RUN-4103: Release 1.1.2: Fix value_choices validation and node_filter_exclude_query (#220)

## Summary

This PR contains bug fixes for v1.1.2 release:

1. **Fix validation error with variable-based value_choices**
([#218](#218))
- Job options with `require_predefined_choice = true` and
`value_choices` set to a Terraform variable no longer fail validation
during plan phase.

2. **Fix node_filter_exclude_query not working** - The
`node_filter_exclude_query` field was not being sent to Rundeck API
correctly. Fixed by using the correct API field name `filterExclude`
instead of `excludeFilter`.

---

## Changes

### Bug Fix 1: value_choices from variables
([#218](#218))

- **resource_job_framework.go**: Modified validation logic to skip
unknown values instead of treating them as errors
  - Skip validation when entire `value_choices` list is unknown
  - Skip validation when any individual choice element is unknown
  - Validation runs during apply phase when values are concrete

### Bug Fix 2: node_filter_exclude_query

- **resource_job_framework.go**: Fixed `jobNodeFilters` struct to use
correct Rundeck API field
- Changed from `excludeFilter` to `filterExclude` (correct Rundeck API
field name)
  - Updated `planToJobJSON` to properly set `FilterExclude` field
- Updated `jobJSONAPIToState` and `jobJSONToState` to read
`filterExclude` from API response

### Test Coverage

- **resource_job_test.go**: Added
`TestAccJobOptions_value_choices_from_variable`
  - Tests job option with `value_choices` set to a variable
  - Verifies plan succeeds without validation error
  - Confirms values are correctly applied

- **resource_job_test.go**: Added `TestAccJob_node_filter_exclude`
  - Tests `node_filter_exclude_query` with include filter
- Tests both `node_filter_query` and `node_filter_exclude_query`
together
  - Verifies `node_filter_exclude_precedence` works correctly

### Documentation

- **CHANGELOG.md**: Added v1.1.2 release notes with both bug fix
descriptions

---

## Test Plan

- [x] Code compiles successfully (`go build`)
- [x] Code formatted (`make fmt`)
- [x] No linting errors (`go vet`)
- [ ] Acceptance test passes:
`TestAccJobOptions_value_choices_from_variable`
- [ ] Acceptance test passes: `TestAccJob_node_filter_exclude`
- [ ] Existing tests still pass
- [x] Manual testing with user's exact scenario from Issue #218
- [x] Manual testing of `node_filter_exclude_query` against local
Rundeck instance

---

## Backward Compatibility

✅ Fully backward compatible

- Existing validation logic unchanged for concrete values
- Still validates empty strings and requires at least one non-empty
value
- Only skips validation when values are unknown (new behavior)
- `node_filter_exclude_query` now works as documented

---

## Related Issues

Fixes #218

---------

Co-authored-by: Luis Toledo <luis@variacode.com>

Author: fdevans

.github/workflows/test.yml

@@ -89,6 +89,8 @@ jobs:
         TF_ACC: 1
         RUNDECK_URL: http://localhost:4440
         RUNDECK_AUTH_TOKEN: 1d08bf61-f962-467f-8ba3-ab8a463b3467
+        RUNDECK_AUTH_USERNAME: admin
+        RUNDECK_AUTH_PASSWORD: admin  # This is the default password for the admin user in Rundeck
         # Don't run Enterprise tests in CI (Community Edition)
         RUNDECK_ENTERPRISE_TESTS: 0
 

CHANGELOG.md

@@ -1,3 +1,21 @@
+## 1.1.2
+
+**Bug Fixes**
+
+### Job Resource
+- **Fixed validation error with variable-based value_choices** ([#218](https://github.com/rundeck/terraform-provider-rundeck/issues/218)) - Job options with `require_predefined_choice = true` and `value_choices` set to a Terraform variable no longer fail validation during plan phase. The provider now correctly skips validation when values are unknown (e.g., from variables or computed values) and validates during apply phase when values are concrete. This fixes the regression introduced in v1.1.0 where users received "Missing value choices" errors even when variables were properly defined.
+
+- **Fixed node_filter_exclude_query not working** - The `node_filter_exclude_query` field was not being sent to Rundeck correctly. The provider was using `excludeFilter` as the JSON field name, but Rundeck's API expects `filterExclude`. Jobs with node exclusion filters now work correctly:
+  ```hcl
+  resource "rundeck_job" "example" {
+    # ...
+    node_filter_query         = "tags: webserver"
+    node_filter_exclude_query = "name: maintenance-*"
+  }
+  ```
+
+---
+
 ## 1.1.1
 
