@aws/nx-plugin 1.0.0-rc.83 → 1.0.0-rc.85

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.js

@@ -0,0 +1,86 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments } from "@nx/devkit";
+import { applyGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+/**
+ * Align each vended per-database Terraform app module
+ * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.
+ *
+ * The app module is what a root configuration instantiates and it forwards its
+ * own value down, so its default is the one that takes effect:
+ *
+ * - `enable_cloudwatch_logs` defaulted to `false` against the core module's
+ *   `true`, so Aurora exported no engine logs and the cluster parameter group
+ *   that configures them (`log_statement=ddl` on PostgreSQL,
+ *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —
+ *   the CDK construct enabled both.
+ * - `enable_key_rotation` was never declared, leaving the core module's
+ *   variable unreachable from a root configuration.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the diverged defaults until this runs. Diverged files are left untouched and
+ * reported via `nextSteps`.
+ */ const TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+const KEY_ROTATION_VARIABLE = [
+    'variable "enable_key_rotation" {',
+    '  description = "Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret."',
+    '  type        = bool',
+    '  default     = true',
+    '}'
+].join('\n');
+const divergedMessage = (filePath)=>`${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \`enable_cloudwatch_logs\` to true here, and declare an \`enable_key_rotation\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;
+const OLD_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';
+const NEW_LOGS_DESCRIPTION = 'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';
+/**
+ * Flip the app module's `enable_cloudwatch_logs` default to match the core
+ * module, and replace the description that documented the old behaviour.
+ *
+ * Keyed on that description, which is the only thing distinguishing the vended
+ * `default = false` from a user who deliberately turned log export off.
+ */ const migrateCloudwatchLogsDefault = (tree, filePath)=>applyGritQL(tree, filePath, hcl(`\`variable "enable_cloudwatch_logs" { $props }\` where {` + ` $props <: contains \`description = "${OLD_LOGS_DESCRIPTION}"\` => \`description = "${NEW_LOGS_DESCRIPTION}"\`,` + ` $props <: contains \`default = false\` => \`default = true\`` + ` }`));
+/**
+ * Declare `enable_key_rotation` and forward it to the core aurora module, so a
+ * root configuration can reach the variable the core module already exposes.
+ */ const migrateKeyRotationVariable = async (tree, filePath)=>{
+    if (await matchGritQL(tree, filePath, hcl('`variable "enable_key_rotation" { $_ }`'))) {
+        return; // Already declared.
+    }
+    const declared = await insertViaGritQL(tree, filePath, hcl(`\`variable "enable_backup" { $props }\` => \`variable "enable_backup" {\n  $props\n}\n\n${GRIT_INSERT_PLACEHOLDER}\``), KEY_ROTATION_VARIABLE);
+    if (!declared) return;
+    // Appended after the existing arguments so their alignment is preserved;
+    // `terraform fmt` re-aligns the block.
+    await applyGritQL(tree, filePath, hcl(`\`module "aurora" { $props }\` => \`module "aurora" {\n  $props\n\n  enable_key_rotation = var.enable_key_rotation\n}\``));
+};
+export default async function migration(tree) {
+    const nextSteps = [];
+    if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {
+        return {
+            nextSteps
+        }; // This workspace has no Terraform database modules.
+    }
+    for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)){
+        const filePath = joinPathFragments(TERRAFORM_DBS_APP_DIR, dirName, `${dirName}.tf`);
+        if (!tree.exists(filePath)) {
+            continue; // Not a database app module directory.
+        }
+        // Both edits hang off the shape the generator produces: the two variables
+        // and the module call that forwards them.
