Direct dependencies between two resources causes IndexOutOfBoundsException

[rickybarefield]

What happened?

During development of Java version of pulumi-terraform an IndexOutOfBoundsException was thrown due to direct dependency between two resources.

Example

In this example two remote state references are created, the second using valueFromBucketOne which was taken from the first.

        bucketOne = new RemoteStateReference("bucketOne", S3RemoteStateReferenceArgs.builder()
                .bucket("bucketOne")
                .key("some-key/terraform.tfstate")
                .region("eu-west-2")
                .build());

       var valueFromBucketOne = bucketOne.getOutput("someKey");

        Output<String> bucketTwoObjectKey = valueFromBucketOne.applyValue(v -> "some-prefix/" + v + "/terraform.tfstate");

        bucketTwo = new RemoteStateReference("bucketTwo", S3RemoteStateReferenceArgs.builder()
                .bucket("bucketTwo")
                .key(bucketTwoObjectKey)
                .region("eu-west-2")
                .build());

Output of pulumi about

CLI
Version 3.121.0
Go Version go1.22.4
Go Compiler gc

Host
OS debian
Version 12.5
Arch x86_64

Backend
Name ***
URL file://~
User ***
Organizations
Token type personal

Additional context

The issue is in DeploymentImpl.java:

var request = ReadResourceRequest.newBuilder()
                                .setType(type)
                                .setName(name)
                                .setId(id)
                                .setParent(prepareResult.parentUrn)
                                .setProvider(prepareResult.providerRef)
                                .setProperties(prepareResult.serializedProps)
                                .setVersion(options.getVersion().orElse(""))
                                .setAcceptSecrets(true)
                                .setAcceptResources(!this.disableResourceReferences);

                        for (int i = 0; i < prepareResult.allDirectDependencyUrns.size(); i++) {
                            request.setDependencies(i, prepareResult.allDirectDependencyUrns.asList().get(i));
                        }

The Builder of ReadResourceRequest initialises a zero length array to hold dependencies, then if allDirectDependencyUrns is not empty, setDependencies is called for each index i. This causes a set to be called to an invalid index on the underlying array.

PR to follow...

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[rickybarefield]

PR raised #1388

[justinvp]

Thanks for opening the issue and for the PR!

[ericrudder]

Thanks @rickybarefield ... are you coming to our UK Meetup so I can thank you in person?! (https://www.meetup.com/london-pulumi-user-group/events/302924290/?eventOrigin=group_featured_event)