Use terraform cli by default, make using opentofu optional (#339)

* Use terraform cli by default, opt into using opentofu

* TestS3BucketModSecret using both tf and opentofu

* lint

* Fix TestPulumiSchemaForModuleHasLanguageInfoGo

* install terraform CLI in setup-tools

* refactor to use module executor variable => WIP

* Schema inference tests, Delete, Read using PickModuleRuntime with tests

* lint NewRuntimeFromExecutable

* lint tests

* better error message in resolveModuleSources

* include runtime description in error message

* more debugging

* TestNewTerraformInit

* show terraform version in CI

* rerun actions

* use bash to show terraform version

* implement test logger for debugging

* cleanup module after extracting content

* error on cleaup

* unique workspaces for terraform vs tofu

* revert workdir changes, log picked runtime

* AuxProviderServer initialized once per test

* update the version of vpc module we are testing against

* use macos-latest instead of ubuntu-latest

* cleanup tfmodules_test

* prepend workspace with executor during tests

* revert adding working directory to tests

* propagate the module executor

* Fixed TestApplyModuleOverrides

* use module dir in TestExtractModuleContentWorks

* run terraform and tofu tests sequentially

* TESTPARALLELISM := 1

* run opentofu then terraform in tests

* larger runner with specific working directory per executor

* clean working directory before extracting

* clean working dir before running the rest of the test

* Split TestExtractModuleContentWorks

* remove cleanup of dirs

* Run prerequisite tests twice per executor

* Remove testUsingExecutor

* back to ubuntu latest

* fix failing tests

* run acceptance tests without using t.Setenv(...)

* remove parallel from tests using multiple executors

* Remove t.Parallel() from TestUnknownsInCreatePlanBySchemaTypeSecrets

* Separate tests per executor

* use executor-specific working directory when initialiting component

* use newPulumiTest

* uncomment debug options

* fix more views test

* Fix TestDiffDetail

* Fix TestState to run both terraform and opentofu

* Skip hanging refresh tests

* Unskip TestRefreshOpenTofu and TestRefreshNoChangesOpenTofu

* a bit of cleanup

Author: Zaid-Ajaj

.github/actions/setup-tools/action.yml

@@ -89,3 +89,11 @@ runs:
       uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3
       with:
         gradle-version: 7.6
+
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v3
+
+    - name: Show Terraform Version
+      shell: bash
+      run: |
+        terraform -version

.github/workflows/prerequisites.yml

@@ -66,8 +66,10 @@ jobs:
         tofu_wrapper: false
     - name: Build provider binary
       run: make provider
-    - name: Unit-test provider code
-      run: make test_provider
+    - name: Unit-test provider code with opentofu
+      run: PULUMI_TERRAFORM_MODULE_EXECUTOR=opentofu make test_provider
+    - name: Unit-test provider code with terraform
+      run: PULUMI_TERRAFORM_MODULE_EXECUTOR=terraform make test_provider
     - name: Upload coverage reports to Codecov
       uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
       env:

pkg/modprovider/constants.go

@@ -1,3 +1,7 @@
 package modprovider
 
-const defaultComponentTypeName = "Module"
+const (
+	defaultComponentTypeName          = "Module"
+	moduleExecutorVariableName        = "executor"
+	moduleExecutorEnvironmentVariable = "PULUMI_TERRAFORM_MODULE_EXECUTOR"
+)

pkg/modprovider/helpers_test.go

@@ -9,13 +9,26 @@ import (
 
 	"github.com/pulumi/pulumi-terraform-module/pkg/auxprovider"
 	"github.com/pulumi/pulumi-terraform-module/pkg/tfsandbox"
+	"github.com/pulumi/pulumi-terraform-module/pkg/tofuresolver"
 )
 
