terraform

Commit Graph

Author	SHA1	Message	Date
Sarah French	7d5baea55e	fix: Simplify how we block upgrading the PSS provider during `init -upgrade`, now that one download step is specific to the PSS provider. (#38690 ) In #38648 the provider download process was changed: Previously the two steps were: 1. Download providers based on configuration 2. Download providers based on state The process remains two steps but the new steps are: 1. Download 0-1 provider if one is needed for PSS (1 provider downloaded if PSS is in use) 2. Download all other providers (configuration + state providers) Because the first download step is specific to the provider used for state storage we can specifically block that provider being upgraded during init. We block upgrade unless the -reconfigure flag is supplied (i.e. the user isn't wanting to migrate state). Users see a warning when they perform an upgrade action and PSS is in use. Prior to this, users would get an error if the upgrade process impacted the state store provider, now it's never impacts and warnings remind users to upgrade that provider via another command.	15 hours ago
Sarah French	ff406ab69b	test: Update tests in command package to use t.Parallel (#38688 ) Updates a bunch of tests in the command package to use t.Parallel, without needing to refactor them to enable it. Also, replaces use of `io/ioutil` in `TestPluginSHA256LockFile_Read`	1 day ago
Sarah French	d038b9e6cd	docs: Add code comments to areas where refactoring to use (Meta).WorkingDir.RootModuleDir is not appropriate	4 days ago
Sarah French	656d9d40b8	refactor: Make `state show` command use the Meta's internal details about the path to the configuration directory. When Terraform CLI starts running the working directory is changed, using `os.Chdir`, if the -chdir global option is set. This means when downstream code uses os.Getwd it will get the directory intended by the user. There currently isn't a bug in the `state show` command, so this change is just a refactor. Also, if the local backend is in use then the `Filesystem` state manager implementation that's used relies on the CLI running `os.Chdir` previously if no explicit -state flag is supplied by the user.	4 days ago
Sarah French	245e69a44c	refactor: Make `providers schema` command use the Meta's internal details about the path to the configuration directory. When Terraform CLI starts running the working directory is changed, using `os.Chdir`, if the -chdir global option is set. This means when downstream code uses os.Getwd it will get the directory intended by the user. There currently isn't a bug in the `providers schema` command, so this change is just a refactor.	4 days ago
Radek Simko	78a333060e	command/init: Only install PSS provider early (#38648 ) This walks back some of the decisions we made earlier around two-step provider downloading process. However, it should not impact the safety features and it should not have a tangible (functional) impact on the end-user aside from the log output outlined below. The motivation is to accommodate some needs of the upcoming policy features. Previously the two steps were: 1. Download providers based on configuration 2. Download providers based on state The process remains two steps but the new steps are: 1. Download 0-1 provider if one is needed for PSS (PSS is in use) 2. Download all other providers (configuration + state) End-user facing changes are mainly related to terminal output - what messages are included and their order: - initializing_provider_plugin_message (re-introduction after removal in 1.14) - initializing_state_store_provider_plugin_message (net new but PSS specific)	4 days ago
Samsondeen	c19440ff27	Add CLI and backend policy wiring for plan apply and query (#38518 )	4 days ago
Daniel Banck	a8b88698df	Add changelog	4 days ago
Daniel Banck	5a96db4685	Check variable collection errors during `show` This is the only other command that didn't check the collection results. Terraform now exits with 1 here as well.	4 days ago
Daniel Banck	ff6fe059e2	Check for errors after variable collection This aligns the plan, query and refresh command behavior with other commands, like apply or console.	4 days ago
Daniel Banck	4178d19a3b	Add exit code regression test for plan, query and refresh Errors during variable collection should result in a non-zero exit code	4 days ago
Daniel Banck	bfa5d9e5e4	Fix go vet errors - Integer args now use %d - Errors now use rawTargetAddr instead of the invalid target	5 days ago
Daniel Banck	493a6da4d0	Bump Go version to 1.26.4	5 days ago
Sarah French	68a3d31a92	test: Make capable E2E tests run in parallel (#38679 ) After #38678 a number of tests no longer use t.Setenv, which means they can now be run in parallel. This change makes those tests use t.Parallel and the time taken to run the test suite has gone down: Before PASS ok github.com/hashicorp/terraform/internal/command/e2etest 172.190s After PASS ok github.com/hashicorp/terraform/internal/command/e2etest 62.911s	5 days ago
