@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/src/op/activities/live-detect.ts

@@ -1,7 +1,8 @@
 /**
  * A fast, regex-based read of whether a root module directory declares a
  * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
- * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ * inside a `terraform { ... }` block of some configuration file (#2103), the
+ * `terraform` object of a `.tf.json` file included (chant#4504).
  *
  * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
  * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
@@ -17,8 +18,38 @@
  * reason.
  */
 
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { isJsonConfigFile, jsonLiveBlocks, listConfigFiles } from "../../hcl/files";
+
+/**
+ * The configuration files of `dir` a live check reads, in filename order.
+ * A `live` block takes effect only under choudoufu, so the set is the one
+ * choudoufu reads (`.tf`, `.tf.json`, `.tofu` and `.tofu.json`, `x.tofu`
+ * over `x.tf`) from the lexicon's one lister (chant#4457), which reads the
+ * directory and nothing else.
+ */
+function liveFiles(dir: string, binary: string): string[] {
+  return listConfigFiles(dir, binary);
+}
+
+/**
+ * The `live` block bodies of one file: a JSON-syntax file's from its
+ * `terraform` blocks (chant#4504), an HCL file's first one by brace counting.
+ * HCL bodies come back as text and JSON ones as objects.
+ */
+function liveBlocksOf(name: string, source: string): Array<string | Record<string, unknown>> {
+  if (isJsonConfigFile(name)) return jsonLiveBlocks(source);
+  const terraformBlock = extractBalancedBlock(source, "terraform");
+  if (terraformBlock === undefined) return [];
+  const liveBlock = extractBalancedBlock(terraformBlock, "live");
+  return liveBlock === undefined ? [] : [liveBlock];
+}
+
+/** A non-empty string, or undefined. */
+function nonEmpty(v: unknown): string | undefined {
+  return typeof v === "string" && v !== "" ? v : undefined;
+}
 
 /** Kept in sync with `LIVE_SIDECAR_FILENAME` in `../../hcl/parse.ts`. */
 const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
@@ -69,7 +100,7 @@ function extractQuotedAttr(body: string, key: string): string | undefined {
  * no sidecar (or one this function cannot read) yields `undefined` rather
  * than throwing, since this is a best-effort check, not the authoritative parse.
  */
-export function detectLiveEstate(dir: string): string | undefined {
+export function detectLiveEstate(dir: string, binary = "choudoufu"): string | undefined {
   const sidecarPath = join(dir, LIVE_SIDECAR_FILENAME);
   if (existsSync(sidecarPath)) {
     try {
@@ -82,9 +113,7 @@ export function detectLiveEstate(dir: string): string | undefined {
 
   let names: string[];
   try {
-    names = readdirSync(dir)
-      .filter((f) => f.endsWith(".tf"))
-      .sort();
+    names = liveFiles(dir, binary);
   } catch {
     return undefined;
   }
@@ -96,12 +125,10 @@ export function detectLiveEstate(dir: string): string | undefined {
     } catch {
       continue;
     }
-    const terraformBlock = extractBalancedBlock(source, "terraform");
-    if (terraformBlock === undefined) continue;
-    const liveBlock = extractBalancedBlock(terraformBlock, "live");
-    if (liveBlock === undefined) continue;
-    const estate = extractEstateAttr(liveBlock);
-    if (estate) return estate;
+    for (const liveBlock of liveBlocksOf(name, source)) {
+      const estate = typeof liveBlock === "string" ? extractEstateAttr(liveBlock) : nonEmpty(liveBlock.estate);
+      if (estate) return estate;
+    }
   }
 
   return undefined;
@@ -129,12 +156,10 @@ export interface LivePolicyVerbs {
   undeclaredUntagged?: string;
 }
 
-export function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined {
+export function detectLivePolicyVerbs(dir: string, binary = "choudoufu"): LivePolicyVerbs | undefined {
   let names: string[];
   try {
-    names = readdirSync(dir)
-      .filter((f) => f.endsWith(".tf"))
-      .sort();
+    names = liveFiles(dir, binary);
   } catch {
     return undefined;
   }
@@ -146,16 +171,20 @@ export function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined
     } catch {
       continue;
     }
-    const terraformBlock = extractBalancedBlock(source, "terraform");
-    if (terraformBlock === undefined) continue;
-    const liveBlock = extractBalancedBlock(terraformBlock, "live");
-    if (liveBlock === undefined) continue;
-    const policyBlock = extractBalancedBlock(liveBlock, "policy");
-    if (policyBlock === undefined) continue;
-    return {
-      undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
-      undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
-    };
+    for (const liveBlock of liveBlocksOf(name, source)) {
+      if (typeof liveBlock === "string") {
+        const policyBlock = extractBalancedBlock(liveBlock, "policy");
+        if (policyBlock === undefined) continue;
+        return {
+          undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
+          undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
+        };
+      }
+      // JSON syntax writes the nested `policy` block as one object or an array of them.
+      const policy = [liveBlock.policy].flat().find((p): p is Record<string, unknown> => typeof p === "object" && p !== null && !Array.isArray(p));
+      if (!policy) continue;
+      return { undeclaredTagged: nonEmpty(policy.undeclared_tagged), undeclaredUntagged: nonEmpty(policy.undeclared_untagged) };
+    }
   }
 
   return undefined;

package/src/op/activities/pin-rollout.ts

@@ -41,6 +41,8 @@ export interface TerraformPinRolloutArgs {
   appliedCheck?: string;
   /** A directory in the repository. Default: the working directory. */
   cwd?: string;
+  /** The binary the roots run, which says whether their `.tofu` files are read (chant#4457). Default `terraform`. */
+  binary?: string;
 }
 
