fix(nullplatform): fail template fetches that do not return 200

nullplatform/parameter_storage_definition/data.tf

@@ -1,5 +1,13 @@
+# A non-2xx is not an error for the http provider: the body would render as the template.
 data "http" "parameter_storage_spec_template" {
   url = "${var.repository_parameter_storage_spec}/${var.repository_parameter_storage_spec_branch}/${var.template_path}"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 data "external" "parameter_storage_spec" {

nullplatform/parameter_storage_definition/variables.tf

@@ -3,6 +3,9 @@ variable "nrn" {
   type        = string
 }
 
+# Unused here (the provider is configured at the root) but passed by consumers, so
+# deleting it is a breaking interface change.
+# tflint-ignore: terraform_unused_declarations
 variable "np_api_key" {
   description = "nullplatform API key. Kept for interface consistency across the parameter-storage modules; the provider is configured at the root."
   type        = string

nullplatform/scope_definition/data.tf

@@ -1,22 +1,55 @@
 ################################################################################
 # Template Fetching
+#
+# A non-2xx is not an error for the http provider: without these postconditions
+# a missing template's body (`404: Not Found`) renders as the template and dies
+# later in jq. Branch defaults track a moving ref, so an upstream rename can
+# break an already-applied state.
 ################################################################################
 data "http" "service_spec_template" {
   url = "${var.repository_service_spec}/${var.repository_service_spec_branch}/${var.service_path}/specs/service-spec.json.tpl"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 data "http" "scope_type_template" {
   url = "${var.repository_scope_template}/${var.repository_scope_template_branch}/${var.service_path}/specs/scope-type-definition.json.tpl"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 data "http" "action_templates" {
   for_each = local.static_action_specs
   url      = "${var.repository_action_templates}/${var.repository_action_templates_branch}/${var.service_path}/specs/actions/${each.key}.json.tpl"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200. Check that the action name is spelled as the template file in the scope repository."
+    }
+  }
 }
 
 data "http" "scope_configuration_template" {
   count = var.create_scope_configuration ? 1 : 0
   url   = "${var.repository_scope_template}/${var.repository_scope_template_branch}/${var.service_path}/specs/scope-configuration.json.tpl"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 # Process service specification template using gomplate with NRN variable

nullplatform/scope_definition_agent_association/data.tf

@@ -2,8 +2,16 @@
 # Notification Channel Template Fetching
 ################################################################################
 
+# A non-2xx is not an error for the http provider: the body would render as the template.
 data "http" "notification_channel_template" {
   url = "${var.repository_notification_channel}/${var.repository_notification_channel_branch}/${var.service_path}/specs/notification-channel.json.tpl"
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 ################################################################################

nullplatform/service_definition/data.tf

@@ -1,3 +1,10 @@
+################################################################################
+# Template Fetching
+#
+# A non-2xx is not an error for the http provider: without these postconditions
+# a missing template's body renders as the template and fails later. On private
+# repositories a 401/403/404 usually means the token or branch is wrong.
+################################################################################
 data "http" "service_spec_template" {
   count = var.git_provider != "local" ? 1 : 0
   url = (
@@ -6,6 +13,13 @@ data "http" "service_spec_template" {
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Fservice-spec.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200."
+    }
+  }
 }
 
 data "http" "action_templates" {
@@ -16,6 +30,13 @@ data "http" "action_templates" {
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Factions%2F${each.key}.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200. Check that the action name is spelled as the template file in the service repository."
+    }
+  }
 }
 
 data "http" "link_templates" {
@@ -26,4 +47,11 @@ data "http" "link_templates" {
     "${local.gitlab_api_file_prefix}${local.gitlab_path_sep}specs%2Flinks%2F${each.key}.json.tpl/raw?ref=${var.repository_branch}"
   )
   request_headers = local.auth_headers
+
+  lifecycle {
+    postcondition {
+      condition     = self.status_code == 200
+      error_message = "Fetch of ${self.url} returned HTTP ${self.status_code}, expected 200. Check that the link name is spelled as the template file in the service repository."
+    }
+  }
 }