+type testLogger struct {
+	logs []string
+}
+
+func (l *testLogger) Log(_ context.Context, level tfsandbox.LogLevel, msg string) {
+	l.logs = append(l.logs, string(level)+": "+msg)
+}
+
+func (l *testLogger) LogStatus(_ context.Context, level tfsandbox.LogLevel, msg string) {
+	l.logs = append(l.logs, string(level)+": "+msg)
+}
+
 //nolint:unused
-func newTestTofu(t *testing.T) *tfsandbox.Tofu {
+func newTestTofu(t *testing.T) *tfsandbox.ModuleRuntime {
 	srv := newTestAuxProviderServer(t)
 
-	tofu, err := tfsandbox.NewTofu(context.Background(), tfsandbox.DiscardLogger, nil, srv)
+	tofu, err := tfsandbox.NewTofu(context.Background(), tfsandbox.DiscardLogger, nil, srv, tofuresolver.ResolveOpts{})
 	require.NoError(t, err)
 
 	t.Cleanup(func() {

pkg/modprovider/module.go

@@ -104,12 +104,13 @@ func (h *moduleHandler) prepSandbox(
 	moduleSource TFModuleSource,
 	moduleVersion TFModuleVersion,
 	providersConfig map[string]resource.PropertyMap,
-) (*tfsandbox.Tofu, error) {
+	executor string,
+) (*tfsandbox.ModuleRuntime, error) {
 	logger := newResourceLogger(h.hc, urn)
-	wd := tfsandbox.ModuleInstanceWorkdir(urn)
-	tf, err := tfsandbox.NewTofu(ctx, logger, wd, h.auxProviderServer)
+	wd := tfsandbox.ModuleInstanceWorkdir(executor, urn)
+	tf, err := tfsandbox.PickModuleRuntime(ctx, logger, wd, h.auxProviderServer, executor)
 	if err != nil {
-		return nil, fmt.Errorf("Sandbox construction failed: %w", err)
+		return nil, fmt.Errorf("sandbox construction failed: %w", err)
 	}
 
 	// Important: the name of the module instance in TF must be at least unique enough to
@@ -130,7 +131,7 @@ func (h *moduleHandler) prepSandbox(
 		moduleVersion, tf.WorkingDir(),
 		moduleInputs, outputSpecs, providersConfig)
 	if err != nil {
-		return nil, fmt.Errorf("Seed file generation failed: %w", err)
+		return nil, fmt.Errorf("seed file generation failed: %w", err)
 	}
 
 	if oldOutputs != nil {
@@ -143,7 +144,7 @@ func (h *moduleHandler) prepSandbox(
 
 	err = tf.Init(ctx, logger)
 	if err != nil {
-		return nil, fmt.Errorf("Init failed: %w", err)
+		return nil, fmt.Errorf("init failed: %w", err)
 	}
 
 	return tf, nil
@@ -161,6 +162,7 @@ func (h *moduleHandler) applyModuleOperation(
 	inferredModule *InferredModuleSchema,
 	packageName packageName,
 	preview bool,
+	executor string,
 ) (resource.PropertyMap, []*pulumirpc.ViewStep, error) {
 	tf, err := h.prepSandbox(
 		ctx,
@@ -171,6 +173,7 @@ func (h *moduleHandler) applyModuleOperation(
 		moduleSource,
 		moduleVersion,
 		providersConfig,
+		executor,
 	)
 	if err != nil {
 		return nil, nil, fmt.Errorf("Failed preparing tofu sandbox: %w", err)
@@ -249,7 +252,7 @@ func (h *moduleHandler) initializationError(outputs resource.PropertyMap, reason
 // Pulls the TF state and formats module outputs with the special __ meta-properties.
 func (h *moduleHandler) outputs(
 	ctx context.Context,
-	tf *tfsandbox.Tofu,
+	tf *tfsandbox.ModuleRuntime,
 	tfState *tfsandbox.State,
 ) (resource.PropertyMap, error) {
 	rawState, rawLockFile, err := tf.PullStateAndLockFile(ctx)
@@ -273,13 +276,14 @@ func (h *moduleHandler) Create(
 	providersConfig map[string]resource.PropertyMap,
 	inferredModule *InferredModuleSchema,
 	packageName packageName,
+	executor string,
 ) (*pulumirpc.CreateResponse, error) {
 	urn := urn.URN(req.GetUrn())
 	logger := newResourceLogger(h.hc, urn)
 
 	statusClient, err := h.statusPool.Acquire(ctx, logger, req.ResourceStatusAddress)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("acquiring status client failed in Create: %w", err)
 	}
 	defer statusClient.Release()
 