+        const recognised = await matchGritQL(tree, filePath, hcl('`variable "enable_cloudwatch_logs" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`variable "enable_backup" { $_ }`')) && await matchGritQL(tree, filePath, hcl('`module "aurora" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }'));
+        if (!recognised) {
+            nextSteps.push(divergedMessage(filePath));
+            continue;
+        }
+        await migrateCloudwatchLogsDefault(tree, filePath);
+        await migrateKeyRotationVariable(tree, filePath);
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/rdb-terraform-aurora-app-module-defaults/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport {\n  applyGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\n\n/**\n * Align each vended per-database Terraform app module\n * (`app/dbs/<name>/<name>.tf`) with the core Aurora module it wraps.\n *\n * The app module is what a root configuration instantiates and it forwards its\n * own value down, so its default is the one that takes effect:\n *\n * - `enable_cloudwatch_logs` defaulted to `false` against the core module's\n *   `true`, so Aurora exported no engine logs and the cluster parameter group\n *   that configures them (`log_statement=ddl` on PostgreSQL,\n *   `server_audit_events=CONNECT,QUERY_DDL` on MySQL) was never created —\n *   the CDK construct enabled both.\n * - `enable_key_rotation` was never declared, leaving the core module's\n *   variable unreachable from a root configuration.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the diverged defaults until this runs. Diverged files are left untouched and\n * reported via `nextSteps`.\n */\n\nconst TERRAFORM_DBS_APP_DIR = `${PACKAGES_DIR}/${SHARED_TERRAFORM_DIR}/src/app/dbs`;\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\nconst KEY_ROTATION_VARIABLE = [\n  'variable \"enable_key_rotation\" {',\n  '  description = \"Whether to enable automatic key rotation on the KMS key used to encrypt the Aurora cluster and its credentials secret.\"',\n  '  type        = bool',\n  '  default     = true',\n  '}',\n].join('\\n');\n\nconst divergedMessage = (filePath: string) =>\n  `${filePath}: has diverged from the generated shape - left untouched. To export Aurora engine logs to CloudWatch as the CDK construct and the core Terraform module do, default \\`enable_cloudwatch_logs\\` to true here, and declare an \\`enable_key_rotation\\` variable (bool, default true) forwarded to the aurora module (see the ts#rdb generator's dbs app template).`;\n\nconst OLD_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL also enables verbose statement logging.';\nconst NEW_LOGS_DESCRIPTION =\n  'Whether to export Aurora engine logs to CloudWatch. PostgreSQL logs DDL statements only (log_statement=ddl); MySQL enables Advanced Auditing scoped to connections and DDL (server_audit_events=CONNECT,QUERY_DDL). Neither logs statement parameter values, to avoid leaking PII into log data.';\n\n/**\n * Flip the app module's `enable_cloudwatch_logs` default to match the core\n * module, and replace the description that documented the old behaviour.\n *\n * Keyed on that description, which is the only thing distinguishing the vended\n * `default = false` from a user who deliberately turned log export off.\n */\nconst migrateCloudwatchLogsDefault = (tree: Tree, filePath: string) =>\n  applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_cloudwatch_logs\" { $props }\\` where {` +\n        ` $props <: contains \\`description = \"${OLD_LOGS_DESCRIPTION}\"\\` => \\`description = \"${NEW_LOGS_DESCRIPTION}\"\\`,` +\n        ` $props <: contains \\`default = false\\` => \\`default = true\\`` +\n        ` }`,\n    ),\n  );\n\n/**\n * Declare `enable_key_rotation` and forward it to the core aurora module, so a\n * root configuration can reach the variable the core module already exposes.