * Update calling code and test helper code to reflect that the nested provider block no longer has its own hash * Remove test; there is now a single hash that SHOULD be affected by the provider block! * Also use provider name, from config, in hash * Update tests to reflect changes in how hashes are made * Remove unused `stateStoreConfigNeedsMigration` function * Remove duplicate isProviderReattached function. * Fixes to affected tests * Allow provider version to impact the state storage hash, update impacted tests and test fixtures * Update tests that now require locks data to be present in test setup * Update comment for accuracy * Fixes to other test fixtures - remove excess hash field, set hash to 0 to indicate they're not set accurately. * Make upgrade test actually use upgrade code path * Add lock files to test fixture directories that represent a project that's had a successful prior init using PSS	2025-10-20 16:51:45 +01:00
Liam Cervante	106f8c6a1f	actions: refactor to simplify test hooks (#37782)	2025-10-17 14:32:12 +02:00
Daniel Schmidt	accaa8d027	also check against action references in depends_on during config parsing	2025-10-17 14:05:26 +02:00
Daniel Schmidt	085c762cad	actions can not be used in depends_on ... Fixed #37780	2025-10-17 14:05:26 +02:00
Radek Simko	cbda324977	backend/oss: Bump github.com/aliyun/aliyun-oss-go-sdk to v2.1.1 (#37442)	2025-10-15 08:49:00 -04:00
Sarah French	76f2982c68	Update the init command's help text to describe PSS-related flags (#37773)	2025-10-15 09:57:00 +00:00
Sarah French	6b73f710f8	PSS: Implement initialisation of new working directory (or use of -reconfigure flag) while using state_store (#37732) ... * Minor fixes in diagnostics This can only be done once modules have been parsed and the required providers data is available. There are multiple places where config is parsed, into either Config or Module structs, so this needs to be implemented in multiple places. * Rename test to make it specific to use of backend block in config * Update initBackend to accept whole initArgs collection * Only process --backend-config data, when setting up a `backend`, if that data isn't empty * Simplify how mock provider factories are made in tests * Update mock provider's default logic to track and manage existing workspaces * Add `ProviderSchema` method to `Pluggable` structs. This allows calling code to access the provider schema when using provider configuration data. * Add function for converting a providerreqs.Version to a hashicorp/go-version Version. This is needed for using locks when creating the backend state file. * Implement initial version of init new working directories using `stateStore_C_s`. Default to creating the default workspace if no workspaces exist. * Update test fixtures to match the hashicorp/test mock provider used in PSS tests * Allow tests to obtain locks that include `testingOverrides` providers. The `testingOverrides` field will only be set in tests, so this should not impact end users. * Add tests showing TF can initialize a working directory for the first time (and do the same when forced by -reconfigure flag). Remove replaced tests. * Add -create-default-workspace flag, to be used to disable creating the default workspace by default when -input=false (i.e for use in CI). Refactor creation of default workspace logic. Add tests. * Allow reattached providers to be used during init for PSS * Rename variable to `backendHash` so relation to `backend` is clearer * Allow `(m *Meta) Backend` to return warning diagnostics * Protect against nil testingOverrides in providerFactoriesFromLocks * Add test case seeing what happens if default workspace selected, doesn't exist, but other workspaces do exist. The consequences here are due to using `selectWorkspace` in `stateStore_C_s`, matching what's done in `backend_C_r_s`. * Address code consistency check failure on PR * Refactor use of mock in test that's experiencing EOF error... * Remove test that requires test to supply input for user prompt This test passes when run in isolation but fails when run alongside other tests, even when skipping all other tests using `testStdinPipe`. I don't think the value of this test is great enough to start changing how we test stdin input. * Allow -create-default-workspace to be used regardless of whether input is enabled or disabled * Add TF_SKIP_CREATE_DEFAULT_WORKSPACE environment variable * Responses to feedback, including making testStdinPipe helper log details of errors copying data to stdin. Note: We cannot call t.Fatal from a non-test goroutine. * Use Errorf instead * Allow backend state files to not include version data when a builtin or reattached provider is in use. * Add clarifying comment about re-attached providers when finding the matching entry in required_providers * Report that the default workspace was created to the view * Refactor: use error comparison via `errors.Is` to identify when no workspaces exist. * Move handling of TF_ENABLE_PLUGGABLE_STATE_STORAGE into init's ParseInit func. * Validate that PSS-related flags can only be used when experiments are enabled, enforce coupling of PSS-related flags when in use. * Slight rewording of output message about default workspace * Update test to assert new output about default workspace	2025-10-15 10:44:21 +01:00
Sebastien Dionne	1047b5355c	Fix typos and linguistic errors in documentation (#37770) ... Signed-off-by: Sebastien Dionne <survivant00@gmail.com>	2025-10-14 10:38:27 +01:00