Merge branch 'main' into triage

Author: jhutchings1

.github/workflows/acceptance-tests.yml

@@ -48,11 +48,24 @@ jobs:
       #
       # - name: Pre-Sweeper
       #  run: go test ./internal/services/... -v -sweep="1" -timeout 60m
+      - name: Run Magic acceptance tests
+        id: magic_acc_tests
+        # tests need to be run one-by-one to avoid account lock contention
+        run: go test -parallel=1 -p=1 -count=1 ./internal/services/{magic_wan_ipsec_tunnel,magic_wan_gre_tunnel,magic_wan_static_route} -run "^TestAcc"
+        env:
+          TF_ACC: 1
+        continue-on-error: true
       - name: Run acceptance tests
+        id: acc_tests
         # note: not all resources are covered here, only passing ones should be included here (for now).
-        run: go test ./internal/services/{account,account_api_token_permission_groups,account_dns_settings,account_dns_settings_internal_view,account_permission_group,account_role,account_subscription,account_token,address_map,api_shield,api_shield_discovery_operation,api_shield_schema,api_token_permission_groups,argo_smart_routing,argo_tiered_caching,authenticated_origin_pulls,authenticated_origin_pulls_certificate,authenticated_origin_pulls_settings,botnet_feed_config_asn,byo_ip_prefix,calls_sfu_app,calls_turn_app,certificate_pack,cloud_connector_rules,cloudforce_one_request,cloudforce_one_request_asset,cloudforce_one_request_message,cloudforce_one_request_priority,content_scanning_expression,custom_pages,custom_ssl,dcv_delegation,dns_record,dns_settings_internal_view,dns_zone_transfers_acl,dns_zone_transfers_peer,dns_zone_transfers_tsig,email_routing_address,email_routing_catch_all,email_routing_dns,email_routing_rule,email_security_block_sender,email_security_impersonation_registry,email_security_trusted_domains,image,image_variant,ip_ranges,leaked_credential_check,leaked_credential_check_rule,list,logpull_retention,logpush_dataset_field,logpush_dataset_job,logpush_job,logpush_ownership_challenge,magic_network_monitoring_configuration,magic_network_monitoring_rule,magic_transit_connector,magic_transit_site,magic_transit_site_acl,magic_transit_site_lan,magic_transit_site_wan,magic_wan_gre_tunnel,magic_wan_ipsec_tunnel,magic_wan_static_route,observatory_scheduled_test,origin_ca_certificate,page_rule,page_shield_connections,page_shield_cookies,page_shield_policy,page_shield_scripts,pages_domain,pages_project,queue,queue_consumer,r2_bucket,r2_bucket_cors,r2_bucket_event_notification,r2_bucket_lifecycle,r2_bucket_lock,r2_bucket_sippy,r2_custom_domain,r2_managed_domain,regional_hostname,regional_tiered_cache,registrar_domain,resource_group,ruleset,snippet_rules,snippets,stream,stream_audio_track,stream_caption_language,stream_download,stream_key,stream_live_input,stream_watermark,stream_webhook,tiered_cache,turnstile_widget,url_normalization_settings,user,waiting_room_settings,workers_cron_trigger,workers_custom_domain,workers_deployment,workers_for_platforms_dispatch_namespace,workers_kv_namespace,workers_route,workers_script,workers_script_subdomain,zero_trust_access_infrastructure_target,zero_trust_access_key_configuration,zero_trust_access_mtls_hostname_settings,zero_trust_access_service_token,zero_trust_access_tag,zero_trust_device_custom_profile,zero_trust_device_default_profile,zero_trust_device_default_profile_certificates,zero_trust_device_managed_networks,zero_trust_dlp_custom_profile,zero_trust_dlp_dataset,zero_trust_dlp_entry,zero_trust_dlp_predefined_profile,zero_trust_gateway_app_types,zero_trust_gateway_categories,zero_trust_gateway_certificate,zero_trust_gateway_logging,zero_trust_gateway_proxy_endpoint,zero_trust_list,zero_trust_risk_behavior,zero_trust_risk_scoring_integration,zero_trust_tunnel_cloudflared,zero_trust_tunnel_cloudflared_route,zero_trust_tunnel_cloudflared_token,zero_trust_tunnel_warp_connector_token,zone,zone_cache_reserve,zone_cache_variants,zone_dns_settings,zone_hold,zone_lockdown,zone_setting,zone_subscription} -run "^TestAcc" -count 1
+        run: ./scripts/run-ci-acceptance-tests
         env:
           TF_ACC: 1
+      - name: Check Test Status
+        if: ${{ steps.magic_acc_tests.outcome == 'failure' || steps.acc_tests.outcome == 'failure' }}
+        run: exit 1
+
+
     # when all resources support sweepers, re-enable.
     #
     # - name: Post-Sweeper