\n */\nconst migrateKeyRotationVariable = async (\n  tree: Tree,\n  filePath: string,\n): Promise<void> => {\n  if (\n    await matchGritQL(\n      tree,\n      filePath,\n      hcl('`variable \"enable_key_rotation\" { $_ }`'),\n    )\n  ) {\n    return; // Already declared.\n  }\n\n  const declared = await insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`variable \"enable_backup\" { $props }\\` => \\`variable \"enable_backup\" {\\n  $props\\n}\\n\\n${GRIT_INSERT_PLACEHOLDER}\\``,\n    ),\n    KEY_ROTATION_VARIABLE,\n  );\n  if (!declared) return;\n\n  // Appended after the existing arguments so their alignment is preserved;\n  // `terraform fmt` re-aligns the block.\n  await applyGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`module \"aurora\" { $props }\\` => \\`module \"aurora\" {\\n  $props\\n\\n  enable_key_rotation = var.enable_key_rotation\\n}\\``,\n    ),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  if (!tree.exists(TERRAFORM_DBS_APP_DIR)) {\n    return { nextSteps }; // This workspace has no Terraform database modules.\n  }\n\n  for (const dirName of tree.children(TERRAFORM_DBS_APP_DIR)) {\n    const filePath = joinPathFragments(\n      TERRAFORM_DBS_APP_DIR,\n      dirName,\n      `${dirName}.tf`,\n    );\n    if (!tree.exists(filePath)) {\n      continue; // Not a database app module directory.\n    }\n\n    // Both edits hang off the shape the generator produces: the two variables\n    // and the module call that forwards them.\n    const recognised =\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_cloudwatch_logs\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl('`variable \"enable_backup\" { $_ }`'),\n      )) &&\n      (await matchGritQL(\n        tree,\n        filePath,\n        hcl(\n          '`module \"aurora\" { $props }` where { $props <: contains `enable_cloudwatch_logs = var.enable_cloudwatch_logs` }',\n        ),\n      ));\n\n    if (!recognised) {\n      nextSteps.push(divergedMessage(filePath));\n      continue;\n    }\n\n    await migrateCloudwatchLogsDefault(tree, filePath);\n    await migrateKeyRotationVariable(tree, filePath);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","applyGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_DBS_APP_DIR","hcl","pattern","KEY_ROTATION_VARIABLE","join","divergedMessage","filePath","OLD_LOGS_DESCRIPTION","NEW_LOGS_DESCRIPTION","migrateCloudwatchLogsDefault","tree","migrateKeyRotationVariable","declared","migration","nextSteps","exists","dirName","children","recognised","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,QAGZ,aAAa;AACpB,SACEC,WAAW,EACXC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AAEvD;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,wBAAwB,GAAGF,aAAa,CAAC,EAAEC,qBAAqB,YAAY,CAAC;AAEnF,MAAME,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;CACD,CAACC,IAAI,CAAC;AAEP,MAAMC,kBAAkB,CAACC,WACvB,GAAGA,SAAS,+VAA+V,CAAC;AAE9W,MAAMC,uBACJ;AACF,MAAMC,uBACJ;AAEF;;;;;;CAMC,GACD,MAAMC,+BAA+B,CAACC,MAAYJ,WAChDb,YACEiB,MACAJ,UACAL,IACE,CAAC,wDAAwD,CAAC,GACxD,CAAC,qCAAqC,EAAEM,qBAAqB,wBAAwB,EAAEC,qBAAqB,IAAI,CAAC,GACjH,CAAC,6DAA6D,CAAC,GAC/D,CAAC,EAAE,CAAC;AAIZ;;;CAGC,GACD,MAAMG,6BAA6B,OACjCD,MACAJ;IAEA,IACE,MAAMV,YACJc,MACAJ,UACAL,IAAI,6CAEN;QACA,QAAQ,oBAAoB;IAC9B;IAEA,MAAMW,WAAW,MAAMjB,gBACrBe,MACAJ,UACAL,IACE,CAAC,wFAAwF,EAAEP,wBAAwB,EAAE,CAAC,GAExHS;IAEF,IAAI,CAACS,UAAU;IAEf,yEAAyE;IACzE,uCAAuC;IACvC,MAAMnB,YACJiB,MACAJ,UACAL,IACE,CAAC,uHAAuH,CAAC;AAG/H;AAEA,eAAe,eAAeY,UAC5BH,IAAU;IAEV,MAAMI,YAAsB,EAAE;IAE9B,IAAI,CAACJ,KAAKK,MAAM,CAACf,wBAAwB;QACvC,OAAO;YAAEc;QAAU,GAAG,oDAAoD;IAC5E;IAEA,KAAK,MAAME,WAAWN,KAAKO,QAAQ,CAACjB,uBAAwB;QAC1D,MAAMM,WAAWd,kBACfQ,uBACAgB,SACA,GAAGA,QAAQ,GAAG,CAAC;QAEjB,IAAI,CAACN,KAAKK,MAAM,CAACT,WAAW;YAC1B,UAAU,uCAAuC;QACnD;QAEA,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAMY,aACJ,AAAC,MAAMtB,YACLc,MACAJ,UACAL,IAAI,kDAEL,MAAML,YACLc,MACAJ,UACAL,IAAI,yCAEL,MAAML,YACLc,MACAJ,UACAL,IACE;QAIN,IAAI,CAACiB,YAAY;YACfJ,UAAUK,IAAI,CAACd,gBAAgBC;YAC/B;QACF;QAEA,MAAMG,6BAA6BC,MAAMJ;QACzC,MAAMK,2BAA2BD,MAAMJ;IACzC;IAEA,MAAMT,qBAAqBa;IAE3B,OAAO;QAAEI;IAAU;AACrB"}

