[IAmJSD]

Closes #1442

Root cause

scripts/generate-federation-iac.go --format bundle has its own bundle builder. It zipped only the target's Terraform directory (iac/federation/azure-target/terraform), whose main.tf calls ../../../../terraform/modules/iam/azure/cudly-reservation-role. #1440 fixed this for the API download by shipping the module inside the zip, but that helper was unexported in internal/api, so the script never got the fix. terraform init on a script-built Azure bundle still failed with "Unreadable module directory".

Fix

• New small package internal/iacbundle holds the bundle Terraform writer, the module list (ExtraModules), the source rewrite, and the UnresolvedLocalModules check. It reads any fs.FS and skips hidden files and directories, so the script can pass its on-disk modules directory without picking up a local .terraform/ or lock file.
• The API now builds its bundles through it. Behaviour is unchanged: the embedded FS has no hidden files, and the module set and rewrite are the same. The now-unused addDirToZip is removed.
• The script's addTerraformToBundle calls iacbundle.AddTerraformDir(os.DirFS(modulesDir), ...), so the Azure bundle ships the role module at terraform/modules/cudly-reservation-role and the call points at it. Like the API's bundle, the script's Azure bundle now also carries terraform/tests/identity_guards.tftest.hcl. Before, the script copied only top-level files.

Three commits, each under 400 lines: add the package, switch the API to it, then switch the script and add its regression test.

Verification

• New scripts/generate_federation_iac_bundle_test.go builds every bundle the script can make (all 5 target/source combos), runs it through iacbundle.UnresolvedLocalModules, and checks that no hidden file is shipped. On main the azure-target case fails with terraform/main.tf: ../../../../terraform/modules/iam/azure/cudly-reservation-role. It passes with the fix.
• New internal/iacbundle unit tests: module shipped and rewritten, hidden files skipped, an uncalled module is an error, and the guard's self-test (moved from internal/api).
• Manual run: built an Azure bundle with the script, unzipped it to an empty directory, and ran terraform get there. It resolved cudly_reservation_role in modules/cudly-reservation-role. No init or plan was run against any backend.
• go build ./..., go vet (plain, integration, e2e), golangci-lint v2.10.1 with and without --build-tags integration (0 issues), gocyclo -over 10 (clean), go test -race -short on iacbundle/api/scripts/terraform, go test -race -tags integration ./internal/api/ (ok), the secrets scan (clean), and scripts/test-git-secrets-allowlist.sh (183 PASS).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 8 billable files and costs up to $2.00.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 01fb35a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ce95869-f56c-41eb-93d8-909e287d9368

Commits

Reviewing files that changed from the base of the PR and between 01fb35a and c0a30ad.

Files selected for processing: 8

• internal/api/federation_bundle_modules.go
• internal/api/federation_bundle_modules_test.go
• internal/api/handler_federation.go
• internal/iacbundle/bundle.go
• internal/iacbundle/bundle_test.go
• scripts/generate-federation-iac.go
• scripts/generate_federation_iac_bundle_test.go
• terraform/embed.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Opened as a draft at c0a30ad: the script's bundle now goes through the shared internal/iacbundle writer, so its Azure bundle ships the role module. A regression test covers all 5 script bundles. Checks are listed in the PR body.

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE c0a30ad179b8bd7c1402d227cc7c44279e5bb9b4

Blocking:

• none

Non-blocking:

• internal/iacbundle/bundle.go:82-90: walkVisible skips dot-prefixed names only. go:embed also leaves out _-prefixed names, so the API's copy and the script's os.DirFS copy would differ if a _foo.tf were ever added under iac/federation/*/terraform. None exist today, so this is theoretical.

Attacked:

• API path equivalence: the old addBundleTerraformDir + addDirToZip and the new AddTerraformDir walk the same embedded FS in the same WalkDir order, with the same rewrite and the same module set. The embed has no dot files, so the API zip contents don't change. The module still comes from the *.tf-only embed in both builders.
• Script path: the main directory is read from disk through os.DirFS(modulesDir) with hidden entries skipped, so the .terraform.lock.hcl present in every iac/federation/*/terraform dir stays out, as before. The only subdirectory on disk is azure-target/terraform/tests, which now ships, matching the API bundle. The PR body says so.
• Fail-before: put main's scripts/generate-federation-iac.go back in the scratch tree and ran TestGenerator_BundleLocalModulesResolveInsideZip. The azure-target case fails with terraform/main.tf: ../../../../terraform/modules/iam/azure/cudly-reservation-role. The other 4 combos pass. Restored, all pass.
• Ran: go build ./...; go vet on iacbundle/api/scripts/terraform, with and without -tags integration; go test -race -short -count=1 on iacbundle, scripts and terraform, plus the federation/bundle tests in internal/api (all ok); go test -race -tags integration -run 'Federation|Bundle|IaC' ./internal/api/ (ok); golangci-lint v2.10.1, with and without the integration tag (0 issues); gocyclo -over 10 on the changed non-test files (clean). Closes fix(scripts): generate-federation-iac.go's Azure bundle still references a module outside the zip #1442 fits: both acceptance points (shared helper, script output run through the resolve check) are met.

Body-stale:

• none

_{Reviewer: rE2. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE c0a30ad179b8bd7c1402d227cc7c44279e5bb9b4

Blocking:

• none
  Non-blocking:
• scripts/generate-federation-iac.go:333 / internal/iacbundle/bundle.go:79: the script now walks the on-disk module directory recursively through os.DirFS, and it skips only dot-prefixed names. A developer's local, non-hidden artefacts in that directory (terraform.tfstate, terraform.tfstate.backup, a *.tfvars, a saved tfplan) would ship in the zip. That was already true for top-level files before this PR, and it is a dev-only tool, so this isn't new exposure. A tracked-files-only filter, or an allowlist of *.tf, *.tftest.hcl and README*, would close it for good. The API path is unaffected: go:embed only ever sees tracked files.
• Minor: go:embed also drops _-prefixed names, and walkVisible doesn't. No such files exist today.
  Attacked: I diffed the new iacbundle against the deleted internal/api helpers. The module set, rewrite, uncalled-module error and zip layout are identical, and the API keeps using the embedded FS (which has no hidden files), so the API bundle is unchanged. I checked that the extra module comes from the compile-time embed (*.tf only), so a go run of the script ships the current tree's module, and that UnresolvedLocalModules resolves ./modules/cudly-reservation-role relative to terraform/main.tf. I also checked how the //go:build ignore script is exercised by runGenerator in the scripts tests. Ran: go build ./..., go vet with and without -tags integration on iacbundle/api/scripts/terraform, go test -race -short -count=1 on iacbundle, api, scripts, terraform and terraform/... (all ok), go test -race -tags integration -run 'Federation|Bundle' ./internal/api/ (ok), and golangci-lint run ./internal/iacbundle/ ./scripts/ (0 issues). Fail-before: with scripts/generate-federation-iac.go reset to the merge-base, TestGenerator_BundleLocalModulesResolveInsideZip/azure-target fails with terraform/main.tf: ../../../../terraform/modules/iam/azure/cudly-reservation-role. It passes at the head. GitHub reports the PR MERGEABLE.
  Body-stale: none

_{Reviewer: rE3. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at c0a30ad179b8bd7c1402d227cc7c44279e5bb9b4 merged onto main (990f4936), together with #1462, #1467, #1468 in that order (combined tree 7a76ef40, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on c0a30ad1 (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly c0a30ad179b8bd7c1402d227cc7c44279e5bb9b4.