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ on:
 jobs:
   lint:
     runs-on: ${{ github.repository == 'stainless-sdks/cloudflare-terraform' && 'depot-ubuntu-24.04' || 'lx64' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v4
 
@@ -31,6 +32,7 @@ jobs:
 
   test:
     runs-on: ${{ github.repository == 'stainless-sdks/cloudflare-terraform' && 'depot-ubuntu-24.04' || 'lx64' }}
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
       - uses: actions/checkout@v4
 

.gitignore

@@ -2,3 +2,4 @@
 dist/
 terraform-provider-cloudflare
 go.work*
+.DS_Store

.grit/patterns/cloudflare_terraform_v5_attribute_renames_state.grit

@@ -56,7 +56,18 @@ pattern cloudflare_terraform_v5_attribute_renames_state() {
     `{ $..., "mode": "managed", "type": "$resource_type", $..., "instances":[$instances] }` where {
         $resource_type <: contains `cloudflare_queue`,
         $instances <: any {
-          contains `"name": $q` => `"queue_name": $q`
+          contains `"name": $q` => `"queue_name": $q`,
+          contains `"id": $id` => `"id": $id, 
+            "queue_id": $id`
+        }
+    },
+
+    // cloudflare_turnstile_widget
+    `{ $..., "mode": "managed", "type": "$resource_type", $..., "instances":[$instances] }` where {
+        $resource_type <: contains `cloudflare_turnstile_widget`,
+        $instances <: any {
+          contains `"id": $id` => `"id": $id, 
+            "sitekey": $id`
         }
     },
 

.grit/patterns/cloudflare_terraform_v5_block_to_attribute_configuration.grit

@@ -138,12 +138,12 @@ pattern cloudflare_terraform_v5_block_to_attribute_configuration() {
     inline_cloudflare_block_to_list(`status_code_ttl`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`status_code_range`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`from_list`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
-    inline_cloudflare_block_to_list(`from_value`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
-    inline_cloudflare_block_to_list(`target_url`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
+    inline_cloudflare_block_to_map(`from_value`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
+    inline_cloudflare_block_to_map(`target_url`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`headers`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`matched_data`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`origin`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
-    inline_cloudflare_block_to_list(`overrides`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
+    inline_cloudflare_block_to_map(`overrides`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`categories`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_map(`response`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`serve_stale`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
@@ -153,7 +153,7 @@ pattern cloudflare_terraform_v5_block_to_attribute_configuration() {
     inline_cloudflare_block_to_list(`query`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_list(`exposed_credential_check`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_map(`logging`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
-    inline_cloudflare_block_to_list(`ratelimit`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
+    inline_cloudflare_block_to_map(`ratelimit`) as $block where { $block <: within `resource "cloudflare_ruleset" $_ { $_ }` },
     inline_cloudflare_block_to_map(`dns`) as $block where { $block <: within `resource "cloudflare_spectrum_application" $_ { $_ }` },
     inline_cloudflare_block_to_map(`edge_ips`) as $block where { $block <: within `resource "cloudflare_spectrum_application" $_ { $_ }` },
     inline_cloudflare_block_to_map(`origin_dns`) as $block where { $block <: within `resource "cloudflare_spectrum_application" $_ { $_ }` },

.grit/patterns/cloudflare_terraform_v5_resource_renames_state.grit

@@ -40,6 +40,12 @@ pattern cloudflare_terraform_v5_resource_renames_state() {
     `"cloudflare_tunnel_config"` => `"cloudflare_zero_trust_tunnel_cloudflared_config"`,
     `"cloudflare_tunnel_route"` => `"cloudflare_zero_trust_tunnel_cloudflared_route"`,
     `"cloudflare_tunnel_virtual_network"` => `"cloudflare_zero_trust_tunnel_cloudflared_virtual_network"`,
+    `"cloudflare_worker_cron_trigger"` => `"cloudflare_workers_cron_trigger"`,
+    `"cloudflare_worker_domain"` => `"cloudflare_workers_custom_domain"`,
+    `"cloudflare_worker_script"` => `"cloudflare_workers_script"`,
+    `"cloudflare_worker_secret"` => `"cloudflare_workers_secret"`,
+    `"cloudflare_workers_for_platforms_namespace"` => `"cloudflare_workers_for_platforms_dispatch_namespace"`,
+    `"cloudflare_managed_headers"` => `"cloudflare_managed_transforms"`,
 
