Add support for write-only attributes in actions (#1233)

* Add support for write-only attributes in action schema

* Add changelog entry

* Update comments to clarify usage

Author: SBGoods

.changes/unreleased/FEATURES-20251014-173739.yaml

@@ -0,0 +1,5 @@
+kind: FEATURES
+body: 'action/schema: Added `WriteOnly` schema field for action schemas.'
+time: 2025-10-14T17:37:39.087475-04:00
+custom:
+    Issue: "1233"

action/schema/bool_attribute.go

@@ -104,6 +104,10 @@ type BoolAttribute struct {
 	// xattr.TypeWithValidate interface, the validators defined in this field
 	// are run in addition to the validation defined by the type.
 	Validators []validator.Bool
+
+	// WriteOnly indicates whether this attribute can accept ephemeral values
+	// or not. If WriteOnly is true, either Optional or Required must also be true.
+	WriteOnly bool
 }
 
 // ApplyTerraform5AttributePathStep always returns an error as it is not
@@ -166,9 +170,9 @@ func (a BoolAttribute) IsSensitive() bool {
 	return false
 }
 
-// IsWriteOnly always returns false as action schema attributes cannot be WriteOnly.
+// IsWriteOnly returns the WriteOnly field value.
 func (a BoolAttribute) IsWriteOnly() bool {
-	return false
+	return a.WriteOnly
 }
 
 // IsRequiredForImport returns false as this behavior is only relevant

action/schema/bool_attribute_test.go

@@ -370,6 +370,12 @@ func TestBoolAttributeIsWriteOnly(t *testing.T) {
 			attribute: schema.BoolAttribute{},
 			expected:  false,
 		},
+		"writeOnly": {
+			attribute: schema.BoolAttribute{
+				WriteOnly: true,
+			},
+			expected: true,
+		},
 	}
 
 	for name, testCase := range testCases {

action/schema/dynamic_attribute.go

@@ -105,6 +105,10 @@ type DynamicAttribute struct {
 	// xattr.TypeWithValidate interface, the validators defined in this field
 	// are run in addition to the validation defined by the type.
 	Validators []validator.Dynamic
+
+	// WriteOnly indicates whether this attribute can accept ephemeral values
+	// or not. If WriteOnly is true, either Optional or Required must also be true.
+	WriteOnly bool
 }
 
 // ApplyTerraform5AttributePathStep always returns an error as it is not
@@ -167,9 +171,9 @@ func (a DynamicAttribute) IsSensitive() bool {
 	return false
 }
 
-// IsWriteOnly always returns false as action schema attributes cannot be WriteOnly.
+// IsWriteOnly returns the WriteOnly field value.
 func (a DynamicAttribute) IsWriteOnly() bool {
-	return false
+	return a.WriteOnly
 }
 
 // IsRequiredForImport returns false as this behavior is only relevant

action/schema/dynamic_attribute_test.go

@@ -9,14 +9,15 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-go/tftypes"
+
 	"github.com/hashicorp/terraform-plugin-framework/action/schema"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/internal/fwschema"
 	"github.com/hashicorp/terraform-plugin-framework/internal/testing/testschema"
 	"github.com/hashicorp/terraform-plugin-framework/internal/testing/testtypes"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 	"github.com/hashicorp/terraform-plugin-framework/types"
-	"github.com/hashicorp/terraform-plugin-go/tftypes"
 )
 
 func TestDynamicAttributeApplyTerraform5AttributePathStep(t *testing.T) {
@@ -369,6 +370,12 @@ func TestDynamicAttributeIsWriteOnly(t *testing.T) {
 			attribute: schema.DynamicAttribute{},
 			expected:  false,
 		},
+		"writeOnly": {
+			attribute: schema.DynamicAttribute{
+				WriteOnly: true,
+			},
+			expected: true,
+		},
 	}
 
 	for name, testCase := range testCases {

action/schema/float32_attribute.go

@@ -107,6 +107,10 @@ type Float32Attribute struct {
 	// xattr.TypeWithValidate interface, the validators defined in this field
 	// are run in addition to the validation defined by the type.
 	Validators []validator.Float32
+
+	// WriteOnly indicates whether this attribute can accept ephemeral values
+	// or not. If WriteOnly is true, either Optional or Required must also be true.
+	WriteOnly bool
 }
 
