Repository navigation
Polaris/regression env config - #149
Merged
Merged
Conversation
Resource addresses are enumerated output and must be pipeable (as established by the list-outputs command), but --list-resources printed them through logger.Message, which writes to stderr and interleaved progress lines. Extract writeResourceAddresses and write one resource_type.label per line to stdout. Also fix a mangled comment/func boundary in collectOutputPaths. Co-Authored-By: Claude Code <noreply@anthropic.com>
Store the Terraform HCL describing the static PingOne regression environment used by the PR regression workflow, so it can be rebuilt if lost or audited for drift. Generated by `pingcli-terraformer export --output-format hcl --include-values` at c14d0b5 (post PR #146), then reviewed and scrubbed: - Connector clientSecret values are empty in the export (the API does not return secret values on read) — marked "provide manually". - davinci_variable_testPW_value is a password held in a plain DaVinci variable; scrubbed from the tfvars and from three flow definitions that embed it in a rich-text node. - Four flows with empty descriptions had description = "" omitted; the pingidentity/pingone provider enforces min-length 1 and the verbatim export fails `terraform validate` otherwise. Also add the CONFIG_AS_CODE_PLAN.md written earlier this session. Un-ignore tests/regression/environment/** in .gitignore so the snapshot can be committed alongside the *.tf output-file rule. Co-Authored-By: Claude Code <noreply@anthropic.com>
Promote tests/regression/environment/ from a never-applied snapshot to
the management config for the static PingOne regression environment:
- Root versions.tf (pingone provider, env-var credentials) and an empty
backend "s3" block configured at init (bucket/region/key from the CI
blob), matching the pipeline-example-platform-test convention.
- ping-export-terraform.auto.tfvars is now git-ignored and removed from
the tree: variable values ride in the TERRAFORM_ENV_BASE64 CI blob and
1Password. davinci_variable_testPW_value is declared sensitive with no
default.
- Secret-bearing connector instances get
lifecycle { ignore_changes = [properties] } so apply can never wipe
live clientSecrets the API cannot read back.
- Committed .terraform.lock.hcl for reproducible CI applies; the
ephemeral state-adoption import file is git-ignored.
- New reviewer-gated regression-env-apply workflow: manual dispatch only
(plan/apply modes, optional -target), saved-plan-file apply,
post-apply verification plan, non-cancelling concurrency.
- Docs: tests/regression/README.md gains the drift-repair runbook, the
regression-env-apply secrets/setup, and the "new resource type ->
live resource" checklist; environment README rewritten (state policy,
adoption runbook, scratch-only re-exports); CONFIG_AS_CODE_PLAN.md
marked superseded; DEVELOPER_HANDBOOK and new-resource skill point at
the checklist; changelog pr-149.
One-time state adoption (198 resources) is a documented local runbook
step pending the AWS bucket and write-scoped worker provisioning.
Co-Authored-By: Claude Code <noreply@anthropic.com>
export.sh gains --upload (export then upload) and --upload-only (upload the reviewed tfvars without exporting) to push the generated ping-export-terraform.auto.tfvars as the TERRAFORM_TFVARS_BASE64 repo-level Actions secret. Requires a gh account with repository-secret write access; the resolved file is piped, never staged or echoed. Co-Authored-By: Claude Code <noreply@anthropic.com>
export.sh gains --full: backs up the tracked environment config to a git-ignored .config-backup/ then replaces the .tf files with a fresh full export, for wholesale baseline refreshes after deliberate environment changes. --revert restores the backup. The default mode still refreshes only the tfvars file; --imports now requires --full. Co-Authored-By: Claude Code <noreply@anthropic.com>
--full now passes --include-imports in the single export run (the generator emits ping-export-imports.tf independently of the tfvars), so the state-adoption import file no longer needs a second export run. The separate --imports flag is removed; --revert, --upload-only, and the tfvars-only default are unchanged. Co-Authored-By: Claude Code <noreply@anthropic.com>
The default export now compares generated variable names against the existing ping-export-terraform.auto.tfvars before touching it: an unchanged variable set preserves the user's reviewed values (no churn, no forced re-review), while new variables trigger a .tfvars-backup of the old file before the fresh export replaces it — variables no longer generated are reported but left in place. Co-Authored-By: Claude Code <noreply@anthropic.com>
--full overwrites the tfvars as part of the fresh export but had no backup of the previous values — only the default path protected them. --full now saves the existing tfvars to ping-export-terraform.auto.tfvars.bak before exporting, same as the default path. Co-Authored-By: Claude Code <noreply@anthropic.com>
export.sh loses the tfvars-only branch: every run is now a full refresh that backs up the tracked config and the tfvars before exporting (the tfvars backup is auto-restored when the fresh export's variable set matches, keeping reviewed values; on a changed set the old file stays as .bak for diffing). --revert and --upload-only are unchanged. ping-export-imports.tf is now committed: its import blocks auto-import resources absent from state (a rebuilt environment self-imports on the first apply) and are verified-inert no-ops for resources already managed — Terraform 1.14 ignores import blocks whose targets are in state. Adoption therefore reduces to init + apply. Co-Authored-By: Claude Code <noreply@anthropic.com>
Regression Test Results
✅ No regressions detectedAll export configurations produced compatible output. Generated by regression workflow • View run |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.