Skip to content

feat: add argo-workflow job agent config#37

Merged
mleonidas merged 1 commit intomainfrom
mleonidas/add_argo_workflow_agent
Apr 1, 2026
Merged

feat: add argo-workflow job agent config#37
mleonidas merged 1 commit intomainfrom
mleonidas/add_argo_workflow_agent

Conversation

@mleonidas
Copy link
Copy Markdown
Collaborator

@mleonidas mleonidas commented Mar 26, 2026

  • adds the ability to configure the argo-workflow job agent

Summary by CodeRabbit

  • New Features

    • Added Argo Workflow as a supported job-agent type with configurable fields: API key (sensitive), webhook secret (sensitive), server URL, workflow template, agent name, and optional http_insecure flag (defaults to false).
  • Documentation

    • Added docs for the new job_agent.argo_workflow block in deployment and job agent guides.
  • Refactor

    • Grouped compile-time assertions for a cleaner internal structure.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 26, 2026

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Adds Argo Workflows as a new job-agent type: introduces argo_workflow nested block with api_key (sensitive), webhook_secret (sensitive), server_url, template, name, and http_insecure (bool, default false); updates models, block selection/counting, and config (de)serialization across provider code and docs.

Changes

Cohort / File(s) Summary
Deployment Resource
internal/provider/deployment_resource.go
Add DeploymentJobAgentArgoWorkflowModel and ArgoWorkflow field; include argo_workflow in block-type detection and single-block counting; emit/parse config keys apiKey, webhookSecret, serverUrl, template, name, httpInsecure; grouped compile-time interface assertions.
Job Agent Resource
internal/provider/job_agent_resource.go
Add argo_workflow nested block to schema and JobAgentArgoWorkflowModel; add ArgoWorkflow list field to JobAgentResourceModel; include in mutual-exclusion counting; serialize/deserialize "argo-workflow" config and preserve sensitive fields across Read; grouped compile-time assertions.
Documentation
docs/resources/deployment.md, docs/resources/job_agent.md
Document new job_agent.argo_workflow / ctrlplane_job_agent.argo_workflow blocks and fields (api_key, webhook_secret sensitive; server_url, template, name; http_insecure boolean default false).

Sequence Diagram(s)

(omitted)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Poem

🐇
I hopped through schemas, soft and bright,
Hid API keys beneath the night,
Webhooks hum and templates flow,
Argo seeds in fields we sow,
Tiny paws deploy delight ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: adding argo-workflow job agent configuration support across provider resources and documentation.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch mleonidas/add_argo_workflow_agent

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@mleonidas mleonidas marked this pull request as ready for review March 30, 2026 14:15
Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (5)
internal/provider/job_agent_resource.go (2)

232-244: ⚠️ Potential issue | 🟡 Minor

Update validation error messages to include argo_workflow.

The error messages reference the old set of job agent types and don't mention the newly added argo_workflow option.

📝 Proposed fix
 	if count == 0 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Exactly one of custom, argocd, github, terraform_cloud, or test_runner must be set.",
+			"Exactly one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner must be set.",
 		)
 		return
 	}
 	if count > 1 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Only one of custom, argocd, github, terraform_cloud, or test_runner can be set.",
+			"Only one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.",
 		)
 	}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 232 - 244, The
validation error messages for job agent selection (inside the block using
countJobAgentConfigs(data) and resp.Diagnostics.AddError) still list the old
agent types; update both error strings to include "argo_workflow" alongside
"custom, argocd, github, terraform_cloud, or test_runner" so they accurately
reflect the new option and maintain the same phrasing for both the zero-count
and multi-count cases in the function where countJobAgentConfigs and resp are
used.

366-377: ⚠️ Potential issue | 🟠 Major

Missing preservation of sensitive api_key field for ArgoWorkflow.

The TFC token is preserved across reads because the API doesn't return sensitive fields. The same pattern should be applied for the ArgoWorkflow api_key field to prevent it from being lost on terraform refresh or subsequent reads.

