@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/src/lint/post-synth/fixtures/TF024/sidecar-with-backend/main.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  backend "gcs" {
+    bucket = "tfstate"
+    prefix = "fixture"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/azurerm-no-resource-group/main.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+
+  backend "azurerm" {
+    storage_account_name = "fixturestate"
+    container_name       = "tfstate"
+    key                  = "fixture.terraform.tfstate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/backend-config-only/main.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+
+  # bucket and region come from -backend-config, which choudoufu does not read.
+  backend "s3" {
+    key = "fixture/terraform.tfstate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/derived-s3/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "fixture/terraform.tfstate"
+    region = "us-east-1"
+  }
+}

package/src/lint/post-synth/fixtures/TF046/derived-s3/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/explicit-local/main.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    record_store "local" {}
+  }
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "fixture/terraform.tfstate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/explicit-s3-beside-local-backend/main.tf

@@ -0,0 +1,15 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    record_store "s3" {
+      bucket = "fixture-records"
+    }
+  }
+
+  backend "local" {}
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/implied-local/main.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF046/sidecar-implied/estate.chdf.hcl

@@ -0,0 +1 @@
+estate = "fixture-estate"

package/src/lint/post-synth/fixtures/TF046/sidecar-implied/main.tf

@@ -0,0 +1,5 @@
+terraform {
+  required_version = ">= 1.5.0"
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF047/clear/main.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+module "sqs" {
+  source  = "terraform-aws-modules/sqs/aws"
+  version = "5.2.2"
+}

package/src/lint/post-synth/fixtures/TF047/refused/main.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+module "eks" {
+  source  = "terraform-aws-modules/eks/aws"
+  version = "21.29.0"
+}

package/src/lint/post-synth/fixtures/TF047/unknown-module/main.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+module "label" {
+  source  = "cloudposse/label/null"
+  version = "0.25.0"
+}

package/src/lint/post-synth/fixtures/TF047/unknown-version/main.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+  }
+}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "5.0.0"
+}

package/src/lint/post-synth/index.ts

@@ -44,6 +44,8 @@ import { tf042 } from "./tf042";
 import { tf043 } from "./tf043";
 import { tf044 } from "./tf044";
 import { tf045 } from "./tf045";
+import { tf046 } from "./tf046";
+import { tf047 } from "./tf047";
 
 export const postSynthChecks: PostSynthCheck[] = [
   tf001,
@@ -90,4 +92,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   tf043,
   tf044,
   tf045,
+  tf046,
+  tf047,
 ];

