@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/src/__fixtures__/live-module-keyed/live-plan.json

@@ -0,0 +1,87 @@
+{
+  "estate": "module-keyed-estate",
+  "choudoufu_version": "",
+  "upstream_version": "1.13.0",
+  "bound": [
+    {
+      "addr": "module.app[0].aws_cloudwatch_log_group.logs",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/app-0",
+      "identity_values": {
+        "name": "/module-keyed-estate/app-0"
+      },
+      "source": "derived"
+    },
+    {
+      "addr": "module.app[0].aws_eip.pool[0]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0a41c7d2e9b3f5061",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[0].aws_eip.pool[1]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0b52d8e3fac4061f2",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[1].aws_eip.pool[0]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0c63e9f40bd5172a3",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[1].aws_eip.pool[1]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0d74fa051ce6283b4",
+      "source": "marker"
+    }
+  ],
+  "omissions": [
+    {
+      "addr": "module.app[1].aws_cloudwatch_log_group.logs",
+      "reason": "ABSENT",
+      "detail": "The provider reports no aws_cloudwatch_log_group exists with identity \"/module-keyed-estate/app-1\", so this resource has not been created yet. The plan will propose creating it."
+    },
+    {
+      "addr": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-east\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"module-keyed-estate\" and tofu-address=\"module.edge:east.aws_cloudwatch_log_group.front\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "addr": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-west\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    }
+  ],
+  "unowned": [
+    {
+      "addr": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/edge-east",
+      "adopt_tofu_estate": "module-keyed-estate",
+      "adopt_tofu_address": "module.edge:east.aws_cloudwatch_log_group.front"
+    },
+    {
+      "addr": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/edge-west",
+      "tofu_estate": "other-estate"
+    }
+  ],
+  "foreign": null,
+  "adoptable": [],
+  "swept": [],
+  "diagnostics": [
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-east\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"module-keyed-estate\" and tofu-address=\"module.edge:east.aws_cloudwatch_log_group.front\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-west\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    }
+  ]
+}

package/src/__fixtures__/live-module-keyed/root/estate.chdf.hcl

@@ -0,0 +1 @@
+estate = "module-keyed-estate"

package/src/__fixtures__/live-module-keyed/root/main.tf

@@ -0,0 +1,21 @@
+# Two expanded module calls, one per expansion form, so every address the
+# live-plan and state documents beside this directory carry is module-keyed
+# (chant #4513): `module.app[0].aws_eip.pool[1]`, `module.edge["east"]...`.
+#
+# The instance key reaches the child only through a variable, which is the
+# form choudoufu's identity resolver reads for a module call's count and
+# for_each (internal/live/identity/moduleforeachvar_test.go,
+# TestModuleCallCountVar and TestModuleCallForEachVar, testdata
+# module-count-var/ and module-foreach-var/).
+
+module "app" {
+  source = "./modules/app"
+  count  = 2
+  index  = count.index
+}
+
+module "edge" {
+  source   = "./modules/edge"
+  for_each = toset(["east", "west"])
+  zone     = each.key
+}

package/src/__fixtures__/live-module-keyed/root/modules/app/main.tf

@@ -0,0 +1,17 @@
+variable "index" {
+  type = number
+}
+
+# Expanded itself too, so its instances carry a key and a scope:
+# `module.app[1].aws_eip.pool[0]`. EC2 assigns the allocation id, so
+# choudoufu binds these by marker.
+resource "aws_eip" "pool" {
+  count  = 2
+  domain = "vpc"
+}
+
+# Not expanded itself: its instances carry a scope and no key. The name is
+# the identity, so choudoufu derives it from the configuration.
+resource "aws_cloudwatch_log_group" "logs" {
+  name = "/module-keyed-estate/app-${var.index}"
+}

package/src/__fixtures__/live-module-keyed/root/modules/edge/main.tf

@@ -0,0 +1,7 @@
+variable "zone" {
+  type = string
+}
+
+resource "aws_cloudwatch_log_group" "front" {
+  name = "/module-keyed-estate/edge-${var.zone}"
+}