🔒 Proposed fix to preserve api_key
 	// Preserve sensitive fields that the API doesn't return.
 	var priorToken types.String
 	if len(data.TerraformCloud) > 0 {
 		priorToken = data.TerraformCloud[0].Token
 	}
+	var priorApiKey types.String
+	if len(data.ArgoWorkflow) > 0 {
+		priorApiKey = data.ArgoWorkflow[0].ApiKey
+	}

 	setJobAgentBlocksFromAPI(&data, jobAgent.Type, jobAgent.Config)

 	// Restore token from prior state since the API never returns it.
 	if len(data.TerraformCloud) > 0 && !priorToken.IsNull() {
 		data.TerraformCloud[0].Token = priorToken
 	}
+	// Restore api_key from prior state since the API never returns it.
+	if len(data.ArgoWorkflow) > 0 && !priorApiKey.IsNull() {
+		data.ArgoWorkflow[0].ApiKey = priorApiKey
+	}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 366 - 377, The
ArgoWorkflow sensitive api_key isn't being preserved across reads; add the same
preservation pattern used for TerraformCloud.token: before calling
setJobAgentBlocksFromAPI capture the existing value into a priorApiKey variable
(e.g., var priorApiKey types.String and if len(data.ArgoWorkflow) > 0 set
priorApiKey = data.ArgoWorkflow[0].ApiKey), call setJobAgentBlocksFromAPI(&data,
jobAgent.Type, jobAgent.Config), then after that restore it (if
len(data.ArgoWorkflow) > 0 && !priorApiKey.IsNull() set
data.ArgoWorkflow[0].ApiKey = priorApiKey).
internal/provider/deployment_resource.go (3)

250-255: ⚠️ Potential issue | 🟡 Minor

Update validation error message to include argo_workflow.

The error message references the old set of job agent block types.

📝 Proposed fix
 		if countDeploymentJobAgentBlocks(ja) > 1 {
 			resp.Diagnostics.AddError(
 				"Invalid job agent configuration",
-				fmt.Sprintf("job_agent[%d]: only one of argocd, github, terraform_cloud, or test_runner can be set.", i),
+				fmt.Sprintf("job_agent[%d]: only one of argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.", i),
 			)
 		}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/deployment_resource.go` around lines 250 - 255, The
validation error message in the block that calls
countDeploymentJobAgentBlocks(ja) and resp.Diagnostics.AddError must be updated
to list the current job_agent types; change the fmt.Sprintf message in that
AddError call to include "argo_workflow" alongside argocd, github,
terraform_cloud, and test_runner so it reads something like: only one of argocd,
github, terraform_cloud, argo_workflow, or test_runner can be set. Ensure you
update the format string passed to resp.Diagnostics.AddError in the same
function.

658-665: ⚠️ Potential issue | 🟠 Major

Missing preservation of sensitive api_key field for ArgoWorkflow in deploymentJobAgentModelsFromAPI.

This function preserves TFC token from prior agents but doesn't preserve ArgoWorkflow's api_key.

🔒 Proposed fix
 		// Preserve sensitive token from prior state since the API won't return it.
 		if i < len(priorAgents) && model.TerraformCloud != nil && priorAgents[i].TerraformCloud != nil {
 			if !priorAgents[i].TerraformCloud.Token.IsNull() {
 				model.TerraformCloud.Token = priorAgents[i].TerraformCloud.Token
 			}
 		}
+		// Preserve sensitive api_key from prior state since the API won't return it.
+		if i < len(priorAgents) && model.ArgoWorkflow != nil && priorAgents[i].ArgoWorkflow != nil {
+			if !priorAgents[i].ArgoWorkflow.ApiKey.IsNull() {
+				model.ArgoWorkflow.ApiKey = priorAgents[i].ArgoWorkflow.ApiKey
+			}
+		}
 		result = append(result, model)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/deployment_resource.go` around lines 658 - 665, In
deploymentJobAgentModelsFromAPI, mirror the existing TerraformCloud token
preservation for ArgoWorkflow by checking if model.ArgoWorkflow != nil and
priorAgents[i].ArgoWorkflow != nil and, if priorAgents[i].ArgoWorkflow.ApiKey is
not null, copy it into model.ArgoWorkflow.ApiKey; follow the same null-check
pattern used for TerraformCloud.Token (e.g., ApiKey.IsNull()) and perform the
assignment before appending model to result so the sensitive ArgoWorkflow
api_key from prior state is preserved.

397-413: ⚠️ Potential issue | 🟠 Major

Missing preservation of sensitive api_key field for ArgoWorkflow in Read.

When handling the legacy JobAgentId branch, the TFC token is preserved from prior state. The same should be done for ArgoWorkflow's api_key.

🔒 Proposed fix
 		if len(priorAgents) > 0 && jobAgent.TerraformCloud != nil && priorAgents[0].TerraformCloud != nil {
 			if !priorAgents[0].TerraformCloud.Token.IsNull() {
 				jobAgent.TerraformCloud.Token = priorAgents[0].TerraformCloud.Token
 			}
 		}
+		if len(priorAgents) > 0 && jobAgent.ArgoWorkflow != nil && priorAgents[0].ArgoWorkflow != nil {
+			if !priorAgents[0].ArgoWorkflow.ApiKey.IsNull() {
+				jobAgent.ArgoWorkflow.ApiKey = priorAgents[0].ArgoWorkflow.ApiKey
+			}
+		}
 		agentList, diags := types.ListValueFrom(ctx, deploymentJobAgentObjectType, []DeploymentJobAgentModel{jobAgent})
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/deployment_resource.go` around lines 397 - 413, The Read
logic creates a DeploymentJobAgentModel (jobAgent) for the legacy JobAgentId
branch but only preserves TerraformCloud.Token from priorAgents; update the same
branch to also preserve ArgoWorkflow.api_key when present by checking
jobAgent.ArgoCD (or jobAgent.ArgoWorkflow field if named) and
priorAgents[0].ArgoCD/ArgoWorkflow, and if
priorAgents[0].ArgoCD/ArgoWorkflow.api_key is not null copy it into
jobAgent.ArgoCD/ArgoWorkflow.api_key after
setDeploymentJobAgentBlocksFromConfig(&jobAgent, dep.JobAgentConfig, blockType);
make sure you reference the exact struct field names (ArgoCD/ArgoWorkflow and
api_key) used in DeploymentJobAgentModel and follow the null checks pattern used
for TerraformCloud.Token to avoid nil derefs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/provider/deployment_resource.go`:
- Around line 902-910: The function boolValueOrFalse is unused and failing CI;
remove the dead helper by deleting the boolValueOrFalse function declaration
from the file (remove its signature and body) and run tests/build to ensure no
references remain; if any references to boolValueOrFalse exist elsewhere,
replace them with a direct types.BoolValue(false) or an explicit conversion
using the calling code instead of reintroducing the helper.

---

Outside diff comments:
In `@internal/provider/deployment_resource.go`:
- Around line 250-255: The validation error message in the block that calls
countDeploymentJobAgentBlocks(ja) and resp.Diagnostics.AddError must be updated
to list the current job_agent types; change the fmt.Sprintf message in that
AddError call to include "argo_workflow" alongside argocd, github,
terraform_cloud, and test_runner so it reads something like: only one of argocd,
github, terraform_cloud, argo_workflow, or test_runner can be set. Ensure you
update the format string passed to resp.Diagnostics.AddError in the same
function.
- Around line 658-665: In deploymentJobAgentModelsFromAPI, mirror the existing
TerraformCloud token preservation for ArgoWorkflow by checking if
model.ArgoWorkflow != nil and priorAgents[i].ArgoWorkflow != nil and, if
priorAgents[i].ArgoWorkflow.ApiKey is not null, copy it into
model.ArgoWorkflow.ApiKey; follow the same null-check pattern used for
TerraformCloud.Token (e.g., ApiKey.IsNull()) and perform the assignment before
appending model to result so the sensitive ArgoWorkflow api_key from prior state
is preserved.
- Around line 397-413: The Read logic creates a DeploymentJobAgentModel
(jobAgent) for the legacy JobAgentId branch but only preserves
TerraformCloud.Token from priorAgents; update the same branch to also preserve
ArgoWorkflow.api_key when present by checking jobAgent.ArgoCD (or
jobAgent.ArgoWorkflow field if named) and priorAgents[0].ArgoCD/ArgoWorkflow,
and if priorAgents[0].ArgoCD/ArgoWorkflow.api_key is not null copy it into
jobAgent.ArgoCD/ArgoWorkflow.api_key after
setDeploymentJobAgentBlocksFromConfig(&jobAgent, dep.JobAgentConfig, blockType);
make sure you reference the exact struct field names (ArgoCD/ArgoWorkflow and
api_key) used in DeploymentJobAgentModel and follow the null checks pattern used
for TerraformCloud.Token to avoid nil derefs.

In `@internal/provider/job_agent_resource.go`:
- Around line 232-244: The validation error messages for job agent selection
(inside the block using countJobAgentConfigs(data) and
resp.Diagnostics.AddError) still list the old agent types; update both error
strings to include "argo_workflow" alongside "custom, argocd, github,
terraform_cloud, or test_runner" so they accurately reflect the new option and
maintain the same phrasing for both the zero-count and multi-count cases in the
function where countJobAgentConfigs and resp are used.
- Around line 366-377: The ArgoWorkflow sensitive api_key isn't being preserved
across reads; add the same preservation pattern used for TerraformCloud.token:
before calling setJobAgentBlocksFromAPI capture the existing value into a
priorApiKey variable (e.g., var priorApiKey types.String and if
len(data.ArgoWorkflow) > 0 set priorApiKey = data.ArgoWorkflow[0].ApiKey), call
setJobAgentBlocksFromAPI(&data, jobAgent.Type, jobAgent.Config), then after that
restore it (if len(data.ArgoWorkflow) > 0 && !priorApiKey.IsNull() set
data.ArgoWorkflow[0].ApiKey = priorApiKey).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7fde64d7-884e-4a61-bb5a-605e6cca89b0

📥 Commits

Reviewing files that changed from the base of the PR and between fbb90b9 and 6187431.

📒 Files selected for processing (2)
  • internal/provider/deployment_resource.go
  • internal/provider/job_agent_resource.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
internal/provider/deployment_resource.go (1)

250-255: ⚠️ Potential issue | 🟡 Minor

Update error message to include argo_workflow.

The validation logic correctly counts argo_workflow blocks, but the error message doesn't list it as an option.

📝 Proposed fix
 		if countDeploymentJobAgentBlocks(ja) > 1 {
 			resp.Diagnostics.AddError(
 				"Invalid job agent configuration",
-				fmt.Sprintf("job_agent[%d]: only one of argocd, github, terraform_cloud, or test_runner can be set.", i),
+				fmt.Sprintf("job_agent[%d]: only one of argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.", i),
 			)
 		}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/deployment_resource.go` around lines 250 - 255, The error
message in the job agent validation (inside the block using
countDeploymentJobAgentBlocks(ja) and resp.Diagnostics.AddError) omits
argo_workflow even though it's counted; update the error text passed to
resp.Diagnostics.AddError (the "job_agent[%d]: ..." message) to include
argo_workflow among the listed valid options so it reads something like "only
one of argocd, github, terraform_cloud, argo_workflow, or test_runner can be
set." Use the same variables (i, ja) and keep the existing Diagnostics.AddError
call.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@internal/provider/deployment_resource.go`:
- Around line 250-255: The error message in the job agent validation (inside the
block using countDeploymentJobAgentBlocks(ja) and resp.Diagnostics.AddError)
omits argo_workflow even though it's counted; update the error text passed to
resp.Diagnostics.AddError (the "job_agent[%d]: ..." message) to include
argo_workflow among the listed valid options so it reads something like "only
one of argocd, github, terraform_cloud, argo_workflow, or test_runner can be
set." Use the same variables (i, ja) and keep the existing Diagnostics.AddError
call.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c3058606-754f-4e5e-af80-d6564a538e4f

📥 Commits

Reviewing files that changed from the base of the PR and between 6187431 and c9aa0de.

📒 Files selected for processing (1)
  • internal/provider/deployment_resource.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
internal/provider/job_agent_resource.go (1)

238-250: ⚠️ Potential issue | 🟡 Minor

Error messages are missing argo_workflow in the list of valid agent types.

The countJobAgentConfigs function correctly counts ArgoWorkflow, but the error messages still list only the old agent types. Users configuring argo_workflow will see confusing errors.

