release(provider): Terraform Provider v1.4.0 - #90
Conversation
Add v1.4.0 CHANGELOG section (KSM-989, KSM-990) and bump provider version constraint from >= 1.3.0 to >= 1.4.0 across README, docs, and all examples.
This comment has been minimized.
This comment has been minimized.
mgallego-keeper
left a comment
mgallego-keeper
left a comment
There was a problem hiding this comment.
went through the v1.4.0 changes, mostly looks good to me. couple small things below, and i left two inline comments on the code too. nothing blocking, mostly docs/nits, lmk if i'm missing context.
- couldn't find docs or an example for the new
secretsmanager_metadatadata source (nodocs/data-sources/metadata.md, nothing inexamples/data-sources/). the other data sources all have both, and i think the registry page builds from thedocs/folder, so this one might come out empty once it's published. also noticeddocs/data-sources/folder.mdstill listsparent_uidunder "Read-Only", but this PR makes it an input now, so that one looks out of date too. - tiny one on
special_set: the description says the default set is!@#$%()+;<>=?[]{}^.,, but the SDK'sAsciiSpecialCharactersactually starts with a"as well. probably worth adding it so people know a double quote can show up in a generated password by default.
mgallego-keeper
left a comment
mgallego-keeper
left a comment
There was a problem hiding this comment.
thanks for the quick turnaround on these! went back through it all and it looks good to me.
the title lookup is a nicer fix than just tweaking the description, and the metadata docs + example read well. also nice catch on the test workflow not actually running before (the main vs master thing), good to see it green now.
one tiny optional thing, definitely not blocking: in data_source_metadata.go the d.SetId(path) means the data source id comes out as literally "*" on a title lookup. the uid attribute is still correct so it doesn't really matter in practice, and secretsmanager_record already does the same thing, so feel free to leave it. could switch both to secret.Uid down the line if we ever care.
approving 👍
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
…older data source (KSM-1016)
The secretsmanager_metadata data source advertised UID-or-title lookup but only ever queried by UID. Add an optional title input wired through getRecord so the path="*" + title convention works, matching the login and record data sources. Add the Registry docs page and example, which were missing, and correct the acceptance test to exercise title lookup.
parent_uid became an optional input but the docs still listed it under Read-Only. Move it to the optional inputs and align the schema description wording.
The SDK default special-character set begins with a double-quote
("!@#$%()+;<>=?[]{}^.,), which the special_set descriptions and the
acceptance-test constants omitted. A user replicating the documented
set would silently drop the double-quote from generated passwords.
Also gofmt the password-generation tests (KSM-989).
The shipped secretsmanager_metadata data source supports lookup by record UID or by title (path="*"); reflect that in the changelog entry.
d66a2f6 to
9a38550
Compare
…open Dependabot alerts Bumps x/crypto 0.46.0 -> 0.54.0 and x/net 0.48.0 -> 0.57.0, resolving all 14 open Dependabot alerts (13 crypto, 1 net) ahead of the v1.4.0 release.
Clears stdlib@go1.26.2 CVEs flagged in the Manifest SBOM scan. Updates the go directive in go.mod and the go-version pins in both CI workflows to match.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Add a boolean publish input (default true) to the release workflow. When unchecked, only the SBOM job runs — check-tag and tag-and-release are skipped — enabling vulnerability scan runs without creating a tag or blocking on prod environment approval.
Clears GHSA-hrxh-6v49-42gf (High 8.8) — xDS RBAC and HTTP/2 vulnerabilities in grpc-go, fixed in v1.82.1. Also upgrades google.golang.org/genproto/googleapis/rpc as a co-dependency. govulncheck ./... confirms 0 reachable vulnerability call paths.
3 participants
Summary
Release branch for v1.4.0: adds a metadata data source, exposes
parent_uidas an input on the folder data source, fixesspecial=0being silently ignored during password generation, addsspecial_setto thecomplexityblock, and clarifies that complexity counts are minimums.Changes
New Features
secretsmanager_metadatadata source (KSM-970): returns non-sensitive record metadata only —uid,type,title,notes,revision,folder_uid,is_editable. Look up a record by UID, or by title withpath = "*". Primary use case: pair with anephemeralresource to drive write-only attribute versioning on other providers (Azure Key Vault, Kubernetes). When the Keeper record rotates,revisionincrements, and the companionvalue_wo_version/data_wo_revisionchanges on the next plan, triggering Terraform to re-apply the write-only value. Nothing sensitive lands in state.parent_uidinput onsecretsmanager_folder(KSM-1016):parent_uidwas previously Computed-only (read back after lookup, but not usable as input). Making it Optional+Computed lets users scope folder lookups to a specific parent, disambiguating folders with identical names under different parents (e.g.test/db,stage/db,prod/db). No logic changes —findFolder()already filtered by parent; only the schema declaration needed updating.special_setin complexity block (KSM-990): adds an optionalspecial_setstring attribute to thecomplexityblock on all password-bearing resources. Constrains which special characters the SDK draws from during generation. Empty string (default) preserves the existing SDK default set ("!@#$%()+;<>=?[]{}^.,), which begins with a double-quote.Bug Fixes
special=0ignored during generation (KSM-989): whenlengthexceeded the sum of category counts, the SDK's extra-character fallback included specials even whenspecial=0. Fixed by usingd.GetRawConfig()to distinguish an explicitly-set zero from an absent field, so unset counts pass""(let the SDK decide) whilespecial=0correctly passes"0"(no specials).caps,lowercase,digits, andspecialin thecomplexityblock set minimum character counts, not exact targets. The generator may produce more of each character class to satisfy the totallength. Schema descriptions now match the Go SDK, Ruby SDK, and Commander docs, which have always used "minimum" language for these fields.Internal
test.ymlbuild/vet/gofmt/unit gate had never run on a PR — it filtered on a non-existentmainbranch while the repo usesmasterandrelease-*. It now triggers onmasterandrelease-**. This change accounts for the bulk of the diff: a one-time repo-widegofmt -spass (the tree had drifted while the gate was dormant) and at.Fatal→t.Skiphardening of the ephemeral acceptance tests so they skip cleanly without credentials. No change to provider behavior. PAM ephemeral test data coverage is tracked separately in KSM-1039.Breaking Changes
None.
Related Issues