@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/dist/lint/post-synth/tf036.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TF036: an EBS volume does not ask for encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW028, written natively.
+ *
+ * Absence is not determined for this resource. `aws_ebs_volume.encrypted` is
+ * optional, computed and force-new (provider `internal/service/ec2/
+ * ebs_volume.go`, v6.67.0). Whether a volume created without it is encrypted
+ * depends on the Region's EBS encryption by default
+ * (https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html),
+ * which is account state the parse cannot see, and a volume built from
+ * `snapshot_id` also follows its snapshot. So an unset `encrypted` emits one
+ * `info` diagnostic, not a finding.
+ *
+ * One configuration does settle absence: the volume `depends_on` an
+ * `aws_ebs_encryption_by_default` in the same module whose `enabled` is
+ * absent (the provider default is `true`) or literal `true`, on the same
+ * `provider` and `region`. The `depends_on` matters: without it Terraform may
+ * create the volume before it turns the default on, and the default "has no
+ * effect on existing EBS volumes".
+ *
+ * `encrypted = false` is a finding even though encryption by default would
+ * override it. The literal is wrong either way: with the default off the
+ * volume is unencrypted, and with it on AWS encrypts the volume anyway ("you
+ * cannot disable it for individual volumes"), the volume no longer matches
+ * the configuration, and because `encrypted` forces replacement Terraform
+ * plans to replace it on every apply.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf036: PostSynthCheck;
+//# sourceMappingURL=tf036.d.ts.map

package/dist/lint/post-synth/tf036.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf036.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf036.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA0B9G,eAAO,MAAM,KAAK,EAAE,cA6DnB,CAAC"}

package/dist/lint/post-synth/tf037.d.ts

@@ -0,0 +1,31 @@
+/**
+ * TF037: an ECR repository lets an image tag be repointed (chant #2288, epic
+ * #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW054, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_ecr_repository.image_tag_mutability` (provider
+ * `internal/service/ecr/repository.go`, v6.67.0) is optional with
+ * `Default: MUTABLE`, so a repository that does not set it lets anyone with
+ * push access move a tag (`prod`, `v1.4.2`) to different image content after
+ * it was deployed, scanned or signed.
+ *
+ * Provider v6 accepts four values (AWS added the two `_WITH_EXCLUSION` modes
+ * in 2025), and the rule reads them as follows:
+ *
+ * - `IMMUTABLE`: secure.
+ * - `IMMUTABLE_WITH_EXCLUSION`: secure. Tags matching an
+ *   `image_tag_mutability_exclusion_filter` stay mutable, a written-down
+ *   exception such as `latest`. A filter that is nothing but `*` excludes
+ *   every tag, so it is a finding; a filter from an expression is not
+ *   determined.
+ * - `MUTABLE`, absent, and `MUTABLE_WITH_EXCLUSION` (every tag mutable except
+ *   those the filters name): a finding.
+ * - an expression: not determined.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf037: PostSynthCheck;
+//# sourceMappingURL=tf037.d.ts.map

package/dist/lint/post-synth/tf037.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf037.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf037.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAmC9G,eAAO,MAAM,KAAK,EAAE,cAoCnB,CAAC"}

package/dist/lint/post-synth/tf038.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TF038: an `oci://` module source names no tag and no digest, or a mutable
+ * tag.
+ *
+ * OpenTofu resolves an OCI module source with no `tag` to the `latest` tag
+ * (https://opentofu.org/docs/language/modules/sources/), so an unpinned source
+ * and `?tag=latest` are the same thing: a push to the registry changes what
+ * the root provisions with no diff to review. A digest, or an exact version
+ * tag, holds it. `classifyModuleSource` (`./module-source.ts`) reads the tag
+ * and digest from either spelling.
+ *
+ * A warning rather than an error: a registry can make a version tag
+ * immutable, and a source that names `?tag=1.4.0` is read as pinned here
+ * whether or not the registry enforces that. A digest is the only pin the
+ * registry cannot move, which the message says. A source that names a digest
+ * is never flagged, whatever tag sits beside it.
+ *
+ * Scope: root and child modules alike (#2112), same as TF004 and TF005.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf038: PostSynthCheck;
+//# sourceMappingURL=tf038.d.ts.map

