You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
tflens diff: classify resource attribute changes as Breaking when the underlying attribute forces destroy+recreate. New pkg/forcenew package carries an embedded force-new attribute table (1004 resource types, 4632 attribute paths, ~270 KB JSON) extracted from a Crossplane runtime IR by internal/tools/cpir-extract. The diff classifier now emits a Breaking change with Source: "force-new" when an in-HCL attribute value differs and the path is in the table — e.g. aws_eks_cluster.role_arn or nested kubernetes_network_config.service_ipv4_cidr. Walks static nested blocks (first-instance pairing for repeated blocks); skips dynamic blocks. Removes the previous reliance on # tflens:track markers to approximate ForceNew for the resource types upjet covers. Extraction unions specSchema's forceNew: true paths with externalName.identifierFields / omittedFields so identity attributes Crossplane elides from spec (e.g. aws_eks_cluster.name) are still classified. region, empty strings, and the malformed _prefix token are filtered. Resources outside the table return known=false from forcenew.IsForceNew, leaving downstream classifiers to decide whether to treat unknowns as safe or to ask for an override.
--immutable-table-override global flag. Loads a JSON force-new table from the given path and merges it over the embedded one. Wired through cobra's PersistentPreRunE so every subcommand that runs the diff classifier sees the merged table. Eager validation — bad path or malformed JSON fails CLI startup with a clear immutable-table-override: … error rather than silently producing wrong classifications. Path-level merge semantics: user paths are added (deduped) to the embedded set; user entries cannot remove embedded paths.
tflens refresh-force-new subcommand. Fetches a Crossplane runtime IR JSON file from --url, runs the same extraction logic as the build-time tool, and writes a JSON force-new table to --output. The result is suitable for --immutable-table-override on subsequent commands. No default URL — refer to your provider distribution's release artifacts for the canonical location. 5-minute HTTP timeout to handle the ~15 MB IR over slow links.
