Support releasable Terraform environments

[gunzip]

Why

Terraform environment projects need an explicit manifest contract before release orchestration can identify, version, and deploy them safely.

What changed

• Discover and validate environment.json manifests in the Terraform Nx plugin.
• Infer tf-plan-upload and nx-release-publish targets for manifest-backed application projects.
• Add Nx Release configuration and environment-aware version actions.
• Add focused discovery, manifest, project, and versioning tests.
• Rebuild committed plugin artifacts and add a version plan.

No repository environment manifest is added in this PR, so existing project graphs and deployment behavior remain unchanged.

Validation

• pnpm nx run-many -t test lint typecheck -p @pagopa/nx-terraform-plugin
• pnpm nx run @pagopa/nx-terraform-plugin:build

Depends on #1994.

Extracted from #1926.

[github-actions]

Code Review Report

Terraform Plan: infra/policy/dev - ✅ Success

Plan: 2 to add, 0 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/dev - ✅ Success

Warning

Warning: Reference to undefined provider

on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1

There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".

If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws".

Plan: 0 to add, 1 to change, 27 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {

metric has been deprecated in favour of the enabled_metric property and
will be removed in v5.0 of the AzureRM provider

Plan: 0 to add, 7 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/dev - ✅ Success

Plan: 0 to add, 44 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/prod - ✅ Success

Plan: 0 to add, 2 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/dev - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.integration_tests_client_id[0],
on ../_modules/azure/custom_environments.tf line 16, in resource "github_actions_environment_secret" "integration_tests_client_id":
16: plaintext_value = azurerm_user_assigned_identity.integration_tests[0].client_id

Use value.

(and 26 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 3 to add, 14 to change, 14 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.automation_infra_cd_client_id,
on ../_modules/azure/custom_environments.tf line 32, in resource "github_actions_environment_secret" "automation_infra_cd_client_id":
32: plaintext_value = module.bootstrap.identities.infra.cd.client_id

Use value.

(and 23 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 14 to add, 16 to change, 58 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

---

Triggered by @gunzip, commit: cc4d1de443a5463907e69d5f18dfcd710eebcecb.

[Copilot]

Pull request overview

This PR extends the @pagopa/nx-terraform-plugin to support releasable Terraform environment projects by introducing an environment.json manifest contract, enabling Nx Release to identify and version environment projects similarly to existing module.json-backed Terraform modules.

Changes:

• Added discovery + validation for environment.json manifests and surfaced them in node creation.
• Inferred environment release targets (tf-plan-upload, nx-release-publish) and enabled Nx Release disk-based versioning for manifest-backed environment applications.
• Updated Terraform VersionActions to read/write versions from module.json (libraries) or environment.json (applications), with added unit tests and rebuilt dist artifacts.

Reviewed changes

Copilot reviewed 12 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-lock.yaml	Records the new dependency resolution for nx added to the plugin.
packages/nx-terraform-plugin/src/release/version-actions.ts	Selects manifest filename by projectType to support both modules and environments in Nx Release versioning.
packages/nx-terraform-plugin/src/release/tests/version-actions.test.ts	Adds coverage for application (environment.json) version read/update behavior.
packages/nx-terraform-plugin/src/project.ts	Infers release targets and Nx Release config for environment.json-backed application projects.
packages/nx-terraform-plugin/src/manifest.ts	Introduces environment.json schema + parser and related error type.
packages/nx-terraform-plugin/src/index.ts	Discovers environment.json files and wires validated manifests into project generation.
packages/nx-terraform-plugin/src/discovery.ts	Adds readEnvironmentManifest to load/validate environment manifests from disk.
packages/nx-terraform-plugin/src/tests/project.test.ts	Validates inferred targets and release config for environment applications.
packages/nx-terraform-plugin/src/tests/index.test.ts	Updates discovery glob expectation to include environment.json.
packages/nx-terraform-plugin/src/tests/environment-manifest.test.ts	Adds unit tests for environment manifest parsing/validation.
packages/nx-terraform-plugin/src/tests/environment-discovery.test.ts	Adds tests for reading environment manifests from disk and handling invalid cases.
packages/nx-terraform-plugin/package.json	Adds runtime dependency on nx for nx/release usage.
packages/nx-terraform-plugin/dist/release/version-actions.js	Rebuilt compiled artifact reflecting the updated version actions logic.
packages/nx-terraform-plugin/dist/index.js	Rebuilt compiled artifact reflecting manifest discovery + environment support.
.nx/version-plans/version-plan-1784226868463.md	Adds a version plan for the plugin release due to user-facing behavior changes.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file