package/src/__fixtures__/live-module-keyed/root/versions.tf

@@ -0,0 +1,30 @@
+# Provider wiring, copied from ../../live-estate/versions.tf (itself derived
+# from choudoufu's live/e2e/estate-block/versions.tf). The estate name is in
+# the estate.chdf.hcl sidecar beside this file, as in live-estate/.
+#
+# Same environment-variable wiring as choudoufu's own fixture
+# (AWS_ENDPOINT_URL, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION);
+# the provider block carries only the flags with no env-var form.
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.58.0"
+    }
+  }
+}
+
+provider "aws" {
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+
+  # skip_requesting_account_id deliberately absent — same rationale as the
+  # main estate's versions.tf (live/e2e/estate/versions.tf): letting the
+  # provider resolve the account keeps tag-filtered discovery honest about
+  # what real AWS would do.
+
+  s3_use_path_style = true
+}

package/src/__fixtures__/live-module-keyed/show-state.json

@@ -0,0 +1,146 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.13.0",
+  "values": {
+    "root_module": {
+      "child_modules": [
+        {
+          "resources": [
+            {
+              "address": "module.app[0].aws_cloudwatch_log_group.logs",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "logs",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/app-0",
+                "id": "/module-keyed-estate/app-0",
+                "name": "/module-keyed-estate/app-0"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[0].aws_eip.pool[0]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 0,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0a41c7d2e9b3f5061",
+                "domain": "vpc",
+                "id": "eipalloc-0a41c7d2e9b3f5061"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[0].aws_eip.pool[1]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 1,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0b52d8e3fac4061f2",
+                "domain": "vpc",
+                "id": "eipalloc-0b52d8e3fac4061f2"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.app[0]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.app[1].aws_cloudwatch_log_group.logs",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "logs",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/app-1",
+                "id": "/module-keyed-estate/app-1",
+                "name": "/module-keyed-estate/app-1"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[1].aws_eip.pool[0]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 0,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0c63e9f40bd5172a3",
+                "domain": "vpc",
+                "id": "eipalloc-0c63e9f40bd5172a3"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[1].aws_eip.pool[1]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 1,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0d74fa051ce6283b4",
+                "domain": "vpc",
+                "id": "eipalloc-0d74fa051ce6283b4"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.app[1]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "front",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/edge-east",
+                "id": "/module-keyed-estate/edge-east",
+                "name": "/module-keyed-estate/edge-east"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.edge[\"east\"]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "front",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/edge-west",
+                "id": "/module-keyed-estate/edge-west",
+                "name": "/module-keyed-estate/edge-west"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.edge[\"west\"]"
+        }
+      ]
+    }
+  }
+}

package/src/__fixtures__/pr-loop/README.md

@@ -0,0 +1,50 @@
+# pr-loop: five roots through the pull-request loop
+
+The workspace `../../components/pr-loop.tofu.test.ts` runs through
+`chant components pr-plan` and `chant components pr-apply` over real `tofu`
+(or `terraform`). Every root uses `terraform_data` with local state, so
+nothing downloads a provider or reaches a cloud.
+
+The estate is net -> a, b and a -> app, with dns on its own. a and b read
+net's `cidr`, and app reads a's `id`, through `stackOutput()` in
+`estate.component.ts`. a's `id` is `terraform_data.subnet.output`, which is
+known only after a applies, so on a pull request that changes a, app sits
+outside any group with an unknown upstream read and is previewed with a
+placeholder for `var.subnet` (chant#4463).
+
+What happens on merge depends on the value a applies with:
+
+- A pull request that changes a's subnet suffix from `a-v1` to `a-v2`: app's
+  real plan, made once a applied, is the update the preview showed with
+  `a.id` filled in. The first approval covers it and both roots apply in one
+  run. This is the single-approval path.
+- A pull request that changes it to `a-wide`: app's `wide` resource has
+  `count = local.wide`, and `local.wide` reads `var.subnet` through a local,
+  which the preview does not follow. The stand-in does not end in `-wide`, so
+  the preview plans no `terraform_data.wide`. The real id does, so the real
+  plan also creates `terraform_data.wide[0]`. That exceeds the preview, so
+  app's round 2 is not covered and waits on its own `pr-apply-round-2` gate
+  (chant#4487).
+
+`chant.config.json` names `tofu`; the test writes its own with whichever
+binary is on PATH.
+
+## The recorded pull-request run for chant#4463
+
+chant#4463's maintainer run uses this fixture, on the `a-v2` path. In a scratch
+directory:
+
+1. Copy this directory, `git init -b main`, add a `.gitignore` with
+   `node_modules`, `.terraform`, `.terraform.lock.hcl`, `*.tfstate*`,
+   `chant.tfplan` and `.chant`, and commit.
+2. Apply the base once: write `all.json` as `{"changed":["net","dns"]}` and run
+   `chant components fan-out --from-affected all.json`.
+3. On a branch, change `a-v1` to `a-v2` in `roots/a/main.tf`, commit, and run
+   `chant components pr-plan --base main --pr <n> --forge github` on the pull
+   request. The note's app row says `previewed with placeholders for var.subnet`.
+4. Approve the digest the note names, merge, and run
+   `chant components pr-apply --base <main before the merge> --forge github --require-review`.
+   Both roots apply in one run, and the note says app's round was covered by
+   the first approval with `a.id` filled in.
+
+Record the note and the apply's output on chant#4463.