package/src/lint/post-synth/record-store.ts

@@ -0,0 +1,122 @@
+/**
+ * The record store a live root resolves to, read from its HCL the way
+ * choudoufu resolves it (INTENTIUS/choudoufu#2293, `internal/configs/live_derive.go`
+ * at choudoufu 74ffde956bfd97f44b8ad444424584e23321adc2). Shared by TF024,
+ * which names where records go, and TF046, which guards a CI root that ends
+ * up on the local store, so the two never disagree.
+ *
+ * The order is choudoufu's:
+ *
+ * 1. A `record_store "<kind>"` block in the `live` block or the
+ *    `estate.chdf.hcl` sidecar always wins (`source: "record_store"`).
+ * 2. Otherwise the backend block choudoufu ignores under live gives the store,
+ *    s3 to s3, gcs to gcs, azurerm to azurerm (`source: "backend"`). s3 and gcs
+ *    need a literal `bucket`; azurerm needs literal `storage_account_name`,
+ *    `container_name` and `resource_group_name`. A value passed only with
+ *    `-backend-config` is not in the configuration, so choudoufu does not see
+ *    it either.
+ * 3. Otherwise the store is local (`source: "implied"`), with `note` saying
+ *    why a backend that was there was not used.
+ *
+ * This mirrors `record_store.source` and `record_store.note` in
+ * `choudoufu live-check -json`. A literal here is a string hcl2json hands back
+ * with no `${...}` in it, the same "not determined" reading the Terragrunt
+ * rules use (`./terragrunt.ts`).
+ */
+
+import type { BlockBody } from "../../hcl/parse";
+import { backendTypes } from "./tf001";
+import { isExpression } from "./terragrunt";
+
+export type RecordStoreSource = "record_store" | "backend" | "implied";
+
+export interface ResolvedRecordStore {
+  /** `local`, `s3`, `gcs`, `azurerm` or `kubernetes`, or whatever label a `record_store` block carries. */
+  kind: string;
+  source: RecordStoreSource;
+  /** The backend type the store came from, or was not derived from, when there is a backend block. */
+  backend?: string;
+  /** Why a backend block that was present did not give a store. Set only with `source: "implied"`. */
+  note?: string;
+}
+
+/** Backend types choudoufu derives a record store from (INTENTIUS/choudoufu#2293). */
+export const DERIVABLE_BACKENDS: ReadonlySet<string> = new Set(["s3", "gcs", "azurerm"]);
+
+const asRecord = (v: unknown): BlockBody =>
+  typeof v === "object" && v !== null && !Array.isArray(v) ? (v as BlockBody) : {};
+
+const firstBody = (v: unknown): BlockBody => asRecord(Array.isArray(v) ? v[0] : v);
+
+/**
+ * The label of a `record_store "<kind>"` block in a live declaration body, or
+ * undefined when it declares none. hcl2json nests the label one level down,
+ * as it does for `backend` (see `backendTypes` in `./tf001.ts`).
+ */
+export function recordStoreKind(liveBody: BlockBody): string | undefined {
+  const raw = liveBody["record_store"];
+  if (raw === undefined || raw === null) return undefined;
+  if (typeof raw !== "object" || Array.isArray(raw)) return undefined;
+  const labels = Object.keys(raw as BlockBody);
+  return labels[0];
+}
+
+/** A top-level backend argument as a literal string, or undefined when it is absent, empty or an expression. */
+function literal(body: BlockBody, name: string): string | undefined {
+  const v = body[name];
+  if (typeof v !== "string" || v === "" || isExpression(v)) return undefined;
+  return v;
+}
+
+/**
+ * Why a backend block gives no record store, or undefined when it gives one.
+ * The wording follows choudoufu's `Live.RecordStoreNote`; an empty string
+ * means no store and nothing to say (a `local` backend).
+ */
+function derivationNote(type: string, body: BlockBody): string | undefined {
+  const where = `backend "${type}"`;
+  switch (type) {
+    case "s3":
+    case "gcs":
+      return literal(body, "bucket") === undefined
+        ? `${where} sets no literal bucket; values passed with -backend-config are not read`
+        : undefined;
+    case "azurerm":
+      for (const name of ["storage_account_name", "container_name", "resource_group_name"]) {
+        if (literal(body, name) === undefined) return `${where} sets no literal ${name}, which the azurerm record store needs`;
+      }
+      return undefined;
+    case "local":
+      // choudoufu leaves no note here: a local backend and the local store agree.
+      return "";
+    default:
+      return `${where} has no record store counterpart`;
+  }
+}
+
+/**
+ * Resolve one live root's record store.
+ *
+ * `terraformBodies` are the bodies of every `terraform` block in the root (a
+ * backend can sit in a separate `backend.tf`). `liveBodies` are the root's
+ * live declarations: its `live` block and its sidecar, if any. choudoufu
+ * refuses a root that has both, so the first `record_store` found is the one.
+ */
+export function resolveRecordStore(
+  terraformBodies: readonly BlockBody[],
+  liveBodies: readonly BlockBody[],
+): ResolvedRecordStore {
+  for (const live of liveBodies) {
+    const kind = recordStoreKind(live);
+    if (kind !== undefined) return { kind, source: "record_store" };
+  }
+  for (const tf of terraformBodies) {
+    const type = backendTypes(tf)[0];
+    if (type === undefined) continue;
+    const body = firstBody(asRecord(tf["backend"])[type]);
+    const note = derivationNote(type, body);
+    if (note === undefined) return { kind: type, source: "backend", backend: type };
+    return { kind: "local", source: "implied", backend: type, ...(note ? { note } : {}) };
+  }
+  return { kind: "local", source: "implied" };
+}

package/src/lint/post-synth/tf001.ts

@@ -30,8 +30,8 @@
  * module's `terraform` block is skipped here rather than read as if it were
  * the root's.
  *
- * Does not fire on a live root (#2103): a `backend` block is exactly what
- * choudoufu refuses there (TF024's territory), and the fallback to local
+ * Does not fire on a live root (#2103): choudoufu ignores a `backend` block
+ * there (TF024 reports what it still does with it), and the fallback to local
  * state this check warns about does not apply, since a live root keeps no
  * state file at all, local or remote.
  */

package/src/lint/post-synth/tf024.test.ts

@@ -13,18 +13,39 @@ async function ctxFor(fixture: string, root = "estate"): Promise<PostSynthContex
 }
 
 describe("TF024: live root declares a backend or cloud block", () => {
-  test("flags a live root with a backend block", async () => {
+  test("reports a backend block as ignored, at info, with the store derived from it", async () => {
     const diags = tf024.check(await ctxFor("live-with-backend"));
     expect(diags).toHaveLength(1);
     expect(diags[0].checkId).toBe("TF024");
-    expect(diags[0].message).toContain("backend");
-    expect(diags[0].message).toContain("Both a backend and a live");
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain('backend "s3"');
+    expect(diags[0].message).toContain("ignores it");
+    expect(diags[0].message).toContain("-migrate-state");
+    expect(diags[0].message).toContain("derives the record store");
+    expect(diags[0].message).not.toContain("refuses this at init");
   });
 
-  test("flags a live root with a cloud block", async () => {
+  test("says an explicit record_store wins over the backend", async () => {
+    const diags = tf024.check(await ctxFor("live-with-record-store"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain("record_store the live declaration names");
+    expect(diags[0].message).not.toContain("derives the record store");
+  });
+
+  test("keys on an estate.chdf.hcl sidecar as well as a live block", async () => {
+    const diags = tf024.check(await ctxFor("sidecar-with-backend"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('backend "gcs"');
+    expect(diags[0].message).toContain("derives the record store");
+  });
+
+  test("warns on a cloud block, which choudoufu drops entirely", async () => {
     const diags = tf024.check(await ctxFor("live-with-cloud"));
     expect(diags).toHaveLength(1);
-    expect(diags[0].message).toContain("cloud");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain("cloud block");
+    expect(diags[0].message).toContain("no record store is derived");
   });
 
   test("passes a live root with neither block", async () => {

package/src/lint/post-synth/tf024.ts

@@ -1,18 +1,38 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
@@ -26,17 +46,74 @@ import type {
   PostSynthDiagnostic,
 } from "@intentius/chant/lint/post-synth";
 import { isResourceDeclarable } from "@intentius/chant/declarable";
-import { TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
-import { hasBlock } from "./tf001";
+import { LIVE_TYPE, TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
+import { backendTypes, hasBlock } from "./tf001";
 import { isRootScoped } from "./scope";
+import { DERIVABLE_BACKENDS, resolveRecordStore, type ResolvedRecordStore } from "./record-store";
+
+export { DERIVABLE_BACKENDS } from "./record-store";
+
+const bodyOf = (props: { body?: unknown }): BlockBody =>
+  (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export function liveBodiesByRoot(ctx: PostSynthContext): Map<string, BlockBody[]> {
+  const roots = new Map<string, BlockBody[]>();
+  for (const entity of ctx.entities.values()) {
+    if (entity.entityType !== LIVE_TYPE) continue;
+    if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+    const props = entity.props as { root?: unknown; body?: unknown };
+    const root = typeof props.root === "string" ? props.root : "";
+    const list = roots.get(root) ?? [];
+    list.push(bodyOf(props));
+    roots.set(root, list);
+  }
+  return roots;
+}
+
+function backendMessage(root: string, type: string, store: ResolvedRecordStore): string {
+  const label = type ? `backend "${type}"` : "backend";
+  const head =
+    `Root module "${root}" runs choudoufu with a declared estate and also declares a ${label} block. ` +
+    "choudoufu ignores it with a warning: no state is read or written there and `init -migrate-state` " +
+    "is refused. An apply publishes the estate's non-sensitive outputs to the location it names, so " +
+    "terraform_remote_state readers keep working.";
+  if (store.source === "record_store") {
+    return `${head} Records go to the record_store the live declaration names, which wins over the backend.`;
+  }
+  if (store.source === "backend") {
+    return (
+      `${head} With no record_store declared, choudoufu derives the record store from this backend's ` +
+      "bucket and prints it on every init and plan (INTENTIUS/choudoufu#2293). Declare record_store to " +
+      "put records somewhere else."
+    );
+  }
+  const why = DERIVABLE_BACKENDS.has(type) && store.note
+    ? `No record store is derived from it: ${store.note}.`
+    : `No record store is derived from a ${type ? `"${type}"` : "backend of unknown type"} (only s3, gcs and azurerm are).`;
+  return (
+    `${head} ${why} No record_store is declared, so records stay in the local ` +
+    "store. Declare record_store if more than one machine runs this root (TF046 guards this in CI)."
+  );
+}
+
+function cloudMessage(root: string): string {
+  return (
+    `Root module "${root}" runs choudoufu with a declared estate and also declares a cloud block. ` +
+    "choudoufu ignores it entirely: no state is read or written there, no outputs are published to it, " +
+    "and no record store is derived from it. Remove it, or use a backend block if " +
+    "terraform_remote_state readers need this estate's outputs."
+  );
+}
 
 export const tf024: PostSynthCheck = {
   id: "TF024",
-  description: "Live root declares a backend or cloud block, which choudoufu refuses",
+  description: "Live root declares a backend or cloud block, which choudoufu ignores",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
     const flagged = new Set<string>();
+    let liveBodies: Map<string, BlockBody[]> | undefined;
 
     for (const [name, entity] of ctx.entities) {
       if (entity.entityType !== TERRAFORM_TYPE) continue;
@@ -46,20 +123,26 @@ export const tf024: PostSynthCheck = {
       const root = typeof props.root === "string" ? props.root : "";
       if (flagged.has(root)) continue;
 
-      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
-      const hasBackend = hasBlock(body, "backend");
+      const body = bodyOf(props);
       const hasCloud = hasBlock(body, "cloud");
+      const hasBackend = hasBlock(body, "backend");
       if (!hasBackend && !hasCloud) continue;
-
       flagged.add(root);
-      const blockKind = hasBackend ? "backend" : "cloud";
+
+      // A cloud block does nothing at all, so it is the one worth a warning
+      // when a (malformed) root somehow carries both.
+      if (hasCloud) {
+        diagnostics.push({ checkId: "TF024", severity: "warning", message: cloudMessage(root), entity: name, lexicon: "terraform" });
+        continue;
+      }
+
+      liveBodies ??= liveBodiesByRoot(ctx);
+      const type = backendTypes(body)[0] ?? "";
+      const store = resolveRecordStore([body], liveBodies.get(root) ?? []);
       diagnostics.push({
         checkId: "TF024",
-        severity: "error",
-        message:
-          `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
-          `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
-          `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+        severity: "info",
+        message: backendMessage(root, type, store),
         entity: name,
         lexicon: "terraform",
       });