OpenTofu lets you declaratively manage your cloud infrastructure.
1531 matches across 10 categories. Click a row to expand file-level details.
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | cmd/tofu/version.go | 21 | // logGodebugUsage produces extra DEBUG log lines if the Go runtime's metrics |
| LOW | cmd/tofu/provider_source_test.go | 161 | } |
| LOW | cmd/tofu/oci_distribution_test.go | 21 | // This ociCredentialsLookupEnv is the concrete implementation of |
| LOW | cmd/tofu/provider_source.go | 101 | // no explicit provider installation configuration in the CLI config. |
| LOW | cmd/tofu/provider_source.go | 121 | // - The "plugins" subdirectory of the CLI config search directory. |
| LOW | cmd/tofu/oci_distribution.go | 41 | var ociReposMu sync.Mutex |
| LOW | cmd/tofu/oci_distribution.go | 121 | |
| LOW | cmd/tofu/experiments.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | cmd/tofu/commands.go | 41 | // ordered so that we can show them in the typical workflow order, rather |
| LOW | cmd/tofu/registries_disco.go | 21 | // newServiceDiscovery returns a newly-created [disco.Disco] object that is |
| LOW | cmd/tofu/main.go | 301 | AutocompleteInstall: "install-autocomplete", |
| LOW | tools/loggraphdiff/loggraphdiff.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | tools/loggraphdiff/loggraphdiff.go | 21 | // module.child.output.a_output - *terraform.NodeApplyableOutput |
| LOW | tools/find-dep-upgrades/main.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | tools/find-dep-upgrades/main.go | 61 | // so we'll use that here even though the complexity of that package's |
| LOW | tools/find-dep-upgrades/main.go | 241 | } |
| LOW | tools/selected-go-version/selected-go-version.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | tools/selected-go-version/selected-go-version.go | 41 | } |
| LOW | tools/protobuf-compile/protobuf-compile.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | tools/find-pkg-importer/main.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/encryption/plan.go | 21 | // |
| LOW | internal/encryption/state.go | 21 | // |
| LOW | internal/encryption/state.go | 41 | // |
| LOW | internal/encryption/base.go | 41 | } |
| LOW | internal/encryption/base.go | 61 | // |
| LOW | internal/encryption/keyprovider/config.go | 21 | |
| LOW | internal/encryption/keyprovider/descriptor.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/encryption/keyprovider/meta.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/encryption/keyprovider/keyprovider.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | …rnal/encryption/keyprovider/openbao/compliance_test.go | 21 | // By default the tests in here behave like unit tests, running against a |
| LOW | internal/encryption/method/config.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/encryption/method/method.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/tracing/context_probe.go | 21 | // primary motivation, but could potentially be used for other |
| LOW | internal/tracing/context_probe.go | 81 | // FunctionsReported returns an interable sequence of all of the functions |
| LOW | internal/tracing/utils.go | 121 | } |
| LOW | internal/tracing/data.go | 21 | // differs when the span is not recording. |
| LOW | internal/tracing/init.go | 41 | better based on experience with this experiment. |
| LOW | internal/tracing/init.go | 61 | const traceStateEnvVar = "TRACESTATE" |
| LOW | internal/tracing/init.go | 81 | // standard OTLP exporter environment variables: |
| LOW | internal/tracing/traceattrs/opentofu.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/tracing/traceattrs/opentofu.go | 21 | // creating import cycles. |
| LOW | internal/tracing/traceattrs/opentofu.go | 41 | // [OpenTofuProviderAddress] to indicate which provider the version number is |
| LOW | internal/tracing/traceattrs/opentofu.go | 61 | func OpenTofuModuleCallName(name string) attribute.KeyValue { |
| LOW | internal/tracing/traceattrs/generic.go | 21 | // it's easier to keep our version selections consistent. |
| LOW | internal/tracing/traceattrs/semconv.go | 21 | // semconv version imported by the "go.opentelemetry.io/otel/sdk/resource", |
| LOW | internal/addrs/provider.go | 21 | // not have an explicit hostname. |
| LOW | internal/addrs/provider.go | 41 | // The this namespace is literally named "builtin", in the hope that users |
| LOW | internal/addrs/provider.go | 61 | // |
| LOW | internal/addrs/provider.go | 121 | // because existing code expects legacy provider names to pass through |
| LOW | internal/addrs/provider.go | 161 | func MustParseProviderSourceString(str string) Provider { |
