@intentius/chant-lexicon-terraform 0.124.27 → 0.124.28

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "7c73de933373fd74e5b748e53a5280faa32a3114a8edfce3c1dc9d73af7c4f1c",
+    "manifest.json": "f7180992dc1958b02021c16194c6e8708902e711ca1a94b93536c377594db42b",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -56,5 +56,5 @@
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "9a19035f727895d0754d577dd4864ff0e9dd1a4d8d35d042ae3684b45eaec70a"
+  "composite": "cef3ea2d21a047946dd260f00650538395ca7d5448da7f1b6ceefc1ce22a3212"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.27",
+  "version": "0.124.28",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.27",
+  "version": "0.124.28",
   "type": "module",
   "files": [
     "src/",
@@ -67,7 +67,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.27",
+    "@intentius/chant": "^0.124.28",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/components/change-set-graph.e2e.test.ts

@@ -0,0 +1,84 @@
+/**
+ * A stored change set's node ids against the spawned `chant graph --format ir`
+ * of a real terraform root (#4022).
+ *
+ * The root is `__fixtures__/change-set/v2.tf.txt` with its local module
+ * `v2-module-app.tf.txt` (less the sensitive variable's default), and the plan is `terraform.plan.json`, the real
+ * `show -json` of applying v2 over v1 (`../change-set.test.ts`). The graph is
+ * read the way `components pr-apply` reads it, by starting chant. The fast
+ * pull-request loop test (`pr-loop.tofu.test.ts`) reads the same ids in
+ * process instead; the first test here holds the two equal.
+ */
+
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { composeChangeSet } from "@intentius/chant/change-set";
+import { buildGraphIr } from "@intentius/chant/graph-ir";
+import { readGraphIds, storeGateChangeSet } from "@intentius/chant/lifecycle/gate-change-set";
+import { readStoredChangeSet } from "@intentius/chant/lifecycle/change-set-store";
+import { terraformChangeSetPart } from "../change-set";
+import { renderTerraformRoots } from "../hcl/roots";
+
+const REPO = join(import.meta.dirname, "..", "..", "..", "..");
+const FIXTURES = join(import.meta.dirname, "..", "__fixtures__", "change-set");
+const TIMEOUT = 240_000;
+
+describe("a terraform change set mapped onto the spawned chant graph", () => {
+  let dir: string;
+  const git = (...a: string[]) => {
+    const r = spawnSync("git", a, { cwd: dir, encoding: "utf8" });
+    if (r.status !== 0) throw new Error(`git ${a.join(" ")}: ${r.stderr}`);
+    return r.stdout.trim();
+  };
+
+  beforeAll(() => {
+    dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-tf-change-set-graph-")));
+    symlinkSync(join(REPO, "node_modules"), join(dir, "node_modules"));
+    mkdirSync(join(dir, "estate", "modules", "app"), { recursive: true });
+    // The sensitive variable's committed default is dropped: `chant graph` refuses source that fails
+    // `chant lint` (TF006, TF007), and the block, which is all the graph needs, stays.
+    writeFileSync(join(dir, "estate", "main.tf"), readFileSync(join(FIXTURES, "v2.tf.txt"), "utf8").replace(/\n\s*default\s*=\s*"s3cr3t-2"/, ""));
+    writeFileSync(join(dir, "estate", "modules", "app", "main.tf"), readFileSync(join(FIXTURES, "v2-module-app.tf.txt"), "utf8"));
+    writeFileSync(join(dir, "chant.config.json"), JSON.stringify({ lexicons: ["terraform"], terraform: { roots: { estate: { dir: "estate" } } } }));
+    writeFileSync(join(dir, ".gitignore"), "node_modules\n");
+    git("init", "-q", "-b", "main");
+    git("config", "user.email", "ci@example.test");
+    git("config", "user.name", "ci");
+    git("add", "-A");
+    git("commit", "-qm", "estate");
+  });
+
+  afterAll(() => {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("the in-process graph has the ids chant graph --format ir prints", async () => {
+    const spawned = await readGraphIds(dir);
+    if ("error" in spawned) throw new Error(spawned.error);
+    const rendered = await renderTerraformRoots({ projectRoot: dir, roots: { estate: { dir: "estate" } } });
+    expect(buildGraphIr(rendered.entities).nodes.map((n) => n.id).sort()).toEqual([...spawned.ids].sort());
+  }, TIMEOUT);
+
+  test("each entry is stored on the block the graph names, and a deleted block has no node", async () => {
+    const plan = JSON.parse(readFileSync(join(FIXTURES, "terraform.plan.json"), "utf8"));
+    const doc = composeChangeSet([terraformChangeSetPart({ member: "estate", plan })]);
+    const head = git("rev-parse", "HEAD");
+    const stored = await storeGateChangeSet({ doc, cwd: dir, at: head });
+    expect(stored.warning).toBeUndefined();
+    expect(stored).toMatchObject({ written: true, graph: { member: null, at: head } });
+    const read = await readStoredChangeSet(doc.digest, { cwd: dir });
+    if (read.status !== "found") throw new Error(read.status);
+    expect(read.document.entries.map((e) => [e.address, e.node])).toEqual([
+      ["module.app.terraform_data.instance[0]", "estate/module.app/terraform_data.instance"],
+      ["module.app.terraform_data.instance[1]", "estate/module.app/terraform_data.instance"],
+      ["terraform_data.config", "estate/terraform_data.config"],
+      ["terraform_data.keep", "estate/terraform_data.keep"],
+      ["terraform_data.old", null],
+      ["terraform_data.secret", "estate/terraform_data.secret"],
+      ["terraform_data.worker", "estate/terraform_data.worker"],
+    ]);
+  }, TIMEOUT);
+});

package/src/components/pr-loop.tofu.test.ts

@@ -22,7 +22,9 @@ import { dirname, join } from "node:path";
 import { afterAll, beforeAll, describe, expect, test, vi } from "vitest";
 import type { ParsedArgs } from "@intentius/chant/cli/registry";
 import type { PrReport } from "@intentius/chant/pr-loop";
+import { buildGraphIr } from "@intentius/chant/graph-ir";
 import { terraformPlugin } from "../plugin";
+import { renderTerraformRoots } from "../hcl/roots";
 
 const REPO = join(import.meta.dirname, "..", "..", "..", "..");
 
@@ -44,10 +46,25 @@ const ROOTS: Record<string, string> = {
   dns: 'resource "terraform_data" "zone" {\n  input = "example.test"\n}\n',
 };
 
+// The source passes `chant lint`, since `chant graph --format ir`, which maps
+// the stored change set onto nodes (#4022), refuses source that does not.
+/**
+ * The estate's graph node ids, read in process with the pair `chant graph
+ * --format ir` runs for terraform roots (`renderTerraformRoots`, then
+ * `buildGraphIr`), so pr-apply maps its stored change set without starting a
+ * chant child process. `change-set-graph.e2e.test.ts` holds these ids equal
+ * to the spawned `chant graph --format ir`'s.
+ */
+async function estateGraphIds(projectRoot: string): Promise<{ ids: string[] }> {
+  const config = JSON.parse(readFileSync(join(projectRoot, "chant.config.json"), "utf8")) as { terraform: { binary?: string; roots: Record<string, { dir: string }> } };
+  const rendered = await renderTerraformRoots({ projectRoot, roots: config.terraform.roots, ...(config.terraform.binary ? { binary: config.terraform.binary } : {}) });
+  return { ids: buildGraphIr(rendered.entities).nodes.map((n) => n.id) };
+}
+
 const COMPONENTS = `import { phase, stackOutput, type Component } from "@intentius/chant/components";
 
 const apply = (root: string, vars?: Record<string, unknown>) =>
-  [phase("Apply", [{ kind: "terraform-apply", root, ...(vars ? { vars } : {}) }])];
+  [phase("Apply", [{ kind: "terraform-apply", root, noRollback: "test roots with local state", vars: vars ?? {} }])];
 
