@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.84

package/src/migrations/latest/terraform-declare-used-providers/migration.js

@@ -0,0 +1,147 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments, visitNotIgnoredFiles } from "@nx/devkit";
+import { captureAllGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TERRAFORM_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Declare every provider each vended Terraform module uses in its own
+ * `required_providers`.
+ *
+ * A provider a module uses but never declares is resolved by implicit
+ * inheritance from the root module, unpinned — so `terraform init` on that
+ * module takes whatever the registry serves, bypassing the version pinning the
+ * generators vend. Several vended modules referenced `random`, `archive`,
+ * `null`, `external` and `aws` without declaring them.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the unpinned shape until this runs. Each missing provider is added to the
+ * module's existing `required_providers`; a module with no `terraform` block at
+ * all is reported via `nextSteps` rather than having one inserted, since where
+ * it belongs depends on how the user has arranged the file.
+ */ const TERRAFORM_SRC = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src');
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** Providers built in to Terraform, which have no entry and no version. */ const BUILTIN_TYPES = new Set([
+    'terraform_data',
+    'terraform_remote_state'
+]);
+/**
+ * The provider a resource or data source type resolves to. Terraform derives
+ * this from the type's first underscore-delimited word; a type it can't
+ * attribute to a provider the plugin vends is not this migration's to touch.
+ */ const providerOf = (type)=>{
+    // `null_resource` and `external` are the whole type, not a prefixed one.
+    if (type === 'null_resource') {
+        return 'null';
+    }
+    if (type === 'external') {
+        return 'external';
+    }
+    const [prefix] = type.split('_');
+    return prefix in TERRAFORM_VERSIONS ? prefix : undefined;
+};
+/**
+ * The providers a module requires, read from its `resource` and `data` blocks.
+ *
+ * Only declarations are read, because Terraform resolves a resource reference
+ * within the module that declares it — so a provider a module references is one
+ * it also declares a block for, and the blocks alone are complete. Matching the
+ * syntax tree also means a type named in a comment, in string prose or inside a
+ * `local-exec` heredoc's embedded Python is not a use, since none of those parse
+ * as a block.
+ */ const usedProviders = async (tree, filePath)=>{
+    const used = new Set();
+    for (const kind of [
+        'resource',
+        'data'
+    ]){
+        for (const block of (await captureAllGritQL(tree, filePath, hcl(`\`${kind} $type $name { $_ }\``)))){
+            // The block's own type, e.g. `resource "random_string" "suffix" {`.
+            const type = /"([A-Za-z0-9_]+)"/.exec(block)?.[1];
+            if (!type || BUILTIN_TYPES.has(type)) {
+                continue;
+            }
+            const provider = providerOf(type);
+            if (provider) {
+                used.add(provider);
+            }
+        }
+    }
+    return used;
+};
+/** Every `.tf` file in the workspace's shared terraform library, by directory. */ const terraformModules = (tree)=>{
+    const modules = new Map();
+    if (!tree.exists(TERRAFORM_SRC)) {
+        return modules;
+    }
+    visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath)=>{
+        if (!filePath.endsWith('.tf')) {
+            return;
+        }
+        const dir = filePath.slice(0, filePath.lastIndexOf('/'));
+        modules.set(dir, [
+            ...modules.get(dir) ?? [],
+            filePath
+        ]);
+    });
+    return modules;
+};
+/** The provider entry to vend, at the version this release pins. */ const providerEntry = (provider)=>[
+        `${provider} = {`,
+        `  source  = "hashicorp/${provider}"`,
+        `  version = "${TERRAFORM_VERSIONS[provider]}"`,
+        '}'
+    ].join('\n');
+/**
+ * Add a provider to a file's `required_providers`. Appended after the block's
+ * existing body, so an entry the user has customised is left as it is.
+ */ const declareProvider = (tree, filePath, provider)=>insertViaGritQL(tree, filePath, hcl(`\`required_providers { $body }\` => \`required_providers {\n  $body\n\n  ${GRIT_INSERT_PLACEHOLDER}\n}\`` + ` where { $body <: not contains \`${provider} = { $_ }\` }`), providerEntry(provider));
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [dir, filePaths] of terraformModules(tree)){
+        const used = new Set();
+        // The file holding the module's `required_providers`, which is where the
+        // missing declarations are added — Terraform merges every `.tf` in a
+        // directory, so one block covers the module.