| LOW | internal/addrs/provider.go | 181 | // rather than some similar rules defined locally, because the hostname part |
| LOW | internal/addrs/check_rule_diagnostic.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/addrs/check_rule_diagnostic.go | 21 | // contain a CheckRule. |
| LOW | internal/addrs/parse_target.go | 241 | } |
| LOW | internal/addrs/parse_target.go | 321 | }) |
| LOW | internal/addrs/move_endpoint.go | 21 | // addresses in a "moved" statement in the configuration, but it's also |
| LOW | internal/addrs/move_endpoint.go | 81 | // For our purposes here we'll just do a unify without a base module |
| LOW | internal/addrs/move_endpoint.go | 161 | // |
| LOW | internal/addrs/unique_key.go | 1 | // Copyright (c) The OpenTofu Authors |
| LOW | internal/addrs/module_source_test.go | 321 | |
| 1360 more matches not shown… | |||
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | website/docker-compose.build-non-main.yml | 6 | # This file is meant to be used only in running the `website` GH workflow on non-main branches and PRs that are targetin |
| MEDIUM | internal/depsfile/locks_file.go | 148 | Bytes: []byte("# This file is maintained automatically by \"tofu init\".\n"), |
| MEDIUM | internal/depsfile/locks_file_test.go | 250 | wantContent := `# This file is maintained automatically by "tofu init". |
| MEDIUM | internal/backend/remote-state/azure/meta-test/main.tf | 3 | # Create an application and service account |
| MEDIUM | internal/command/providers_lock_test.go | 48 | expected := `# This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/providers_lock_test.go | 64 | expected := `# This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/init_test.go | 2316 | # This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/init_test.go | 2350 | # This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/init_test.go | 2363 | # This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/init_test.go | 2376 | # This file is maintained automatically by "tofu init". |
| MEDIUM | internal/command/init_test.go | 2390 | # This file is maintained automatically by "tofu init". |
| MEDIUM | …and/testdata/providers-lock/append/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". |
| MEDIUM | …roviders-mirror-with-bad-lock-file/.terraform.lock.hcl | 1 | # This file is maintained automatically by "tofu init". |
| MEDIUM | …fu-providers-mirror-with-lock-file/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". |
| MEDIUM | …ests/tests/moved_with_refresh_only/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …sts/tests/basic_json_string_update/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …ence-tests/tests/moved_with_update/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …nce-tests/tests/replace_within_set/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …uivalence-tests/tests/drift_simple/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …ts/tests/drift_relevant_attributes/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …uivalence-tests/tests/moved_simple/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …ests/basic_multiline_string_update/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …nce-tests/tests/replace_within_map/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …-tests/tests/replace_within_object/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …lence-tests/tests/moved_with_drift/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …ts/fully_populated_complex_destroy/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …ce-tests/tests/replace_within_list/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …e-tests/tests/null_provider_delete/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …-tests/tests/local_provider_update/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …-tests/tests/local_provider_delete/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …nce-tests/tests/drift_refresh_only/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | …sts/fully_populated_complex_update/.terraform.lock.hcl | 1 | # This file is maintained automatically by "opentf init". |
| MEDIUM | .github/workflows/nightly.yml | 68 | # Create a staging directory for upload |
| MEDIUM | .github/scripts/compare-release-version.sh | 19 | # Create a clean semver tag without the v prefix |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | …rnal/getproviders/package_location_oci_blob_archive.go | 242 | // anyway to be robust since go-getter returns this information regardless. |
| MEDIUM | internal/getmodules/oci_getter.go | 444 | // but we'll return an error here anyway just to be robust. |
