states: check root output value changes in refresh-only mode

[bschaatsbergen]

Fixes #35806

In refresh-only mode, we don’t expect to propose any actions, but a plan is marked as “applyable” if there are state changes between runs. Currently, a plan is considered “applyable” only when there are differences in managed resources, which overlooks changes in root output values. As a result, a plan is marked as non-applyable even when the root output values have changed, since only managed resources are being checked.

The states package has an Equal function that checks if two states are deeply equal. While this could solve the issue, it seemed like an overreach, as it focuses on managed resource instances only. To address this, I added a function specifically to detect changes in root output values between states.

It’s also worth noting that output values in other modules don’t persist between runs. Terraform Core tracks these internally, but they aren’t included in any artifacts that persist across executions.

Question for the reviewer: What about ephemeral output values? And, are data sources considered as part of the existing ManagedResourcesEqual function already?

 $ go test -run "TestState" -v
=== RUN   TestState
--- PASS: TestState (0.00s)
=== RUN   TestStateDeepCopyObject
--- PASS: TestStateDeepCopyObject (0.00s)
=== RUN   TestStateDeepCopy
--- PASS: TestStateDeepCopy (0.00s)
=== RUN   TestStateHasResourceInstanceObjects
=== RUN   TestStateHasResourceInstanceObjects/empty
=== RUN   TestStateHasResourceInstanceObjects/one_current,_ready_object_in_root_module
=== RUN   TestStateHasResourceInstanceObjects/one_current,_ready_object_in_child_module
=== RUN   TestStateHasResourceInstanceObjects/one_current,_tainted_object_in_root_module
=== RUN   TestStateHasResourceInstanceObjects/one_deposed,_ready_object_in_root_module
=== RUN   TestStateHasResourceInstanceObjects/one_empty_resource_husk_in_root_module
=== RUN   TestStateHasResourceInstanceObjects/one_current_data_resource_object_in_root_module
--- PASS: TestStateHasResourceInstanceObjects (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/empty (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_current,_ready_object_in_root_module (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_current,_ready_object_in_child_module (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_current,_tainted_object_in_root_module (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_deposed,_ready_object_in_root_module (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_empty_resource_husk_in_root_module (0.00s)
    --- PASS: TestStateHasResourceInstanceObjects/one_current_data_resource_object_in_root_module (0.00s)
=== RUN   TestStateHasRootOutputValues
=== RUN   TestStateHasRootOutputValues/empty
=== RUN   TestStateHasRootOutputValues/one_output_value
=== RUN   TestStateHasRootOutputValues/one_secret_output_value
=== RUN   TestStateHasRootOutputValues/one_output_value_in_child_module
=== RUN   TestStateHasRootOutputValues/one_output_value_in_multi_module
--- PASS: TestStateHasRootOutputValues (0.00s)
    --- PASS: TestStateHasRootOutputValues/empty (0.00s)
    --- PASS: TestStateHasRootOutputValues/one_output_value (0.00s)
    --- PASS: TestStateHasRootOutputValues/one_secret_output_value (0.00s)
    --- PASS: TestStateHasRootOutputValues/one_output_value_in_child_module (0.00s)
    --- PASS: TestStateHasRootOutputValues/one_output_value_in_multi_module (0.00s)
=== RUN   TestState_MoveAbsResource
=== RUN   TestState_MoveAbsResource/basic_move
=== RUN   TestState_MoveAbsResource/move_to_new_module
=== RUN   TestState_MoveAbsResource/from_a_child_module_to_root
=== RUN   TestState_MoveAbsResource/module_to_new_module
=== RUN   TestState_MoveAbsResource/module_to_new_module#01
--- PASS: TestState_MoveAbsResource (0.00s)
    --- PASS: TestState_MoveAbsResource/basic_move (0.00s)
    --- PASS: TestState_MoveAbsResource/move_to_new_module (0.00s)
    --- PASS: TestState_MoveAbsResource/from_a_child_module_to_root (0.00s)
    --- PASS: TestState_MoveAbsResource/module_to_new_module (0.00s)
    --- PASS: TestState_MoveAbsResource/module_to_new_module#01 (0.00s)
=== RUN   TestState_MaybeMoveAbsResource
=== RUN   TestState_MaybeMoveAbsResource/first_move
=== RUN   TestState_MaybeMoveAbsResource/noop
--- PASS: TestState_MaybeMoveAbsResource (0.00s)
    --- PASS: TestState_MaybeMoveAbsResource/first_move (0.00s)
    --- PASS: TestState_MaybeMoveAbsResource/noop (0.00s)
=== RUN   TestState_MoveAbsResourceInstance
=== RUN   TestState_MoveAbsResourceInstance/resource_to_resource_instance
=== RUN   TestState_MoveAbsResourceInstance/move_to_new_module
--- PASS: TestState_MoveAbsResourceInstance (0.00s)
    --- PASS: TestState_MoveAbsResourceInstance/resource_to_resource_instance (0.00s)
    --- PASS: TestState_MoveAbsResourceInstance/move_to_new_module (0.00s)
=== RUN   TestState_MaybeMoveAbsResourceInstance
=== RUN   TestState_MaybeMoveAbsResourceInstance/first_move
=== RUN   TestState_MaybeMoveAbsResourceInstance/noop
--- PASS: TestState_MaybeMoveAbsResourceInstance (0.00s)
    --- PASS: TestState_MaybeMoveAbsResourceInstance/first_move (0.00s)
    --- PASS: TestState_MaybeMoveAbsResourceInstance/noop (0.00s)
=== RUN   TestState_MoveModuleInstance
--- PASS: TestState_MoveModuleInstance (0.00s)
=== RUN   TestState_MaybeMoveModuleInstance
=== RUN   TestState_MaybeMoveModuleInstance/first_move
=== RUN   TestState_MaybeMoveModuleInstance/noop
--- PASS: TestState_MaybeMoveModuleInstance (0.00s)
    --- PASS: TestState_MaybeMoveModuleInstance/first_move (0.00s)
    --- PASS: TestState_MaybeMoveModuleInstance/noop (0.00s)
=== RUN   TestState_MoveModule
=== RUN   TestState_MoveModule/basic
=== RUN   TestState_MoveModule/nested_modules
--- PASS: TestState_MoveModule (0.00s)
    --- PASS: TestState_MoveModule/basic (0.00s)
    --- PASS: TestState_MoveModule/nested_modules (0.00s)
PASS
ok      github.com/hashicorp/terraform/internal/states  0.298s

[liamcervante]

I think I'm okay with this change. Can you get all the tests passing @bschaatsbergen?

[radeksimko]

Question for the reviewer: What about ephemeral output values?

We decided to reject root ephemeral output values as per #35791 so they will not be playing any role in the plan. Ephemeral outputs may only be used internally between nested modules.

And, are data sources considered as part of the existing ManagedResourcesEqual function already?

The name would suggest they are not but I'm not aware of any particular issues with data sources during terraform apply -refresh-only currently, are you?

[jbardin]

No, data sources are not considered in the comparison, they only really exist in the state at all for historical reasons and don't need to be refreshed.

[bschaatsbergen]

I think I'm okay with this change. Can you get all the tests passing @bschaatsbergen?

Fixed, 73320c5

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.