package/src/__fixtures__/pr-loop/chant.config.json

@@ -0,0 +1,13 @@
+{
+  "lexicons": ["terraform"],
+  "terraform": {
+    "binary": "tofu",
+    "roots": {
+      "net": { "dir": "roots/net" },
+      "a": { "dir": "roots/a" },
+      "b": { "dir": "roots/b" },
+      "app": { "dir": "roots/app" },
+      "dns": { "dir": "roots/dns" }
+    }
+  }
+}

package/src/__fixtures__/pr-loop/estate.component.ts

@@ -0,0 +1,10 @@
+import { phase, stackOutput, type Component } from "@intentius/chant/components";
+
+const apply = (root: string, vars?: Record<string, unknown>) =>
+  [phase("Apply", [{ kind: "terraform-apply", root, noRollback: "test roots with local state", vars: vars ?? {} }])];
+
+export const net: Component = { name: "net", dependsOn: [], deploy: apply("net") };
+export const a: Component = { name: "a", dependsOn: ["net"], deploy: apply("a", { cidr: stackOutput("net", "cidr") }) };
+export const b: Component = { name: "b", dependsOn: ["net"], deploy: apply("b", { cidr: stackOutput("net", "cidr") }) };
+export const app: Component = { name: "app", dependsOn: ["a"], deploy: apply("app", { subnet: stackOutput("a", "id") }) };
+export const dns: Component = { name: "dns", dependsOn: [], deploy: apply("dns") };

package/src/__fixtures__/pr-loop/roots/a/main.tf

@@ -0,0 +1,11 @@
+variable "cidr" {
+  type = string
+}
+
+resource "terraform_data" "subnet" {
+  input = "${var.cidr}/a-v1"
+}
+
+output "id" {
+  value = terraform_data.subnet.output
+}

package/src/__fixtures__/pr-loop/roots/app/main.tf

@@ -0,0 +1,19 @@
+variable "subnet" {
+  type = string
+}
+
+locals {
+  # A second resource only on a subnet whose id ends in -wide. The count
+  # reads var.subnet through a local, which the placeholder preview does not
+  # follow (chant#4463), so the preview plans no wide instance. See README.md.
+  wide = endswith(var.subnet, "-wide") ? 1 : 0
+}
+
+resource "terraform_data" "app" {
+  input = "app on ${var.subnet}"
+}
+
+resource "terraform_data" "wide" {
+  count = local.wide
+  input = "wide on ${var.subnet}"
+}

package/src/__fixtures__/pr-loop/roots/b/main.tf

@@ -0,0 +1,7 @@
+variable "cidr" {
+  type = string
+}
+
+resource "terraform_data" "subnet" {
+  input = "${var.cidr}/b-v1"
+}

package/src/__fixtures__/pr-loop/roots/dns/main.tf

@@ -0,0 +1,3 @@
+resource "terraform_data" "zone" {
+  input = "example.test"
+}

package/src/__fixtures__/pr-loop/roots/net/main.tf

@@ -0,0 +1,7 @@
+resource "terraform_data" "vpc" {
+  input = "10.0.0.0/16"
+}
+
+output "cidr" {
+  value = terraform_data.vpc.output
+}

