@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/src/module-catalog/types.ts

@@ -0,0 +1,88 @@
+/**
+ * The shape of choudoufu's `live/module-compat.json` (choudoufu#2292,
+ * `tools/modcompat/modcompat.go`), as far as the known-module catalog reads
+ * it. Only the static tier is typed here; see `./refresh-cli.ts`.
+ */
+
+/** One refusal on a static row: a choudoufu refusal ID and where it is documented. */
+export interface StaticRefusal {
+  id: string;
+  layer: string;
+  sites: number;
+  docs_ref: string;
+  docs_url: string;
+}
+
+/** One terraform-aws-modules example measured offline in the onboarded form. */
+export interface StaticRow {
+  tier: "static";
+  /** Registry address, `terraform-aws-modules/vpc/aws`. */
+  module: string;
+  /** The module repository's tag, `v6.6.1`. */
+  version: string;
+  /** The example directory inside the module repository. */
+  example: string;
+  date: string;
+  commit: string;
+  aws_provider: string;
+  verdict: "clear" | "refused" | "unmeasured";
+  /** Eligible data-source reads. These never refuse and are not refusals. */
+  reads: number;
+  refusals: StaticRefusal[];
+  reason?: string;
+  partial_schemas?: string[];
+}
+
+export interface StaticSource {
+  module: string;
+  repo: string;
+  version: string;
+  commit: string;
+  glob: string;
+  examples: number;
+}
+
+/** How the static tier was measured. */
+export interface StaticMeasurement {
+  date: string;
+  commit: string;
+  instrument: string;
+  form: string;
+  schemas: boolean;
+  second_pass: boolean;
+  aws_provider: string;
+  sources: StaticSource[];
+}
+
+/** The parts of the file the catalog reads. */
+export interface ModuleCompatFile {
+  schema: number;
+  static_measurement: StaticMeasurement;
+  static: StaticRow[];
+}
+
+const VERDICTS = new Set(["clear", "refused", "unmeasured"]);
+
+/**
+ * Check a parsed `live/module-compat.json` against the shape above and return
+ * it. Throws on a schema other than 1, a row outside the static tier, or a
+ * row whose verdict disagrees with its refusals, so a refresh never vendors a
+ * table the catalog would misread.
+ */
+export function parseModuleCompat(raw: unknown): ModuleCompatFile {
+  const file = raw as Partial<ModuleCompatFile>;
+  if (file?.schema !== 1) throw new Error(`module-compat.json: schema ${String(file?.schema)}, expected 1`);
+  if (!file.static_measurement || !Array.isArray(file.static)) {
+    throw new Error("module-compat.json: missing static_measurement or static");
+  }
+  for (const row of file.static) {
+    const where = `${row.module} ${row.version} ${row.example}`;
+    if (row.tier !== "static") throw new Error(`module-compat.json: ${where} is in the static array with tier ${row.tier}`);
+    if (!VERDICTS.has(row.verdict)) throw new Error(`module-compat.json: ${where} has verdict ${row.verdict}`);
+    if (!Array.isArray(row.refusals)) throw new Error(`module-compat.json: ${where} has no refusals list`);
+    if ((row.verdict === "refused") !== (row.refusals.length > 0)) {
+      throw new Error(`module-compat.json: ${where} is ${row.verdict} with ${row.refusals.length} refusals`);
+    }
+  }
+  return { schema: file.schema, static_measurement: file.static_measurement, static: file.static };
+}