     // handle dependencies
     `"cloudflare_access_application.$dep"` => `"cloudflare_zero_trust_access_application.$dep"`,

.grit/patterns/test_v5.md

@@ -108,6 +108,137 @@ resource "cloudflare_access_policy" "test_policy" {
 }
 ```
 
+## test-rulesets: collapse list, nested blocks mapped
+```hcl
+resource "cloudflare_ruleset" "test_ruleset" {
+  kind        = "zone"
+  name        = "test"
+  phase       = "http_request_dynamic_redirect"
+  zone_id     = "f037e56e89293a057740de681ac9abbe"
+
+  rules {
+    action = "redirect"
+    action_parameters {
+      from_value {
+        preserve_query_string = true
+        status_code           = 301
+        target_url {
+          value = "https://example.com"
+        }
+      }
+    }
+    description = "foo"
+    enabled     = false
+    expression  = "(http.host in {\"www.foo.com\"} and (http.user_agent contains \"foo\" or http.user_agent contains \"foo\"))"
+    ref         = "f037e56e89293a057740de681ac9abbe"
+  }
+  rules {
+    action = "redirect"
+    action_parameters {
+      from_value {
+        preserve_query_string = false
+        status_code           = 301
+        target_url {
+          value = "https://example.com"
+        }
+      }
+    }
+    description = "foo"
+    enabled     = false
+    expression  = "(http.host in {\"www.foo.com\"} and (http.user_agent contains \"foo\" or http.user_agent contains \"foo\"))"
+    ref         = "f037e56e89293a057740de681ac9abbe"
+  }
+  rules {
+    action = "execute"
+    action_parameters {
+      id = "f037e56e89293a057740de681ac9abbe"
+      overrides {
+        enabled = true
+        categories {
+          category = "drupal"
+          action   = "managed_challenge"
+        }
+        categories {
+          category = "command-injection"
+          action   = "block"
+        }
+        categories {
+          category = "apache-struts"
+          action   = "challenge"
+        }
+      }
+    }
+    enabled    = true
+    expression = "true"
+  }
+}
+```
+```hcl
+resource "cloudflare_ruleset" "test_ruleset" {
+  kind    = "zone"
+  name    = "test"
+  phase   = "http_request_dynamic_redirect"
+  zone_id = "f037e56e89293a057740de681ac9abbe"
+
+  rules = [{
+    action = "redirect"
+    action_parameters = {
+      from_value = {
+        preserve_query_string = true
+        status_code           = 301
+        target_url = {
+          value = "https://example.com"
+        }
+      }
+    }
+    description = "foo"
+    enabled     = false
+    expression  = "(http.host in {\"www.foo.com\"} and (http.user_agent contains \"foo\" or http.user_agent contains \"foo\"))"
+    ref         = "f037e56e89293a057740de681ac9abbe"
+    },
+    {
+      action = "redirect"
+      action_parameters = {
+        from_value = {
+          preserve_query_string = false
+          status_code           = 301
+          target_url = {
+            value = "https://example.com"
+          }
+        }
+      }
+      description = "foo"
+      enabled     = false
+      expression  = "(http.host in {\"www.foo.com\"} and (http.user_agent contains \"foo\" or http.user_agent contains \"foo\"))"
+      ref         = "f037e56e89293a057740de681ac9abbe"
+    },
+    {
+      action = "execute"
+      action_parameters = {
+        id = "f037e56e89293a057740de681ac9abbe"
+        overrides = {
+          enabled = true
+          categories = [{
+            category = "drupal"
+            action   = "managed_challenge"
+            },
+            {
+              category = "command-injection"
+              action   = "block"
+            },
+            {
+              category = "apache-struts"
+              action   = "challenge"
+          }]
+
+
+        }
+      }
+      enabled    = true
+      expression = "true"
+  }]
+}
+```
 ## test: single blocks
 
 Blocks which are not lists should become attribute objects. This is based on the schema, not the number of blocks.

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "5.6.0"
+  ".": "5.8.2"
 }

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 1752
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-b9cf8d97f015bd3c7509f68b4dea2c37dc5f97183372064702ea540b6dd999f8.yml
-openapi_spec_hash: 83243c9ee06f88d0fa91e9b185d8a42e
-config_hash: cce40d4d65a4d67d5df957a75a15b567
+configured_endpoints: 1783
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-e408a7cdec2dae3d1a18842dcc59280c56050fb042569139aec3fe0f12e0d461.yml
+openapi_spec_hash: 7e210c76f5dd4c79b3e67204ad279b81
+config_hash: a433f3793b734bc6fcc9d9e0c27ff8c2