package/src/migrations/latest/terraform-declare-used-providers/metadata.json

@@ -0,0 +1,3 @@
+{
+  "description": "Declare every provider each vended Terraform module uses in its own required_providers"
+}

package/src/migrations/latest/terraform-declare-used-providers/migration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type MigrationReturnObject, type Tree } from '@nx/devkit';
+export default function migration(tree: Tree): Promise<MigrationReturnObject>;

package/src/migrations/latest/terraform-declare-used-providers/migration.js

@@ -0,0 +1,147 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { joinPathFragments, visitNotIgnoredFiles } from "@nx/devkit";
+import { captureAllGritQL, GRIT_INSERT_PLACEHOLDER, insertViaGritQL, matchGritQL } from "../../../utils/ast.js";
+import { formatFilesInSubtree } from "../../../utils/format.js";
+import { PACKAGES_DIR, SHARED_TERRAFORM_DIR } from "../../../utils/shared-constructs-constants.js";
+import { TERRAFORM_VERSIONS } from "../../../utils/versions.js";
+/**
+ * Declare every provider each vended Terraform module uses in its own
+ * `required_providers`.
+ *
+ * A provider a module uses but never declares is resolved by implicit
+ * inheritance from the root module, unpinned — so `terraform init` on that
+ * module takes whatever the registry serves, bypassing the version pinning the
+ * generators vend. Several vended modules referenced `random`, `archive`,
+ * `null`, `external` and `aws` without declaring them.
+ *
+ * These files are generated with `KeepExisting`, so an upgraded workspace keeps
+ * the unpinned shape until this runs. Each missing provider is added to the
+ * module's existing `required_providers`; a module with no `terraform` block at
+ * all is reported via `nextSteps` rather than having one inserted, since where
+ * it belongs depends on how the user has arranged the file.
+ */ const TERRAFORM_SRC = joinPathFragments(PACKAGES_DIR, SHARED_TERRAFORM_DIR, 'src');
+const hcl = (pattern)=>`language hcl\n${pattern}`;
+/** Providers built in to Terraform, which have no entry and no version. */ const BUILTIN_TYPES = new Set([
+    'terraform_data',
+    'terraform_remote_state'
+]);
+/**
+ * The provider a resource or data source type resolves to. Terraform derives
+ * this from the type's first underscore-delimited word; a type it can't
+ * attribute to a provider the plugin vends is not this migration's to touch.
+ */ const providerOf = (type)=>{
+    // `null_resource` and `external` are the whole type, not a prefixed one.
+    if (type === 'null_resource') {
+        return 'null';
+    }
+    if (type === 'external') {
+        return 'external';
+    }
+    const [prefix] = type.split('_');
+    return prefix in TERRAFORM_VERSIONS ? prefix : undefined;
+};
+/**
+ * The providers a module requires, read from its `resource` and `data` blocks.
+ *
+ * Only declarations are read, because Terraform resolves a resource reference
+ * within the module that declares it — so a provider a module references is one
+ * it also declares a block for, and the blocks alone are complete. Matching the
+ * syntax tree also means a type named in a comment, in string prose or inside a
+ * `local-exec` heredoc's embedded Python is not a use, since none of those parse
+ * as a block.
+ */ const usedProviders = async (tree, filePath)=>{
+    const used = new Set();
+    for (const kind of [
+        'resource',
+        'data'
+    ]){
+        for (const block of (await captureAllGritQL(tree, filePath, hcl(`\`${kind} $type $name { $_ }\``)))){
+            // The block's own type, e.g. `resource "random_string" "suffix" {`.