package/dist/lint/post-synth/tf038.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf038.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf038.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}

package/dist/lint/post-synth/tf039.d.ts

@@ -0,0 +1,23 @@
+/**
+ * TF039: a registry module's `version` is a range, not an exact version.
+ *
+ * TF004 flags a registry module with no `version`; a `version` of `~> 1.4`,
+ * `>= 1.4` or `>= 1.0, < 2.0` passes it, yet an upstream release inside the
+ * range changes what the root provisions with no diff to review. This rule is
+ * for projects that pin modules to one version (`1.4.0` or `= 1.4.0`).
+ *
+ * Off by default: it is a `report-only` catalog entry, so the `recommended`
+ * preset leaves it out and `lint.presets: { terraform: "all" }` (or a
+ * `lint.rules` entry for TF039) turns it on. Ranges are common and often
+ * intended, so a default warning would be noise for most roots. It is a
+ * separate rule from TF004 because a post-synth check receives no options
+ * (`PostSynthCheck.check(ctx)`), while the preset mechanism already carries
+ * exactly this on/off choice per rule id (#3190).
+ *
+ * A module that has no `version` is TF004's finding and is skipped here.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf039: PostSynthCheck;
+//# sourceMappingURL=tf039.d.ts.map

package/dist/lint/post-synth/tf039.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf039.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf039.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf040.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF040: a root that uses providers has no `.terraform.lock.hcl`.
+ *
+ * The lock file records the provider versions and hashes `terraform init`
+ * selected. Without it, each `init` resolves `required_providers` constraints
+ * afresh, so a provider release changes a plan with no diff. None of
+ * TF001 to TF029 looks at it.
+ *
+ * "Committed" is decided by presence: the file sits beside the root's `.tf`
+ * files in the source tree being parsed (`props.lockFile`, stamped by
+ * `parseTerraformRootDir` and by the local audit path). Whether git tracks it
+ * is not asked, so a lock file that is present but gitignored counts as
+ * committed. A parse with no directory to look in (a fetched repository,
+ * inline source) leaves `lockFile` unset and the rule reports nothing: not
+ * determined, not clean.
+ *
+ * A root that implies no provider (no `provider` block and no resource or data
+ * type) gets no lock file from `init`, so it is skipped, as is a live
+ * choudoufu root, which runs no `init`. One diagnostic per root, anchored on
+ * the first block that implies a provider.
+ *
+ * Off by default in both places: the `report-only` tier keeps it out of a
+ * build's `recommended` preset, and `auditOptIn` keeps it out of `chant audit`.
+ * Many estates run `init` in CI and never commit the file.
+ *
+ * Scope: root modules only (#2112); a child module has no lock file of its own.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf040: PostSynthCheck;
+//# sourceMappingURL=tf040.d.ts.map

package/dist/lint/post-synth/tf040.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf040.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf040.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf041.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TF041: a Terragrunt `dependency` has `mock_outputs` and lets them stand in
+ * for `apply`.
+ *
+ * `mock_outputs` is what a dependency returns when it has no outputs yet.
+ * `mock_outputs_allowed_terraform_commands` limits which commands may use
+ * them. Terragrunt reads a missing list and an empty list the same way, as no
+ * limit (`shouldReturnMockOutputs` in `pkg/config/dependency.go`, v1.1.6:
+ * `nil || len == 0 || slices.Contains(list, command)`). So a dependency with
+ * mocks and no list, or a list that names `apply`, can apply the mock values
+ * to real state when the upstream unit has not been applied, and the apply
+ * reports success. The usual list is `["validate", "plan"]`.
+ *
+ * A list that is an expression (`local.mock_commands`) is not determined and
+ * passes. A dependency with `enabled = false` returns its mocks whatever the
+ * list says; that is a different decision and is not reported here.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf041: PostSynthCheck;
+//# sourceMappingURL=tf041.d.ts.map

package/dist/lint/post-synth/tf041.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf041.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf041.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf042.d.ts