🐛 Proposed fix
 	if count == 0 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Exactly one of custom, argocd, github, terraform_cloud, or test_runner must be set.",
+			"Exactly one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner must be set.",
 		)
 		return
 	}
 	if count > 1 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Only one of custom, argocd, github, terraform_cloud, or test_runner can be set.",
+			"Only one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.",
 		)
 	}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 238 - 250, The error
messages in the validation block that checks the counted job agent configs (the
branch using count and resp.Diagnostics.AddError) are out of sync with
countJobAgentConfigs: add "argo_workflow" to both error message lists so they
read "...custom, argocd, github, terraform_cloud, argo_workflow, or
test_runner..." (update both the zero-count and multi-count
resp.Diagnostics.AddError calls to include argo_workflow).
🧹 Nitpick comments (1)
internal/provider/job_agent_resource.go (1)

144-147: Minor: Description refers to "application template" but should say "workflow template".

The description appears to be copied from ArgoCD. For Argo Workflows, "application template" doesn't match the terminology.

📝 Suggested description update
 						"template": schema.StringAttribute{
 							Required:    true,
-							Description: "ArgoWorkflow application template",
+							Description: "Argo Workflow template content",
 						},
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 144 - 147, Update the
attribute description for the "template" schema.StringAttribute in
job_agent_resource.go: replace the current Description "ArgoWorkflow application
template" with wording that uses Argo Workflows terminology (e.g., "Argo
Workflows workflow template" or "Argo Workflow template") so it accurately
reflects that this is a workflow template, not an application template.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@internal/provider/job_agent_resource.go`:
- Around line 238-250: The error messages in the validation block that checks
the counted job agent configs (the branch using count and
resp.Diagnostics.AddError) are out of sync with countJobAgentConfigs: add
"argo_workflow" to both error message lists so they read "...custom, argocd,
github, terraform_cloud, argo_workflow, or test_runner..." (update both the
zero-count and multi-count resp.Diagnostics.AddError calls to include
argo_workflow).

---

Nitpick comments:
In `@internal/provider/job_agent_resource.go`:
- Around line 144-147: Update the attribute description for the "template"
schema.StringAttribute in job_agent_resource.go: replace the current Description
"ArgoWorkflow application template" with wording that uses Argo Workflows
terminology (e.g., "Argo Workflows workflow template" or "Argo Workflow
template") so it accurately reflects that this is a workflow template, not an
application template.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ea96358f-a15a-46ac-98cc-645701ef5d8a

📥 Commits

Reviewing files that changed from the base of the PR and between c9aa0de and 488018e.

📒 Files selected for processing (4)
  • docs/resources/deployment.md
  • docs/resources/job_agent.md
  • internal/provider/deployment_resource.go
  • internal/provider/job_agent_resource.go
✅ Files skipped from review due to trivial changes (2)
  • docs/resources/job_agent.md
  • docs/resources/deployment.md
🚧 Files skipped from review as they are similar to previous changes (1)
  • internal/provider/deployment_resource.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
internal/provider/job_agent_resource.go (1)

248-256: ⚠️ Potential issue | 🟡 Minor

Update validation messages to include argo_workflow.

Line 248 and Line 255 still say only custom, argocd, github, terraform_cloud, or test_runner, but Line 534 now includes argo_workflow in counting logic. The diagnostics are now misleading.

✏️ Suggested patch
-			"Exactly one of custom, argocd, github, terraform_cloud, or test_runner must be set.",
+			"Exactly one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner must be set.",
...
-			"Only one of custom, argocd, github, terraform_cloud, or test_runner can be set.",
+			"Only one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 248 - 256, The
diagnostic messages in the job agent validation (the if branches that call
resp.Diagnostics.AddError when count == 0 and count > 1) omit the recently added
argo_workflow option; update both error strings to list "custom, argocd, github,
terraform_cloud, argo_workflow, or test_runner" so the messages match the
counting logic that includes argo_workflow (refer to the variables/names custom,
argocd, github, terraform_cloud, argo_workflow, test_runner and the
resp.Diagnostics.AddError calls).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/provider/job_agent_resource.go`:
- Around line 644-646: When reading ArgoWorkflow config in
job_agent_resource.go, preserve sensitive fields by capturing the prior state's
apiKey and webhookSecret before calling setJobAgentBlocksFromAPI and restoring
them afterward; specifically, before setJobAgentBlocksFromAPI save the values
from the existing state (the prior map/struct entries used for ApiKey and
WebhookSecret), call setJobAgentBlocksFromAPI as before, then if the API
returned redacted or "<nil>" values replace those returned ApiKey and
WebhookSecret with the saved prior values (leave ServerUrl as-is), ensuring the
resource's ApiKey and WebhookSecret fields are not overwritten with the "<nil>"
string.
- Around line 153-158: The Read logic must normalize a missing http_insecure to
false to avoid state diffs: in the resource's Read function (where config is
read and boolValueOrNull(config["httpInsecure"]) is used) set the httpInsecure
state to false when the key is absent and only call boolValueOrNull if config
contains "httpInsecure"; ensure the schema attribute "http_insecure" (Default:
false) is reflected by writing false into state when the API omits the field so
subsequent plans no longer toggle between null and false.

