Repository navigation
Prevent cross-type label suffixes from breaking references - #146
Merged
Merged
Conversation
Cover equal labels across standard references, embedded RawHCLValue references and graph edges, and runtime dependencies.
Add boundary regressions for canonical labels, raw import IDs, runtime dependency omission, and type-qualified output matching across HCL, Terraform JSON, imports, and command outputs.
Document the cross-type label and API ID identity fixes for issue #145. Co-Authored-By: Claude <noreply@anthropic.com>
Regression Test Results
✅ No regressions detectedAll export configurations produced compatible output. Generated by regression workflow • View run |
These 4 task-summary files were force-added despite the existing .polaris/ .gitignore rule, so they showed up in the PR diff. .polaris/ holds local Polaris SDLC workflow state and should never be committed to a public branch, matching the existing convention for .claude/, .github/agents/, CLAUDE.md, and AGENT.md. Removes them from git tracking only — the files remain on disk. Co-Authored-By: Claude <noreply@anthropic.com>
Regression Test Results
✅ No regressions detectedAll export configurations produced compatible output. Generated by regression workflow • View run |
pr-145.txt referenced the linked issue number, not the PR; repo convention keys the filename to the PR (#146). Co-Authored-By: Claude <noreply@anthropic.com>
Regression Test Results
✅ No regressions detectedAll export configurations produced compatible output. Generated by regression workflow • View run |
This was referenced Sep 21, 2026
plambrechtsen
pushed a commit
to plambrechtsen/pingcli-plugin-terraformer
that referenced
this pull request
Sep 21, 2026
Store the Terraform HCL describing the static PingOne regression environment used by the PR regression workflow, so it can be rebuilt if lost or audited for drift. Generated by `pingcli-terraformer export --output-format hcl --include-values` at c14d0b5 (post PR pingidentity#146), then reviewed and scrubbed: - Connector clientSecret values are empty in the export (the API does not return secret values on read) — marked "provide manually". - davinci_variable_testPW_value is a password held in a plain DaVinci variable; scrubbed from the tfvars and from three flow definitions that embed it in a rich-text node. - Four flows with empty descriptions had description = "" omitted; the pingidentity/pingone provider enforces min-length 1 and the verbatim export fails `terraform validate` otherwise. Also add the CONFIG_AS_CODE_PLAN.md written earlier this session. Un-ignore tests/regression/environment/** in .gitignore so the snapshot can be committed alongside the *.tf output-file rule. Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #145
Summary
The dependency graph indexed nodes by
(resource type, API ID)but allocated unique labels globally by label alone, while the orchestrator assignsResourceData.Labelper resource type. When two different resource types produced the same base label (e.g.,pingone_davinci_connection.__pingcli_DVAandpingone_davinci_flow.__pingcli_DVA), the second graph insertion was internally renamed with a_2suffix while the emitted resource block kept the original label. Graph-derived standard references, embedded references, and runtimedepends_oncould then point at a non-existent address — which type broke depended on processing order.The same work item also fixes an adjacent type-scoping bug: filter exclusion bookkeeping (
excludedIDs) was keyed by raw API ID only, so if two resource types shared an API ID, excluding one could incorrectly force references to the other into fallback variables.Changes
internal/graph: label allocation (nameUsage) is now scoped by(resource type, label). Same-type duplicate suffixing (_2,_3) and all public graph APIs are unchanged.internal/core: filter exclusion state uses a type-qualified identity (excludedResourceIdentity) at every producer (direct filtering, upstream expansion) and consumer (resolveOneReference), removing cross-type exclusion bleed..changelog/pr-145.txt.Tests
Validating tests (new):
internal/graph/graph_test.go— cross-type equal labels unsuffixed (both insertion orders), same-type suffixes intactinternal/core/orchestrator_test.go—TestExportOrchestrator_Export_EqualLabelsAcrossTypes,TestExportOrchestrator_Export_FilterExclusionIsTypeAware,TestExportOrchestrator_Export_IncludeUpstreamExclusionIsTypeAware,TestResolveOneReference_ExcludedResourceTypeAware,TestResolveDependsOnResources_EqualLabelsAcrossTypesinternal/core/embedded_references_test.go—TestResolveEmbeddedReferences_EqualLabelsAcrossTypesinternal/formatters/{hcl,tfjson},internal/imports,cmd/export_outputs_test.goImpacted tests passing:
go test ./... -count=1— all packages passmake vet,go build ./...,git diff --check— passgo test -race ./internal/graph ./internal/core -count=1— passKnown unrelated failures (pre-existing, not from this change):
TestResolveEmbeddedReferences_DisambiguatedName_StableAcrossEnvironments(internal/core/embedded_references_test.go:1357) fails intermittently: map iteration order decides which node receives the disambiguated fallback-variable suffix (node1vsnode2). Reproducible with-count=10onmainas well.make lintreports existing issues in unchanged files (cmd/export.go,cmd/list_outputs.go,internal/core/apidata.go,internal/compare/content.go).Breaking changes
None. Labels that are unique within their type are unchanged; only the incorrect cross-type graph-side renaming is removed.
🤖 Generated with Claude Code