@intentius/chant-lexicon-terraform 0.124.45 → 0.124.48

package/src/__fixtures__/plan-read-drift/main.tf

@@ -0,0 +1,63 @@
+# The plan depth's recorded document (#4358): `../show-plan.json` is
+# `terraform show -json` over a saved plan of this root. README.md next door
+# is the recording log. `plan-read/` holds the same `terraform_data` blocks
+# without the shell provider, for the tests that run a real binary offline.
+terraform {
+  backend "local" {
+    path = "terraform.tfstate"
+  }
+
+  required_providers {
+    shell = {
+      source  = "scottwinkler/shell"
+      version = "~> 1.7"
+    }
+  }
+}
+
+variable "generation" {
+  type    = string
+  default = "1"
+}
+
+# A sensitive default, on purpose: the redaction tests need a known secret
+# to look for. TF006 is right about it in a real root.
+# chant-ignore-block: TF006
+variable "token" {
+  type      = string
+  default   = "hunter2"
+  sensitive = true
+}
+
+# Drifts: the recording rewrites conf.json between apply and plan, so the
+# refresh finds the object changed outside Terraform (`resource_drift`).
+resource "shell_script" "conf" {
+  working_directory = path.module
+
+  lifecycle_commands {
+    create = "printf '{\"port\":\"8080\"}' > conf.json; cat conf.json"
+    read   = "cat conf.json"
+    delete = "rm -f conf.json"
+  }
+}
+
+# Reads the drifted object, so the plan lists it in `relevant_attributes`.
+resource "terraform_data" "reader" {
+  input = shell_script.conf.output["port"]
+}
+
+resource "terraform_data" "replaced" {
+  triggers_replace = var.generation
+  input            = "stable"
+}
+
+resource "terraform_data" "updated" {
+  input = {
+    name  = "app-${var.generation}"
+    token = var.token
+  }
+}
+
+resource "terraform_data" "downstream" {
+  input = terraform_data.replaced.id
+}

package/src/__fixtures__/plan-read-drift/next.tfvars

@@ -0,0 +1 @@
+generation = "2"

package/src/__fixtures__/search-roots/chant.config.ts

@@ -0,0 +1,11 @@
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-terraform";
+
+export default {
+  lexicons: ["terraform"],
+  terraform: {
+    roots: {
+      net: { dir: "./net" },
+    },
+  },
+} satisfies ChantConfig;

package/src/__fixtures__/search-roots/net/main.tf

@@ -0,0 +1,73 @@
+# One VPC, two subnets, three security groups, and the rules and instances
+# that reference them, for `chant search` over a terraform.roots project
+# (chant #4365, #4368). Lint-clean, so `chant graph --format ir` draws it and
+# the tests can compare the two commands' node ids.
+
+# Local state on purpose: nothing applies this fixture.
+# chant-ignore-block: TF001
+terraform {
+  required_version = ">= 1.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "aws_subnet" "a" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.1.0/24"
+}
+
+resource "aws_subnet" "b" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.2.0/24"
+}
+
+resource "aws_security_group" "web" {
+  vpc_id = aws_vpc.main.id
+
+  ingress {
+    protocol    = "tcp"
+    from_port   = 443
+    to_port     = 443
+    cidr_blocks = ["10.0.0.0/16"]
+  }
+}
+
+resource "aws_security_group" "batch" {
+  vpc_id = aws_vpc.main.id
+}
+
+resource "aws_security_group" "db" {
+  vpc_id = aws_vpc.main.id
+}
+
+resource "aws_security_group_rule" "db_pg" {
+  type                     = "ingress"
+  security_group_id        = aws_security_group.db.id
+  source_security_group_id = aws_security_group.web.id
+  protocol                 = "tcp"
+  from_port                = 5432
+  to_port                  = 5432
+}
+
+resource "aws_instance" "web" {
+  ami                    = "ami-12345678"
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.a.id
+  vpc_security_group_ids = [aws_security_group.web.id]
+}
+
+resource "aws_instance" "db" {
+  ami                    = "ami-12345678"
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.b.id
+  vpc_security_group_ids = [aws_security_group.db.id]
+}

package/src/__fixtures__/search-roots/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "chant-fixture-terraform-search-roots",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module"
+}

package/src/__fixtures__/sensitive-default/chant.config.ts

@@ -0,0 +1,11 @@
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-terraform";
+
+export default {
+  lexicons: ["terraform"],
+  terraform: {
+    roots: {
+      net: { dir: "./net" },
+    },
+  },
+} satisfies ChantConfig;

package/src/__fixtures__/sensitive-default/net/main.tf

@@ -0,0 +1,38 @@
+# Sensitive variables with literal defaults, for the redaction tests (chant
+# #4377). TF006 is suppressed on purpose: the defaults are the point.
+
+# Local state on purpose: nothing applies this fixture.
+# chant-ignore-block: TF001
+terraform {
+  required_version = ">= 1.6"
+}
+
+# chant-ignore-block: TF006, TF007
+variable "api_token" {
+  type      = string
+  default   = "tok-string-9f3a"
+  sensitive = true
+}
+
+# chant-ignore-block: TF006, TF007
+variable "db_port" {
+  default   = 5432917
+  sensitive = true
+}
+
+# chant-ignore-block: TF006, TF007
+variable "creds" {
+  sensitive = true
+  default = {
+    user = "admin-map-77"
+    pass = "pw-map-c0ffee"
+  }
+}
+
+variable "region" {
+  default = "us-east-1"
+}
+
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+}

package/src/__fixtures__/sensitive-default/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "chant-fixture-terraform-sensitive-default",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module"
+}