 **Bug Fixes**

rundeck/resource_job_framework.go

@@ -129,7 +129,7 @@ type jobRetry struct {
 
 type jobNodeFilters struct {
 	Filter        string       `json:"filter,omitempty"`
-	ExcludeFilter string       `json:"excludeFilter,omitempty"`
+	FilterExclude string       `json:"filterExclude,omitempty"`
 	Dispatch      *jobDispatch `json:"dispatch,omitempty"`
 }
 
@@ -423,7 +423,7 @@ func (r *jobResource) ValidateConfig(ctx context.Context, req resource.ValidateC
 				}
 
 				valueChoicesList, ok := valueChoicesAttr.(types.List)
-				if !ok || valueChoicesList.IsNull() || valueChoicesList.IsUnknown() {
+				if !ok || valueChoicesList.IsNull() {
 					resp.Diagnostics.AddAttributeError(
 						path.Root("option").AtListIndex(i).AtName("value_choices"),
 						"Missing value choices",
@@ -432,6 +432,12 @@ func (r *jobResource) ValidateConfig(ctx context.Context, req resource.ValidateC
 					continue
 				}
 
+				// Skip validation if value_choices is unknown (e.g., from a variable or computed value)
+				// Validation will occur during apply when the value is known
+				if valueChoicesList.IsUnknown() {
+					continue
+				}
+
 				// Extract string values from the list
 				var valueChoices []types.String
 				diags := valueChoicesList.ElementsAs(ctx, &valueChoices, false)
@@ -442,9 +448,15 @@ func (r *jobResource) ValidateConfig(ctx context.Context, req resource.ValidateC
 
 				// Check for at least one non-empty value and reject empty strings
 				hasNonEmptyValue := false
+				hasUnknownValue := false
 				var emptyValueIndices []int
 				for j, choice := range valueChoices {
-					if choice.IsNull() || choice.IsUnknown() {
+					if choice.IsUnknown() {
+						// If any element is unknown, skip validation entirely
+						hasUnknownValue = true
+						break
+					}
+					if choice.IsNull() {
 						emptyValueIndices = append(emptyValueIndices, j)
 						continue
 					}
@@ -456,6 +468,11 @@ func (r *jobResource) ValidateConfig(ctx context.Context, req resource.ValidateC
 					}
 				}
 
+				// Skip validation if any element is unknown
+				if hasUnknownValue {
+					continue
+				}
+
 				if !hasNonEmptyValue {
 					resp.Diagnostics.AddAttributeError(
 						path.Root("option").AtListIndex(i).AtName("value_choices"),
@@ -948,6 +965,8 @@ func (r *jobResource) planToJobJSON(ctx context.Context, plan *jobResourceModel)
 	// Note: When a job has node filters (dispatches to nodes), the dispatch config
 	// is nested INSIDE nodefilters, not at the root level.
 	// This applies to both Open Source and Enterprise Rundeck.
+	//
+	// Rundeck uses "filter" for include patterns and "filterExclude" for exclude patterns.
 	hasNodeFilters := !plan.NodeFilterQuery.IsNull() || !plan.NodeFilterExcludeQuery.IsNull()
 	hasDispatchConfig := !plan.MaxThreadCount.IsNull() || !plan.ContinueNextNodeOnError.IsNull() ||
 		!plan.RankOrder.IsNull() || !plan.RankAttribute.IsNull() ||
@@ -956,12 +975,12 @@ func (r *jobResource) planToJobJSON(ctx context.Context, plan *jobResourceModel)
 	if hasNodeFilters || hasDispatchConfig {
 		job.NodeFilters = &jobNodeFilters{}
 
