query: propagate graph node removal to descendants

Author: dsa0x

internal/backend/local/backend_local.go

@@ -132,7 +132,9 @@ func (b *Local) localRun(op *backendrun.Operation) (*backendrun.LocalRun, *confi
 		// If validation is enabled, validate
 		if b.OpValidation {
 			log.Printf("[TRACE] backend/local: running validation operation")
-			validateDiags := ret.Core.Validate(ret.Config, nil)
+			// TODO: Implement query validate command. op.Query is false when running the command "terraform validate"
+			opts := &terraform.ValidateOpts{Query: op.Query}
+			validateDiags := ret.Core.Validate(ret.Config, opts)
 			diags = diags.Append(validateDiags)
 		}
 	}

internal/terraform/context_plan_query_test.go

@@ -885,6 +885,94 @@ func TestContext2Plan_queryList(t *testing.T) {
 				}
 			},
 		},
+		{
+			name: ".tf file blocks should not be processed in query mode",
+			mainConfig: `
+				terraform {
+					required_providers {
+						test = {
+							source = "hashicorp/test"
+							version = "1.0.0"
+						}
+					}
+				}
+				
+				locals {
+					foo = "bar"
+				}
+				
+				// This would produce an error if triggered, but we expect it to be ignored in query mode
+				resource "test_resource" "example" {
+					instance_type = "ami-123456"
+					
+					lifecycle {
+						precondition {
+							condition = local.foo != "bar"
+							error_message = "This should not be executed"
+						}
+					}
+				}
+				
+				// This would produce an error if triggered, but we expect it to be ignored in query mode
+				// output "resource_attr" {
+				// 	value = sensitive(test_resource.example.instance_type)
+				// }
+				`,
+			queryConfig: `
+				list "test_resource" "test" {
+					provider = test
+					include_resource = true
+
+					config {
+						filter = {
+							attr = "foo"
+						}
+					}
+				}
+				`,
+			listResourceFn: func(request providers.ListResourceRequest) providers.ListResourceResponse {
+				madeUp := []cty.Value{
+					cty.ObjectVal(map[string]cty.Value{"instance_type": cty.StringVal("ami-123456")}),
+					cty.ObjectVal(map[string]cty.Value{"instance_type": cty.StringVal("ami-654321")}),
+					cty.ObjectVal(map[string]cty.Value{"instance_type": cty.StringVal("ami-789012")}),
+				}
+				ids := []cty.Value{}
+				for i := range madeUp {
+					ids = append(ids, cty.ObjectVal(map[string]cty.Value{
+						"id": cty.StringVal(fmt.Sprintf("i-v%d", i+1)),
+					}))
+				}
+
+				resp := []cty.Value{}
+				for i, v := range madeUp {
+					mp := map[string]cty.Value{
+						"identity":     ids[i],
+						"display_name": cty.StringVal(fmt.Sprintf("Instance %d", i+1)),
+					}
+					if request.IncludeResourceObject {
+						mp["state"] = v
+					}
+					resp = append(resp, cty.ObjectVal(mp))
+				}
+
+				ret := request.Config.AsValueMap()
+				maps.Copy(ret, map[string]cty.Value{
+					"data": cty.TupleVal(resp),
+				})
+
+				return providers.ListResourceResponse{Result: cty.ObjectVal(ret)}
+			},
+			assertChanges: func(sch providers.ProviderSchema, changes *plans.ChangesSrc) {
+				expectedResources := []string{"list.test_resource.test"}
+				actualResources := make([]string, 0)
+				for _, change := range changes.Queries {
+					actualResources = append(actualResources, change.Addr.String())
+				}
+				if diff := cmp.Diff(expectedResources, actualResources); diff != "" {
+					t.Fatalf("Expected resources to match, but they differ: %s", diff)
+				}
+			},
+		},
 	}
 
 	for _, tc := range cases {
@@ -922,7 +1010,9 @@ func TestContext2Plan_queryList(t *testing.T) {
 			})
 			tfdiags.AssertNoDiagnostics(t, diags)
 
-			diags = ctx.Validate(mod, &ValidateOpts{})
+			diags = ctx.Validate(mod, &ValidateOpts{
+				Query: true,
+			})
 			if tc.assertValidateDiags != nil {
 				tc.assertValidateDiags(t, diags)
 				return

internal/terraform/context_validate.go

@@ -34,6 +34,9 @@ type ValidateOpts struct {
 	// not available to this function. Therefore, it is the responsibility of
 	// the caller to ensure that the provider configurations are valid.
 	ExternalProviders map[addrs.RootProviderConfig]providers.Interface
+
+	// When true, query files will also be validated.
+	Query bool
 }
 
 // Validate performs semantic validation of a configuration, and returns
@@ -105,6 +108,7 @@ func (c *Context) Validate(config *configs.Config, opts *ValidateOpts) tfdiags.D
 		Operation:               walkValidate,
 		ExternalProviderConfigs: opts.ExternalProviders,
 		ImportTargets:           c.findImportTargets(config),
+		queryPlan:               opts.Query,
 	}).Build(addrs.RootModuleInstance)
 	diags = diags.Append(moreDiags)
 	if moreDiags.HasErrors() {

internal/terraform/graph_builder_apply.go

@@ -122,10 +122,6 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
 		&ConfigTransformer{
 			Concrete: concreteResource,
 			Config:   b.Config,
-			resourceMatcher: func(mode addrs.ResourceMode) bool {
-				// list resources are not added to the graph during apply
-				return mode != addrs.ListResourceMode
-			},
 		},
 
 		// Add dynamic values
@@ -239,6 +235,9 @@ func (b *ApplyGraphBuilder) Steps() []GraphTransformer {
 		// Target
 		&TargetsTransformer{Targets: b.Targets, ActionTargets: b.ActionTargets},
 
+		// Exclude list resources and their descendants from the apply graph
+		&QueryTransformer{includeLists: false},
+
 		// Close any ephemeral resource instances.
 		&ephemeralResourceCloseTransformer{},
 

internal/terraform/graph_builder_plan.go

@@ -159,14 +159,6 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
 			ConcreteAction: b.ConcreteAction,
 			Config:         b.Config,
 			destroy:        b.Operation == walkDestroy || b.Operation == walkPlanDestroy,
-			resourceMatcher: func(mode addrs.ResourceMode) bool {
-				// all resources are included during validation.
-				if b.Operation == walkValidate {
-					return true
-				}
-
-				return b.queryPlan == (mode == addrs.ListResourceMode)
-			},
 
 			importTargets: b.ImportTargets,
 
@@ -290,6 +282,11 @@ func (b *PlanGraphBuilder) Steps() []GraphTransformer {
 		// Target
 		&TargetsTransformer{Targets: b.Targets},
 
+		// Filter the graph to only include nodes that are relevant to the
+		// current operation. In case of a query, this will filter out nodes
+		// that are not relevant to the query.
+		&QueryTransformer{includeLists: b.queryPlan},
+
 		// Detect when create_before_destroy must be forced on for a particular
 		// node due to dependency edges, to avoid graph cycles during apply.
 		&ForcedCBDTransformer{},

internal/terraform/transform_config.go

@@ -53,8 +53,6 @@ type ConfigTransformer struct {
 	// try to delete the imported resource unless the config is updated
 	// manually.
 	generateConfigPathForImportTargets string
-
-	resourceMatcher func(addrs.ResourceMode) bool
 }
 
 func (t *ConfigTransformer) Transform(g *Graph) error {
@@ -163,11 +161,6 @@ func (t *ConfigTransformer) transformSingle(g *Graph, config *configs.Config) er
 			continue
 		}
 
-		if t.resourceMatcher != nil && !t.resourceMatcher(r.Mode) {
-			// Skip resources that do not match the filter
-			continue
-		}
-
 		// Verify that any actions referenced in the resource's ActionTriggers exist in this module
 		var diags tfdiags.Diagnostics
 		if r.Managed != nil && r.Managed.ActionTriggers != nil {
@@ -262,10 +255,6 @@ func (t *ConfigTransformer) transformSingle(g *Graph, config *configs.Config) er
 	// If any import targets were not claimed by resources we may be
 	// generating configuration. Add them to the graph for validation.
 	for _, i := range importTargets {
-		if t.resourceMatcher != nil && !t.resourceMatcher(i.Config.ToResource.Resource.Mode) {
-			// Skip resources that do not match the filter
-			continue
-		}
 
 		log.Printf("[DEBUG] ConfigTransformer: adding config generation node for %s", i.Config.ToResource)
 

internal/terraform/transform_query.go

@@ -0,0 +1,43 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package terraform
+
+import (
+	"github.com/hashicorp/terraform/internal/addrs"
+	"github.com/hashicorp/terraform/internal/dag"
+)
+
+type QueryTransformer struct {
+	// includeLists is a flag that determines whether list resources should be included in the query.
+	// If true, list resources and their dependencies will be included in the query. If false, list resources and their dependencies will be excluded.
+	includeLists bool
+}
+
+func (t *QueryTransformer) Transform(g *Graph) error {
+	var nodesToRemove []dag.Vertex
+	for v := range dag.SelectSeq[GraphNodeConfigResource](g.VerticesSeq()) {
+		mode := v.ResourceAddr().Resource.Mode
+		// The first condition checks if we want to include list resources, in which case we should remove all
+		// non-list resources.
+		// The second condition checks if we want to exclude list resources, in which case we should remove all
+		// list resources.
+		shouldRemove := (mode != addrs.ListResourceMode && t.includeLists) ||
+			(mode == addrs.ListResourceMode && !t.includeLists)
+
+		// If the node is to be removed, we need to remove it and its descendants from the graph.
+		if shouldRemove {
+			deps := g.Descendants(v)
+			deps.Add(v)
+			for node := range deps {
+				nodesToRemove = append(nodesToRemove, node)
+			}
+		}
+	}
+
+	for _, node := range nodesToRemove {
+		g.Remove(node)
+	}
+
+	return nil
+}