+        let blockFile;
+        const declared = new Set();
+        for (const filePath of filePaths){
+            for (const provider of (await usedProviders(tree, filePath))){
+                used.add(provider);
+            }
+            const contents = tree.read(filePath, 'utf-8') ?? '';
+            if (!contents.includes('required_providers')) {
+                continue;
+            }
+            blockFile ??= filePath;
+            for (const provider of Object.keys(TERRAFORM_VERSIONS)){
+                if (await matchGritQL(tree, filePath, hcl(`\`required_providers { $body }\` where { $body <: contains \`${provider} = { $_ }\` }`))) {
+                    declared.add(provider);
+                }
+            }
+        }
+        const missing = [
+            ...used
+        ].filter((p)=>!declared.has(p)).sort();
+        if (missing.length === 0) {
+            continue;
+        }
+        if (!blockFile) {
+            nextSteps.push(`${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`);
+            continue;
+        }
+        for (const provider of missing){
+            if (!await declareProvider(tree, blockFile, provider)) {
+                nextSteps.push(`${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-declare-used-providers/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-declare-used-providers/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  captureAllGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Declare every provider each vended Terraform module uses in its own\n * `required_providers`.\n *\n * A provider a module uses but never declares is resolved by implicit\n * inheritance from the root module, unpinned — so `terraform init` on that\n * module takes whatever the registry serves, bypassing the version pinning the\n * generators vend. Several vended modules referenced `random`, `archive`,\n * `null`, `external` and `aws` without declaring them.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the unpinned shape until this runs. Each missing provider is added to the\n * module's existing `required_providers`; a module with no `terraform` block at\n * all is reported via `nextSteps` rather than having one inserted, since where\n * it belongs depends on how the user has arranged the file.\n */\n\nconst TERRAFORM_SRC = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n  'src',\n);\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** Providers built in to Terraform, which have no entry and no version. */\nconst BUILTIN_TYPES = new Set(['terraform_data', 'terraform_remote_state']);\n\n/**\n * The provider a resource or data source type resolves to. Terraform derives\n * this from the type's first underscore-delimited word; a type it can't\n * attribute to a provider the plugin vends is not this migration's to touch.\n */\nconst providerOf = (type: string): string | undefined => {\n  // `null_resource` and `external` are the whole type, not a prefixed one.\n  if (type === 'null_resource') {\n    return 'null';\n  }\n  if (type === 'external') {\n    return 'external';\n  }\n  const [prefix] = type.split('_');\n  return prefix in TERRAFORM_VERSIONS ? prefix : undefined;\n};\n\n/**\n * The providers a module requires, read from its `resource` and `data` blocks.\n *\n * Only declarations are read, because Terraform resolves a resource reference\n * within the module that declares it — so a provider a module references is one\n * it also declares a block for, and the blocks alone are complete. Matching the\n * syntax tree also means a type named in a comment, in string prose or inside a\n * `local-exec` heredoc's embedded Python is not a use, since none of those parse\n * as a block.