@@ -301,6 +305,7 @@ func (h *moduleHandler) Create(
 		inferredModule,
 		packageName,
 		req.GetPreview(),
+		executor,
 	)
 
 	// Publish views even if applyErr != nil as is the case of partial failures.
@@ -336,6 +341,7 @@ func (h *moduleHandler) Update(
 	providersConfig map[string]resource.PropertyMap,
 	inferredModule *InferredModuleSchema,
 	packageName packageName,
+	executor string,
 ) (*pulumirpc.UpdateResponse, error) {
 	urn := urn.URN(req.GetUrn())
 	logger := newResourceLogger(h.hc, urn)
@@ -352,7 +358,7 @@ func (h *moduleHandler) Update(
 
 	statusClient, err := h.statusPool.Acquire(ctx, logger, req.ResourceStatusAddress)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("acquiring status client failed in Update: %w", err)
 	}
 	defer statusClient.Release()
 
@@ -369,6 +375,7 @@ func (h *moduleHandler) Update(
 		inferredModule,
 		packageName,
 		req.GetPreview(),
+		executor,
 	)
 	// TODO[pulumi/pulumi-terraform-module#342] partial error handling needs to modify this.
 	if err != nil {
@@ -401,13 +408,14 @@ func (h *moduleHandler) Delete(
 	moduleVersion TFModuleVersion,
 	inferredModule *InferredModuleSchema,
 	providersConfig map[string]resource.PropertyMap,
+	executor string,
 ) (*emptypb.Empty, error) {
 	urn := urn.URN(req.GetUrn())
 	logger := newResourceLogger(h.hc, resource.URN(req.GetUrn()))
 
 	statusClient, err := h.statusPool.Acquire(ctx, logger, req.ResourceStatusAddress)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("acquiring status client failed in Delete: %w", err)
 	}
 	defer statusClient.Release()
 
@@ -430,9 +438,10 @@ func (h *moduleHandler) Delete(
 		moduleSource,
 		moduleVersion,
 		providersConfig,
+		executor,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("Failed preparing tofu sandbox: %w", err)
+		return nil, fmt.Errorf("failed preparing tofu sandbox: %w", err)
 	}
 
 	// TODO[pulumi/pulumi-terraform-module#247] once the engine is ready to receive view steps multiple times, the
@@ -477,6 +486,7 @@ func (h *moduleHandler) Read(
 	moduleVersion TFModuleVersion,
 	inferredModule *InferredModuleSchema,
 	providersConfig map[string]resource.PropertyMap,
+	executor string,
 ) (*pulumirpc.ReadResponse, error) {
 	if req.Inputs == nil {
 		return nil, fmt.Errorf("Read() is currently only supported for pulumi refresh")
@@ -510,6 +520,7 @@ func (h *moduleHandler) Read(
 		moduleSource,
 		moduleVersion,
 		providersConfig,
+		executor,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("Failed preparing tofu sandbox: %w", err)

pkg/modprovider/module_component.go

@@ -69,6 +69,7 @@ func newModuleComponentResource(
 	packageRef string,
 	providerSelfURN pulumi.URN,
 	providersConfig map[string]resource.PropertyMap,
+	moduleExecutor string,
 	opts ...pulumi.ResourceOption,
 ) (componentUrn *urn.URN, moduleStateResource *moduleStateResource, outputs pulumi.Map, finalError error) {
 	component := ModuleComponentResource{}
@@ -129,14 +130,23 @@ func newModuleComponentResource(
 		}
 	}()
 
