Skip to content

Update terraform-policy skill for tfpolicy 0.1.x and 0.2.0+ compatibility - #97

Merged
leefowlercu merged 5 commits into
hashicorp:mainfrom
vpaul97:tfpolicy-required-providers
Aug 26, 2026
Merged

Update terraform-policy skill for tfpolicy 0.1.x and 0.2.0+ compatibility#97
leefowlercu merged 5 commits into
hashicorp:mainfrom
vpaul97:tfpolicy-required-providers

Conversation

@vpaul97

@vpaul97 vpaul97 commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Summary

  • document mandatory policy.required_providers usage for .policy.hcl when using tfpolicy 0.2.0+
  • document best-effort validation behavior for version ranges
  • document wildcard schema-validation limitations
  • document tfpolicy test schema-verification caveat observed with tfpolicy 0.2.0
  • add version-aware skill guidance so the skill branches between tfpolicy 0.1.x and 0.2.0+

Changes

  • updated plugins/terraform/skills/terraform-policy/SKILL.md
  • updated plugins/terraform/skills/terraform-policy/README.md
  • updated plugins/terraform/skills/terraform-policy/references/tfpolicy-author.md
  • updated plugins/terraform/skills/terraform-policy/references/tfpolicy-test.md
  • updated plugins/terraform/skills/terraform-policy/references/verified-syntax.md

Notes

  • tfpolicy 0.1.x does not require policy { required_providers { ... } }
  • tfpolicy 0.2.0+ requires top-level policy { required_providers { ... } } for .policy.hcl validation
  • version-range validation is best effort
  • wildcard targets such as resource_policy "*" are not schema-validated
  • tfpolicy test may warn that resource types were not verified against provider schemas even when tfpolicy validate succeeds separately
  • the skill now instructs the agent to check CLI version first and provide version-specific guidance

Validation

./scripts/validate-structure.sh
git diff --check

@vpaul97
vpaul97 requested a review from a team as a code owner August 18, 2026 20:27
@leefowlercu leefowlercu self-assigned this Aug 19, 2026

### Core Structure
```hcl
policy {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vpaul97 - instead of hardcoding the provider version you should write the reasoning for it and give the AWS one here as an example

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Put the reasoning in the 'Block' section above and wrote further reasoning with the aws example 👍 Let me know if this works better!

…and example

- Add comments explaining why version constraints matter
- Change from hardcoded 6.0.0 to broader 5.0.0 range as example
- Add guidance to adjust based on infrastructure
- Note that other providers can be added

Addresses reviewer feedback on PR hashicorp#97

@gautambaghel gautambaghel left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@leefowlercu leefowlercu left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! Thanks for the update V!

@leefowlercu
leefowlercu merged commit 3268468 into hashicorp:main Aug 26, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants