feat(iac): add resource ownership contract#824
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a provider-neutral IaC “resource ownership” contract to the plugin ecosystem so wfctl can (a) enforce an ownership safety gate during infra apply and (b) enumerate owned resources via a new infra owners subcommand.
Changes:
- Introduces optional gRPC service
IaCProviderOwnership(proto + generated Go) and a matching Go interfaceinterfaces.OwnershipProvider. - Wires SDK auto-registration + ContractRegistry advertisement and extends the typed wfctl adapter with ownership RPCs.
- Adds
wfctl infra apply --owner/--force-ownergating +wfctl infra ownerslisting, plus ADR/plan/docs updates.
Reviewed changes
Copilot reviewed 19 out of 21 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| plugin/external/sdk/iacserver.go | Auto-registers the new optional ownership gRPC service when implemented by a provider. |
| plugin/external/sdk/iacserver_test.go | Extends registration tests to include IaCProviderOwnership. |
| plugin/external/sdk/contracts_iac_test.go | Ensures ContractRegistry advertises ownership service when registered. |
| plugin/external/proto/iac.proto | Adds the IaCProviderOwnership service and request/response message types. |
| plugin/external/proto/iac.pb.go | Regenerated protobuf message/types for the new ownership contract. |
| plugin/external/proto/iac_grpc.pb.go | Regenerated gRPC client/server stubs for IaCProviderOwnership. |
| plugin/external/proto/iac_proto_test.go | Updates optional-service interface distinctness test to include ownership. |
| interfaces/iac_provider.go | Adds OwnershipProvider, ResourceOwner, and OwnerFilter to the public IaC interfaces surface. |
| cmd/wfctl/iac_typed_adapter.go | Adds typed ownership client wiring and implements OwnershipProvider methods (optional-service gated). |
| cmd/wfctl/iac_typed_adapter_test.go | Adds unit/integration coverage for ownership optional gating and round-trips. |
| cmd/wfctl/iac_typed_fixture_test.go | Extends typed-fixture to register ownership service for adapter tests. |
| cmd/wfctl/infra.go | Adds infra owners dispatcher entry + apply flag plumbing for --owner/--force-owner. |
| cmd/wfctl/infra_owners.go | New wfctl infra owners command implementation. |
| cmd/wfctl/infra_owners_test.go | Adds coverage for listing and “unsupported provider” behavior. |
| cmd/wfctl/infra_apply.go | Wires the ownership gate into apply hooks (both “computed plan” and “precomputed plan” paths). |
| cmd/wfctl/infra_apply_ownership.go | Implements the ownership gate hook logic and owner identity resolution (flag/env). |
| cmd/wfctl/infra_apply_ownership_test.go | Adds focused tests for ownership gate behavior (missing/mismatch/force/create stamping). |
| cmd/wfctl/infra_apply_dns_gate.go | Switches DNS gate wiring to compose with other OnBeforeAction hooks. |
| docs/WFCTL.md | Documents infra owners and the new infra apply ownership flags/behavior. |
| docs/plans/2026-06-01-iac-resource-ownership.md | Records the implementation plan for the ownership contract and CLI changes. |
| decisions/0046-iac-resource-ownership-contract.md | ADR documenting why/how the ownership contract was added and expected consequences. |
Files not reviewed (1)
- plugin/external/proto/iac_grpc.pb.go: Language not supported
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
This was referenced Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
buf lintis not currently a clean gate in this repo; it fails on existing proto package/service naming rules, plus the new ownership service follows the existing service naming pattern.\n- A fullGOWORK=off go test ./interfaces ./plugin/external/proto ./plugin/external/sdk ./cmd/wfctl -count=1run was stopped after the first three packages passed and cmd/wfctl did not finish within the local wait window; targeted wfctl ownership tests and compile-only checks passed.\n\nCloses Cross-driver IaC ownership-tagging convention (phase 2 of gocodealone-dns import) #779 for the core contract. Provider plugin tag/label implementations follow as cascade PRs after this lands.