@@ -0,0 +1,18 @@
+/**
+ * TF042: a Terragrunt `dependency` sets `skip_outputs = true` and
+ * `mock_outputs`.
+ *
+ * With `skip_outputs = true` Terragrunt never reads the upstream unit's
+ * outputs (`shouldGetOutputs` in `pkg/config/dependency.go`, v1.1.6), so the
+ * only values the dependency can return are the mocks. Every plan and apply
+ * the mocks are allowed for runs on them, however far the upstream unit has
+ * been applied. The pair is sometimes meant, to break a cycle or to avoid
+ * reading state, and then the mock values are the configuration; that is
+ * worth writing as inputs, which a reader of the unit can see.
+ *
+ * Only a literal `skip_outputs = true` is reported. A `skip_outputs` built
+ * from an expression is not determined.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf042: PostSynthCheck;
+//# sourceMappingURL=tf042.d.ts.map

package/dist/lint/post-synth/tf042.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf042.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf042.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,KAAK,EAAE,cAqBnB,CAAC"}

package/dist/lint/post-synth/tf043.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TF043: a Terragrunt unit's `terraform.source` names no version.
+ *
+ * A git source with no `?ref=` follows the default branch, a `tfr://` source
+ * with no `?version=` follows the registry's latest release, and an `oci://`
+ * source with no tag or digest pulls `latest`. A push or a release changes
+ * what the unit provisions with no diff to review. TF005 and TF038 do the same
+ * for `module` blocks; a Terragrunt unit has no `module` block, its source is
+ * the `source` argument of the `terraform` block.
+ *
+ * A local path and a source built from an expression (`${local.base}//x`) are
+ * not determined and pass. A mutable `?ref=main` is not judged
+ * here: the rule asks only whether a version is named.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf043: PostSynthCheck;
+//# sourceMappingURL=tf043.d.ts.map

package/dist/lint/post-synth/tf043.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf043.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf043.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,KAAK,EAAE,cAuBnB,CAAC"}

package/dist/lint/post-synth/tf044.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TF044: a Terragrunt config keeps state in a local backend.
+ *
+ * Read from `remote_state { backend = "local" }` and from a `generate` block
+ * whose `contents` declare `backend "local"`. State on the runner's disk is
+ * gone when the job ends, a second job cannot read what the first applied, and
+ * a git-range run, which checks out each side in a temporary directory, never
+ * sees state at all. A shared backend (S3, GCS, azurerm, a Terraform HTTP
+ * backend) holds it.
+ *
+ * A backend named by an expression is not determined and passes. A local
+ * backend is sometimes right for a throwaway sandbox; suppress the rule there
+ * with `# chant-ignore TF044`.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf044: PostSynthCheck;
+//# sourceMappingURL=tf044.d.ts.map

package/dist/lint/post-synth/tf044.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf044.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf044.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G,eAAO,MAAM,KAAK,EAAE,cA6BnB,CAAC"}

package/dist/lint/post-synth/tf045.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TF045: no Terragrunt config sets `terragrunt_version_constraint`.
+ *
+ * The attribute makes Terragrunt refuse to run on a release outside the range.
+ * Without it each machine and each CI image runs whatever Terragrunt it
+ * installed, and a behaviour change between releases reaches a plan with no
+ * diff. It is usually set once, in the root config every unit includes.
+ *
+ * The rule looks at the whole set of configs in the scan and reports once. It
+ * reports only when the set holds a config that includes no other file (the
+ * root config, or a self-contained unit) and none of the configs sets the
+ * attribute. A set made only of units that include a parent it did not read,
+ * such as one unit directory passed alone, is not determined: the parent may
+ * set it. The finding is anchored on `root.hcl` when the set has one.
+ *
+ * Off by default: the `report-only` tier keeps it out of the `recommended`
+ * preset, since many repos pin Terragrunt in the toolchain (`.tool-versions`,
+ * a CI image) rather than in config.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf045: PostSynthCheck;
+//# sourceMappingURL=tf045.d.ts.map

package/dist/lint/post-synth/tf045.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf045.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf045.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,KAAK,EAAE,cAsBnB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.101.0",
+  "version": "0.104.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/okf/index.md