\n */\nconst usedProviders = async (\n  tree: Tree,\n  filePath: string,\n): Promise<Set<string>> => {\n  const used = new Set<string>();\n  for (const kind of ['resource', 'data']) {\n    for (const block of await captureAllGritQL(\n      tree,\n      filePath,\n      hcl(`\\`${kind} $type $name { $_ }\\``),\n    )) {\n      // The block's own type, e.g. `resource \"random_string\" \"suffix\" {`.\n      const type = /\"([A-Za-z0-9_]+)\"/.exec(block)?.[1];\n      if (!type || BUILTIN_TYPES.has(type)) {\n        continue;\n      }\n      const provider = providerOf(type);\n      if (provider) {\n        used.add(provider);\n      }\n    }\n  }\n  return used;\n};\n\n/** Every `.tf` file in the workspace's shared terraform library, by directory. */\nconst terraformModules = (tree: Tree): Map<string, string[]> => {\n  const modules = new Map<string, string[]>();\n  if (!tree.exists(TERRAFORM_SRC)) {\n    return modules;\n  }\n  visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath) => {\n    if (!filePath.endsWith('.tf')) {\n      return;\n    }\n    const dir = filePath.slice(0, filePath.lastIndexOf('/'));\n    modules.set(dir, [...(modules.get(dir) ?? []), filePath]);\n  });\n  return modules;\n};\n\n/** The provider entry to vend, at the version this release pins. */\nconst providerEntry = (provider: string) =>\n  [\n    `${provider} = {`,\n    `  source  = \"hashicorp/${provider}\"`,\n    `  version = \"${TERRAFORM_VERSIONS[provider as keyof typeof TERRAFORM_VERSIONS]}\"`,\n    '}',\n  ].join('\\n');\n\n/**\n * Add a provider to a file's `required_providers`. Appended after the block's\n * existing body, so an entry the user has customised is left as it is.\n */\nconst declareProvider = (tree: Tree, filePath: string, provider: string) =>\n  insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n  $body\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\`` +\n        ` where { $body <: not contains \\`${provider} = { $_ }\\` }`,\n    ),\n    providerEntry(provider),\n  );\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [dir, filePaths] of terraformModules(tree)) {\n    const used = new Set<string>();\n    // The file holding the module's `required_providers`, which is where the\n    // missing declarations are added — Terraform merges every `.tf` in a\n    // directory, so one block covers the module.\n    let blockFile: string | undefined;\n    const declared = new Set<string>();\n\n    for (const filePath of filePaths) {\n      for (const provider of await usedProviders(tree, filePath)) {\n        used.add(provider);\n      }\n      const contents = tree.read(filePath, 'utf-8') ?? '';\n      if (!contents.includes('required_providers')) {\n        continue;\n      }\n      blockFile ??= filePath;\n      for (const provider of Object.keys(TERRAFORM_VERSIONS)) {\n        if (\n          await matchGritQL(\n            tree,\n            filePath,\n            hcl(\n              `\\`required_providers { $body }\\` where { $body <: contains \\`${provider} = { $_ }\\` }`,\n            ),\n          )\n        ) {\n          declared.add(provider);\n        }\n      }\n    }\n\n    const missing = [...used].filter((p) => !declared.has(p)).sort();\n    if (missing.length === 0) {\n      continue;\n    }\n\n    if (!blockFile) {\n      nextSteps.push(\n        `${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`,\n      );\n      continue;\n    }\n\n    for (const provider of missing) {\n      if (!(await declareProvider(tree, blockFile, provider))) {\n        nextSteps.push(\n          `${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`,\n        );\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","visitNotIgnoredFiles","captureAllGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_SRC","hcl","pattern","BUILTIN_TYPES","Set","providerOf","type","prefix","split","undefined","usedProviders","tree","filePath","used","kind","block","exec","has","provider","add","terraformModules","modules","Map","exists","endsWith","dir","slice","lastIndexOf","set","get","providerEntry","join","declareProvider","migration","nextSteps","filePaths","blockFile","declared","contents","read","includes","Object","keys","missing","filter","p","sort","length","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,oBAAoB,QACf,aAAa;AACpB,SACEC,gBAAgB,EAChBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,gBAAgBV,kBACpBO,cACAC,sBACA;AAGF,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,yEAAyE,GACzE,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAkB;CAAyB;AAE1E;;;;CAIC,GACD,MAAMC,aAAa,CAACC;IAClB,yEAAyE;IACzE,IAAIA,SAAS,iBAAiB;QAC5B,OAAO;IACT;IACA,IAAIA,SAAS,YAAY;QACvB,OAAO;IACT;IACA,MAAM,CAACC,OAAO,GAAGD,KAAKE,KAAK,CAAC;IAC5B,OAAOD,UAAUR,qBAAqBQ,SAASE;AACjD;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,OACpBC,MACAC;IAEA,MAAMC,OAAO,IAAIT;IACjB,KAAK,MAAMU,QAAQ;QAAC;QAAY;KAAO,CAAE;QACvC,KAAK,MAAMC,SAAS,CAAA,MAAMvB,iBACxBmB,MACAC,UACAX,IAAI,CAAC,EAAE,EAAEa,KAAK,qBAAqB,CAAC,EACtC,EAAG;YACD,oEAAoE;YACpE,MAAMR,OAAO,oBAAoBU,IAAI,CAACD,QAAQ,CAAC,EAAE;YACjD,IAAI,CAACT,QAAQH,cAAcc,GAAG,CAACX,OAAO;gBACpC;YACF;YACA,MAAMY,WAAWb,WAAWC;YAC5B,IAAIY,UAAU;gBACZL,KAAKM,GAAG,CAACD;YACX;QACF;IACF;IACA,OAAOL;AACT;AAEA,gFAAgF,GAChF,MAAMO,mBAAmB,CAACT;IACxB,MAAMU,UAAU,IAAIC;IACpB,IAAI,CAACX,KAAKY,MAAM,CAACvB,gBAAgB;QAC/B,OAAOqB;IACT;IACA9B,qBAAqBoB,MAAMX,eAAe,CAACY;QACzC,IAAI,CAACA,SAASY,QAAQ,CAAC,QAAQ;YAC7B;QACF;QACA,MAAMC,MAAMb,SAASc,KAAK,CAAC,GAAGd,SAASe,WAAW,CAAC;QACnDN,QAAQO,GAAG,CAACH,KAAK;eAAKJ,QAAQQ,GAAG,CAACJ,QAAQ,EAAE;YAAGb;SAAS;IAC1D;IACA,OAAOS;AACT;AAEA,kEAAkE,GAClE,MAAMS,gBAAgB,CAACZ,WACrB;QACE,GAAGA,SAAS,IAAI,CAAC;QACjB,CAAC,uBAAuB,EAAEA,SAAS,CAAC,CAAC;QACrC,CAAC,aAAa,EAAEnB,kBAAkB,CAACmB,SAA4C,CAAC,CAAC,CAAC;QAClF;KACD,CAACa,IAAI,CAAC;AAET;;;CAGC,GACD,MAAMC,kBAAkB,CAACrB,MAAYC,UAAkBM,WACrDxB,gBACEiB,MACAC,UACAX,IACE,CAAC,yEAAyE,EAAER,wBAAwB,KAAK,CAAC,GACxG,CAAC,iCAAiC,EAAEyB,SAAS,aAAa,CAAC,GAE/DY,cAAcZ;AAGlB,eAAe,eAAee,UAC5BtB,IAAU;IAEV,MAAMuB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACT,KAAKU,UAAU,IAAIf,iBAAiBT,MAAO;QACrD,MAAME,OAAO,IAAIT;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,6CAA6C;QAC7C,IAAIgC;QACJ,MAAMC,WAAW,IAAIjC;QAErB,KAAK,MAAMQ,YAAYuB,UAAW;YAChC,KAAK,MAAMjB,YAAY,CAAA,MAAMR,cAAcC,MAAMC,SAAQ,EAAG;gBAC1DC,KAAKM,GAAG,CAACD;YACX;YACA,MAAMoB,WAAW3B,KAAK4B,IAAI,CAAC3B,UAAU,YAAY;YACjD,IAAI,CAAC0B,SAASE,QAAQ,CAAC,uBAAuB;gBAC5C;YACF;YACAJ,cAAcxB;YACd,KAAK,MAAMM,YAAYuB,OAAOC,IAAI,CAAC3C,oBAAqB;gBACtD,IACE,MAAMJ,YACJgB,MACAC,UACAX,IACE,CAAC,6DAA6D,EAAEiB,SAAS,aAAa,CAAC,IAG3F;oBACAmB,SAASlB,GAAG,CAACD;gBACf;YACF;QACF;QAEA,MAAMyB,UAAU;eAAI9B;SAAK,CAAC+B,MAAM,CAAC,CAACC,IAAM,CAACR,SAASpB,GAAG,CAAC4B,IAAIC,IAAI;QAC9D,IAAIH,QAAQI,MAAM,KAAK,GAAG;YACxB;QACF;QAEA,IAAI,CAACX,WAAW;YACdF,UAAUc,IAAI,CACZ,GAAGvB,IAAI,gFAAgF,EAAEkB,QAAQZ,IAAI,CAAC,MAAM,qGAAqG,CAAC;YAEpN;QACF;QAEA,KAAK,MAAMb,YAAYyB,QAAS;YAC9B,IAAI,CAAE,MAAMX,gBAAgBrB,MAAMyB,WAAWlB,WAAY;gBACvDgB,UAAUc,IAAI,CACZ,GAAGZ,UAAU,6FAA6F,EAAElB,SAAS,qCAAqC,EAAEA,SAAS,CAAC,CAAC;YAE3K;QACF;IACF;IAEA,MAAMtB,qBAAqBe;IAE3B,OAAO;QAAEuB;IAAU;AACrB"}