package/src/op/activities/choudoufu-plan-set-op.test.ts

@@ -0,0 +1,111 @@
+/**
+ * `choudoufuPlanSet` as an Op activity (#4483, H3 of #4477). One Op plans two
+ * live choudoufu roots, one per cloud, and hands each root's `changeSet` to
+ * `composeChangeSet`, the shape behold's three-cloud front door takes instead
+ * of composing the change set in a script.
+ *
+ * The activity is the real one, resolved through `loadActivities`, so it runs
+ * the configured binary. A fake `choudoufu` on `PATH` answers `version` and
+ * prints a one-root set plan document for `live-plan-set`, exiting 2 as
+ * choudoufu does for a plan with changes. Nothing reaches a cloud.
+ */
+
+import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+import { composeChangeSet, loadActivities, runOpLocally, validateActivitySteps, validateStepOutputRefs, type ActivityProfile, type OpConfig } from "@intentius/chant/op";
+import { choudoufuPlanSet } from "../builders";
+import * as contracts from "../activity-contracts";
+import { __resetChoudoufuVersionCheckForTests } from "./terraform";
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+beforeEach(() => __resetChoudoufuVersionCheckForTests());
+afterEach(() => vi.unstubAllEnvs());
+
+const PROFILES: Record<string, ActivityProfile> = {
+  longInfra: { timeout: "5m", retry: { maximumAttempts: 1 } },
+  fastIdempotent: { timeout: "5m", retry: { maximumAttempts: 1 } },
+};
+
+/** A fake choudoufu: `version`, and `live-plan-set -json -out-dir=<d> <root>` printing a one-root document. */
+const FAKE = `#!/bin/sh
+if [ "$1" = "version" ]; then echo "choudoufu v0.31.0 (based on OpenTofu v1.13.0)"; exit 0; fi
+if [ "$1" = "live-plan-set" ]; then
+  for a in "$@"; do root="$a"; done
+  name=$(basename "$root")
+  cat <<EOF
+{"format_version":"1","roots":[{"root":"$root","estate":"$name","status":"planned","error":"","changes":true,"plan":{"format_version":"1.2","resource_changes":[{"address":"null_resource.$name","mode":"managed","type":"null_resource","name":"$name","change":{"actions":["create"],"before":null,"after":{}}}]},"digest":"sha256:root-$name"}],"summary":{"roots":1,"planned":1,"changed":1,"failed":0},"digest":"sha256:set-$name","exit_code":2}
+EOF
+  exit 2
+fi
+echo "fake choudoufu: unexpected $*" >&2
+exit 1
+`;
+
+function project(): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-plan-set-op-")));
+  scratch.push(dir);
+  const bin = join(dir, "bin");
+  mkdirSync(bin);
+  writeFileSync(join(bin, "choudoufu"), FAKE);
+  chmodSync(join(bin, "choudoufu"), 0o755);
+  vi.stubEnv("PATH", `${bin}:${process.env.PATH ?? ""}`);
+  for (const root of ["aws", "azure"]) {
+    mkdirSync(join(dir, "estates", root), { recursive: true });
+    writeFileSync(join(dir, "estates", root, "main.tf"), "");
+  }
+  writeFileSync(
+    join(dir, "chant.config.json"),
+    JSON.stringify({ lexicons: ["terraform"], terraform: { binary: "choudoufu", roots: { aws: { dir: "estates/aws" }, azure: { dir: "estates/azure" } } } }),
+  );
+  return dir;
+}
+
+function frontDoor(cwd: string): OpConfig {
+  const aws = choudoufuPlanSet("aws", { cwd, id: "aws" });
+  const azure = choudoufuPlanSet("azure", { cwd, id: "azure" });
+  return {
+    name: "front-door-plan",
+    overview: "",
+    phases: [
+      { name: "Plan", steps: [aws, azure] },
+      { name: "Compose", steps: [composeChangeSet({ parts: [aws.out.changeSet, azure.out.changeSet], id: "doc" })] },
+    ],
+  };
+}
+
+describe("choudoufuPlanSet as an Op activity (#4483)", () => {
+  test("is resolved from the terraform lexicon's activities", async () => {
+    const activities = await loadActivities(["terraform"]);
+    expect(typeof activities.get("choudoufuPlanSet")).toBe("function");
+  });
+
+  test("its contract validates the steps and the changeSet references", () => {
+    const map = new Map(Object.values(contracts).map((c) => [c.name, c]));
+    const config = frontDoor("/tmp/x");
+    expect(validateActivitySteps(config, map)).toEqual([]);
+    expect(validateStepOutputRefs(config, map)).toEqual([]);
+  });
+
+  test("an Op plans two clouds' roots and composes one change set from their parts", async () => {
+    const dir = project();
+    const activities = await loadActivities(["terraform"]);
+    const compose = activities.get("composeChangeSet")!;
+    const documents: Array<{ document: { members?: Array<{ member: string }> }; digest: string }> = [];
+    activities.set("composeChangeSet", async (args, signal) => {
+      const out = (await compose(args, signal)) as (typeof documents)[number];
+      documents.push(out);
+      return out;
+    });
+    const result = await runOpLocally(frontDoor(dir), activities, PROFILES);
+    expect(result.status).toBe("ok");
+    expect(result.records.filter((r) => r.fn === "choudoufuPlanSet").map((r) => r.status)).toEqual(["ok", "ok"]);
+    expect(documents).toHaveLength(1);
+    expect(documents[0]!.digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
+    expect((documents[0]!.document.members ?? []).map((m) => m.member).sort()).toEqual(["aws", "azure"]);
+  });
+});

package/src/op/activities/index.ts

@@ -16,6 +16,10 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - choudoufuPlanSet: `live-plan-set -json` over one live root, as a
+ *     one-root set (#3459). Its `changeSet` is the root's part, so an Op can
+ *     plan several clouds' roots and hand the parts to `composeChangeSet`
+ *     (#4483).
  *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
  *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
@@ -34,6 +38,8 @@ export {
   choudoufuLiveLs,
   choudoufuLiveCheck,
   choudoufuAdopt,
+  choudoufuPlanSet,
+  choudoufuPlanSetCommand,
   terraformInitCommand,
   terraformPlanCommand,
   terraformApplyCommand,
@@ -52,6 +58,7 @@ export {
   DEFAULT_TERRAFORM_BINARY,
   DEFAULT_LIVE_PLAN_DOCUMENT_FILE,
   MIN_CHOUDOUFU_VERSION,
+  MIN_CHOUDOUFU_ESTATES_VERSION,
   classifyApprovalRefusal,
   CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL,
   CHOUDOUFU_APPROVAL_EXIT_CODE,
@@ -78,6 +85,8 @@ export type {
   ChoudoufuLiveLsResult,
   ChoudoufuLiveCheckResult,
   ChoudoufuAdoptResult,
+  ChoudoufuPlanSet,
+  ChoudoufuPlanSetResult,
   AdoptionRefusal,
   PlanChangeCounts,
   LivePlanUnownedCounts,

package/src/op/activities/live-detect.ts

@@ -1,7 +1,8 @@
 /**
  * A fast, regex-based read of whether a root module directory declares a
  * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
- * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ * inside a `terraform { ... }` block of some configuration file (#2103), the
+ * `terraform` object of a `.tf.json` file included (chant#4504).
  *
  * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
  * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
@@ -17,8 +18,38 @@
  * reason.
  */
 
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { isJsonConfigFile, jsonLiveBlocks, listConfigFiles } from "../../hcl/files";
+
+/**
+ * The configuration files of `dir` a live check reads, in filename order.
+ * A `live` block takes effect only under choudoufu, so the set is the one
+ * choudoufu reads (`.tf`, `.tf.json`, `.tofu` and `.tofu.json`, `x.tofu`
+ * over `x.tf`) from the lexicon's one lister (chant#4457), which reads the
+ * directory and nothing else.
+ */
+function liveFiles(dir: string, binary: string): string[] {
+  return listConfigFiles(dir, binary);
+}
+
+/**
+ * The `live` block bodies of one file: a JSON-syntax file's from its
+ * `terraform` blocks (chant#4504), an HCL file's first one by brace counting.
+ * HCL bodies come back as text and JSON ones as objects.
+ */
+function liveBlocksOf(name: string, source: string): Array<string | Record<string, unknown>> {
+  if (isJsonConfigFile(name)) return jsonLiveBlocks(source);
+  const terraformBlock = extractBalancedBlock(source, "terraform");
+  if (terraformBlock === undefined) return [];
+  const liveBlock = extractBalancedBlock(terraformBlock, "live");
+  return liveBlock === undefined ? [] : [liveBlock];
+}
+
+/** A non-empty string, or undefined. */
+function nonEmpty(v: unknown): string | undefined {
+  return typeof v === "string" && v !== "" ? v : undefined;
+}
 
 /** Kept in sync with `LIVE_SIDECAR_FILENAME` in `../../hcl/parse.ts`. */
 const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
@@ -69,7 +100,7 @@ function extractQuotedAttr(body: string, key: string): string | undefined {
  * no sidecar (or one this function cannot read) yields `undefined` rather
  * than throwing, since this is a best-effort check, not the authoritative parse.
  */
-export function detectLiveEstate(dir: string): string | undefined {
+export function detectLiveEstate(dir: string, binary = "choudoufu"): string | undefined {
   const sidecarPath = join(dir, LIVE_SIDECAR_FILENAME);
   if (existsSync(sidecarPath)) {
     try {
@@ -82,9 +113,7 @@ export function detectLiveEstate(dir: string): string | undefined {
 
   let names: string[];
   try {
-    names = readdirSync(dir)
-      .filter((f) => f.endsWith(".tf"))
-      .sort();
+    names = liveFiles(dir, binary);
   } catch {
     return undefined;
   }
@@ -96,12 +125,10 @@ export function detectLiveEstate(dir: string): string | undefined {
     } catch {
       continue;
     }
-    const terraformBlock = extractBalancedBlock(source, "terraform");
-    if (terraformBlock === undefined) continue;
-    const liveBlock = extractBalancedBlock(terraformBlock, "live");
-    if (liveBlock === undefined) continue;
-    const estate = extractEstateAttr(liveBlock);
-    if (estate) return estate;
+    for (const liveBlock of liveBlocksOf(name, source)) {
+      const estate = typeof liveBlock === "string" ? extractEstateAttr(liveBlock) : nonEmpty(liveBlock.estate);
+      if (estate) return estate;
+    }
   }
 
   return undefined;
@@ -129,12 +156,10 @@ export interface LivePolicyVerbs {
   undeclaredUntagged?: string;
 }
 
-export function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined {
+export function detectLivePolicyVerbs(dir: string, binary = "choudoufu"): LivePolicyVerbs | undefined {
   let names: string[];
   try {
-    names = readdirSync(dir)
-      .filter((f) => f.endsWith(".tf"))
-      .sort();
+    names = liveFiles(dir, binary);
   } catch {
     return undefined;
   }
@@ -146,16 +171,20 @@ export function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined
     } catch {
       continue;
     }
-    const terraformBlock = extractBalancedBlock(source, "terraform");
-    if (terraformBlock === undefined) continue;
-    const liveBlock = extractBalancedBlock(terraformBlock, "live");
-    if (liveBlock === undefined) continue;
-    const policyBlock = extractBalancedBlock(liveBlock, "policy");
-    if (policyBlock === undefined) continue;
-    return {
-      undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
-      undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
-    };
+    for (const liveBlock of liveBlocksOf(name, source)) {
+      if (typeof liveBlock === "string") {
+        const policyBlock = extractBalancedBlock(liveBlock, "policy");
+        if (policyBlock === undefined) continue;
+        return {
+          undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
+          undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
+        };
+      }
+      // JSON syntax writes the nested `policy` block as one object or an array of them.
+      const policy = [liveBlock.policy].flat().find((p): p is Record<string, unknown> => typeof p === "object" && p !== null && !Array.isArray(p));
+      if (!policy) continue;
+      return { undeclaredTagged: nonEmpty(policy.undeclared_tagged), undeclaredUntagged: nonEmpty(policy.undeclared_untagged) };
+    }
   }
 
   return undefined;

package/src/op/activities/pin-rollout.ts

@@ -41,6 +41,8 @@ export interface TerraformPinRolloutArgs {
   appliedCheck?: string;
   /** A directory in the repository. Default: the working directory. */
   cwd?: string;
+  /** The binary the roots run, which says whether their `.tofu` files are read (chant#4457). Default `terraform`. */
+  binary?: string;
 }
 
 export type TerraformPinRolloutResult = PinRolloutResult;
@@ -73,5 +75,6 @@ export async function readPinRollout(args: TerraformPinRolloutArgs): Promise<Ter
     ...(args.base ? { base: args.base } : {}),
     ...(args.remote ? { remote: args.remote } : {}),
     ...(args.appliedCheck ? { appliedCheck: args.appliedCheck } : {}),
+    ...(args.binary ? { binary: args.binary } : {}),
   });
 }

package/src/op/activities/registry.test.ts

@@ -15,7 +15,7 @@ import { describe, test, expect } from "vitest";
 import { loadActivities, resolveActivity } from "@intentius/chant/op";
 
 describe("loadActivities([\"terraform\"]) (#2086, #2103)", () => {
-  test("resolves all seven activity names", async () => {
+  test("resolves its activity names", async () => {
     const activities = await loadActivities(["terraform"]);
     for (const name of [
       "terraformInit",
@@ -25,6 +25,7 @@ describe("loadActivities([\"terraform\"]) (#2086, #2103)", () => {
       "choudoufuLivePlan",
       "choudoufuLiveLs",
       "choudoufuLiveCheck",
+      "choudoufuPlanSet",
     ]) {
       expect(typeof resolveActivity(activities, name)).toBe("function");
     }

package/src/op/activities/terraform.test.ts

@@ -183,6 +183,22 @@ describe("terraformInitCommand (#2086)", () => {
     ).toBe("tofu init -input=false -backend-config=bucket=tf-state -backend-config=key=app/terraform.tfstate");
   });
 
+  test("backendConfigFiles become -backend-config=<path> flags, in order and before the pairs (chant#4459)", () => {
+    expect(
+      terraformInitCommand({
+        binary: "tofu",
+        backendConfig: { key: "app/terraform.tfstate" },
+        backendConfigFiles: ["backend.hcl", "/etc/chant/shared.hcl"],
+      }),
+    ).toBe("tofu init -input=false -backend-config=backend.hcl -backend-config=/etc/chant/shared.hcl -backend-config=key=app/terraform.tfstate");
+  });
+
+  test("the init line a refusal prints carries the files too, relative to the root it -chdirs into (chant#4459)", () => {
+    expect(terraformInitLine({ binary: "terraform", dir: "/repo/roots/app", backendConfigFiles: ["backend.hcl"], backendConfig: { key: "k" } })).toBe(
+      "terraform -chdir=/repo/roots/app init -input=false -backend-config=backend.hcl -backend-config=key=k",
+    );
+  });
+
   test("-upgrade and -reconfigure are opt-in", () => {
     expect(terraformInitCommand({ binary: "terraform", upgrade: true, reconfigure: true })).toBe(
       "terraform init -input=false -upgrade -reconfigure",
@@ -408,6 +424,32 @@ describe("terraformInit (#2086)", () => {
     expect(execCalls[0].opts.env?.TF_WORKSPACE).toBe("prod");
     expect(result.workspace).toBe("prod");
   });
+
+  test("a failed init carries the root it resolved as known outputs (chant#4512)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra", workspace: "prod" } } });
+    // A workspace root, so the root has a workspace-relative path to publish.
+    // The walk up to it stops at the git root, so the project is one.
+    mkdirSync(join(dir, ".git"));
+    writeFileSync(join(dir, "chant.workspace.json"), JSON.stringify({ name: "w", schema: 1, members: [{ name: "app", dir: ".", kind: "chant" }] }));
+    replies.push({ match: "init", reply: execError(1, "Error: Failed to get existing workspaces: backend unreachable") });
+    const failure = await terraformInit({ root: "app", cwd: dir }).then(
+      () => undefined,
+      (err: unknown) => err,
+    );
+    expect(failure).toBeInstanceOf(Error);
+    expect((failure as { knownOutputs?: unknown }).knownOutputs).toEqual({ dir: resolve(dir, "infra"), workspace: "prod", rootPath: "infra" });
+  });
+
+  test("a root that does not resolve fails with no known outputs (chant#4512)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra" } } });
+    const failure = await terraformInit({ root: "nope", cwd: dir }).then(
+      () => undefined,
+      (err: unknown) => err,
+    );
+    expect(failure).toBeInstanceOf(Error);
+    expect(failure).not.toHaveProperty("knownOutputs");
+    expect(execCalls).toHaveLength(0);
+  });
 });
 
 // ── terraformPlan ───────────────────────────────────────────────────────────
@@ -429,6 +471,19 @@ describe("terraformPlan — the -detailed-exitcode mapping (#2086)", () => {
     ]);
   });
 
+  test("text: false runs show -json alone, and the result's text is empty (#4479)", async () => {
+    const dir = project({ roots: { app: { dir: "./infra" } } });
+    showReplies();
+    const result = await terraformPlan({ root: "app", cwd: dir, text: false });
+    expect(result.text).toBe("");
+    expect(result.json).toEqual(JSON.parse(PLAN_JSON));
+    expect(result.planDigest).toBe(terraformPlanDigest(JSON.parse(PLAN_JSON)));
+    expect(execCalls.map((c) => c.cmd)).toEqual([
+      "terraform plan -input=false -detailed-exitcode -out=chant.tfplan",
+      "terraform show -json chant.tfplan",
+    ]);
+  });
+
   // #2300 — the Plan phase is where the plan gets its identity, so the
   // activity's own result carries it and the Gate step references it from
   // there rather than re-reading the file.