enable unknown conditionals

DanielMSchmidt · DanielMSchmidt · commit 34b8c8cd8d8c · 2025-08-26T15:03:07.000+02:00
diff --git a/internal/command/jsonplan/action_invocations.go b/internal/command/jsonplan/action_invocations.go
@@ -44,6 +44,7 @@ type LifecycleActionTrigger struct {
 	ActionTriggerEvent        string `json:"action_trigger_event,omitempty"`
 	ActionTriggerBlockIndex   int    `json:"action_trigger_block_index"`
 	ActionsListIndex          int    `json:"actions_list_index"`
+	Tentative                 bool   `json:"tentative"`
 }
 
 type InvokeCmdActionTrigger struct {
@@ -135,6 +136,7 @@ func MarshalActionInvocation(action *plans.ActionInvocationInstanceSrc, schemas
 			ActionTriggerEvent:        at.TriggerEvent().String(),
 			ActionTriggerBlockIndex:   at.ActionTriggerBlockIndex,
 			ActionsListIndex:          at.ActionsListIndex,
+			Tentative:                 at.Tentative,
 		}
 	default:
 		return ai, fmt.Errorf("unsupported action trigger type: %T", at)
diff --git a/internal/command/views/hook_json_test.go b/internal/command/views/hook_json_test.go
@@ -31,14 +31,15 @@ func testJSONHookResourceID(addr addrs.AbsResourceInstance) terraform.HookResour
 	}
 }
 
-func testJSONHookActionID(actionAddr addrs.AbsActionInstance, triggeringResourceAddr addrs.AbsResourceInstance, actionTriggerIndex int, actionsListIndex int) terraform.HookActionIdentity {
+func testJSONHookActionID(actionAddr addrs.AbsActionInstance, triggeringResourceAddr addrs.AbsResourceInstance, actionTriggerIndex int, actionsListIndex int, certain bool) terraform.HookActionIdentity {
 	return terraform.HookActionIdentity{
 		Addr: actionAddr,
 		ActionTrigger: plans.LifecycleActionTrigger{
 			TriggeringResourceAddr:  triggeringResourceAddr,
 			ActionTriggerBlockIndex: actionTriggerIndex,
 			ActionsListIndex:        actionsListIndex,
 			ActionTriggerEvent:      configs.AfterCreate,
+			Tentative:               certain,
 		},
 	}
 }
@@ -610,8 +611,8 @@ func TestJSONHook_actions(t *testing.T) {
 		Name: "boop",
 	}.Instance(addrs.NoKey).Absolute(subModule)
 
-	actionAHookId := testJSONHookActionID(actionA, resourceA, 0, 1)
-	actionBHookId := testJSONHookActionID(actionB, resourceB, 2, 3)
+	actionAHookId := testJSONHookActionID(actionA, resourceA, 0, 1, true)
+	actionBHookId := testJSONHookActionID(actionB, resourceB, 2, 3, false)
 
 	action, err := hook.StartAction(actionAHookId)
 	testHookReturnValues(t, action, err)
diff --git a/internal/command/views/json/change.go b/internal/command/views/json/change.go
@@ -70,6 +70,7 @@ func NewPlannedActionInvocation(aiSrc *plans.ActionInvocationInstanceSrc) *Actio
 			TriggeringEvent:         at.ActionTriggerEvent.String(),
 			ActionTriggerBlockIndex: at.ActionTriggerBlockIndex,
 			ActionsListIndex:        at.ActionsListIndex,
+			Tentative:               at.Tentative,
 		}
 	}
 
@@ -93,6 +94,7 @@ type ActionInvocationLifecycleTrigger struct {
 	TriggeringEvent         string       `json:"triggering_event"`
 	ActionTriggerBlockIndex int          `json:"action_trigger_block_index"`
 	ActionsListIndex        int          `json:"actions_list_index"`
+	Tentative               bool         `json:"tentative"`
 }
 