Sarah French	7615b9397a	e2e: Reuse a single experimental build of Terraform in tests for experimental features (#38678 ) In the e2etest package tests reuse a single build of Terraform accessible via this global scope var: `terraformBin` in internal/command/e2etest/main_test.go. A setup function (`func TestMain(m *testing.M)` in the same file) runs once before any tests run, makes a Terraform binary, and enables tests to reuse that binary like this: ```go fixturePath := filepath.Join("testdata", "full-workflow-null") tf := e2e.NewBinary(t, terraformBin, fixturePath) ``` This change updates that process to also build a binary with experiments enabled, which can be reused in tests that cover experimental features. By preventing experimental tests from all building their separate experimental builds of Terraform we can reduce the package's test suite duration by about half. --------- Co-authored-by: Daniel Banck <dbanck@users.noreply.github.com>	5 days ago
Sarah French	b2fc2caf72	fix: Remove deprecation marks when formatting output for the `console` command. (#38676 ) This change introduces handling of deprecation marks to resolve the linked issue, where the `console` command would panic when displaying a deprecated field, either directly, as part of a whole resource, or when referenced within a resource/local/etc. Deprecation marks aren't used to change how values are rendered, but they need to be removed before we use the cty library to get string representations of values. I decided to only remove marks in the context of a deprecation mark being present; if a different type of mark is added in future then the engineer implementing it will need to make an explicit decision about how it should be handled in the context of `console`. If that isn't done then the panic from the cty library will re-appear.	5 days ago
Valentino	fb8d253b97	fix: Filter out `forget` resources in jsonplan `planned_values` (#38665 ) When rendering a plan file in JSON format we filter out both deleted and 'forgotten' resources when creating the `planned_values` section of the JSON; there is no value to be planned in those scenarios. Prior to this commit forgotten resources (i.e. removed via a `removed` block with `lifecycle { destroy = false }`) were erroneously still included in the planned values.	5 days ago
hc-github-team-tf-core	624c2f1b38	Cleanup after 1.16.0-alpha20260603 release	6 days ago
hc-github-team-tf-core	464ca86c74	Prepare before 1.16.0-alpha20260603 release	6 days ago
Samsondeen	74ad66488f	Address comments in policy evaluation wiring PR (#38669 )	7 days ago
dependabot[bot]	253ca3ddf9	build(deps): bump the github-actions-backward-compatible group with 7 updates (#38666 ) Bumps the github-actions-backward-compatible group with 7 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [hashicorp/actions-go-build](https://github.com/hashicorp/actions-go-build) \| `1.1.1` \| `1.1.2` \| \| [hashicorp/actions-packaging-linux](https://github.com/hashicorp/actions-packaging-linux) \| `1.10` \| `1.11` \| \| [hashicorp/actions-set-product-version](https://github.com/hashicorp/actions-set-product-version) \| `2.0.1` \| `2.0.2` \| \| [hashicorp/actions-generate-metadata](https://github.com/hashicorp/actions-generate-metadata) \| `1.1.3` \| `1.1.4` \| \| [hashicorp/actions-docker-build](https://github.com/hashicorp/actions-docker-build) \| `2.2.0` \| `2.2.1` \| \| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) \| `4.0.0` \| `4.1.0` \| \| [dessant/lock-threads](https://github.com/dessant/lock-threads) \| `6.0.0` \| `6.0.2` \| Updates `hashicorp/actions-go-build` from 1.1.1 to 1.1.2 - [Release notes](https://github.com/hashicorp/actions-go-build/releases) - [Changelog](https://github.com/hashicorp/actions-go-build/blob/main/CHANGELOG.md) - [Commits](`b9e2cfba30...dd7ca5a30c`) Updates `hashicorp/actions-packaging-linux` from 1.10 to 1.11 - [Release notes](https://github.com/hashicorp/actions-packaging-linux/releases) - [Commits](`129994a18b...006298649b`) Updates `hashicorp/actions-set-product-version` from 2.0.1 to 2.0.2 - [Release notes](https://github.com/hashicorp/actions-set-product-version/releases) - [Commits](`2ec1b51402...d9be602dfa`) Updates `hashicorp/actions-generate-metadata` from 1.1.3 to 1.1.4 - [Release notes](https://github.com/hashicorp/actions-generate-metadata/releases) - [Commits](`f1d8525252...a43468dfb1`) Updates `hashicorp/actions-docker-build` from 2.2.0 to 2.2.1 - [Release notes](https://github.com/hashicorp/actions-docker-build/releases) - [Changelog](https://github.com/hashicorp/actions-docker-build/blob/main/CHANGELOG.md) - [Commits](`200254326a...e12557abf0`) Updates `docker/setup-qemu-action` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](`ce360397dd...06116385d9`) Updates `dessant/lock-threads` from 6.0.0 to 6.0.2 - [Release notes](https://github.com/dessant/lock-threads/releases) - [Changelog](https://github.com/dessant/lock-threads/blob/main/CHANGELOG.md) - [Commits](`7266a7ce5c...89ae32b08e`) --- updated-dependencies: - dependency-name: hashicorp/actions-go-build dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-backward-compatible - dependency-name: hashicorp/actions-packaging-linux dependency-version: '1.11' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-backward-compatible - dependency-name: hashicorp/actions-set-product-version dependency-version: 2.