feat: template variables added to input

Input can override template vars, implementing the equivalent
of '-var' in terraform.

Author: Emyrk

preview.go

@@ -8,12 +8,14 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/aquasecurity/trivy/pkg/iac/scanners/terraform/parser"
 	"github.com/aquasecurity/trivy/pkg/log"
 	"github.com/hashicorp/hcl/v2"
 	"github.com/zclconf/go-cty/cty"
 
+	"github.com/coder/preview/tfvars"
 	"github.com/coder/preview/types"
 )
 
@@ -25,6 +27,7 @@ type Input struct {
 	PlanJSON        json.RawMessage
 	ParameterValues map[string]string
 	Owner           types.WorkspaceOwner
+	TFVars          map[string]cty.Value
 }
 
 type Output struct {
@@ -50,6 +53,17 @@ func Preview(ctx context.Context, input Input, dir fs.FS) (*Output, hcl.Diagnost
 		}
 	}
 
+	variableValues, err := tfvars.LoadTFVars(dir, varFiles)
+	if err != nil {
+		return nil, hcl.Diagnostics{
+			{
+				Severity: hcl.DiagError,
+				Summary:  "Failed to load tfvars from files",
+				Detail:   err.Error(),
+			},
+		}
+	}
+
 	planHook, err := PlanJSONHook(dir, input)
 	if err != nil {
 		return nil, hcl.Diagnostics{
@@ -71,17 +85,23 @@ func Preview(ctx context.Context, input Input, dir fs.FS) (*Output, hcl.Diagnost
 			},
 		}
 	}
-	var _ = ownerHook
+
+	// Override with user supplied variables
+	for k, v := range input.TFVars {
+		variableValues[k] = v
+	}
 
 	// moduleSource is "" for a local module
 	p := parser.New(dir, "",
 		parser.OptionStopOnHCLError(false),
 		parser.OptionWithDownloads(false),
 		parser.OptionWithSkipCachedModules(true),
-		parser.OptionWithTFVarsPaths(varFiles...),
 		parser.OptionWithEvalHook(planHook),
 		parser.OptionWithEvalHook(ownerHook),
 		parser.OptionWithEvalHook(ParameterContextsEvalHook(input)),
+		// 'OptionsWithTfVars' cannot be set with 'OptionWithTFVarsPaths'. So load the
+		// tfvars from the files ourselves and merge with the user-supplied tf vars.
+		parser.OptionsWithTfVars(variableValues),
 	)
 
 	err = p.ParseFS(ctx, ".")
@@ -149,7 +169,7 @@ func tfVarFiles(path string, dir fs.FS) ([]string, error) {
 			files = append(files, newFiles...)
 		}
 
-		if filepath.Ext(entry.Name()) == ".tfvars" {
+		if filepath.Ext(entry.Name()) == ".tfvars" || strings.HasSuffix(entry.Name(), ".tfvars.json") {
 			files = append(files, filepath.Join(path, entry.Name()))
 		}
 	}

preview_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/zclconf/go-cty/cty"
 
 	"github.com/coder/preview"
 	"github.com/coder/preview/types"
@@ -392,6 +393,37 @@ func Test_Extract(t *testing.T) {
 				"beta":  ap().unknown(),
 			},
 		},
+		{
+			name:    "tfvars_from_file",
+			dir:     "tfvars",
+			expTags: map[string]string{},
+			input: preview.Input{
+				ParameterValues: map[string]string{},
+			},
+			unknownTags: []string{},
+			params: map[string]assertParam{
+				"variable_values": ap().
+					def("alex").optVals("alex", "bob", "claire", "jason"),
+			},
+		},
+		{
+			name:    "tfvars_from_input",
+			dir:     "tfvars",
+			expTags: map[string]string{},
+			input: preview.Input{
+				ParameterValues: map[string]string{},
+				TFVars: map[string]cty.Value{
+					"one":   cty.StringVal("andrew"),
+					"two":   cty.StringVal("bill"),
+					"three": cty.StringVal("carter"),
+				},
+			},
+			unknownTags: []string{},
+			params: map[string]assertParam{
+				"variable_values": ap().
+					def("andrew").optVals("andrew", "bill", "carter", "jason"),
+			},
+		},
 		{
 			skip:    "skip until https://github.com/aquasecurity/trivy/pull/8479 is resolved",
 			name:    "submodcount",

testdata/tfvars/.auto.tfvars.json

@@ -0,0 +1 @@
+{"four":"jason"}

testdata/tfvars/main.tf

@@ -0,0 +1,61 @@
+// Base case for workspace tags + parameters.
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.2"
+    }
+  }
+}
+
+variable "one" {
+  default = "alice"
+  type = string
+}
+
+variable "two" {
+  default = "bob"
+  type = string
+}
+
+variable "three" {
+  default = "charlie"
+  type = string
+}
+
+variable "four" {
+  default = "jack"
+  type = string
+}
+
+
+data "coder_parameter" "variable_values" {
+  name        = "variable_values"
+  description = "Just to show the variable values"
+  type        = "string"
+  default     = var.one
+
+
+  option {
+    name  = "one"
+    value = var.one
+  }
+
+  option {
+    name  = "two"
+    value = var.two
+  }
+
+  option {
+    name  = "three"
+    value = var.three
+  }
+
+  option {
+    name  = "four"
+    value = var.four
+  }
+}

testdata/tfvars/values.tfvars

@@ -0,0 +1,2 @@
+one="alex"
+three="claire"

tfvars/load.go

@@ -0,0 +1,85 @@
+// Code taken from https://github.com/aquasecurity/trivy/blob/main/pkg/iac/scanners/terraform/parser/load_vars.go
+package tfvars
+
+import (
+	"fmt"
+	"io/fs"
+	"path/filepath"
+	"strings"
+
+	"github.com/hashicorp/hcl/v2"
+	"github.com/hashicorp/hcl/v2/hclsyntax"
+	hcljson "github.com/hashicorp/hcl/v2/json"
+	"github.com/zclconf/go-cty/cty"
+)
+
+func LoadTFVars(srcFS fs.FS, filenames []string) (map[string]cty.Value, error) {
+	combinedVars := make(map[string]cty.Value)
+
+	// Intentionally commented out to avoid loading from host environment
+	//
+	//for _, env := range os.Environ() {
+	//	split := strings.Split(env, "=")
+	//	key := split[0]
+	//	if !strings.HasPrefix(key, "TF_VAR_") {
+	//		continue
+	//	}
+	//	key = strings.TrimPrefix(key, "TF_VAR_")
+	//	var val string
+	//	if len(split) > 1 {
+	//		val = split[1]
+	//	}
+	//	combinedVars[key] = cty.StringVal(val)
+	//}
+
+	for _, filename := range filenames {
+		vars, err := LoadTFVarsFile(srcFS, filename)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load tfvars from %s: %w", filename, err)
+		}
+		for k, v := range vars {
+			combinedVars[k] = v
+		}
+	}
+
+	return combinedVars, nil
+}
+
+func LoadTFVarsFile(srcFS fs.FS, filename string) (map[string]cty.Value, error) {
+	inputVars := make(map[string]cty.Value)
+	if filename == "" {
+		return inputVars, nil
+	}
+
+	src, err := fs.ReadFile(srcFS, filepath.ToSlash(filename))
+	if err != nil {
+		return nil, err
+	}
+
+	var attrs hcl.Attributes
+	if strings.HasSuffix(filename, ".json") {
+		variableFile, err := hcljson.Parse(src, filename)
+		if err != nil {
+			return nil, err
+		}
+		attrs, err = variableFile.Body.JustAttributes()
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		variableFile, err := hclsyntax.ParseConfig(src, filename, hcl.Pos{Line: 1, Column: 1})
+		if err != nil {
+			return nil, err
+		}
+		attrs, err = variableFile.Body.JustAttributes()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	for _, attr := range attrs {
+		inputVars[attr.Name], _ = attr.Expr.Value(&hcl.EvalContext{})
+	}
+
+	return inputVars, nil
+}