Report safe Terraform identity validation diagnostics #124

Merged

gitchegumi merged 1 commit from kiyi/terraform-plan-diagnostics into main

2026-10-18 00:04:12 -05:00

kiyi commented

2026-10-17 23:52:07 -05:00

Member

Terraform plan validation currently hides its own fixed OpenBao contract errors behind the generic provider-output warning. In Terraform run 104, planning and JSON export succeeded but the job stopped before producing approval values, leaving the rejected rule unidentified.

Give library-authored contract errors a separate exception type and report the rule plus the resource/field from the validated public declaration. Raw provider exceptions, undeclared addresses, and secret/configuration values remain withheld. The same plans remain blocked; approval checks, permissions and workflow/status names are unchanged. This exposes the next diagnostic and does not claim the underlying run 104 rejection is resolved.

Validation: all 55 Terraform delivery, OpenBao, catalog and backend-bootstrap tests pass, including new checks for useful diagnostics and private-value suppression. Native Gitleaks 8.30.1 and git diff --check pass. No live plan/apply or deployment was run.

Terraform plan validation currently hides its own fixed OpenBao contract errors behind the generic provider-output warning. In [Terraform run 104](https://git.gitchegumi.com/Homelab/terraform-modules/actions/runs/104/jobs/1/attempt/1), planning and JSON export succeeded but the job stopped before producing approval values, leaving the rejected rule unidentified. Give library-authored contract errors a separate exception type and report the rule plus the resource/field from the validated public declaration. Raw provider exceptions, undeclared addresses, and secret/configuration values remain withheld. The same plans remain blocked; approval checks, permissions and workflow/status names are unchanged. This exposes the next diagnostic and does not claim the underlying run 104 rejection is resolved. Validation: all 55 Terraform delivery, OpenBao, catalog and backend-bootstrap tests pass, including new checks for useful diagnostics and private-value suppression. Native Gitleaks 8.30.1 and git diff --check pass. No live plan/apply or deployment was run.

kiyi added 1 commit

2026-10-17 23:52:07 -05:00

Report safe Terraform identity validation diagnostics

Workflow acceptance / acceptance (pull_request) Successful in 1m40s

Details

Repository security / security-1 (pull_request) Successful in 2m18s

Details

Library checks / tests (pull_request) Successful in 10m17s

Details

a9b43ab0f8

portegumi approved these changes

2026-10-17 23:53:31 -05:00

portegumi left a comment

Reviewed the authenticated source at a9b43ab0f8. The new IdentityContractError is raised with fixed library-authored rule text (including fixed field labels); plan_summary prefixes only an address present in the validated expected declaration. Unknown addresses continue to emit a generic rejection, and unrelated provider/parse failures retain the withheld-output path. Tests exercise safe declared-resource/field diagnostics and suppression of a synthetic private value and undeclared address. No UDS deployment, route, admission, or policy ownership change is involved. This is source approval only: Workflow acceptance, Repository security, and Library checks were still running at review time; all required checks must pass before merge. No live plan/apply was verified.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the authenticated source at a9b43ab0f8e4395b818244f844a90b1bacb6ccd5. The new IdentityContractError is raised with fixed library-authored rule text (including fixed field labels); plan_summary prefixes only an address present in the validated expected declaration. Unknown addresses continue to emit a generic rejection, and unrelated provider/parse failures retain the withheld-output path. Tests exercise safe declared-resource/field diagnostics and suppression of a synthetic private value and undeclared address. No UDS deployment, route, admission, or policy ownership change is involved. This is source approval only: Workflow acceptance, Repository security, and Library checks were still running at review time; all required checks must pass before merge. No live plan/apply was verified. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.