 export type TerraformPinRolloutResult = PinRolloutResult;
@@ -73,5 +75,6 @@ export async function readPinRollout(args: TerraformPinRolloutArgs): Promise<Ter
     ...(args.base ? { base: args.base } : {}),
     ...(args.remote ? { remote: args.remote } : {}),
     ...(args.appliedCheck ? { appliedCheck: args.appliedCheck } : {}),
+    ...(args.binary ? { binary: args.binary } : {}),
   });
 }

package/src/op/activities/registry.test.ts

@@ -15,7 +15,7 @@ import { describe, test, expect } from "vitest";
 import { loadActivities, resolveActivity } from "@intentius/chant/op";
 
 describe("loadActivities([\"terraform\"]) (#2086, #2103)", () => {
-  test("resolves all seven activity names", async () => {
+  test("resolves its activity names", async () => {
     const activities = await loadActivities(["terraform"]);
     for (const name of [
       "terraformInit",
@@ -25,6 +25,7 @@ describe("loadActivities([\"terraform\"]) (#2086, #2103)", () => {
       "choudoufuLivePlan",
       "choudoufuLiveLs",
       "choudoufuLiveCheck",
+      "choudoufuPlanSet",
     ]) {
       expect(typeof resolveActivity(activities, name)).toBe("function");
     }

package/src/op/activities/terraform.test.ts

@@ -183,6 +183,22 @@ describe("terraformInitCommand (#2086)", () => {
     ).toBe("tofu init -input=false -backend-config=bucket=tf-state -backend-config=key=app/terraform.tfstate");
   });
 
+  test("backendConfigFiles become -backend-config=<path> flags, in order and before the pairs (chant#4459)", () => {
+    expect(
+      terraformInitCommand({
+        binary: "tofu",
+        backendConfig: { key: "app/terraform.tfstate" },
+        backendConfigFiles: ["backend.hcl", "/etc/chant/shared.hcl"],
+      }),
+    ).toBe("tofu init -input=false -backend-config=backend.hcl -backend-config=/etc/chant/shared.hcl -backend-config=key=app/terraform.tfstate");
+  });
+
+  test("the init line a refusal prints carries the files too, relative to the root it -chdirs into (chant#4459)", () => {
+    expect(terraformInitLine({ binary: "terraform", dir: "/repo/roots/app", backendConfigFiles: ["backend.hcl"], backendConfig: { key: "k" } })).toBe(
+      "terraform -chdir=/repo/roots/app init -input=false -backend-config=backend.hcl -backend-config=key=k",
+    );
+  });
+
   test("-upgrade and -reconfigure are opt-in", () => {
     expect(terraformInitCommand({ binary: "terraform", upgrade: true, reconfigure: true })).toBe(
       "terraform init -input=false -upgrade -reconfigure",
@@ -408,6 +424,32 @@ describe("terraformInit (#2086)", () => {
     expect(execCalls[0].opts.env?.TF_WORKSPACE).toBe("prod");
     expect(result.workspace).toBe("prod");
   });
+
+  test("a failed init carries the root it resolved as known outputs (chant#4512)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra", workspace: "prod" } } });
+    // A workspace root, so the root has a workspace-relative path to publish.
+    // The walk up to it stops at the git root, so the project is one.
+    mkdirSync(join(dir, ".git"));
+    writeFileSync(join(dir, "chant.workspace.json"), JSON.stringify({ name: "w", schema: 1, members: [{ name: "app", dir: ".", kind: "chant" }] }));
+    replies.push({ match: "init", reply: execError(1, "Error: Failed to get existing workspaces: backend unreachable") });
+    const failure = await terraformInit({ root: "app", cwd: dir }).then(
+      () => undefined,
+      (err: unknown) => err,
+    );
+    expect(failure).toBeInstanceOf(Error);
+    expect((failure as { knownOutputs?: unknown }).knownOutputs).toEqual({ dir: resolve(dir, "infra"), workspace: "prod", rootPath: "infra" });
+  });
+
+  test("a root that does not resolve fails with no known outputs (chant#4512)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra" } } });
+    const failure = await terraformInit({ root: "nope", cwd: dir }).then(
+      () => undefined,
+      (err: unknown) => err,
+    );
+    expect(failure).toBeInstanceOf(Error);
+    expect(failure).not.toHaveProperty("knownOutputs");
+    expect(execCalls).toHaveLength(0);
+  });
 });
 
 // ── terraformPlan ───────────────────────────────────────────────────────────
@@ -429,6 +471,19 @@ describe("terraformPlan — the -detailed-exitcode mapping (#2086)", () => {
     ]);
   });
 
+  test("text: false runs show -json alone, and the result's text is empty (#4479)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra" } } });
+    showReplies();
+    const result = await terraformPlan({ root: "app", cwd: dir, text: false });
+    expect(result.text).toBe("");
+    expect(result.json).toEqual(JSON.parse(PLAN_JSON));
+    expect(result.planDigest).toBe(terraformPlanDigest(JSON.parse(PLAN_JSON)));
+    expect(execCalls.map((c) => c.cmd)).toEqual([
+      "terraform plan -input=false -detailed-exitcode -out=chant.tfplan",
+      "terraform show -json chant.tfplan",
+    ]);
+  });
+
   // #2300 — the Plan phase is where the plan gets its identity, so the
   // activity's own result carries it and the Gate step references it from
   // there rather than re-reading the file.