---

Outside diff comments:
In `@internal/provider/job_agent_resource.go`:
- Around line 248-256: The diagnostic messages in the job agent validation (the
if branches that call resp.Diagnostics.AddError when count == 0 and count > 1)
omit the recently added argo_workflow option; update both error strings to list
"custom, argocd, github, terraform_cloud, argo_workflow, or test_runner" so the
messages match the counting logic that includes argo_workflow (refer to the
variables/names custom, argocd, github, terraform_cloud, argo_workflow,
test_runner and the resp.Diagnostics.AddError calls).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e4d3951f-f0d1-4aed-972a-6386a720c64e

📥 Commits

Reviewing files that changed from the base of the PR and between 488018e and fa9753d.

📒 Files selected for processing (4)
  • docs/resources/deployment.md
  • docs/resources/job_agent.md
  • internal/provider/deployment_resource.go
  • internal/provider/job_agent_resource.go
✅ Files skipped from review due to trivial changes (1)
  • docs/resources/deployment.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • docs/resources/job_agent.md
  • internal/provider/deployment_resource.go

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
internal/provider/job_agent_resource.go (1)

244-257: ⚠️ Potential issue | 🟡 Minor

Error messages don't include argo_workflow in the list of valid options.

The ValidateConfig function validates that exactly one job agent type is set, but the error messages omit argo_workflow from the list of valid options. This will confuse users when they receive these validation errors.

📝 Suggested fix
 	count := countJobAgentConfigs(data)
 	if count == 0 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Exactly one of custom, argocd, github, terraform_cloud, or test_runner must be set.",
+			"Exactly one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner must be set.",
 		)
 		return
 	}
 	if count > 1 {
 		resp.Diagnostics.AddError(
 			"Invalid job agent configuration",
-			"Only one of custom, argocd, github, terraform_cloud, or test_runner can be set.",
+			"Only one of custom, argocd, argo_workflow, github, terraform_cloud, or test_runner can be set.",
 		)
 	}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@internal/provider/job_agent_resource.go` around lines 244 - 257, The
validation error messages in the job agent config check (used by ValidateConfig
via countJobAgentConfigs) omit the "argo_workflow" option; update both error
strings where count == 0 and count > 1 to include "argo_workflow" in the list of
valid options (so the messages read something like "custom, argocd,
argo_workflow, github, terraform_cloud, or test_runner") so users see the
complete set of possible job agent types.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@internal/provider/job_agent_resource.go`:
- Around line 244-257: The validation error messages in the job agent config
check (used by ValidateConfig via countJobAgentConfigs) omit the "argo_workflow"
option; update both error strings where count == 0 and count > 1 to include
"argo_workflow" in the list of valid options (so the messages read something
like "custom, argocd, argo_workflow, github, terraform_cloud, or test_runner")
so users see the complete set of possible job agent types.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4561988b-ee91-4001-9756-268a88facb57

📥 Commits

Reviewing files that changed from the base of the PR and between fa9753d and abd311a.

📒 Files selected for processing (1)
  • internal/provider/job_agent_resource.go

* adds the ability to configure the argo-workflow job agent

feat: update argo workflow job agent

fix: fix config mapping

fix: lint issues

fix: generate docs

feat: add webhook secret to argoworkflow
* adds webhook_secret to argo workflow job agent config

docs: update docs

feat: add insecure flag for argoworkflow agent
* configure http(s) configs for argoworkflow agent

fix: state mismatch due to null
* fixes constant drift of state due to null return on sensitive params
@mleonidas mleonidas force-pushed the mleonidas/add_argo_workflow_agent branch from abd311a to 1bc8bfc Compare March 31, 2026 16:41
@mleonidas mleonidas merged commit ab1cb9b into main Apr 1, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant