Update minimum TF version; add tests

.github/workflows/CICD.yml

@@ -9,9 +9,10 @@ jobs:
     steps:
       - name: Generate Matrix
         id: matrix
-        uses: Invicton-Labs/terraform-module-testing/matrix@v0.2.0
+        uses: Invicton-Labs/terraform-module-testing/matrix@v0.3.0
         with:
-          minimum_tf_version: '1.9.0'
+          minimum_tf_version: '1.10.3'
+          additional_runners: 'macos-13, windows-2019'
 
       - name: Output Matrix
         run: |
@@ -28,25 +29,119 @@ jobs:
     steps:
       - name: Initialize - Pass
         id: init-pass
-        uses: Invicton-Labs/terraform-module-testing/initialize@v0.2.0
+        uses: Invicton-Labs/terraform-module-testing/initialize@v0.3.0
         with:
           tf_path: tests/pass
       - name: Run Tests - Pass
         id: tests-pass
-        uses: Invicton-Labs/terraform-module-testing/apply-destroy@v0.2.0
+        uses: Invicton-Labs/terraform-module-testing/apply-destroy@v0.3.0
         with:
           tf_path: tests/pass
 
+      - name: Initialize - Pass (With Output)
+        id: init-pass-output
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-output
+      - name: Run Tests - Pass (With Output)
+        id: tests-pass-output
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-output
+
+      - name: Initialize - Pass - Condition Delayed
+        id: init-pass-condition-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-condition-delayed
+      - name: Run Tests - Pass - Condition Delayed
+        id: tests-pass-condition-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-condition-delayed
+
+      - name: Initialize - Pass - Message Delayed
+        id: init-pass-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-message-delayed
+      - name: Run Tests - Pass - Message Delayed
+        id: tests-pass-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-message-delayed
+          stderr_contains: Unsuitable value for error message
+
+      - name: Initialize - Pass - Condition & Message Delayed
+        id: init-pass-condition-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-condition-message-delayed
+      - name: Run Tests - Pass - Condition & Message Delayed
+        id: tests-pass-condition-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/pass-condition-message-delayed
+
       - name: Initialize - Fail
         id: init-fail
-        uses: Invicton-Labs/terraform-module-testing/initialize@v0.2.0
+        uses: Invicton-Labs/terraform-module-testing/initialize@v0.3.0
         with:
           tf_path: tests/fail
       - name: Run Tests - Fail
         id: tests-fail
-        uses: Invicton-Labs/terraform-module-testing/apply-failure@v0.2.0
+        uses: Invicton-Labs/terraform-module-testing/apply-failure@v0.3.0
         with:
           tf_path: tests/fail
+          stderr_contains: sample error
+
+      - name: Initialize - Fail (Output)
+        id: init-fail-output
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-output
+      - name: Run Tests - Fail (Output)
+        id: tests-fail-output
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-output
+          stderr_contains: sample error
+
+      - name: Initialize - Fail - Condition Delayed
+        id: init-fail-condition-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-condition-delayed
+      - name: Run Tests - Fail - Condition Delayed
+        id: tests-fail-condition-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-condition-delayed
+          stderr_contains: sample error
+
+      - name: Initialize - Fail - Message Delayed
+        id: init-fail-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-message-delayed
+      - name: Run Tests - Fail - Message Delayed
+        id: tests-fail-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-message-delayed
+          stderr_contains: Unsuitable value for error message
+
+      - name: Initialize - Fail - Condition & Message Delayed
+        id: init-fail-condition-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-condition-message-delayed
+      - name: Run Tests - Fail - Condition & Message Delayed
+        id: tests-fail-condition-message-delayed
+        uses: Invicton-Labs/terraform-module-testing/[email protected]
+        with:
+          tf_path: tests/fail-condition-message-delayed
+          stderr_contains: sample error
 
   # This job just waits for all other jobs to pass. We have it here
   # so our branch protection rule can reference a single job, instead

.gitignore

@@ -27,3 +27,5 @@ override.tf.json
 
 # Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
 # example: *tfplan*
+
+/tests/**/.terraform.lock.hcl

README.md

@@ -30,3 +30,25 @@ var.error_message is "This Terraform configuration can only be run on Unix-based
 // Ignore this part
 There is no function named "SEE_ABOVE_ERROR_MESSAGE".
 ```
+
+## Plan, Apply, and Unknown Values
+
+There are several edge cases regarding conditions that aren't known until apply and error messages that aren't known until apply.
+
+
+### Conditions not known during planning
+
+When the `condition` variable doesn't have a known value during the plan step, the assertion will not be checked during the plan step. The `error_message` variable will not be used or evaluated.
+
+The `condition` _will_ still be checked during the apply step, and the `error_message` variable will be used if `condition` evaluates to `false`.
+
+
+### Error messages not known during planning
+
+When the `error_message` variable doesn't have a known value during the plan step, the behaviour will vary depending on whether the `condition` value is known during the plan step.
+
+If `condition` is not known during planning, then the `error_message` will not be evaluated/used until the apply step, and only if `condition` evaluates to `false`.
+
+If the `condition` _is_ known during planning and it evaluates to `false`, then the Terraform operation will fail during the plan step and the output error message will explain that the `error_message` variable value is invalid (not known).
+
+If `condition` evaluates to `true` as soon as it's known, then `error_message` will never be used or evaluated, so it doesn't matter if it's known or not.

tests/fail-condition-delayed/main.tf

@@ -0,0 +1,6 @@
+module "fail" {
+  source = "../../"
+  // Use a condition that isn't known until the apply step
+  condition     = uuid() == ""
+  error_message = "sample error"
+}

tests/fail-condition-message-delayed/main.tf

@@ -0,0 +1,7 @@
+module "fail" {
+  source = "../../"
+  // Use a condition that isn't known until the apply step
+  condition = uuid() == ""
+  // Use a message that isn't known until the apply step
+  error_message = "sample error: ${uuid()}"
+}

tests/fail-message-delayed/main.tf

@@ -0,0 +1,6 @@
+module "fail" {
+  source    = "../../"
+  condition = false
+  // Use a message that isn't known until the apply step
+  error_message = "sample error: ${uuid()}"
+}

tests/fail-output/main.tf

@@ -0,0 +1,11 @@
+module "fail" {
+  source        = "../../"
+  condition     = false
+  error_message = "sample error"
+}
+
+// Force the module and conditions to be evaluated
+// by using the module output in a config output.
+output "result" {
+  value = module.fail.checked
+}

tests/pass-condition-delayed/main.tf

@@ -0,0 +1,6 @@
+module "pass" {
+  source = "../../"
+  // Use a condition that isn't known until the apply step
+  condition     = uuid() != ""
+  error_message = "sample error"
+}

tests/pass-condition-message-delayed/main.tf

@@ -0,0 +1,7 @@
+module "pass" {
+  source = "../../"
+  // Use a condition that isn't known until the apply step
+  condition = uuid() != ""
+  // Use a message that isn't known until the apply step
+  error_message = "sample error: ${uuid()}"
+}

tests/pass-message-delayed/main.tf

@@ -0,0 +1,6 @@
+module "pass" {
+  source    = "../../"
+  condition = true
+  // Use a message that isn't known until the apply step
+  error_message = "sample error: ${uuid()}"
+}

tests/pass-output/main.tf

@@ -0,0 +1,11 @@
+module "pass" {
+  source        = "../../"
+  condition     = true
+  error_message = "sample error"
+}
+
+// Force the module and conditions to be evaluated
+// by using the module output in a config output.
+output "result" {
+  value = module.pass.checked
+}

variables.tf

@@ -12,7 +12,7 @@ variable "condition" {
     // until var.error_message is known. Otherwise, it can fail during the validation
     // phase but won't output the proper error message.
     // https://github.com/hashicorp/terraform/issues/35397
-    condition     = var.error_message != null && var.condition == true
+    condition     = var.error_message == "" ? var.condition : var.condition
     error_message = var.error_message
   }
 }

versions.tf

@@ -1,3 +1,3 @@
 terraform {
-  required_version = ">= 1.9.0"
+  required_version = ">= 1.10.3"
 }