 type ChangeAction string
diff --git a/internal/command/views/operation_test.go b/internal/command/views/operation_test.go
@@ -680,6 +680,7 @@ func TestOperationJSON_plan_with_actions(t *testing.T) {
 				"lifecycle_trigger": map[string]interface{}{
 					"action_trigger_block_index": float64(0),
 					"actions_list_index":         float64(0),
+					"tentative":                  false,
 					"triggering_event":           "AfterCreate",
 					"triggering_resource": map[string]interface{}{
 						"addr":             `test_resource.boop`,
@@ -712,6 +713,7 @@ func TestOperationJSON_plan_with_actions(t *testing.T) {
 				"lifecycle_trigger": map[string]interface{}{
 					"action_trigger_block_index": float64(0),
 					"actions_list_index":         float64(1),
+					"tentative":                  false,
 					"triggering_event":           "AfterCreate",
 					"triggering_resource": map[string]interface{}{
 						"addr":             `test_resource.boop`,
@@ -744,6 +746,7 @@ func TestOperationJSON_plan_with_actions(t *testing.T) {
 				"lifecycle_trigger": map[string]interface{}{
 					"action_trigger_block_index": float64(1),
 					"actions_list_index":         float64(0),
+					"tentative":                  false,
 					"triggering_event":           "BeforeUpdate",
 					"triggering_resource": map[string]interface{}{
 						"addr":             `module.vpc.test_resource.beep[0]`,
diff --git a/internal/plans/action_invocation.go b/internal/plans/action_invocation.go
@@ -57,6 +57,8 @@ type LifecycleActionTrigger struct {
 	ActionTriggerBlockIndex int
 	// The index of the action in the events list of the action_trigger block
 	ActionsListIndex int
+	// Set to false if the condition is unknown, true otherwise
+	Tentative bool
 }
 
 func (t LifecycleActionTrigger) TriggerEvent() configs.ActionTriggerEvent {
diff --git a/internal/plans/planfile/tfplan.go b/internal/plans/planfile/tfplan.go
@@ -1347,6 +1347,7 @@ func actionInvocationFromTfplan(rawAction *planproto.ActionInvocationInstance) (
 			ActionTriggerBlockIndex: int(at.LifecycleActionTrigger.ActionTriggerBlockIndex),
 			ActionsListIndex:        int(at.LifecycleActionTrigger.ActionsListIndex),
 			ActionTriggerEvent:      ate,
+			Tentative:               at.LifecycleActionTrigger.Tentative,
 		}
 	default:
 		// This should be exhaustive
@@ -1408,6 +1409,7 @@ func actionInvocationToTfPlan(action *plans.ActionInvocationInstanceSrc) (*planp
 				TriggeringResourceAddr:  at.TriggeringResourceAddr.String(),
 				ActionTriggerBlockIndex: int64(at.ActionTriggerBlockIndex),
 				ActionsListIndex:        int64(at.ActionsListIndex),
+				Tentative:               at.Tentative,
 			},
 		}
 	default:
diff --git a/internal/plans/planproto/planfile.pb.go b/internal/plans/planproto/planfile.pb.go
diff --git a/internal/plans/planproto/planfile.proto b/internal/plans/planproto/planfile.proto
@@ -485,6 +485,7 @@ message LifecycleActionTrigger {
   ActionTriggerEvent trigger_event = 2;
   int64 action_trigger_block_index = 3;
   int64 actions_list_index = 4;
+  bool tentative = 5;
 }
 
 message ResourceInstanceActionChange {
diff --git a/internal/terraform/context_plan_actions_test.go b/internal/terraform/context_plan_actions_test.go
@@ -1759,7 +1759,6 @@ resource "test_object" "a" {
 		},
 