| MEDIUM | internal/repl/session.go | 197 | // but we'll be robust here and just pass through the GoString |
| MEDIUM | internal/legacy/tofu/state_filter.go | 103 | // is a bit more robust. |
| MEDIUM | internal/tofu/eval_variable.go | 41 | // but we'll check it here too to be robust. |
| MEDIUM | internal/tofu/eval_variable_test.go | 110 | // metadata is stripped from empty default collections. Essentially, you |
| MEDIUM | internal/tofu/context.go | 365 | return // should not happen, but we'll be robust |
| MEDIUM | internal/tofu/context.go | 369 | continue // should not happen, but we'll be robust |
| MEDIUM | internal/lang/functions.go | 95 | // robust. |
| MEDIUM | internal/lang/blocktoattr/fixup.go | 36 | // in the presence of poorly-configured test mocks, so we'll be robust |
| MEDIUM | internal/lang/globalref/analyzer_meta_references.go | 366 | // for all of the relative traversal types, but we'll be robust in |
| MEDIUM | internal/lang/exprs/example_test.go | 172 | // NOTE: This is not a robust implementation of "upper", just |
| MEDIUM | internal/lang/funcs/datetime.go | 195 | // be robust here. |
| MEDIUM | internal/configs/static_scope.go | 312 | // handle this here just to be robust. |
| MEDIUM | internal/configs/configschema/validate_traversal.go | 71 | // but we'll handle this with a generic error anyway to be robust. |
| MEDIUM | internal/configs/configschema/empty_value.go | 61 | // but we'll be robust and return a result nonetheless. |
| MEDIUM | internal/configs/configload/loader_snapshot.go | 265 | // This function doesn't try to be incredibly robust in supporting |
| MEDIUM | internal/states/state_test.go | 410 | // happen" case but we'll test to make sure we're robust to |
| MEDIUM | internal/states/statemgr/filesystem.go | 194 | // TODO: this should use a more robust method of writing state, by first |
| MEDIUM | internal/states/statemgr/persistent.go | 84 | // Some implementations may optionally utilize config schema to persist |
| MEDIUM | internal/registry/package_extract.go | 34 | // decompressors should all be robust to malicious input anyway. |
| MEDIUM | internal/command/meta_providers.go | 139 | // unit tests might not always populate Meta fully and so we'll be robust |
| MEDIUM | internal/command/cliconfig/cliconfig.go | 441 | // improve on this later using the more-robust merging behavior |
| MEDIUM | internal/command/views/hook_ui.go | 114 | // bug in the caller but we'll ignore it in order to be robust. |
| MEDIUM | internal/command/clistate/local_state.go | 68 | // TODO: this should use a more robust method of writing state, by first |
| MEDIUM | internal/command/arguments/types.go | 47 | // more nuanced set of data to be presented to the view constructors. |
| MEDIUM | …tdata/move-statement-implied/move-statement-implied.tf | 1 | # This fixture is useful only in conjunction with a previous run state that |
| MEDIUM | …move-statement-implied/child/move-statement-implied.tf | 1 | # This fixture is useful only in conjunction with a previous run state that |
| MEDIUM | internal/moduletest/status.go | 35 | // Essentially, if a test suite has a bunch of failures and passes the overall |
| LOW | scripts/changelog-links.sh | 12 | # released items are presented as clickable links, but we can just use the |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 3 | ## Step 1: Leave the original encryption method unchanged: |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 8 | # Step 2: Add the unencrypted method here: |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 12 | ## Step 3: Disable or remove the "enforced" option: |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 15 | ## Step 4: Move the original encryption method into the "fallback" block: |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 20 | ## Step 5: Reference the unencrypted method as your primary "encryption" method. |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 24 | ## Step 6: Run "tofu apply". |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 26 | ## Step 7: Remove the "state" block once the migration is complete. |
| LOW | …e/state/examples/encryption/fallback_to_unencrypted.tf | 28 | ## Step 8: Repeat steps 3-7 for plan{} if needed. |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 9 | ## Step 1: Add the unencrypted method: |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 12 | ## Step 2: Add the desired key provider: |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 17 | ## Step 3: Add the desired encryption method: |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 23 | ## Step 4: Link the desired encryption method: |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 26 | ## Step 5: Add the "fallback" block referencing the |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 32 | ## Step 6: Run "tofu apply". |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 34 | ## Step 7: Remove the "fallback" block above and |
| LOW | …state/examples/encryption/fallback_from_unencrypted.tf | 39 | ## Step 8: Repeat steps 4-8 for plan{} if needed. |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 9 | ## Step 1: Add the desired key provider: |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 13 | ## Step 2: Set up your encryption method: |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 19 | ## Step 3: Link the desired encryption method: |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 22 | ## Step 4: Run "tofu apply". |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 24 | ## Step 5: Consider adding the "enforced" option: |
| LOW | …site/docs/language/state/examples/encryption/sample.tf | 28 | ## Step 6: Repeat steps 3-5 for plan{} if needed. |
| LOW | internal/providercache/installer.go | 216 | // Step 1: Which providers might we need to fetch a new version of? |
| LOW | internal/providercache/installer.go | 224 | // Step 2: Query the provider source for each of the providers we selected |
| LOW | internal/providercache/installer.go | 234 | // Step 3: For each provider version we've decided we need to install, |
| LOW | internal/dag/walk.go | 453 | // Dependencies satisfied! We need to check if any errored |
| LOW | internal/tofu/context_apply_test.go | 2879 | // Step 1: create the resources and instances |
| LOW | internal/tofu/context_apply_test.go | 2914 | // Step 2: update with an empty config, to destroy everything |
| LOW | internal/tofu/transform_targets.go | 115 | // Step 1: Find all excluded targetable nodes, and their descendants |
| LOW | internal/tofu/transform_targets.go | 149 | // Step 2: Of the targetable nodes that were not excluded, build the graph similarly to -target |
| LOW | internal/tofu/transform_targets.go | 168 | // Step 3: Add outputs |
| Severity | File | Line | Snippet |
|---|---|---|---|
| HIGH | internal/configs/parser.go | 86 | // have been loaded through this parser, with source filenames (as requested |
| HIGH | internal/command/jsonformat/plan.go | 456 | buf.WriteString(fmt.Sprintf("[bold] # %s[reset] will be [bold][red]replaced[reset], as requested", dispAddr)) |
| HIGH | internal/command/jsonformat/plan.go | 547 | buf.WriteString(fmt.Sprintf("[bold] # %s[reset] will be [bold][red]replaced[reset], as requested", dispAddr)) |
| HIGH | internal/command/jsonformat/plan_test.go | 6189 | ExpectedOutput: ` # test_instance.example will be replaced, as requested |
| HIGH | internal/command/jsonformat/plan_test.go | 6200 | ExpectedOutput: ` # test_instance.example will be replaced, as requested |
| HIGH | internal/command/views/view.go | 42 | // ModuleDeprecationWarnLvl is used to filter out deprecation warnings for outputs and variables as requested by the us |
| HIGH | internal/command/arguments/view.go | 29 | // ModuleDeprecationWarnLvl is used to filter out deprecation warnings for outputs and variables as requested by the us |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | internal/tofu/context_plugins_test.go | 26 | // so the caller can feel free to modify the returned value to further |
| MEDIUM | internal/tofu/context_plugins_test.go | 59 | // callers can feel free to modify it once returned. |
| MEDIUM | internal/command/testdata/fmt/general_out.tf | 3 | # here, but you can also add other _in.tf/_out.tf pairs in the |
| MEDIUM | internal/command/testdata/fmt/general_in.tf | 3 | # here, but you can also add other _in.tf/_out.tf pairs in the |
| Severity | File | Line | Snippet |
|---|---|---|---|
| CRITICAL | internal/command/jsonplan/values.go | 212 | r.Addr.Resource.Resource.Mode.String(), |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | internal/backend/remote/testdata/plan-long-line/main.tf | 3 | long_line = "[{'_id':'5c5ab0ed7de45e993ffb9eeb','index':0,'guid':'e734d772-6b5a-4cb0-805c-91cd5e560e20','isActive':f |
| LOW | internal/cloud/testdata/plan-long-line/main.tf | 3 | long_line = "[{'_id':'5c5ab0ed7de45e993ffb9eeb','index':0,'guid':'e734d772-6b5a-4cb0-805c-91cd5e560e20','isActive':f |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | …docs/cli/commands/test/examples/module/main.tftest.hcl | 7 | # Check if the webserver returned an HTTP 200 status code: |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | internal/command/jsonformat/differ/attribute.go | 77 | // function computeChangeForDynamicValues(), but external callers will |