Add Local Provider Testing Support for Migration E2E Tests & improve integration tests (#47)

* feat: add comprehensive e2e tests

* fix: preserve schedule and match blocks with dynamic refs in device posture migration

This commit fixes two critical drift issues in the zero_trust_device_posture_rule v4 to v5 migration:

1. Schedule field drift (affected 14 resources)
   - Removed logic that deleted schedule = "5m" from state
   - The v5 provider returns this value from API, so removing it caused drift
   - Now preserved in state to match v5 API behavior

2. Match blocks with dynamic references (affected 5+ resources)
   - Fixed MergeAttributeAndBlocksToObjectArray to preserve dynamic references
   - Previously, match blocks with each.value.platform or var.platform were completely removed
   - Added extractTokensFromBlock helper to preserve HCL tokens (variables, interpolations, functions)
   - Now correctly transforms match blocks to arrays while preserving dynamic expressions

Additional changes:
- Added 3 unit tests for match blocks with dynamic references
- Updated integration testdata to include preserved schedule and match arrays
- Added E2E test Step 4 to verify stable state after v5 apply
- E2E script now exits with error if ongoing drift is detected

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(e2e): add local provider support and update test expectations

  Add ability to test migrations with locally built provider binary, and
  update test data to reflect current provider behavior.

  Changes:
  - Add --provider flag to run-e2e-tests script for local provider testing
    - Verifies provider binary exists before running tests
    - Creates .terraformrc-tf-migrate with dev_overrides automatically
    - Applies dev overrides only to v5 tests (v4 uses registry provider)
  - Update zero_trust_gateway_policy migration logic for v5 schema changes
  - Update test expectations for logpull_retention, zero_trust_gateway_policy,
    and zero_trust_list to match current provider output

  The --provider flag enables rapid iteration when fixing provider issues:
    ./scripts/run-e2e-tests --provider /path/to/cloudflare-terraform-next

  This allows testing provider fixes during migration without waiting for
  provider releases, while keeping v4 tests using stable registry versions.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: tamas-jozsa

.gitignore

@@ -1,4 +1,8 @@
 tf-migrate
+.terraformrc-tf-migrate
+
+# Local provider dev overrides
+.terraformrc-tf-migrate
 
 # E2E test files
 # Ignore v4 directory except provider.tf and backend.hcl

integration/v4_to_v5/testdata/logpull_retention/expected/logpull_retention.tf

@@ -1,218 +1,19 @@
 # Integration Test for cloudflare_logpull_retention v4 → v5 Migration
-# This file tests ALL Terraform patterns as required by subtask 08
-
-# ============================================================================
-# Pattern Group 1: Variables & Locals (Required by Subtask 08)
-# ============================================================================
-
-variable "cloudflare_account_id" {
-  description = "Cloudflare account ID"
-  type        = string
-}
+# Simplified to single resource since logpull_retention is a zone-level setting
 
 variable "cloudflare_zone_id" {
   description = "Cloudflare zone ID"
   type        = string
 }
 
