@intentius/chant-lexicon-terraform 0.105.1 → 0.106.1

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9bcc2f2626fed67d9687c013e667c8a648f5a0af7cc46b256145f84472b12c3c",
+    "manifest.json": "88dd9c9a9374f8880f3ec2028254efa12d37a931f7ab2dd40313a08687844670",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -31,7 +31,7 @@
     "rules/tf019.ts": "ae1841a358e5b7a3f42c484f0b5cf1c1f5aa845a50516969a46d65b13e282951",
     "rules/tf020.ts": "2210815c355e37459c34de0fe622f0b87b78010ee7c444135cf5abf7e048adf7",
     "rules/tf021.ts": "ad3cd813a289437d33da866927697077e7a5b20f3c05341325193d286b57bbd5",
-    "rules/tf022.ts": "87483762b02e947aba94ec9b79fb9bf4dd6442287d602836306bc66b4a239a35",
+    "rules/tf022.ts": "5466797cd88fd5489f6c5abd1e796d7c5d3d0e977d0e9e043d253f6ecf369cdc",
     "rules/tf024.ts": "c0c101f913bd3d0fdb5403ee57888e80d8fc612e363f0eb43d7ae759ac1d5651",
     "rules/tf025.ts": "0c31be3885e940e2b3e9ac8e023067d8d6e2b42c04f628890405c9fc6db7d1ce",
     "rules/tf026.ts": "8cf1e61bc9563aa2d3c149f243ffa02ad4f183eebb672f861cd6c4e6fba1d310",
@@ -56,5 +56,5 @@
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "d5a10541b312d0d4af01f0fef77394bcbaae24b5ad2a6b973dd189ec237c6c5f"
+  "composite": "88c99f7360817f2de33f2eef527c4778e223db4679dd3cebde3649dd53652631"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.105.1",
+  "version": "0.106.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/rules/tf022.ts

@@ -50,7 +50,7 @@ export const tf022: PostSynthCheck = {
             "characters, redacted here). The value is in git history, in state, and in plan output. " +
             "Replace it with a reference: a `sensitive` variable, or a data source that reads the " +
             "value from a secret manager at apply time.",
-          entity: `${block.key}.${attr.path}`,
+          entity: block.key,
           lexicon: "terraform",
         });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.105.1",
+  "version": "0.106.1",
   "type": "module",
   "files": [
     "src/",
@@ -67,7 +67,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.105.1",
+    "@intentius/chant": "^0.106.1",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   },

package/src/change-set-combined-run.test.ts

@@ -8,7 +8,8 @@
  *
  * The plans are the real fixtures the adapter tests pin: chant's `lifecycle
  * plan --json` against floci (`packages/core/src/__fixtures__/change-set`),
- * choudoufu 0.16.0's `show -json` and the warden's reconcile change set. The
+ * choudoufu 0.16.0's `show -json` and the change sets github-warden's
+ * `reconcile --plan-json` wrote (`warden.plan.json`, github-warden#66). The
  * two planner activities that need a cloud are stand-ins returning what the
  * real ones return for those plans. `composeChangeSet` and
  * `readChangeSetPart` are the real activities. The scenario is #2300's on a

package/src/changed-roots.test.ts

@@ -56,3 +56,29 @@ describe("changedRoots", () => {
     expect(changedRoots(project, ROOTS, ["README.md", "roots/netsplit/main.tf"])).toEqual([]);
   });
 });
+
+describe("changedRoots in a workspace member (#3465)", () => {
+  // The project is a member at infra/network. Its root calls a module that
+  // lives outside the member, and the changed files come relative to the
+  // member, so a file outside it reads `../...`.
+  const repo = mkdtempSync(join(tmpdir(), "chant-changed-roots-member-"));
+  afterAll(() => rmSync(repo, { recursive: true, force: true }));
+  const put = (path: string, text: string): void => {
+    mkdirSync(dirname(join(repo, path)), { recursive: true });
+    writeFileSync(join(repo, path), text);
+  };
+  put("infra/network/roots/vpc/main.tf", 'module "base" {\n  source = "../../../../shared/modules/base"\n}\n');
+  put("shared/modules/base/main.tf", "");
+  put("apps/web/main.tf", "");
+  const member = join(repo, "infra/network");
+  const roots = { vpc: { dir: "roots/vpc" } };
+
+  test("a module outside the member is watched by a path that leaves it", () => {
+    expect(rootWatchPaths(member, roots.vpc)).toEqual(["../../shared/modules/base", "roots/vpc"]);
+  });
+
+  test("a change to that module touches the root; a change in another member touches nothing", () => {
+    expect(changedRoots(member, roots, ["../../shared/modules/base/main.tf"])).toEqual(["vpc"]);
+    expect(changedRoots(member, roots, ["../../apps/web/main.tf"])).toEqual([]);
+  });
+});

package/src/lint/post-synth/single-block.test.ts

@@ -243,9 +243,10 @@ describe("TF022: credential-named resource attribute holding a literal", () => {
   test("flags the plaintext password", async () => {
     const diags = tf022.check(await loadFixture("TF022", "positive"));
     expect(diags).toHaveLength(1);
-    expect(diags[0].entity).toBe("TF022/aws_db_instance.app.password");
+    expect(diags[0].entity).toBe("TF022/aws_db_instance.app");
     expect(diags[0].message).not.toContain("Pr0dDbP4ssw0rd");
     expect(diags[0].message).toContain("reference");
+    expect(diags[0].message).toContain("`password`");
   });
 
   test("passes a password read from a data source", async () => {
@@ -254,7 +255,8 @@ describe("TF022: credential-named resource attribute holding a literal", () => {
 
   test("descends into a nested block", async () => {
     const diags = tf022.check(await loadFixture("TF022", "positive-nested"));
-    expect(diags.map((d) => d.entity)).toEqual(["TF022/aws_instance.web.connection.password"]);
+    expect(diags.map((d) => d.entity)).toEqual(["TF022/aws_instance.web"]);
+    expect(diags[0].message).toContain("`connection.password`");
   });
 
   test("a locator attribute is the remediation, not the finding", async () => {

package/src/lint/post-synth/tf022.ts

@@ -50,7 +50,7 @@ export const tf022: PostSynthCheck = {
             "characters, redacted here). The value is in git history, in state, and in plan output. " +
             "Replace it with a reference: a `sensitive` variable, or a data source that reads the " +
             "value from a secret manager at apply time.",
-          entity: `${block.key}.${attr.path}`,
+          entity: block.key,
           lexicon: "terraform",
         });
       }

package/src/plan-summary.test.ts

@@ -102,6 +102,24 @@ describe("the shared normalization vectors", () => {
     expect(grouped).toEqual([]);
   });
 
+  test("red first: keeping a sensitive value or a read's result splits the sensitive and read must-group rows", () => {
+    const keepValues = (root: Json): Json => {
+      const r = clone(root);
+      for (const rc of r.plan.resource_changes) {
+        delete rc.change.before_sensitive;
+        delete rc.change.after_sensitive;
+        if (rc.change.actions.length === 1 && rc.change.actions[0] === "read") rc.change.actions = ["create"];
+      }
+      return r;
+    };
+    const rows = vectors.rootPairs.filter((r) => r.group && ["sensitive attribute with different values", "read entries whose results differ"].includes(r.name));
+    expect(rows.map((r) => r.name).sort()).toEqual(["read entries whose results differ", "sensitive attribute with different values"]);
+    for (const row of rows) {
+      expect(rootsGroup(row.a, row.b)).toBe(true);
+      expect(rootsGroup(keepValues(row.a), keepValues(row.b))).toBe(false);
+    }
+  });
+
   test("red first: blanking every string falsely groups exactly the named must-not pairs", () => {
     const falselyGrouped = vectors.rootPairs.filter((r) => !r.group && rootsGroup(blankStrings(r.a), blankStrings(r.b))).map((r) => r.name);
     expect(falselyGrouped.sort()).toEqual([...vectors.overEagerFalselyGroups].sort());