+            const type = /"([A-Za-z0-9_]+)"/.exec(block)?.[1];
+            if (!type || BUILTIN_TYPES.has(type)) {
+                continue;
+            }
+            const provider = providerOf(type);
+            if (provider) {
+                used.add(provider);
+            }
+        }
+    }
+    return used;
+};
+/** Every `.tf` file in the workspace's shared terraform library, by directory. */ const terraformModules = (tree)=>{
+    const modules = new Map();
+    if (!tree.exists(TERRAFORM_SRC)) {
+        return modules;
+    }
+    visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath)=>{
+        if (!filePath.endsWith('.tf')) {
+            return;
+        }
+        const dir = filePath.slice(0, filePath.lastIndexOf('/'));
+        modules.set(dir, [
+            ...modules.get(dir) ?? [],
+            filePath
+        ]);
+    });
+    return modules;
+};
+/** The provider entry to vend, at the version this release pins. */ const providerEntry = (provider)=>[
+        `${provider} = {`,
+        `  source  = "hashicorp/${provider}"`,
+        `  version = "${TERRAFORM_VERSIONS[provider]}"`,
+        '}'
+    ].join('\n');
+/**
+ * Add a provider to a file's `required_providers`. Appended after the block's
+ * existing body, so an entry the user has customised is left as it is.
+ */ const declareProvider = (tree, filePath, provider)=>insertViaGritQL(tree, filePath, hcl(`\`required_providers { $body }\` => \`required_providers {\n  $body\n\n  ${GRIT_INSERT_PLACEHOLDER}\n}\`` + ` where { $body <: not contains \`${provider} = { $_ }\` }`), providerEntry(provider));
+export default async function migration(tree) {
+    const nextSteps = [];
+    for (const [dir, filePaths] of terraformModules(tree)){
+        const used = new Set();
+        // The file holding the module's `required_providers`, which is where the
+        // missing declarations are added — Terraform merges every `.tf` in a
+        // directory, so one block covers the module.
+        let blockFile;
+        const declared = new Set();
+        for (const filePath of filePaths){
+            for (const provider of (await usedProviders(tree, filePath))){
+                used.add(provider);
+            }
+            const contents = tree.read(filePath, 'utf-8') ?? '';
+            if (!contents.includes('required_providers')) {
+                continue;
+            }
+            blockFile ??= filePath;
+            for (const provider of Object.keys(TERRAFORM_VERSIONS)){
+                if (await matchGritQL(tree, filePath, hcl(`\`required_providers { $body }\` where { $body <: contains \`${provider} = { $_ }\` }`))) {
+                    declared.add(provider);
+                }
+            }
+        }
+        const missing = [
+            ...used
+        ].filter((p)=>!declared.has(p)).sort();
+        if (missing.length === 0) {
+            continue;
+        }
+        if (!blockFile) {
+            nextSteps.push(`${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`);
+            continue;
+        }
+        for (const provider of missing){
+            if (!await declareProvider(tree, blockFile, provider)) {
+                nextSteps.push(`${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`);
+            }
+        }
+    }
+    await formatFilesInSubtree(tree);
+    return {
+        nextSteps
+    };
+}
+
+//# sourceMappingURL=migration.js.map

package/src/migrations/latest/terraform-declare-used-providers/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/latest/terraform-declare-used-providers/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n  visitNotIgnoredFiles,\n} from '@nx/devkit';\nimport {\n  captureAllGritQL,\n  GRIT_INSERT_PLACEHOLDER,\n  insertViaGritQL,\n  matchGritQL,\n} from '../../../utils/ast.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport {\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n} from '../../../utils/shared-constructs-constants.js';\nimport { TERRAFORM_VERSIONS } from '../../../utils/versions.js';\n\n/**\n * Declare every provider each vended Terraform module uses in its own\n * `required_providers`.\n *\n * A provider a module uses but never declares is resolved by implicit\n * inheritance from the root module, unpinned — so `terraform init` on that\n * module takes whatever the registry serves, bypassing the version pinning the\n * generators vend. Several vended modules referenced `random`, `archive`,\n * `null`, `external` and `aws` without declaring them.\n *\n * These files are generated with `KeepExisting`, so an upgraded workspace keeps\n * the unpinned shape until this runs. Each missing provider is added to the\n * module's existing `required_providers`; a module with no `terraform` block at\n * all is reported via `nextSteps` rather than having one inserted, since where\n * it belongs depends on how the user has arranged the file.\n */\n\nconst TERRAFORM_SRC = joinPathFragments(\n  PACKAGES_DIR,\n  SHARED_TERRAFORM_DIR,\n  'src',\n);\n\nconst hcl = (pattern: string) => `language hcl\\n${pattern}`;\n\n/** Providers built in to Terraform, which have no entry and no version. */\nconst BUILTIN_TYPES = new Set(['terraform_data', 'terraform_remote_state']);\n\n/**\n * The provider a resource or data source type resolves to. Terraform derives\n * this from the type's first underscore-delimited word; a type it can't\n * attribute to a provider the plugin vends is not this migration's to touch.\n */\nconst providerOf = (type: string): string | undefined => {\n  // `null_resource` and `external` are the whole type, not a prefixed one.\n  if (type === 'null_resource') {\n    return 'null';\n  }\n  if (type === 'external') {\n    return 'external';\n  }\n  const [prefix] = type.split('_');\n  return prefix in TERRAFORM_VERSIONS ? prefix : undefined;\n};\n\n/**\n * The providers a module requires, read from its `resource` and `data` blocks.\n *\n * Only declarations are read, because Terraform resolves a resource reference\n * within the module that declares it — so a provider a module references is one\n * it also declares a block for, and the blocks alone are complete. Matching the\n * syntax tree also means a type named in a comment, in string prose or inside a\n * `local-exec` heredoc's embedded Python is not a use, since none of those parse\n * as a block.\n */\nconst usedProviders = async (\n  tree: Tree,\n  filePath: string,\n): Promise<Set<string>> => {\n  const used = new Set<string>();\n  for (const kind of ['resource', 'data']) {\n    for (const block of await captureAllGritQL(\n      tree,\n      filePath,\n      hcl(`\\`${kind} $type $name { $_ }\\``),\n    )) {\n      // The block's own type, e.g. `resource \"random_string\" \"suffix\" {`.\n      const type = /\"([A-Za-z0-9_]+)\"/.exec(block)?.[1];\n      if (!type || BUILTIN_TYPES.has(type)) {\n        continue;\n      }\n      const provider = providerOf(type);\n      if (provider) {\n        used.add(provider);\n      }\n    }\n  }\n  return used;\n};\n\n/** Every `.tf` file in the workspace's shared terraform library, by directory. */\nconst terraformModules = (tree: Tree): Map<string, string[]> => {\n  const modules = new Map<string, string[]>();\n  if (!tree.exists(TERRAFORM_SRC)) {\n    return modules;\n  }\n  visitNotIgnoredFiles(tree, TERRAFORM_SRC, (filePath) => {\n    if (!filePath.endsWith('.tf')) {\n      return;\n    }\n    const dir = filePath.slice(0, filePath.lastIndexOf('/'));\n    modules.set(dir, [...(modules.get(dir) ?? []), filePath]);\n  });\n  return modules;\n};\n\n/** The provider entry to vend, at the version this release pins. */\nconst providerEntry = (provider: string) =>\n  [\n    `${provider} = {`,\n    `  source  = \"hashicorp/${provider}\"`,\n    `  version = \"${TERRAFORM_VERSIONS[provider as keyof typeof TERRAFORM_VERSIONS]}\"`,\n    '}',\n  ].join('\\n');\n\n/**\n * Add a provider to a file's `required_providers`. Appended after the block's\n * existing body, so an entry the user has customised is left as it is.\n */\nconst declareProvider = (tree: Tree, filePath: string, provider: string) =>\n  insertViaGritQL(\n    tree,\n    filePath,\n    hcl(\n      `\\`required_providers { $body }\\` => \\`required_providers {\\n  $body\\n\\n  ${GRIT_INSERT_PLACEHOLDER}\\n}\\`` +\n        ` where { $body <: not contains \\`${provider} = { $_ }\\` }`,\n    ),\n    providerEntry(provider),\n  );\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [dir, filePaths] of terraformModules(tree)) {\n    const used = new Set<string>();\n    // The file holding the module's `required_providers`, which is where the\n    // missing declarations are added — Terraform merges every `.tf` in a\n    // directory, so one block covers the module.\n    let blockFile: string | undefined;\n    const declared = new Set<string>();\n\n    for (const filePath of filePaths) {\n      for (const provider of await usedProviders(tree, filePath)) {\n        used.add(provider);\n      }\n      const contents = tree.read(filePath, 'utf-8') ?? '';\n      if (!contents.includes('required_providers')) {\n        continue;\n      }\n      blockFile ??= filePath;\n      for (const provider of Object.keys(TERRAFORM_VERSIONS)) {\n        if (\n          await matchGritQL(\n            tree,\n            filePath,\n            hcl(\n              `\\`required_providers { $body }\\` where { $body <: contains \\`${provider} = { $_ }\\` }`,\n            ),\n          )\n        ) {\n          declared.add(provider);\n        }\n      }\n    }\n\n    const missing = [...used].filter((p) => !declared.has(p)).sort();\n    if (missing.length === 0) {\n      continue;\n    }\n\n    if (!blockFile) {\n      nextSteps.push(\n        `${dir}: has no terraform required_providers block - left untouched. Add one declaring ${missing.join(', ')}, so the module pins the providers it uses rather than inheriting them unpinned from the root module.`,\n      );\n      continue;\n    }\n\n    for (const provider of missing) {\n      if (!(await declareProvider(tree, blockFile, provider))) {\n        nextSteps.push(\n          `${blockFile}: its required_providers block has diverged from the generated shape - left untouched. Add a ${provider} entry to it, sourced from hashicorp/${provider}.