Add Terraform execution primitives

[gunzip]

Why

The release workflow needs reusable, tested primitives for persisting a Terraform plan and later applying that exact reviewed plan.

What changed

• Add terraformPlanUpload and terraformApply tasks to @pagopa/dx-tasks.
• Add plan-upload and release-apply executors to the Terraform Nx plugin.
• Support configurable sensitive Terraform output keys across plan and apply execution.
• Publish compiled dx-tasks entry points and declare the plugin runtime dependencies required by bundled task code.
• Rebuild committed plugin artifacts and add version plans.

This PR adds execution capabilities only; it does not discover releasable environments or dispatch deployments.

Validation

• pnpm nx run-many -t test lint typecheck -p @pagopa/dx-tasks @pagopa/nx-terraform-plugin
• pnpm nx run @pagopa/nx-terraform-plugin:build

Depends on #1993.

Extracted from #1926.

[Copilot]

Pull request overview

This PR adds reusable “plan-then-apply” execution primitives for Terraform, so release workflows can upload a reviewed plan bundle and later apply that exact plan via Nx + @pagopa/dx-tasks, with configurable masking of sensitive Terraform output keys.

Changes:

• Added terraformPlanUpload / terraformApply tasks (plus reports + masking support) to @pagopa/dx-tasks.
• Added plan-upload and release-apply executors to @pagopa/nx-terraform-plugin, and surfaced sensitive output key configuration to the plan executor.
• Updated packaging/bundled artifacts and runtime dependencies; added version plans for both packages.