-locals {
-  common_zone    = var.cloudflare_zone_id
-  name_prefix    = "test-integration"
-  tags           = ["test", "migration", "v4_to_v5"]
-  enable_feature = true
-  enable_test    = false
-  zone_count     = 3
-}
-
-# ============================================================================
-# Pattern Group 2: for_each with Maps (3-5 resources)
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "map_example" {
-  for_each = {
-    "zone1" = {
-      zone_id = var.cloudflare_zone_id
-      enabled = true
-    }
-    "zone2" = {
-      zone_id = var.cloudflare_zone_id
-      enabled = false
-    }
-    "zone3" = {
-      zone_id = var.cloudflare_zone_id
-      enabled = true
-    }
-    "zone4" = {
-      zone_id = var.cloudflare_zone_id
-      enabled = false
-    }
-  }
-
-  zone_id = each.value.zone_id
-  flag    = each.value.enabled
-}
-
-# ============================================================================
-# Pattern Group 3: for_each with Sets (3-5 items)
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "set_example" {
-  for_each = toset([
-    "alpha",
-    "beta",
-    "gamma",
-    "delta"
-  ])
-
-  zone_id = var.cloudflare_zone_id
-  flag    = each.key == "alpha" || each.key == "gamma" ? true : false
-}
-
-# ============================================================================
-# Pattern Group 4: count-based Resources (at least 3)
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "counted" {
-  count = 3
-
-  zone_id = var.cloudflare_zone_id
-  flag    = count.index % 2 == 0 ? true : false
-}
-
-# ============================================================================
-# Pattern Group 5: Conditional Creation
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "conditional_enabled" {
-  count = local.enable_feature ? 1 : 0
-
-  zone_id = var.cloudflare_zone_id
-  flag    = true
-}
-
-resource "cloudflare_logpull_retention" "conditional_disabled" {
-  count = local.enable_test ? 1 : 0
-
-  zone_id = var.cloudflare_zone_id
-  flag    = false
-}
-
-# ============================================================================
-# Pattern Group 6: Terraform Functions
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "with_functions" {
-  zone_id = var.cloudflare_zone_id
-  flag    = true
-}
-
-resource "cloudflare_logpull_retention" "with_interpolation" {
-  zone_id = "${var.cloudflare_zone_id}" # String interpolation
-  flag    = false
-}
-
-# ============================================================================
-# Pattern Group 7: Lifecycle Meta-Arguments
-# ============================================================================
-
-resource "cloudflare_logpull_retention" "with_lifecycle" {
-  zone_id = var.cloudflare_zone_id
-
-  lifecycle {
-    create_before_destroy = true
-  }
-  flag = true
-}
-
-resource "cloudflare_logpull_retention" "with_ignore_changes" {
-  zone_id = local.common_zone
-
-  lifecycle {
-    ignore_changes = [flag]
-  }
-  flag = false
-}
-
-resource "cloudflare_logpull_retention" "with_prevent_destroy" {
-  zone_id = var.cloudflare_zone_id
-
-  lifecycle {
-    prevent_destroy = false # Set to false for testing
-  }
-  flag = true
-}
-
-# ============================================================================
-# Pattern Group 8: Edge Cases
-# ============================================================================
-
-# Minimal resource (only required fields)
-resource "cloudflare_logpull_retention" "minimal" {
-  zone_id = var.cloudflare_zone_id
-  flag    = true
-}
-
-# Using locals reference
-resource "cloudflare_logpull_retention" "with_local" {
-  zone_id = local.common_zone
-  flag    = local.enable_feature
-}
-
-# Complex conditional expression
-resource "cloudflare_logpull_retention" "complex_conditional" {
-  zone_id = var.cloudflare_zone_id
-  flag    = local.enable_feature && !local.enable_test ? true : false
+variable "cloudflare_account_id" {
+  description = "Cloudflare account ID"
+  type        = string
 }
 
-# ============================================================================
-# Pattern Group 9: Additional Real-World Patterns
-# ============================================================================
-
-# Testing enabled=true explicitly
-resource "cloudflare_logpull_retention" "enabled_explicit" {
+# Single logpull retention resource
+# Tests the basic enabled → flag migration
+resource "cloudflare_logpull_retention" "basic" {
   zone_id = var.cloudflare_zone_id
   flag    = true
 }
-
-# Testing enabled=false explicitly
-resource "cloudflare_logpull_retention" "disabled_explicit" {
-  zone_id = var.cloudflare_zone_id
-  flag    = false
-}
-
-# Using ternary operator
-resource "cloudflare_logpull_retention" "ternary_true" {
-  zone_id = var.cloudflare_zone_id
-  flag    = 1 == 1 ? true : false
-}
-
-resource "cloudflare_logpull_retention" "ternary_false" {
-  zone_id = var.cloudflare_zone_id
-  flag    = 1 == 2 ? true : false
-}
-
-# ============================================================================
-# Summary:
-# - Total resource declarations: 18
-# - Total instances created:
-#   - map_example: 4 instances
-#   - set_example: 4 instances
-#   - counted: 3 instances
-#   - conditional_enabled: 1 instance
-#   - conditional_disabled: 0 instances (count = 0)
-#   - Others: 11 instances
-#   TOTAL: 4 + 4 + 3 + 1 + 0 + 11 = 23 instances
-#
-# Patterns covered:
-# ✓ Variables (cloudflare_account_id, cloudflare_zone_id)
-# ✓ Locals (common_zone, enable_feature, enable_test)
-# ✓ for_each with maps (4 resources)
-# ✓ for_each with sets using toset() (4 resources)
-# ✓ count-based resources (3 resources)
-# ✓ Conditional creation with ternary operator
-# ✓ String interpolation
-# ✓ Lifecycle meta-arguments (create_before_destroy, ignore_changes, prevent_destroy)
-# ✓ Terraform functions (toset())
-# ✓ Edge cases (minimal config, complex conditionals)
-# ✓ Boolean values (both true and false)
-# ============================================================================