`,\n        );\n      }\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["joinPathFragments","visitNotIgnoredFiles","captureAllGritQL","GRIT_INSERT_PLACEHOLDER","insertViaGritQL","matchGritQL","formatFilesInSubtree","PACKAGES_DIR","SHARED_TERRAFORM_DIR","TERRAFORM_VERSIONS","TERRAFORM_SRC","hcl","pattern","BUILTIN_TYPES","Set","providerOf","type","prefix","split","undefined","usedProviders","tree","filePath","used","kind","block","exec","has","provider","add","terraformModules","modules","Map","exists","endsWith","dir","slice","lastIndexOf","set","get","providerEntry","join","declareProvider","migration","nextSteps","filePaths","blockFile","declared","contents","read","includes","Object","keys","missing","filter","p","sort","length","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,iBAAiB,EAGjBC,oBAAoB,QACf,aAAa;AACpB,SACEC,gBAAgB,EAChBC,uBAAuB,EACvBC,eAAe,EACfC,WAAW,QACN,wBAAwB;AAC/B,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SACEC,YAAY,EACZC,oBAAoB,QACf,gDAAgD;AACvD,SAASC,kBAAkB,QAAQ,6BAA6B;AAEhE;;;;;;;;;;;;;;;CAeC,GAED,MAAMC,gBAAgBV,kBACpBO,cACAC,sBACA;AAGF,MAAMG,MAAM,CAACC,UAAoB,CAAC,cAAc,EAAEA,SAAS;AAE3D,yEAAyE,GACzE,MAAMC,gBAAgB,IAAIC,IAAI;IAAC;IAAkB;CAAyB;AAE1E;;;;CAIC,GACD,MAAMC,aAAa,CAACC;IAClB,yEAAyE;IACzE,IAAIA,SAAS,iBAAiB;QAC5B,OAAO;IACT;IACA,IAAIA,SAAS,YAAY;QACvB,OAAO;IACT;IACA,MAAM,CAACC,OAAO,GAAGD,KAAKE,KAAK,CAAC;IAC5B,OAAOD,UAAUR,qBAAqBQ,SAASE;AACjD;AAEA;;;;;;;;;CASC,GACD,MAAMC,gBAAgB,OACpBC,MACAC;IAEA,MAAMC,OAAO,IAAIT;IACjB,KAAK,MAAMU,QAAQ;QAAC;QAAY;KAAO,CAAE;QACvC,KAAK,MAAMC,SAAS,CAAA,MAAMvB,iBACxBmB,MACAC,UACAX,IAAI,CAAC,EAAE,EAAEa,KAAK,qBAAqB,CAAC,EACtC,EAAG;YACD,oEAAoE;YACpE,MAAMR,OAAO,oBAAoBU,IAAI,CAACD,QAAQ,CAAC,EAAE;YACjD,IAAI,CAACT,QAAQH,cAAcc,GAAG,CAACX,OAAO;gBACpC;YACF;YACA,MAAMY,WAAWb,WAAWC;YAC5B,IAAIY,UAAU;gBACZL,KAAKM,GAAG,CAACD;YACX;QACF;IACF;IACA,OAAOL;AACT;AAEA,gFAAgF,GAChF,MAAMO,mBAAmB,CAACT;IACxB,MAAMU,UAAU,IAAIC;IACpB,IAAI,CAACX,KAAKY,MAAM,CAACvB,gBAAgB;QAC/B,OAAOqB;IACT;IACA9B,qBAAqBoB,MAAMX,eAAe,CAACY;QACzC,IAAI,CAACA,SAASY,QAAQ,CAAC,QAAQ;YAC7B;QACF;QACA,MAAMC,MAAMb,SAASc,KAAK,CAAC,GAAGd,SAASe,WAAW,CAAC;QACnDN,QAAQO,GAAG,CAACH,KAAK;eAAKJ,QAAQQ,GAAG,CAACJ,QAAQ,EAAE;YAAGb;SAAS;IAC1D;IACA,OAAOS;AACT;AAEA,kEAAkE,GAClE,MAAMS,gBAAgB,CAACZ,WACrB;QACE,GAAGA,SAAS,IAAI,CAAC;QACjB,CAAC,uBAAuB,EAAEA,SAAS,CAAC,CAAC;QACrC,CAAC,aAAa,EAAEnB,kBAAkB,CAACmB,SAA4C,CAAC,CAAC,CAAC;QAClF;KACD,CAACa,IAAI,CAAC;AAET;;;CAGC,GACD,MAAMC,kBAAkB,CAACrB,MAAYC,UAAkBM,WACrDxB,gBACEiB,MACAC,UACAX,IACE,CAAC,yEAAyE,EAAER,wBAAwB,KAAK,CAAC,GACxG,CAAC,iCAAiC,EAAEyB,SAAS,aAAa,CAAC,GAE/DY,cAAcZ;AAGlB,eAAe,eAAee,UAC5BtB,IAAU;IAEV,MAAMuB,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAACT,KAAKU,UAAU,IAAIf,iBAAiBT,MAAO;QACrD,MAAME,OAAO,IAAIT;QACjB,yEAAyE;QACzE,qEAAqE;QACrE,6CAA6C;QAC7C,IAAIgC;QACJ,MAAMC,WAAW,IAAIjC;QAErB,KAAK,MAAMQ,YAAYuB,UAAW;YAChC,KAAK,MAAMjB,YAAY,CAAA,MAAMR,cAAcC,MAAMC,SAAQ,EAAG;gBAC1DC,KAAKM,GAAG,CAACD;YACX;YACA,MAAMoB,WAAW3B,KAAK4B,IAAI,CAAC3B,UAAU,YAAY;YACjD,IAAI,CAAC0B,SAASE,QAAQ,CAAC,uBAAuB;gBAC5C;YACF;YACAJ,cAAcxB;YACd,KAAK,MAAMM,YAAYuB,OAAOC,IAAI,CAAC3C,oBAAqB;gBACtD,IACE,MAAMJ,YACJgB,MACAC,UACAX,IACE,CAAC,6DAA6D,EAAEiB,SAAS,aAAa,CAAC,IAG3F;oBACAmB,SAASlB,GAAG,CAACD;gBACf;YACF;QACF;QAEA,MAAMyB,UAAU;eAAI9B;SAAK,CAAC+B,MAAM,CAAC,CAACC,IAAM,CAACR,SAASpB,GAAG,CAAC4B,IAAIC,IAAI;QAC9D,IAAIH,QAAQI,MAAM,KAAK,GAAG;YACxB;QACF;QAEA,IAAI,CAACX,WAAW;YACdF,UAAUc,IAAI,CACZ,GAAGvB,IAAI,gFAAgF,EAAEkB,QAAQZ,IAAI,CAAC,MAAM,qGAAqG,CAAC;YAEpN;QACF;QAEA,KAAK,MAAMb,YAAYyB,QAAS;YAC9B,IAAI,CAAE,MAAMX,gBAAgBrB,MAAMyB,WAAWlB,WAAY;gBACvDgB,UAAUc,IAAI,CACZ,GAAGZ,UAAU,6FAA6F,EAAElB,SAAS,qCAAqC,EAAEA,SAAS,CAAC,CAAC;YAE3K;QACF;IACF;IAEA,MAAMtB,qBAAqBe;IAE3B,OAAO;QAAEuB;IAAU;AACrB"}