This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Specifications

1 - Terraform execution

1.1 - terraform-execution Specification

Provide reusable Bazel rules that acquire pinned Terraform providers and run Terraform with declared configuration, executable, and provider inputs.

The provider module extension SHALL download immutable HTTPS archives with mandatory SHA256 integrity through Bazel repository fetching. It SHALL select one version for each canonical provider source across the extension graph.

  • WHEN declarations select different versions of the same provider source
  • THEN extension resolution fails before provider repositories are created.
  • WHEN a provider archive is fetched
  • THEN Bazel verifies the declared integrity and exposes its canonical source, version, platform, and packed filesystem-mirror path.

Terraform rules SHALL place selected provider archives in runfiles using the packed filesystem-mirror layout. The runner SHALL configure only that mirror for provider installation and SHALL preserve the declared Terraform executable.

  • WHEN all required providers are declared by a target
  • THEN initialization and provider schema validation succeed without registry access or a host provider cache.
  • WHEN configuration requires a provider absent from the target’s mirror
  • THEN initialization fails without falling back to a registry download.

The reusable module SHALL own Terraform execution and named command maps while remaining independent of parent repository labels. Maps SHALL support optional caller-supplied command wrappers. Repository consumers SHALL select generic AL wrappers explicitly to preserve configuration, plugin lifecycle, backend injection, named operations, and the saved-plan apply guard. Shared provider pins SHALL be owned by third_party/terraform.

  • WHEN a targeted apply wrapper receives a missing plan or extra arguments
  • THEN the runner rejects it before Terraform initialization.
  • WHEN repository Terraform commands and tests are analyzed
  • THEN they load maps from rules_terraform, select shared provider labels, and require neither tools/terraform nor a checked-in .terraform.lock.hcl file.
  • WHEN a command map supplies a wrapper
  • THEN the wrapper receives the declared Terraform invocation and runfiles without requiring a framework dependency in the reusable module.
  • WHEN a test map needs no external command setup
  • THEN it runs the Terraform test rule without an AL dependency.