-		// Set filter fields
-		if !plan.NodeFilterQuery.IsNull() {
+		// Set filter fields - Rundeck uses separate "filter" and "filterExclude" fields
+		if !plan.NodeFilterQuery.IsNull() && plan.NodeFilterQuery.ValueString() != "" {
 			job.NodeFilters.Filter = plan.NodeFilterQuery.ValueString()
 		}
-		if !plan.NodeFilterExcludeQuery.IsNull() {
-			job.NodeFilters.ExcludeFilter = plan.NodeFilterExcludeQuery.ValueString()
+		if !plan.NodeFilterExcludeQuery.IsNull() && plan.NodeFilterExcludeQuery.ValueString() != "" {
+			job.NodeFilters.FilterExclude = plan.NodeFilterExcludeQuery.ValueString()
 		}
 
 		// Set dispatch configuration (nested inside nodefilters)
@@ -1152,12 +1171,13 @@ func (r *jobResource) jobJSONToState(ctx context.Context, job *jobJSON, state *j
 	}
 
 	// Handle node filters
+	// Rundeck uses separate "filter" and "filterExclude" fields
 	if job.NodeFilters != nil {
 		if job.NodeFilters.Filter != "" {
 			state.NodeFilterQuery = types.StringValue(job.NodeFilters.Filter)
 		}
-		if job.NodeFilters.ExcludeFilter != "" {
-			state.NodeFilterExcludeQuery = types.StringValue(job.NodeFilters.ExcludeFilter)
+		if job.NodeFilters.FilterExclude != "" {
+			state.NodeFilterExcludeQuery = types.StringValue(job.NodeFilters.FilterExclude)
 		}
 	}
 
@@ -1302,12 +1322,13 @@ func (r *jobResource) jobJSONAPIToState(ctx context.Context, job *JobJSON, state
 	}
 
 	// Handle node filters and dispatch (nested inside nodefilters)
+	// Rundeck uses separate "filter" and "filterExclude" fields
 	if job.NodeFilters != nil {
 		if filter, ok := job.NodeFilters["filter"].(string); ok && filter != "" {
 			state.NodeFilterQuery = types.StringValue(filter)
 		}
-		if excludeFilter, ok := job.NodeFilters["excludeFilter"].(string); ok && excludeFilter != "" {
-			state.NodeFilterExcludeQuery = types.StringValue(excludeFilter)
+		if filterExclude, ok := job.NodeFilters["filterExclude"].(string); ok && filterExclude != "" {
+			state.NodeFilterExcludeQuery = types.StringValue(filterExclude)
 		}
 
 		// Dispatch is nested inside nodefilters

rundeck/resource_job_test.go

@@ -73,6 +73,32 @@ func TestAccJob_cmd_nodefilter(t *testing.T) {
 	})
 }
 
+// TestAccJob_node_filter_exclude tests the node_filter_exclude_query field
+// This verifies that the filterExclude field is correctly sent to and read from Rundeck API
+func TestAccJob_node_filter_exclude(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(),
+		CheckDestroy:             testAccJobCheckDestroy(),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccJobConfig_node_filter_exclude,
+				Check: resource.ComposeTestCheckFunc(
+					// Test job with only exclude filter
+					resource.TestCheckResourceAttr("rundeck_job.test_exclude_only", "name", "Test-Exclude-Only"),
+					resource.TestCheckResourceAttr("rundeck_job.test_exclude_only", "node_filter_query", ".*"),
+					resource.TestCheckResourceAttr("rundeck_job.test_exclude_only", "node_filter_exclude_query", "name: localhost"),
+					// Test job with both include and exclude filters
+					resource.TestCheckResourceAttr("rundeck_job.test_both_filters", "name", "Test-Both-Filters"),
+					resource.TestCheckResourceAttr("rundeck_job.test_both_filters", "node_filter_query", "tags: webserver"),
+					resource.TestCheckResourceAttr("rundeck_job.test_both_filters", "node_filter_exclude_query", "name: maintenance-*"),
+					resource.TestCheckResourceAttr("rundeck_job.test_both_filters", "node_filter_exclude_precedence", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccJob_cmd_referred_job(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { testAccPreCheck(t) },
@@ -303,6 +329,34 @@ func TestAccJobOptions_option_type(t *testing.T) {
 	})
 }
 