-	wd := tfsandbox.ModuleInstanceWorkdir(urn)
+	wd := tfsandbox.ModuleInstanceWorkdir(moduleExecutor, urn)
 	logger := newComponentLogger(ctx.Log, &component)
 
-	tf, err := tfsandbox.NewTofu(ctx.Context(), logger, wd, auxProviderServer)
+	// decide whether to use opentofu or terraform
+	tf, err := tfsandbox.PickModuleRuntime(
+		ctx.Context(),
+		logger, wd, auxProviderServer, moduleExecutor,
+	)
+
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("Sandbox construction failed: %w", err)
+		return nil, nil, nil,
+			fmt.Errorf("failed to choose module runtime from executor %s: %w",
+				moduleExecutor, err)
 	}
 
+	logger.LogStatus(ctx.Context(), tfsandbox.Debug, "Using "+tf.Description())
+
 	// Important: the name of the module instance in TF must be at least unique enough to
 	// include the Pulumi resource name to avoid Duplicate URN errors. For now we reuse the
 	// Pulumi name as present in the module URN.
@@ -155,7 +165,7 @@ func newModuleComponentResource(
 		moduleInputs, outputSpecs, providersConfig)
 
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("Seed file generation failed: %w", err)
+		return nil, nil, nil, fmt.Errorf("seed file generation failed: %w", err)
 	}
 
 	var moduleOutputs resource.PropertyMap
@@ -166,7 +176,7 @@ func newModuleComponentResource(
 
 	err = tf.Init(ctx.Context(), logger)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("Init failed: %w", err)
+		return nil, nil, nil, fmt.Errorf("init failed: %w", err)
 	}
 
 	var childResources []*childResource
@@ -216,7 +226,7 @@ func newModuleComponentResource(
 			}
 		})
 		if err := errors.Join(errs...); err != nil {
-			return nil, nil, nil, fmt.Errorf("Child resource init failed: %w", err)
+			return nil, nil, nil, fmt.Errorf("child resource init failed: %w", err)
 		}
 		moduleOutputs = plan.Outputs()
 	} else {
@@ -258,7 +268,7 @@ func newModuleComponentResource(
 			}
 		})
 		if err := errors.Join(errs...); err != nil {
-			return nil, nil, nil, fmt.Errorf("Child resource init failed: %w", err)
+			return nil, nil, nil, fmt.Errorf("child resource init failed: %w", err)
 		}
 
 		moduleOutputs = tfState.Outputs()
@@ -272,7 +282,7 @@ func newModuleComponentResource(
 	}
 
 	if applyErr != nil {
-		return nil, nil, nil, fmt.Errorf("Apply failed: %w", applyErr)
+		return nil, nil, nil, fmt.Errorf("apply failed: %w", applyErr)
 	}
 
 	marshalledOutputs := pulumix.MustUnmarshalPropertyMap(ctx, moduleOutputs)

pkg/modprovider/schema.go

@@ -108,6 +108,24 @@ func pulumiSchemaForModule(pargs *ParameterizeArgs, inferredModule *InferredModu
 		}
 	}
 
+	moduleExecutorVariable := schema.PropertySpec{
+		TypeSpec: schema.TypeSpec{
+			Type: "string",
+		},
+
+		Description: "Sets the executor used to run the module.",
+		Default:     "",
+		DefaultInfo: &schema.DefaultSpec{
+			Environment: []string{moduleExecutorEnvironmentVariable},
+		},
+	}
+
+	if inferredModule.ProvidersConfig.Variables == nil {
+		inferredModule.ProvidersConfig.Variables = map[string]schema.PropertySpec{}
+	}
+
+	inferredModule.ProvidersConfig.Variables[moduleExecutorVariableName] = moduleExecutorVariable
+
 	packageSpec := &schema.PackageSpec{
 		Name:    string(packageName),
 		Version: string(pkgVer),