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-backward-compatible - dependency-name: hashicorp/actions-generate-metadata dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-backward-compatible - dependency-name: hashicorp/actions-docker-build dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-backward-compatible - dependency-name: docker/setup-qemu-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-backward-compatible - dependency-name: dessant/lock-threads dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-backward-compatible ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 week ago
Sarah French	581ffab924	docs: Change files should reference PR numbers only. (#38663 )	1 week ago
Sarah French	097fa34f84	Add some light guidance about changelog description content (#38659 )	1 week ago
Samsondeen	7d22d46d6d	Wire policy evaluation into Terraform core runtime (#38516 )	1 week ago
Sarah French	61a0333f96	feat: Add warnings to the `init` command if unmanaged providers will influence provider installation When developer overrides warnings were first added in #26605 we warned users about the potential impacts of dev_overrides on resource state. If users performed apply using a dev override in a project that wasn't for testing purposes their state could become incompatible with published providers and require manual edits to state to reverse the effects. Not good. Warnings were added to init, apply, and eventually to plan. Later, in #27514, the warning in init was made more specific than warnings in plan/apply and just instructed users to not run init when overrides are used. This was based on the assumption that the provider would not be used during init in any way. This also was intended as a way for users to avoid confusing errors when their config includes an unpublished provider in required_providers, supply that provider via overrides, and then experience installation errors during init. Recently, in #37884, dev_overrides were made more compatible with init, avoiding the unpublished provider installation errors from happening. Therefore the old guidance of 'don't run init when using dev_overrides' became outdated. At that time the dev_override warning was updated to stop instructing users to not perform init while a dev_override is present, and instead the warning tells users about the overrides' potential effects on provider download. Given that latest change, this PR adds a warning to init highlighting the same effects of unmanaged providers on the provider download process. Unmanaged providers have the same impact as overridden providers.	2 weeks ago
Sarah French	cf395905e7	Fix: Remove erroneous warning about dev overrides in the providers lock command (#38655 ) In the `init` command we skip downloading any providers that are overridden or aren't managed by Terraform, but during `providers lock` the installer is not configured with knowledge about those affected providers so they aren't similarly skipped. Compare how the init installer is created (`cf0aae24f4/internal/command/meta_providers.go (L63-L92)`) to how the providers lock installer is created (`cf0aae24f4/internal/command/providers_lock.go (L258-L265)`). Therefore we don't need to warn about the effect of dev_overrides as they have no effect.	2 weeks ago
Sarah French	cf0aae24f4	fix: Stop our anti-`init -upgrade` check panicking when an overridden provider is in use. (#38635 ) Prior to this commit we wanted to validate the provider upgrade process using data that was only populated during backend initialisation (as that was the only place using that data previously). Now we enable the provider supply mode data to be available before backends are initialised. After making that available, we can update the check after getProvidersFromConfig that protects against the provider version being changed outside of a deliberate state migration process. If the state store provider is overridden then the upgrade process doesn't impact that provider anyway, so the check can be skipped. Also, this protects against errors if there was ever a built in provider supplying a state store implementation.	2 weeks ago
Sarah French	dcfb4828cc	PSS: Allow users of Terraform in automation to trust the state storage provider when initialising a state store for the first time (#38461 ) Terraform cannot prompt users to establish trust in a newly downloaded provider used for state storage if input is disabled. This commit's changes enable people using Terraform in automation (defined as `-input=false` being set) to establish trust for a provider in the same situation. We expect users to follow this workflow: 1. Practitioner initialises a Terraform project with minimal config describing how they'd like to use PSS in other production configurations. This is done manually, so they get an interactive prompt for approval and create a lock file describing the downloaded provider. 2. Practitioner copies that .terraform.lock.hcl artefact to a location that can be used in their automation environment. 3. Projects being initialised with PSS for the first time (no prior state) in automation are initialised using the command terraform init -state-provider-lock=<path-to-reused-lock-file>. The `-state-provider-lock-file` flag is expected to be a path to a .terraform.lock.hcl file. If the flag is missing it defaults to a path for the project's own lock file. The lock file is expected to describe the provider used for state storage (can be among other locks present in the file) and the version must match the requirements of the config used. Use of the lock file supplied via the flag is at the same point that a user would otherwise interactively approve a provider. If the lock file is insufficient to establish trust it'll be similar to a user declining a prompt to trust a provider.	2 weeks ago
Sarah French	234ef96aec	init: Make both provider override methods (dev_overrides and reattaching providers) behave same in the context of provider download (#38634 ) This PR makes a few related changes: 1. Construct provider cache Installers so they have knowledge about dev_override providers Prior to this change, providercache.Installer variables were made in the command package with knowledge about reattached/unmanaged providers, but not with knowledge about dev_override providers. Now both sets of overridden providers are present in the installer and can affect installation logic. 2. Make the provider installation logic skip any dev_override providers from being installed from the Registry (or other configured sources) This means that if a provider is first added to a config while someone uses a dev_override an init command will not add that provider to the lock file. If the overridden provider is already in the lock file then the lock will be unchanged. An edge case, that already exists for unmanaged providers, is that if a dev_override is in play while an init -upgrade command is used, only the providers that aren't overridden or unmanaged will be upgraded This change is coupled to another change in the PR described below. 3. Fix the provider download process (in context of init) so that dev_overrides are not removed from the provider requirements. This reverts a change in https://github.com/hashicorp/terraform/pull/37884. The original motivation of that PR was to address a situation where the provider supplied by dev_overrides isn't published to the Registry yet. The config may need to include an entry in required_providers for that provider, which means that init would always fail due to the provider being unavailable in the Registry for download. The prior commit (`bfc08b5d96`) changed installer logic to skip dev_override providers, which cancels out this commit's changes; dev_override providers will remain in the provider requirements passed to installation logic, but that logic will now ignore them. As a consequence of no longer removing these provider requirements we will retain any pre-existing locks for the provider through the init process. 4. The `providers locks` command will now warn users about any dev_overrides in effect, as these will stop provider locks from being downloaded.	2 weeks ago
Sarah French	81053e9d70	fix: Block commands from using an invalid workspace name. (#38594 ) We're blocking commands from using an invalid workspace name, as this mitigates some risks if the invalid name attempts to cause path traversal. A workspace is selected if its name is in the .terraform/environment file, and something other than Terraform could change the contents of that file. To fix this, we expect users to use Terraform to update that file via Terraform using the `workspace select` command. This will allow the user to select or create a valid workspace instead, while also removing the bad data from the file without expecting the user to know about that file (it's an implementation detail, not a public API!).	2 weeks ago
Samsondeen	3b4c2f2427	Fix flaky ordering test (#38650 )	2 weeks ago