Reviewed changes

Copilot reviewed 35 out of 42 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Adds runtime deps required by the plugin’s bundled dx-tasks code (Azure/S3 SDKs).
packages/nx-terraform-plugin/tsdown.config.ts	Adds build entries for the new executors.
packages/nx-terraform-plugin/src/project.ts	Propagates configured sensitive output keys into the plan target options.
packages/nx-terraform-plugin/src/options.ts	Adds plugin options for plan-upload target name and sensitive output keys.
packages/nx-terraform-plugin/src/executors/release-apply/schema.ts	Defines zod schema/types for release-apply executor inputs.
packages/nx-terraform-plugin/src/executors/release-apply/schema.json	Publishes the executor JSON schema for Nx.
packages/nx-terraform-plugin/src/executors/release-apply/release-apply.ts	Implements the executor that dispatches terraformApply via dx-tasks.
packages/nx-terraform-plugin/src/executors/release-apply/tests/release-apply.test.ts	Tests release-apply executor behavior (dispatch + dry-run handling).
packages/nx-terraform-plugin/src/executors/plan/schema.ts	Extends plan executor schema with sensitiveKeys.
packages/nx-terraform-plugin/src/executors/plan/schema.json	Documents sensitiveKeys option for the plan executor.
packages/nx-terraform-plugin/src/executors/plan/plan.ts	Passes sensitiveKeys through to dx-tasks terraformPlan.
packages/nx-terraform-plugin/src/executors/plan/tests/plan.test.ts	Updates plan executor tests for sensitiveKeys.
packages/nx-terraform-plugin/src/executors/plan-upload/schema.ts	Defines zod schema/types for plan-upload executor inputs.
packages/nx-terraform-plugin/src/executors/plan-upload/schema.json	Publishes the executor JSON schema for Nx.
packages/nx-terraform-plugin/src/executors/plan-upload/plan-upload.ts	Implements the executor that dispatches terraformPlanUpload via dx-tasks.
packages/nx-terraform-plugin/src/executors/plan-upload/tests/plan-upload.test.ts	Tests plan-upload executor behavior.
packages/nx-terraform-plugin/src/tests/package-manifest.test.ts	Asserts plugin declares required runtime deps for bundled dx-tasks.
packages/nx-terraform-plugin/src/tests/options.test.ts	Extends options parsing tests for new options.
packages/nx-terraform-plugin/package.json	Declares new external runtime dependencies (Azure/S3 SDKs).
packages/nx-terraform-plugin/executors.json	Registers the new executors for Nx consumption.
packages/nx-terraform-plugin/dist/index.js	Rebuilt plugin bundle reflecting option/target changes.
packages/nx-terraform-plugin/dist/executors/release-apply/release-apply.js	Compiled release-apply executor output.
packages/nx-terraform-plugin/dist/executors/publish/publish.js	Rebuilt compiled artifact (import ordering change in output).
packages/nx-terraform-plugin/dist/executors/plan/plan.js	Rebuilt compiled plan executor output with sensitive keys support.
packages/nx-terraform-plugin/dist/executors/plan-upload/plan-upload.js	Compiled plan-upload executor output.
packages/nx-terraform-plugin/dist/default-dispatcher-BTdenmPC.js	Bundled dx-tasks dispatcher code inside the plugin dist artifacts.
packages/dx-tasks/tsconfig.build.json	Adds a build tsconfig for emitting dist/ while excluding tests.
packages/dx-tasks/src/terraform/plan.ts	Adds sensitiveKeys to plan task payload and masking.
packages/dx-tasks/src/terraform/plan-upload.ts	Adds new task to plan with a fixed output and upload the bundle.
packages/dx-tasks/src/terraform/plan-file.ts	Defines shared fixed plan file name used by upload/apply.
packages/dx-tasks/src/terraform/apply.ts	Adds new task to download/apply a stored plan bundle + reporting.
packages/dx-tasks/src/terraform/tests/plan.test.ts	Adds test coverage for configured key masking in plan output.
packages/dx-tasks/src/terraform/tests/plan-upload.test.ts	Adds tests for the new plan-upload task.
packages/dx-tasks/src/terraform/tests/apply.test.ts	Adds tests for the new apply task and markdown/report rendering.
packages/dx-tasks/src/tasks.ts	Registers new task definitions for plan-upload and apply.
packages/dx-tasks/src/index.ts	Exposes apply report namespace and plan storage helpers from root export.
packages/dx-tasks/src/default-dispatcher.ts	Registers new tasks + apply report namespace in the default dispatcher.
packages/dx-tasks/README.md	Documents the new tasks and two-phase workflow semantics.
packages/dx-tasks/package.json	Switches exports to compiled dist/ entry points and adds build script.
nx.json	Configures global sensitive output keys for the terraform plugin.
.nx/version-plans/version-plan-1784226769468.md	Version plan for @pagopa/nx-terraform-plugin minor bump.
.nx/version-plans/version-plan-1784226768872.md	Version plan for @pagopa/dx-tasks minor bump.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[github-actions]

Code Review Report

Terraform Plan: infra/policy/dev - ✅ Success

Plan: 2 to add, 0 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/dev - ✅ Success

Warning

Warning: Reference to undefined provider

on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1

There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".

If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws".

Plan: 0 to add, 1 to change, 27 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {

metric has been deprecated in favour of the enabled_metric property and
will be removed in v5.0 of the AzureRM provider

Plan: 0 to add, 7 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/dev - ✅ Success

Plan: 0 to add, 44 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/prod - ✅ Success

Plan: 0 to add, 2 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/dev - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.integration_tests_client_id[0],
on ../_modules/azure/custom_environments.tf line 16, in resource "github_actions_environment_secret" "integration_tests_client_id":
16: plaintext_value = azurerm_user_assigned_identity.integration_tests[0].client_id

Use value.

(and 26 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 3 to add, 14 to change, 14 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.automation_infra_cd_client_id,
on ../_modules/azure/custom_environments.tf line 32, in resource "github_actions_environment_secret" "automation_infra_cd_client_id":
32: plaintext_value = module.bootstrap.identities.infra.cd.client_id

Use value.

(and 23 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 14 to add, 16 to change, 58 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

---

Triggered by @gunzip, commit: a3471b65bf834493da70996f338f927e927bb6d5.