@@ -32,4 +32,20 @@ okf_version: '0.2'
 * [TF027](/rules/TF027.md) - Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
 * [TF028](/rules/TF028.md) - A live root is watched by a TerraformWatchOp built without live: true
 * [TF029](/rules/TF029.md) - Live root names its estate both in chant.config and in its own HCL
+* [TF030](/rules/TF030.md) - Security group rule allows unrestricted ingress on a sensitive port
+* [TF031](/rules/TF031.md) - IAM policy allows a wildcard Action or Resource
+* [TF032](/rules/TF032.md) - ECS container definition passes a credential as a plaintext environment value
+* [TF033](/rules/TF033.md) - RDS DB instance or cluster storage is not encrypted
+* [TF034](/rules/TF034.md) - SNS topic has no server-side encryption
+* [TF035](/rules/TF035.md) - SQS queue turns server-side encryption off
+* [TF036](/rules/TF036.md) - EBS volume does not ask for encryption
+* [TF037](/rules/TF037.md) - ECR repository allows mutable image tags
+* [TF038](/rules/TF038.md) - OCI module source has no tag or digest, or a mutable tag
+* [TF039](/rules/TF039.md) - Registry module version is a range, not an exact version
+* [TF040](/rules/TF040.md) - Root has no committed .terraform.lock.hcl
+* [TF041](/rules/TF041.md) - Terragrunt dependency lets mock_outputs stand in for apply
+* [TF042](/rules/TF042.md) - Terragrunt dependency sets skip_outputs together with mock_outputs
+* [TF043](/rules/TF043.md) - Terragrunt terraform.source names no version (git ref, tfr version or oci tag)
+* [TF044](/rules/TF044.md) - Terragrunt config keeps state in a local backend
+* [TF045](/rules/TF045.md) - No Terragrunt config sets terragrunt_version_constraint
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF030.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF030
+description: Security group rule allows unrestricted ingress on a sensitive port
+id: TF030
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Security group rule allows unrestricted ingress on a sensitive port

package/dist/okf/rules/TF031.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF031
+description: IAM policy allows a wildcard Action or Resource
+id: TF031
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+IAM policy allows a wildcard Action or Resource

package/dist/okf/rules/TF032.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF032
+description: ECS container definition passes a credential as a plaintext environment value
+id: TF032
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+ECS container definition passes a credential as a plaintext environment value

package/dist/okf/rules/TF033.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF033
+description: RDS DB instance or cluster storage is not encrypted
+id: TF033
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+RDS DB instance or cluster storage is not encrypted

package/dist/okf/rules/TF034.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF034
+description: SNS topic has no server-side encryption
+id: TF034
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+SNS topic has no server-side encryption

package/dist/okf/rules/TF035.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF035
+description: SQS queue turns server-side encryption off
+id: TF035
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+SQS queue turns server-side encryption off

package/dist/okf/rules/TF036.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF036
+description: EBS volume does not ask for encryption
+id: TF036
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+EBS volume does not ask for encryption

package/dist/okf/rules/TF037.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF037
+description: ECR repository allows mutable image tags
+id: TF037
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+ECR repository allows mutable image tags

package/dist/okf/rules/TF038.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF038
+description: OCI module source has no tag or digest, or a mutable tag
+id: TF038
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+OCI module source has no tag or digest, or a mutable tag

package/dist/okf/rules/TF039.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF039
+description: Registry module version is a range, not an exact version
+id: TF039
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Registry module version is a range, not an exact version

package/dist/okf/rules/TF040.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF040
+description: Root has no committed .terraform.lock.hcl
+id: TF040
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Root has no committed .terraform.lock.hcl

package/dist/okf/rules/TF041.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF041
+description: Terragrunt dependency lets mock_outputs stand in for apply
+id: TF041
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Terragrunt dependency lets mock_outputs stand in for apply

package/dist/okf/rules/TF042.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF042
+description: Terragrunt dependency sets skip_outputs together with mock_outputs
+id: TF042
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Terragrunt dependency sets skip_outputs together with mock_outputs

package/dist/okf/rules/TF043.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF043
+description: Terragrunt terraform.source names no version (git ref, tfr version or oci tag)
+id: TF043
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Terragrunt terraform.source names no version (git ref, tfr version or oci tag)

package/dist/okf/rules/TF044.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF044
+description: Terragrunt config keeps state in a local backend
+id: TF044
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Terragrunt config keeps state in a local backend

package/dist/okf/rules/TF045.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF045
+description: No Terragrunt config sets terragrunt_version_constraint
+id: TF045
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+No Terragrunt config sets terragrunt_version_constraint

package/dist/op/activities/index.d.ts

@@ -16,6 +16,8 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
+ *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
  * The module is dependency-light on purpose: it shells out to the configured
  * binary and reads the `terraform` config namespace, and never touches the
@@ -26,4 +28,6 @@
 export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
 export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
 export { detectLiveEstate } from "./live-detect.js";
+export { terraformPinRollout } from "./pin-rollout.js";
+export type { TerraformPinRolloutArgs, TerraformPinRolloutResult } from "./pin-rollout.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}

package/dist/op/activities/pin-rollout.d.ts

@@ -0,0 +1,46 @@
+/**
+ * `terraformPinRollout`: one run of a pin-bump rollout (#3189), as an Op
+ * activity. `chant terraform pin-rollout` calls the same function.
+ *
+ * Each run reads where the rollout stands on the forge and opens at most one
+ * wave's pull request (`../../pin/rollout.ts`). Run it again, by hand or on
+ * an Op `schedule`, to move on once a wave's PR has merged and its roots have
+ * applied. A run that finds a failed root or a PR closed without merging
+ * throws, naming it, so the run fails rather than reporting success.
+ *
+ * The HCL parser, the pin code and the TypeScript editor load on first call,
+ * so importing the activities loads none of them.
+ */
+import type { PinRoot, PinRolloutMode, PinRolloutResult } from "../../pin/index.js";
+export interface TerraformPinRolloutArgs {
+    /** The module, as its `source` names it without the pin: `oci://registry.example.com/modules/vpc`. */
+    module: string;
+    /** The pin the roots are at now. */
+    from: string;
+    /** The pin to move them to: an exact version, tag, ref or `sha256:` digest. */
+    to: string;
+    /** The roots, by directory relative to the repository. Default: every root that calls the module. */
+    roots?: PinRoot[];
+    /** Roots that form wave 1. */
+    canaries?: string[];
+    /** A `choudoufu live-waves -json` document to take the waves from, instead of canaries and dependency order. */
+    wavesFrom?: string;
+    /** The directory choudoufu ran in, relative to the repository, when its roots are relative to that. */
+    wavesPrefix?: string;
+    /** `report` (default) or `pull-request`. */
+    mode?: PinRolloutMode;
+    /** The branch PRs target. Default: the remote's default branch. */
+    base?: string;
+    /** Default `origin`. */
+    remote?: string;
+    /** The apply check each root reports on the merge commit, with `{root}` for its directory. Default `apply/{root}`. */
+    appliedCheck?: string;
+    /** A directory in the repository. Default: the working directory. */
+    cwd?: string;
+}
+export type TerraformPinRolloutResult = PinRolloutResult;
+/** Run one step of a pin-bump rollout. Throws when the rollout has stopped. */
+export declare function terraformPinRollout(args: TerraformPinRolloutArgs): Promise<TerraformPinRolloutResult>;
+/** The same run, returning a stopped rollout instead of throwing. `chant terraform pin-rollout` calls this. */
+export declare function readPinRollout(args: TerraformPinRolloutArgs): Promise<TerraformPinRolloutResult>;
+//# sourceMappingURL=pin-rollout.d.ts.map

package/dist/op/activities/pin-rollout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-rollout.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pin-rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACtC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,qGAAqG;IACrG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gHAAgH;IAChH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sHAAsH;IACtH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAEzD,+EAA+E;AAC/E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAI3G;AAED,+GAA+G;AAC/G,wBAAsB,cAAc,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAqBtG"}