fix: re-evaluate submodules when inputs change

gotfparse/go.mod

@@ -66,3 +66,5 @@ require (
 	google.golang.org/grpc v1.60.1 // indirect
 	google.golang.org/protobuf v1.32.0 // indirect
 )
+
+replace github.com/aquasecurity/defsec v0.93.1 => github.com/cloud-custodian/defsec v0.93.2-0.20240322122006-69f7f1796542

gotfparse/go.sum

@@ -203,8 +203,6 @@ github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4t
 github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
-github.com/aquasecurity/defsec v0.93.1 h1:y4XgRknjs2M58XVLANBT1wulO7N6Rz1oyfwNuzID+h4=
-github.com/aquasecurity/defsec v0.93.1/go.mod h1:i80K4WRNbcIWDOQDWnTHkutBwplzw/uZD4laKbhu4sE=
 github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.49.16 h1:KAQwhLg296hfffRdh+itA9p7Nx/3cXS/qOa3uF9ssig=
 github.com/aws/aws-sdk-go v1.49.16/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
@@ -220,6 +218,8 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloud-custodian/defsec v0.93.2-0.20240322122006-69f7f1796542 h1:JhRWMiuTUVNh6Gl14u7Ov8we7cjVIezUhr85AbNiBas=
+github.com/cloud-custodian/defsec v0.93.2-0.20240322122006-69f7f1796542/go.mod h1:i80K4WRNbcIWDOQDWnTHkutBwplzw/uZD4laKbhu4sE=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=

tests/terraform/module-in-out/main.tf

@@ -0,0 +1,24 @@
+variable "tags" {
+  type = map(any)
+  default = {
+    env = "dev"
+    app = "weather"
+  }
+}
+
+
+module "tags_base" {
+  source    = "./module/tags"
+  tags_base = var.tags
+}
+
+
+locals {
+  default_tags = module.tags_base.tags
+}
+
+
+module "bucket" {
+  source       = "./module/bucket"
+  default_tags = local.default_tags
+}

tests/terraform/module-in-out/module/bucket/main.tf

@@ -0,0 +1,7 @@
+resource "aws_s3_bucket" "bucket_module" {
+  tags = var.default_tags
+}
+
+variable "default_tags" {
+  type = map(string)
+}

tests/terraform/module-in-out/module/tags/main.tf

@@ -0,0 +1,22 @@
+
+variable "tags_base" {
+  type    = map(any)
+  default = {}
+}
+
+variable "additional_tags" {
+  type    = map(string)
+  default = {}
+}
+
+
+locals {
+  tags = {
+    "app-id" = "static"
+  }
+
+}
+
+output "tags" {
+  value = merge(local.tags, var.tags_base, var.additional_tags)
+}

tests/test_tfparse.py

@@ -423,3 +423,31 @@ def test_modules_located_above_root(tmp_path):
     assert output1["value"] == "hello-world"
     assert output2["__tfmeta"]["path"] == "module.test.output.output"
     assert output2["value"] == "testing"
+
+
+def test_module_input_output(tmp_path):
+    root_path = init_module("module-in-out", tmp_path)
+    parsed = load_from_path(root_path)
+
+    asserted_tags = {"app": "weather", "app-id": "static", "env": "dev"}
+    # check output from tag module
+    assert parsed["output"][0]["value"] == asserted_tags
+
+    # check root module local default tags variable
+    found = False
+    for localv in parsed["locals"]:
+        if localv["__tfmeta"]["filename"] == "main.tf" and "default_tags" in localv:
+            found = True
+            assert localv["default_tags"] == asserted_tags
+    assert found
+
+    # check bucket module input has correct value
+    found = False
+    for module in parsed["module"]:
+        if module["__tfmeta"]["label"] == "bucket" and "default_tags" in module:
+            found = True
+            assert module["default_tags"] == asserted_tags
+    assert found
+
+    # check the bucket has the tags
+    assert parsed["aws_s3_bucket"][0]["tags"] == asserted_tags