fix(terraform): support OpenTofu language block#10923
Conversation
OpenTofu v1.12 introduced a top-level `language` block used to declare version/compatibility constraints (with a nested `compatible_with` block). Trivy's hardcoded HCL body schema did not list this block type, so any `.tofu`/`.tf` file containing it failed to parse with: Unsupported block type; Blocks of type "language" are not expected here. Add `language` to the terraform body schema so the parser accepts it. The nested `compatible_with` block is decoded by the generic block machinery, so no further schema changes are required. Adds a regression test that parses a config using the `language` block and reads the nested `compatible_with.opentofu` constraint. Closes aquasecurity#10906
|
|
| // When the parser reads the file | ||
| // Then it must not fail with "Unsupported block type", and the nested | ||
| // `compatible_with.opentofu` constraint must be readable. | ||
| func Test_OpenTofuLanguageBlock(t *testing.T) { |
There was a problem hiding this comment.
The Given/When/Then doc comment is out of style for this file — compare with TestConfigWithEphemeralBlock nearby. A link to #10906 is enough. The require messages, the resource block check, and the compatible_with assertions can go — the point of the test is just that the language block no longer triggers "Unsupported block type".
a7hu-15
left a comment
a7hu-15
left a comment
There was a problem hiding this comment.
LGTM. Thanks! Let's get this merged once tests pass.
Drop the Given/When/Then comment and over-specified assertions per review; the test only needs to prove the language block no longer triggers Unsupported block type. Ref aquasecurity#10906
|
Done. Trimmed the test to just |
4 participants
Trivy's HCL body schema rejects OpenTofu v1.12's top-level
languageblock with "Unsupported block type", which fails the whole scan.pkg/iac/terraform/schema.goenumerates the allowed block types andlanguagewas missing. This adds it. The nestedcompatible_withblock and anyedition/experimentsattributes decode through the existing generic block handling, so no other schema change is needed.Added a parser test that reads a
language { compatible_with { opentofu = ">= 1.12" } }file. It fails on current main with the exact "Unsupported block type" error and passes with the fix.Closes #10906