这是indexloc提供的服务,不要输入任何密码
Skip to content

Conversation

@thentenaar
Copy link
Contributor

@thentenaar thentenaar commented Apr 15, 2025

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

  • Allow for --var-file arguments outside of the tf dir to be handled correctly
  • Use a dict to enforce tfvars precedence, grouping vars by the directory for which they were defined, reducing the number of tfvar nodes added to the graph for a given directory.
  • Create variable -> tfvars edges based on the directory for which the var was defined.
  • Have _load_files take a list of str instead of os.DirEntry.
  • Changed a usage of printf() to logging.debug()

Fixes #4321

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes

Copy link
Contributor

@omriyoffe-panw omriyoffe-panw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @thentenaar,
First of all thank you for your contribution!
I left a few minor comments, however along with them I am not sure I understand your use of the "explicit" variable. If I understand correctly the goal is to allow for .tfvars file in sub-directories of the project using the -var-file flag. I saw you implemented a search on the directory for .tfvars files but I don't see why you would need the "explicit" variable and I can see some use cases where it might allow for files other then .tfvars to be passed in the flag causing errors.
Would love if you could add a short explanation for this implementation.
Thanks!

Copy link
Contributor

@gruebel gruebel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall the suggested implementation doesn't reflect the actual Terraform behavior and with the added explicit marker makes it harder to maintain than it actually should be, because it is not a simple override mechanism but rather a hierarchical resolution order.

* Allow for ``--var-file`` arguments outside of the tf dir to be
  handled correctly.

* Use a dict to enforce tfvars precedence, grouping vars by the directory
  for which they were defined, reducing the number of tfvar nodes added to
  the graph for a given directory.

* Create variable -> tfvars edges based on the directory for which the
  var was defined.

* Have _load_files take a list of str instead of os.DirEntry.

* Changed a usage of printf() to logging.debug()
@lirshindalman lirshindalman merged commit 10d12c9 into bridgecrewio:main Jun 5, 2025
46 checks passed
Saarett pushed a commit that referenced this pull request Jun 5, 2025
fix(terraform): Handle explicitly-specified vars explicitly

* Allow for ``--var-file`` arguments outside of the tf dir to be
  handled correctly.

* Use a dict to enforce tfvars precedence, grouping vars by the directory
  for which they were defined, reducing the number of tfvar nodes added to
  the graph for a given directory.

* Create variable -> tfvars edges based on the directory for which the
  var was defined.

* Have _load_files take a list of str instead of os.DirEntry.

* Changed a usage of printf() to logging.debug()
@thentenaar thentenaar deleted the tfvars branch June 5, 2025 11:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Checkov ignores terraform tfvars file specified in --var-file flag

4 participants