+// TestAccJobOptions_value_choices_from_variable tests Issue #218 fix
+// Verifies that value_choices can be set from a variable without triggering
+// "Missing value choices" validation error during plan phase
+func TestAccJobOptions_value_choices_from_variable(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testAccPreCheck(t) },
+		ProtoV5ProviderFactories: testAccProtoV5ProviderFactories(),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccJobOptions_value_choices_from_variable,
+				Check: resource.ComposeTestCheckFunc(
+					// Verify the job was created successfully
+					resource.TestCheckResourceAttr("rundeck_job.test", "name", "job-with-variable-choices"),
+					resource.TestCheckResourceAttr("rundeck_job.test", "execution_enabled", "true"),
+					// Verify the option configuration
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.name", "environment"),
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.require_predefined_choice", "true"),
+					// Verify value_choices were properly set from the variable
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.value_choices.#", "3"),
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.value_choices.0", "dev"),
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.value_choices.1", "staging"),
+					resource.TestCheckResourceAttr("rundeck_job.test", "option.0.value_choices.2", "prod"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccJob_plugins(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:                 func() { testAccPreCheck(t) },
@@ -671,6 +725,56 @@ resource "rundeck_job" "source_test_job" {
 }
 `
 
+// Test configuration for node_filter_exclude_query
+const testAccJobConfig_node_filter_exclude = `
+resource "rundeck_project" "test_exclude" {
+  name = "terraform-acc-test-node-filter-exclude"
+  description = "Test project for node_filter_exclude_query"
+
+  resource_model_source {
+    type = "file"
+    config = {
+        format = "resourceyaml"
+        file = "/tmp/terraform-acc-tests.yaml"
+    }
+  }
+}
+
+resource "rundeck_job" "test_exclude_only" {
+  project_name      = rundeck_project.test_exclude.name
+  name              = "Test-Exclude-Only"
+  description       = "Tests node_filter_exclude_query with include filter"
+  execution_enabled = true
+
+  node_filter_query         = ".*"
+  node_filter_exclude_query = "name: localhost"
+  max_thread_count          = 1
+
+  command {
+    description   = "Echo test"
+    shell_command = "echo 'Testing exclude filter'"
+  }
+}
+
+resource "rundeck_job" "test_both_filters" {
+  project_name      = rundeck_project.test_exclude.name
+  name              = "Test-Both-Filters"
+  description       = "Tests both node_filter_query and node_filter_exclude_query"
+  execution_enabled = true
+
+  node_filter_query              = "tags: webserver"
+  node_filter_exclude_query      = "name: maintenance-*"
+  node_filter_exclude_precedence = true
+  max_thread_count               = 5
+  continue_next_node_on_error    = true
+
+  command {
+    description   = "Echo test"
+    shell_command = "echo 'Testing both filters'"
+  }
+}
+`
+
 const testAccJobConfig_cmd_referred_job = `
 resource "rundeck_project" "source_test" {
   name = "source_project"
@@ -1049,6 +1153,48 @@ resource "rundeck_job" "test" {
 }
 `
 
+// Test configuration for Issue #218 - value_choices from variable
+const testAccJobOptions_value_choices_from_variable = `
+variable "environment_choices" {
+  type    = list(string)
+  default = ["dev", "staging", "prod"]
+}
+
+resource "rundeck_project" "test" {
+  name = "terraform-acc-test-job-option-var-choices"
+  description = "parent project for job acceptance tests"
+
+  resource_model_source {
+    type = "file"
+    config = {
+        format = "resourceyaml"
+        file = "/tmp/terraform-acc-tests.yaml"
+    }
+  }
+}
+
+resource "rundeck_job" "test" {
+  project_name = rundeck_project.test.name
+  name = "job-with-variable-choices"
+  description = "A job with value_choices from variable"
+
+  option {
+    name                      = "environment"
+    label                     = "Environment"
+    description               = "Target environment"
+    required                  = true
+    default_value             = "dev"
+    value_choices             = var.environment_choices
+    require_predefined_choice = true
+  }
+
+  command {
+    description = "Echo environment"
+    shell_command = "echo $${option.environment}"
+  }
+}
+`
+
 const testOchestration_maxperecent = `
 resource "rundeck_project" "test" {
 	name = "terraform-acc-test-job"