 export const net: Component = { name: "net", dependsOn: [], deploy: apply("net") };
 export const a: Component = { name: "a", dependsOn: ["net"], deploy: apply("a", { cidr: stackOutput("net", "cidr") }) };
@@ -151,6 +168,7 @@ describe.skipIf(!BINARY)(`the pull-request loop over five ${BINARY ?? "terraform
     });
     vi.stubGlobal("fetch", github.fetch);
     handlers = await import("@intentius/chant/cli/handlers/pr");
+    (await import("@intentius/chant/lifecycle/gate-change-set")).setGraphIdReader(estateGraphIds);
     ({ recordGateApproval } = await import("@intentius/chant/cli/handlers/operator"));
 
     // Every root applied once, so each has state and outputs to read.
@@ -159,7 +177,8 @@ describe.skipIf(!BINARY)(`the pull-request loop over five ${BINARY ?? "terraform
     expect(await runComponentsFanOut(ctx({ fromAffected: "all.json" }) as never)).toBe(0);
   }, 240_000);
 
-  afterAll(() => {
+  afterAll(async () => {
+    (await import("@intentius/chant/lifecycle/gate-change-set")).setGraphIdReader(undefined);
     vi.unstubAllGlobals();
     if (cwd) process.chdir(cwd);
     for (const key of Object.keys(process.env)) if (!(key in env)) delete process.env[key];
@@ -222,6 +241,25 @@ describe.skipIf(!BINARY)(`the pull-request loop over five ${BINARY ?? "terraform
     expect(github.statuses.at(-1)).toMatchObject({ context: "chant/apply", state: "success", sha: applied.head });
   }, 240_000);
 
+  test("the change set the approval bound is stored by its digest, each entry on its graph node (#4022)", async () => {
+    const applied = report("apply");
+    const { changeSetShowDocument } = await import("@intentius/chant/workspace/change-set-show");
+    const shown = await changeSetShowDocument({ cwd: dir, digest: applied.digest });
+    if ("error" in shown) throw new Error(shown.error.message);
+    expect(shown).toMatchObject({ member: null, digest: applied.digest, reason: null });
+    const stored = shown.changeSet!;
+    expect(stored.digest).toBe(applied.digest);
+    expect(stored.graph).toEqual({ member: null, at: applied.head });
+    // The plan's addresses, each on the block the terraform lexicon's graph names `<root>/<address>`.
+    expect(stored.entries.map((e) => [e.member, e.address, e.action, e.node])).toEqual([
+      ["a", "terraform_data.subnet", "update", "a/terraform_data.subnet"],
+      ["app", "terraform_data.app", "no-op", "app/terraform_data.app"],
+    ]);
+    // And those are ids the estate's graph has.
+    const graph = await estateGraphIds(dir);
+    for (const e of stored.entries) expect(graph.ids).toContain(e.node);
+  }, 240_000);
+
   test("a plan that changed after review is refused, naming both digests, and nothing applies", async () => {
     const reviewed = await openPullRequest(2, "a-v3");
     github.reviews[2] = [{ user: { login: "alice" }, state: "APPROVED" }];
@@ -240,5 +278,11 @@ describe.skipIf(!BINARY)(`the pull-request loop over five ${BINARY ?? "terraform
     expect(state("a")).toContain("a-v2");
     expect(state("a")).not.toContain("a-v4");
     expect(github.statuses.at(-1)).toMatchObject({ context: "chant/apply", state: "failure", description: "refused: the plan changed after review" });
+
+    // The gate now waits on the plan it was refused, and workspace status links it to that change set (#4022).
+    const { readMemberGates } = await import("@intentius/chant/workspace/status-gates");
+    const { gates } = await readMemberGates("_gates", "flat", git("rev-parse", "chant/lifecycle"), [], dir, new Date().toISOString());
+    const gate = gates.find((g) => g.component === "pr-2")!;
+    expect(gate).toMatchObject({ state: "pending", planDigest: refused.digest, changeSet: refused.digest });
   }, 240_000);
 });