fix(secure): persist API-returned version on Falco element updates

[ombellare]

What

The Update path of the Falco element resources sends the version held in state to the API, then discards the version returned in the response. Create already writes it back, so after any successful update state kept the pre-update version while the backend had moved on.

Fixed in sysdig_secure_macro, sysdig_secure_list, and the container, filesystem, network, process, stateful and syscall rule resources — all following the pattern sysdig_secure_rule_falco already used.

-	_, err = client.UpdateMacro(ctx, macro)
+	updatedMacro, err := client.UpdateMacro(ctx, macro)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 	sysdigClients.AddCleanupHook(sendPoliciesToAgents)
 
+	_ = d.Set("version", updatedMacro.Version)

Impact

Latent today, worth fixing now. The v2 macro service performs no version comparison, and Read repopulates the field on the next refresh, so ordinary applies self-heal. It becomes user-visible the moment the backend treats version as an optimistic concurrency token — every second consecutive update would fail with a spurious conflict. It also already sends a knowingly stale value on -refresh=false runs and saved plans, and terraform state show reports a version the backend does not have.

Observed against an onprem backend before the fix: macro at server version 2 while state reported 1; a further -refresh=false update sent version 1 and the server advanced to 3.

Documentation

The sysdig_secure_macro example appended a macro the customer had just created. Backends that have not migrated to the v2 macro storage reject that with The field 'name' must not be the same as another Secure UI macro, so the resource's primary documented example failed outright for those users. The example now appends a Sysdig-provided macro, which works on every backend.

The append note now also records that appending a customer-owned macro requires a migrated backend, that the appended condition must begin with a logical operator, and that the "extend only once" limit applies to earlier backends but is not enforced by newer ones.

Tests

• TestAccMacroVersionIsPersistedOnUpdate — asserts version is 1 after create and 2 after an in-place update. Fails on the unfixed code with Attribute 'version' expected "2", got "1".
• TestAccMacroAppendToCustomMacro — covers appending a customer-owned macro. Existing coverage only appended a Sysdig-provided macro (macroAppendToDefault uses container), which is why the documentation problem went unnoticed. Opt-in via SYSDIG_SECURE_MACROS_V2 since it cannot pass on unmigrated backends.

go build ./..., go vet (incl. acceptance tags) and gofmt are clean. Acceptance run against an onprem backend:

Test	Result
TestAccMacroVersionIsPersistedOnUpdate	PASS (FAIL on unfixed code, as intended)
TestAccMacroAppendToCustomMacro	PASS
TestAccList	PASS
TestAccRuleFalcoTerminalShell, ...WithMinimumEngineVersion	PASS
TestAccRuleFalcoDataSource, TestAccRuleFalcoCountDataSource	PASS

The rule resource changes are compile-verified only: TestAccRuleContainer / Filesystem / Network / Process / Syscall are unconditionally skipped in the repo (List matching rules are deprecated - skipping tests).

Two pre-existing failures on that environment, unrelated to this change and reproduced identically on unmodified master:

• TestAccMacro step 6/7 — Undefined macro '<name>' used in filter when a macro references another custom macro created in the same apply. Reproduces on master; step number and resource vary between runs, so it looks like a race in the v2 validation path rather than anything in this diff.
• TestAccRuleStatefulDataSource / ...CountDataSource — cannot append to a non-existent rule 'API Gateway Enumeration Detected'; that default rule is absent on this backend.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates Sysdig Secure Terraform resources to persist the backend-returned version after updates, and expands documentation/tests around macros—especially append behavior and version handling.

Changes:

• Persist updated version in state for multiple Secure rule resources, macros, and lists after Update API calls.
• Add acceptance tests covering macro version persistence on update and appending to customer-owned macros (opt-in).
• Improve Secure macro documentation with clearer append semantics and backend-compatibility notes.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
website/docs/r/secure_macro.md	Clarifies macro append usage, includes examples, and documents backend limitations.
sysdig/resource_sysdig_secure_rule_syscall.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_rule_stateful.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_rule_process.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_rule_network.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_rule_filesystem.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_rule_container.go	Writes API-returned rule version back to Terraform state on update.
sysdig/resource_sysdig_secure_macro_test.go	Adds acceptance tests for version persistence and append-to-custom-macro behavior.
sysdig/resource_sysdig_secure_macro.go	Writes API-returned macro version back to Terraform state on update.
sysdig/resource_sysdig_secure_list.go	Writes API-returned list version back to Terraform state on update.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.