 		"unknown condition": {
-			toBeImplemented: true,
 			module: map[string]string{
 				"main.tf": `
 variable "cond" {
@@ -1867,6 +1866,132 @@ resource "test_object" "a" {
 				}
 			},
 		},
+
+		"non-boolean unknown condition": {
+			module: map[string]string{
+				"main.tf": `
+variable "cond" {
+    type = number
+}
+action "test_unlinked" "hello" {}
+resource "test_object" "a" {
+  lifecycle {
+    action_trigger {
+      events = [before_create]
+      condition = var.cond + 12
+      actions = [action.test_unlinked.hello]
+    }
+  }
+}
+`,
+			},
+			expectPlanActionCalled: false,
+			planOpts: &PlanOpts{
+				Mode: plans.NormalMode,
+				SetVariables: InputValues{
+					"cond": &InputValue{
+						Value:      cty.UnknownVal(cty.Number),
+						SourceType: ValueFromCaller,
+					},
+				},
+			},
+
+			expectPlanDiagnostics: func(m *configs.Config) tfdiags.Diagnostics {
+				return tfdiags.Diagnostics{}.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Incorrect value type",
+					Detail:   "Invalid expression value: bool required, but have number.",
+					Subject: &hcl.Range{
+						Filename: filepath.Join(m.Module.SourceDir, "main.tf"),
+						Start:    hcl.Pos{Line: 10, Column: 19, Byte: 186},
+						End:      hcl.Pos{Line: 10, Column: 39, Byte: 199},
+					},
+				})
+			},
+		},
+
+		"using count in condition": {
+			toBeImplemented: true,
+			module: map[string]string{
+				"main.tf": `
+
+action "test_unlinked" "hello" {}
+action "test_unlinked" "world" {}
+
+resource "test_object" "a" {
+  count = 2
+  name = "foo"
+  lifecycle {
+    action_trigger {
+      events = [before_create]
+      condition = count.index == 1
+      actions = [action.test_unlinked.hello]
+    }
+    action_trigger {
+      events = [before_create]
+      condition = count.index == 2
+      actions = [action.test_unlinked.world]
+    }
+  }
+}
+`,
+			},
+			expectPlanActionCalled: true,
+
+			assertPlan: func(t *testing.T, p *plans.Plan) {
+				if len(p.Changes.ActionInvocations) != 1 {
+					t.Fatalf("expected 1 actions in plan, got %d", len(p.Changes.ActionInvocations))
+				}
+				if p.Changes.ActionInvocations[0].Addr.String() != "action.test_unlinked.hello" {
+					t.Fatalf("expected action.test_unlinked.hello, got %s", p.Changes.ActionInvocations[0].Addr.String())
+				}
+				at := p.Changes.ActionInvocations[0].ActionTrigger.(plans.LifecycleActionTrigger)
+				if !at.TriggeringResourceAddr.Equal(mustResourceInstanceAddr("test_object.a[1]")) {
+					t.Fatalf("expected test_object.a[1], got %s", at.TriggeringResourceAddr.String())
+				}
+			},
+		},
+		"using for_each in condition": {
+			toBeImplemented: true,
+			module: map[string]string{
+				"main.tf": `
+
+action "test_unlinked" "hello" {}
+action "test_unlinked" "world" {}
+
+resource "test_object" "a" {
+  for_each = toset(["foo", "bar"])
+  name = "foo"
+  lifecycle {
+    action_trigger {
+      events = [before_create]
+      condition = for_each.key == "bar"
+      actions = [action.test_unlinked.hello]
+    }
+    action_trigger {
+      events = [before_create]
+      condition = for_each.key == "baz"
+      actions = [action.test_unlinked.world]
+    }
+  }
+}
+`,
+			},
+			expectPlanActionCalled: true,
+
+			assertPlan: func(t *testing.T, p *plans.Plan) {
+				if len(p.Changes.ActionInvocations) != 1 {
+					t.Fatalf("expected 1 actions in plan, got %d", len(p.Changes.ActionInvocations))
+				}
+				if p.Changes.ActionInvocations[0].Addr.String() != "action.test_unlinked.hello" {
+					t.Fatalf("expected action.test_unlinked.hello, got %s", p.Changes.ActionInvocations[0].Addr.String())
+				}
+				at := p.Changes.ActionInvocations[0].ActionTrigger.(plans.LifecycleActionTrigger)
+				if !at.TriggeringResourceAddr.Equal(mustResourceInstanceAddr(`test_object.a["bar"]`)) {
+					t.Fatalf(`expected test_object.a["bar"], got %s`, at.TriggeringResourceAddr.String())
+				}
+			},
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			if tc.toBeImplemented {
diff --git a/internal/terraform/node_action_trigger_instance_plan.go b/internal/terraform/node_action_trigger_instance_plan.go
@@ -39,12 +39,13 @@ func (at *lifecycleActionTriggerInstance) Name() string {
 	return fmt.Sprintf("%s.lifecycle.action_trigger[%d].actions[%d]", at.resourceAddress.String(), at.actionTriggerBlockIndex, at.actionListIndex)
 }
 
-func (at *lifecycleActionTriggerInstance) ActionTrigger(triggeringEvent configs.ActionTriggerEvent) plans.LifecycleActionTrigger {
+func (at *lifecycleActionTriggerInstance) ActionTrigger(triggeringEvent configs.ActionTriggerEvent, Tentative bool) plans.LifecycleActionTrigger {
 	return plans.LifecycleActionTrigger{
 		TriggeringResourceAddr:  at.resourceAddress,
 		ActionTriggerBlockIndex: at.actionTriggerBlockIndex,
 		ActionsListIndex:        at.actionListIndex,
 		ActionTriggerEvent:      triggeringEvent,
+		Tentative:               Tentative,
 	}
 }
 