 // ApplyTerraform5AttributePathStep always returns an error as it is not
@@ -169,9 +173,9 @@ func (a Float32Attribute) IsSensitive() bool {
 	return false
 }
 
-// IsWriteOnly always returns false as action schema attributes cannot be WriteOnly.
+// IsWriteOnly returns the WriteOnly field value.
 func (a Float32Attribute) IsWriteOnly() bool {
-	return false
+	return a.WriteOnly
 }
 
 // IsRequiredForImport returns false as this behavior is only relevant

action/schema/float32_attribute_test.go

@@ -370,6 +370,12 @@ func TestFloat32AttributeIsWriteOnly(t *testing.T) {
 			attribute: schema.Float32Attribute{},
 			expected:  false,
 		},
+		"writeOnly": {
+			attribute: schema.Float32Attribute{
+				WriteOnly: true,
+			},
+			expected: true,
+		},
 	}
 
 	for name, testCase := range testCases {

action/schema/float64_attribute.go

@@ -107,6 +107,10 @@ type Float64Attribute struct {
 	// xattr.TypeWithValidate interface, the validators defined in this field
 	// are run in addition to the validation defined by the type.
 	Validators []validator.Float64
+
+	// WriteOnly indicates whether this attribute can accept ephemeral values
+	// or not. If WriteOnly is true, either Optional or Required must also be true.
+	WriteOnly bool
 }
 
 // ApplyTerraform5AttributePathStep always returns an error as it is not
@@ -169,9 +173,9 @@ func (a Float64Attribute) IsSensitive() bool {
 	return false
 }
 
-// IsWriteOnly always returns false as action schema attributes cannot be WriteOnly.
+// IsWriteOnly returns the WriteOnly field value.
 func (a Float64Attribute) IsWriteOnly() bool {
-	return false
+	return a.WriteOnly
 }
 
 // IsRequiredForImport returns false as this behavior is only relevant

action/schema/float64_attribute_test.go

@@ -359,7 +359,7 @@ func TestFloat64AttributeIsSensitive(t *testing.T) {
 	}
 }
 
-func TestFloat54AttributeIsWriteOnly(t *testing.T) {
+func TestFloat64AttributeIsWriteOnly(t *testing.T) {
 	t.Parallel()
 
 	testCases := map[string]struct {
@@ -370,6 +370,12 @@ func TestFloat54AttributeIsWriteOnly(t *testing.T) {
 			attribute: schema.Float64Attribute{},
 			expected:  false,
 		},
+		"writeOnly": {
+			attribute: schema.Float64Attribute{
+				WriteOnly: true,
+			},
+			expected: true,
+		},
 	}
 
 	for name, testCase := range testCases {

action/schema/int32_attribute.go

@@ -107,6 +107,10 @@ type Int32Attribute struct {
 	// xattr.TypeWithValidate interface, the validators defined in this field
 	// are run in addition to the validation defined by the type.
 	Validators []validator.Int32
+
+	// WriteOnly indicates whether this attribute can accept ephemeral values
+	// or not. If WriteOnly is true, either Optional or Required must also be true.
+	WriteOnly bool
 }
 
 // ApplyTerraform5AttributePathStep always returns an error as it is not
@@ -169,9 +173,9 @@ func (a Int32Attribute) IsSensitive() bool {
 	return false
 }
 
-// IsWriteOnly always returns false as action schema attributes cannot be WriteOnly.
+// IsWriteOnly returns the WriteOnly field value.
 func (a Int32Attribute) IsWriteOnly() bool {
-	return false
+	return a.WriteOnly
 }
 
 // IsRequiredForImport returns false as this behavior is only relevant