infraweaver 0.3.8 → 0.3.9

package/README.md

@@ -2,7 +2,7 @@
 
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![CI](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml)
-[![Version](https://img.shields.io/badge/version-0.3.8)](package.json) <!-- x-release-please-version -->
+[![Version](https://img.shields.io/badge/version-0.3.9)](package.json) <!-- x-release-please-version -->
 
 **Infraweaver brings your Terraform up to best practice — automatically, as reviewable pull requests.**
 

package/dist/cli.mjs

@@ -200490,7 +200490,7 @@ import { randomBytes } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.8",
+  version: "0.3.9",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -283379,7 +283379,8 @@ function markPossibleRenames(introduced, resolved, headAddresses) {
     if (finding.address === null) continue;
     const dir = dirOf3(finding.concern.location.file);
     const match5 = vanished.find(
-      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // renamed in place, or moved elsewhere under its own name
+      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // a `moved` block cannot change a resource's type
+      typeOf(r.address) === typeOf(finding.address) && // renamed in place, or moved elsewhere under its own name
       dirOf3(r.concern.location.file) === dir !== (r.address === finding.address)
     );
     if (!match5) continue;
@@ -283388,6 +283389,9 @@ function markPossibleRenames(introduced, resolved, headAddresses) {
     finding.renamedFrom = { address: match5.address, file: match5.concern.location.file };
   }
 }
+function typeOf(address) {
+  return address.slice(0, address.lastIndexOf("."));
+}
 function undeclaredRenames(introduced) {
   const byPair = /* @__PURE__ */ new Map();
   for (const f of introduced) {
@@ -284943,7 +284947,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.3.8";
+  const raw2 = "0.3.9";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -287720,6 +287724,7 @@ This mode reviews the **Terraform** in a human PR and submits ONE review. It is
    - **module & interface hygiene** \u2014 a variable losing its validation or its secure default, a sensitive output not marked \`sensitive\`.
    - **correctness** \u2014 would this pass \`terraform validate\`? deprecated arguments, wrong types, \`count\`/\`for_each\` index churn.
    Do NOT re-raise as a judgement anything an introduced finding already covers, and do not comment on pre-existing code the PR did not touch.
+   When one judgement applies at several sites (the same constraint loosened in every root, the same block missing from each copy), post it ONCE, on the first site, and name the other \`file:line\` sites in that comment \u2014 never the same point once per file.
 
    If the Terraform change is **genuinely trivial** (a comment/whitespace-only edit, a tag value, a description string) AND there are no introduced findings, skip the lenses and submit a \`> \u2705 No new issues found.\` review.
 
@@ -319789,7 +319794,7 @@ async function runVerifyEvidenceCli2(params) {
 }
 
 // src/cli.ts
-var VERSION14 = "0.3.8";
+var VERSION14 = "0.3.9";
 var bin = basename9(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -259203,7 +259203,7 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.3.8",
+  version: "0.3.9",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -276963,6 +276963,7 @@ This mode reviews the **Terraform** in a human PR and submits ONE review. It is
    - **module & interface hygiene** \u2014 a variable losing its validation or its secure default, a sensitive output not marked \`sensitive\`.
    - **correctness** \u2014 would this pass \`terraform validate\`? deprecated arguments, wrong types, \`count\`/\`for_each\` index churn.
    Do NOT re-raise as a judgement anything an introduced finding already covers, and do not comment on pre-existing code the PR did not touch.
+   When one judgement applies at several sites (the same constraint loosened in every root, the same block missing from each copy), post it ONCE, on the first site, and name the other \`file:line\` sites in that comment \u2014 never the same point once per file.
 
    If the Terraform change is **genuinely trivial** (a comment/whitespace-only edit, a tag value, a description string) AND there are no introduced findings, skip the lenses and submit a \`> \u2705 No new issues found.\` review.
 
@@ -280062,7 +280063,8 @@ function markPossibleRenames(introduced, resolved, headAddresses) {
     if (finding.address === null) continue;
     const dir = dirOf3(finding.concern.location.file);
     const match5 = vanished.find(
-      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // renamed in place, or moved elsewhere under its own name
+      (r) => !used.has(r) && ruleKey(r.concern) === ruleKey(finding.concern) && // a `moved` block cannot change a resource's type
+      typeOf(r.address) === typeOf(finding.address) && // renamed in place, or moved elsewhere under its own name
       dirOf3(r.concern.location.file) === dir !== (r.address === finding.address)
     );
     if (!match5) continue;
@@ -280071,6 +280073,9 @@ function markPossibleRenames(introduced, resolved, headAddresses) {
     finding.renamedFrom = { address: match5.address, file: match5.concern.location.file };
   }
 }
+function typeOf(address) {
+  return address.slice(0, address.lastIndexOf("."));
+}
 function undeclaredRenames(introduced) {
   const byPair = /* @__PURE__ */ new Map();
   for (const f of introduced) {

package/dist/internal.js

@@ -2251,6 +2251,7 @@ This mode reviews the **Terraform** in a human PR and submits ONE review. It is
    - **module & interface hygiene** \u2014 a variable losing its validation or its secure default, a sensitive output not marked \`sensitive\`.
    - **correctness** \u2014 would this pass \`terraform validate\`? deprecated arguments, wrong types, \`count\`/\`for_each\` index churn.
    Do NOT re-raise as a judgement anything an introduced finding already covers, and do not comment on pre-existing code the PR did not touch.
+   When one judgement applies at several sites (the same constraint loosened in every root, the same block missing from each copy), post it ONCE, on the first site, and name the other \`file:line\` sites in that comment \u2014 never the same point once per file.
 
    If the Terraform change is **genuinely trivial** (a comment/whitespace-only edit, a tag value, a description string) AND there are no introduced findings, skip the lenses and submit a \`> \u2705 No new issues found.\` review.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",

package/src/mcp/terraform/scanDelta.ts

@@ -298,6 +298,8 @@ function markPossibleRenames(
       (r) =>
         !used.has(r) &&
         ruleKey(r.concern) === ruleKey(finding.concern) &&
+        // a `moved` block cannot change a resource's type
+        typeOf(r.address as string) === typeOf(finding.address as string) &&
         // renamed in place, or moved elsewhere under its own name
         (dirOf(r.concern.location.file) === dir) !== (r.address === finding.address),
     );
@@ -308,6 +310,11 @@ function markPossibleRenames(
   }
 }
 
+/** `aws_s3_bucket.logs` → `aws_s3_bucket`, `data.aws_iam_policy_document.x` → `data.aws_iam_policy_document`. */
+function typeOf(address: string): string {
+  return address.slice(0, address.lastIndexOf("."));
+}
+
 /** One resource that looks renamed (or moved to another directory) without a
  *  `moved` block, and how many introduced findings ride on it. */
 export interface UndeclaredRename {

package/src/modes/terraform-code-review.ts

@@ -42,6 +42,7 @@ This mode reviews the **Terraform** in a human PR and submits ONE review. It is
    - **module & interface hygiene** — a variable losing its validation or its secure default, a sensitive output not marked \`sensitive\`.
    - **correctness** — would this pass \`terraform validate\`? deprecated arguments, wrong types, \`count\`/\`for_each\` index churn.
    Do NOT re-raise as a judgement anything an introduced finding already covers, and do not comment on pre-existing code the PR did not touch.
+   When one judgement applies at several sites (the same constraint loosened in every root, the same block missing from each copy), post it ONCE, on the first site, and name the other \`file:line\` sites in that comment — never the same point once per file.
 
    If the Terraform change is **genuinely trivial** (a comment/whitespace-only edit, a tag value, a description string) AND there are no introduced findings, skip the lenses and submit a \`> ✅ No new issues found.\` review.