@@ -87,7 +88,7 @@ func (n *nodeActionTriggerPlanInstance) Execute(ctx EvalContext, operation walkO
 	ai := plans.ActionInvocationInstance{
 		Addr:          n.actionAddress,
 		ProviderAddr:  actionInstance.ProviderAddr,
-		ActionTrigger: n.lifecycleActionTrigger.ActionTrigger(configs.Unknown),
+		ActionTrigger: n.lifecycleActionTrigger.ActionTrigger(configs.Unknown, false),
 		ConfigValue:   actionInstance.ConfigValue,
 	}
 
@@ -109,22 +110,30 @@ func (n *nodeActionTriggerPlanInstance) Execute(ctx EvalContext, operation walkO
 		panic("triggeringEvent cannot be nil")
 	}
 
-	// Evaluate the condition expression if it exists (otherwise it's true)
+	// It is only uncertain an action will be triggered if the condition is unknown
+	tentative := false
+	// Evaluate the condition expression if it exists
 	if n.lifecycleActionTrigger != nil && n.lifecycleActionTrigger.conditionExpr != nil {
 		condition, conditionDiags := evaluateCondition(ctx, n.lifecycleActionTrigger.conditionExpr)
 		diags = diags.Append(conditionDiags)
 		if conditionDiags.HasErrors() {
 			return conditionDiags
 		}
 
-		// The condition is false so we skip the action
-		if condition.False() {
-			return diags
+		if condition.IsWhollyKnown() {
+			// The condition is false so we skip the action
+			if condition.False() {
+				return diags
+			}
+		} else {
+			// If the condition is unknown, we cannot be certain the action will be triggered
+			// but we still need to plan the action as if it will be triggered
+			tentative = true
 		}
 	}
 
 	// We need to set the triggering event on the action invocation
-	ai.ActionTrigger = n.lifecycleActionTrigger.ActionTrigger(*triggeringEvent)
+	ai.ActionTrigger = n.lifecycleActionTrigger.ActionTrigger(*triggeringEvent, tentative)
 
 	provider, _, err := getProvider(ctx, actionInstance.ProviderAddr)
 	if err != nil {
@@ -214,19 +223,8 @@ func evaluateCondition(ctx EvalContext, conditionExpr hcl.Expression) (cty.Value
 		return cty.False, diags
 	}
 
-	// TODO: Support unknown condition values
 	if !val.IsWhollyKnown() {
-		panic("condition is not wholly known")
-	}
-	// If the condition is neither true nor false, it's an error
-	if !(val.True() || val.False()) {
-		diags = diags.Append(&hcl.Diagnostic{
-			Severity: hcl.DiagError,
-			Summary:  "Invalid condition",
-			Detail:   "The condition must be either true or false",
-			Subject:  conditionExpr.Range().Ptr(),
-		})
-		return cty.False, diags
+		return val, diags
 	}
 
 	return val, nil

Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,7 @@ type LifecycleActionTrigger struct {`
`44`	`44`	ActionTriggerEvent string `json:"action_trigger_event,omitempty"`
`45`	`45`	ActionTriggerBlockIndex int `json:"action_trigger_block_index"`
`46`	`46`	ActionsListIndex int `json:"actions_list_index"`
	`47`	+ Tentative bool `json:"tentative"`
`47`	`48`	`}`
`48`	`49`
`49`	`50`	`type InvokeCmdActionTrigger struct {`
`@@ -135,6 +136,7 @@ func MarshalActionInvocation(action *plans.ActionInvocationInstanceSrc, schemas`
`135`	`136`	`ActionTriggerEvent: at.TriggerEvent().String(),`
`136`	`137`	`ActionTriggerBlockIndex: at.ActionTriggerBlockIndex,`
`137`	`138`	`ActionsListIndex: at.ActionsListIndex,`
	`139`	`+ Tentative: at.Tentative,`
`138`	`140`	`}`
`139`	`141`	`default:`
`140`	`142`	`return ai, fmt.Errorf("unsupported action trigger type: %T", at)`
Original file line number	Diff line number	Diff line change
`@@ -31,14 +31,15 @@ func testJSONHookResourceID(addr addrs.AbsResourceInstance) terraform.HookResour`
`31`	`31`	`}`
`32`	`32`	`}`
`33`	`33`
`34`		`-func testJSONHookActionID(actionAddr addrs.AbsActionInstance, triggeringResourceAddr addrs.AbsResourceInstance, actionTriggerIndex int, actionsListIndex int) terraform.HookActionIdentity {`
	`34`	`+func testJSONHookActionID(actionAddr addrs.AbsActionInstance, triggeringResourceAddr addrs.AbsResourceInstance, actionTriggerIndex int, actionsListIndex int, certain bool) terraform.HookActionIdentity {`
`35`	`35`	`return terraform.HookActionIdentity{`
`36`	`36`	`Addr: actionAddr,`
`37`	`37`	`ActionTrigger: plans.LifecycleActionTrigger{`
`38`	`38`	`TriggeringResourceAddr: triggeringResourceAddr,`
`39`	`39`	`ActionTriggerBlockIndex: actionTriggerIndex,`
`40`	`40`	`ActionsListIndex: actionsListIndex,`
`41`	`41`	`ActionTriggerEvent: configs.AfterCreate,`
	`42`	`+ Tentative: certain,`
`42`	`43`	`},`
`43`	`44`	`}`
`44`	`45`	`}`
`@@ -610,8 +611,8 @@ func TestJSONHook_actions(t *testing.T) {`
`610`	`611`	`Name: "boop",`
`611`	`612`	`}.Instance(addrs.NoKey).Absolute(subModule)`
`612`	`613`
`613`		`- actionAHookId := testJSONHookActionID(actionA, resourceA, 0, 1)`
`614`		`- actionBHookId := testJSONHookActionID(actionB, resourceB, 2, 3)`
	`614`	`+ actionAHookId := testJSONHookActionID(actionA, resourceA, 0, 1, true)`
	`615`	`+ actionBHookId := testJSONHookActionID(actionB, resourceB, 2, 3, false)`
`615`	`616`
`616`	`617`	`action, err := hook.StartAction(actionAHookId)`
`617`	`618`	`testHookReturnValues(t, action, err)`
Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,7 @@ func NewPlannedActionInvocation(aiSrc plans.ActionInvocationInstanceSrc) Actio`
`70`	`70`	`TriggeringEvent: at.ActionTriggerEvent.String(),`
`71`	`71`	`ActionTriggerBlockIndex: at.ActionTriggerBlockIndex,`
`72`	`72`	`ActionsListIndex: at.ActionsListIndex,`
	`73`	`+ Tentative: at.Tentative,`
`73`	`74`	`}`
`74`	`75`	`}`
`75`	`76`
`@@ -93,6 +94,7 @@ type ActionInvocationLifecycleTrigger struct {`
`93`	`94`	TriggeringEvent string `json:"triggering_event"`
`94`	`95`	ActionTriggerBlockIndex int `json:"action_trigger_block_index"`
`95`	`96`	ActionsListIndex int `json:"actions_list_index"`
	`97`	+ Tentative bool `json:"tentative"`
`96`	`98`	`}`
`97`	`99`
`98`	`100`	`type ChangeAction string`
Original file line number	Diff line number	Diff line change
`@@ -57,6 +57,8 @@ type LifecycleActionTrigger struct {`
`57`	`57`	`ActionTriggerBlockIndex int`
`58`	`58`	`// The index of the action in the events list of the action_trigger block`
`59`	`59`	`ActionsListIndex int`
	`60`	`+ // Set to false if the condition is unknown, true otherwise`
	`61`	`+ Tentative bool`
`60`	`62`	`}`
`61`	`63`
`62`	`64`	`func (t LifecycleActionTrigger) TriggerEvent() configs.ActionTriggerEvent {`
Original file line number	Diff line number	Diff line change
`@@ -485,6 +485,7 @@ message LifecycleActionTrigger {`
`485`	`485`	`ActionTriggerEvent trigger_event = 2;`
`486`	`486`	`int64 action_trigger_block_index = 3;`
`487`	`487`	`int64 actions_list_index = 4;`
	`488`	`+ bool tentative = 5;`
`488`	`489`	`}`
`489`	`490`
`490`	`491`	`message ResourceInstanceActionChange {`