package/src/__fixtures__/report/applied.show.json

@@ -0,0 +1,51 @@
+{
+  "format_version": "1.2",
+  "resource_changes": [],
+  "prior_state": {
+    "values": {
+      "root_module": {
+        "child_modules": [
+          {
+            "address": "module.network",
+            "resources": [
+              {
+                "address": "module.network.aws_subnet.new",
+                "values": {
+                  "id": "subnet-0a1b",
+                  "arn": "arn:aws:ec2:us-east-1:000000000000:subnet/subnet-0a1b"
+                },
+                "sensitive_values": {}
+              }
+            ]
+          },
+          {
+            "address": "module.app",
+            "resources": [
+              {
+                "address": "module.app.aws_security_group.sg",
+                "values": {
+                  "id": "sg-0c2d",
+                  "vpc_id": "vpc-0e3f"
+                },
+                "sensitive_values": {}
+              }
+            ]
+          },
+          {
+            "address": "module.edge",
+            "resources": [
+              {
+                "address": "module.edge.aws_route_table.rt",
+                "values": {
+                  "id": "rtb-0f4a",
+                  "vpc_id": "vpc-0e3f"
+                },
+                "sensitive_values": {}
+              }
+            ]
+          }
+        ]
+      }
+    }
+  }
+}

package/src/__fixtures__/report/generate.ts

@@ -0,0 +1,63 @@
+/**
+ * Regenerate the `chant terraform report` fixture behold renders (#4439):
+ *
+ *     npx tsx lexicons/terraform/src/__fixtures__/report/generate.ts
+ *
+ * It reads `plan.show.json` (a three-estate composed plan: network, app and
+ * edge, with app reading network and edge reading app) and `applied.show.json`
+ * (the plan made after the apply), runs `terraformReport` for both stages, and
+ * writes `<stage>/report.json` and `<stage>/change-set.json` beside them.
+ * `report.test.ts` runs `generateReportFixture` and compares it with the
+ * files, so a change to the writer shows as a diff here.
+ */
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { terraformReport, writeReport, type ReportStage, type ReportStore } from "../../report";
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+export const FIXTURE_RUN = { project: "forgejo:3000/admin/demo-terragrunt", commit: "4439c0ffee", job_url: "http://forgejo:3000/admin/demo-terragrunt/actions/runs/1", pull_request: "1" };
+export const FIXTURE_ESTATES = { network: "demo-network", app: "demo-app", edge: "demo-edge" };
+const FINISHED: Record<ReportStage, string> = { "tf-plan": "2026-10-25T10:00:00Z", "tf-apply": "2026-10-25T10:05:00Z" };
+
+const readJson = (name: string): unknown => JSON.parse(readFileSync(join(here, name), "utf8"));
+
+/** The fixture's output files by path under this directory: `<stage>/report.json` and `<stage>/change-set.json`. */
+export async function generateReportFixture(): Promise<Record<string, string>> {
+  const plan = readJson("plan.show.json");
+  const applied = readJson("applied.show.json");
+  const files: Record<string, string> = {};
+  const store: ReportStore = {
+    async read() {
+      return undefined;
+    },
+    async put(key, body) {
+      const m = /\/(tf-plan|tf-apply)\/(report|change-set)\.json$/.exec(key);
+      if (m) files[`${m[1]}/${m[2]}.json`] = body;
+    },
+  };
+  for (const stage of ["tf-plan", "tf-apply"] as const) {
+    await writeReport(store, terraformReport({
+      stage,
+      plan,
+      ...(stage === "tf-apply" ? { applied } : {}),
+      run: FIXTURE_RUN,
+      binary: "choudoufu",
+      rootDir: "estates",
+      estates: FIXTURE_ESTATES,
+      finished: FINISHED[stage],
+    }));
+  }
+  return files;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  const files = await generateReportFixture();
+  for (const [name, body] of Object.entries(files)) {
+    mkdirSync(dirname(join(here, name)), { recursive: true });
+    writeFileSync(join(here, name), body);
+  }
+  console.log(`wrote ${Object.keys(files).join(", ")}`);
+}