Sarah French	95db2b28ee	Refactor E2E tests to use new reattached provider test helper (#38643 ) * test: Update reattachedProviderForTest to return the provider server used, so tests can choose to make assertions against it. Refactor relevant E2E tests to use new reattachedProviderForTest helper function.	2 weeks ago
Sarah French	8410263caa	test: Add tests defining how provider installation behaviour is affected by providers that are either reattached or dev_overrides (#38633 ) * test: Add test coverage to provider installer logic defining how providers being unmanaged/reattached or dev_overrides impacts the provider installation process These tests show that the two methods of overriding a provider behave differently. This is due to how reattached/unmanaged providers are skipped during the provider installation process whereas development overrides are removed from the provider requirements passed into the installation logic. This results in Terraform treating dev_override providers similarly to a provider that's been completely removed from a configuration. I believe this is a bug and will fix in a future commit, but these tests help to highlight the current problem.	2 weeks ago
Daniel Banck	c4dda736bf	Add changelog	2 weeks ago
Daniel Banck	a22d91b65b	terraform: Handle missing source in nodeInstallModule	2 weeks ago
Daniel Banck	d8aedeaf4a	command: Test init with invalid configuration	2 weeks ago
Daniel Banck	fd454a061d	Add changelog	2 weeks ago
Daniel Banck	23ba5d5364	Check if module version evaluates to something != null Instead of assuming a registry module when a version attribute is set, Terraform now checks if the expression evaluates to a valid constraints and only then treats the source as a registry module.	2 weeks ago
Daniel Banck	e9e554957f	Add init test cases where version = null	2 weeks ago
Daniel Banck	040d053eea	Fix Context Init Test to check version constraints	2 weeks ago
Sarah French	ecb1350623	chore: Bump golang.org/x/net to v0.55.0 https://pkg.go.dev/vuln/GO-2026-5026	2 weeks ago
Sarah French	9762e96734	chore: Bump golang.org/x/crypto to v0.52.0 https://pkg.go.dev/vuln/GO-2026-5018?q	2 weeks ago
Sarah French	a2ad11c4f1	fix: Make sure the backend state file is valid if a user introduces PSS to a pre-existing project via `init -reconfigure`. The -reconfigure flag makes Terraform ignore the backend state file when deciding what scenario is happening, which leads to Terraform acting like it's initialising a working dir for the first time. However downstream code then needs to be prepared for both of these scenarios: - The work dir has never been initialised before and the backend state file doesn't exist yet - The work dir has been used before but Terraform is being forced to treat it as new. This change helps with the second point - we need to remove any old descriptions of a Backend to avoid a situation where the backend state file describes both a backend and state_store.	2 weeks ago
Adam Snyder	c78b2c2f22	fix: Fix panic on deposed object with precondition and nop change	3 weeks ago
Kristin Laemmert	4d8ecf9d23	chore: add a test for import duplication I woke up in a cold sweat about not testing the assertion that imports in parent modules take precedence when there are duplicates. I'm genuinely revlieved this Just Worked	3 weeks ago
Samsondeen	42fe4265f2	Add policy client and protocol plumbing (#38514 )	3 weeks ago
Daniel Banck	5d289cc1a2	Improve `--from-module` test coverage Clean up and old todo and add a test for the simplified error message.	3 weeks ago
Sarah French	eb374193aa	fix: Remove unused returned diagnostics (#38617 ) Follow up to https://github.com/hashicorp/terraform/pull/38573, addressing feedback asking to remove the unused diagnostics. As discussed in that PR, the only way to use these returned diags would be to use a combination of named returns and defer functions editing those return values in order to capture those diagnostics. This is brittle and has questionable pay-off, so instead we remove these diags.	3 weeks ago
Sarah French	deed538ea8	chore: Remove unneeded `init` test (#38622 ) Follow up to https://github.com/hashicorp/terraform/pull/38391 That PR added tests showing that upgrading the provider used for PSS is blocked in init. There are no other upgrade-related user stories related to PSS in init, as upgrading the state storage provider will only be possible through a new `state migrate` command in future. Therefore these TODOs etc should be removed.	3 weeks ago
Sarah French	d75460af6d	fix: Prevent provider binary being placed outside of .terraform/providers cache unexpectedly due to use of symlinks. (#38611 )	3 weeks ago

1 2 3 4 5 ...

35481 Commits (7d5baea55e559f18f5cb3d0a9ba3c31622139dea) All Branches Search

35481 Commits (7d5baea55e559f18f5cb3d0a9ba3c31622139dea)

All Branches