Replace Terraform 1.3.8 with OpenTofu 1.9.1, bump go to 1.24

.github/workflows/rc.yml

@@ -14,7 +14,7 @@ jobs:
           submodules: true
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.22'
+          go-version: '1.24'
       - run: make install_tools
       - name: Extract version name from git branch
         id: version

.github/workflows/release_manual.yml

@@ -15,7 +15,7 @@ jobs:
         submodules: true
     - uses: actions/setup-go@v3
       with:
-        go-version: '1.22'
+        go-version: '1.24'
     - run: make install_tools
     - name: Extract tag name from git ref
       id: tag_name

.github/workflows/release_workflow.yml

@@ -17,7 +17,7 @@ jobs:
         submodules: true
     - uses: actions/setup-go@v3
       with:
-        go-version: '1.22'
+        go-version: '1.24'
     - run: make install_tools
     - name: Extract version from branch name
       id: version

.github/workflows/test.yaml

@@ -8,7 +8,7 @@ jobs:
     name: Test with Go ${{ matrix.go }}
     strategy:
       matrix:
-        go: ["1.21", "1.22", "1.23"]
+        go: ["1.24"]
     steps:
     - uses: actions/checkout@v3
       with:

pkg/engine/policyset.go

@@ -22,7 +22,7 @@ import (
 	"sync"
 
 	"github.com/hashicorp/go-multierror"
-	"github.com/open-policy-agent/opa/ast"
+	"github.com/open-policy-agent/opa/v1/ast"
 	"github.com/snyk/policy-engine/pkg/data"
 	"github.com/snyk/policy-engine/pkg/internal/withtimeout"
 	"github.com/snyk/policy-engine/pkg/metrics"

pkg/hcl_interpreter/data.go

@@ -18,8 +18,8 @@ package hcl_interpreter
 import (
 	"github.com/zclconf/go-cty/cty"
 
-	"github.com/snyk/policy-engine/pkg/internal/terraform/addrs"
-	"github.com/snyk/policy-engine/pkg/internal/terraform/tfdiags"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/addrs"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/tfdiags"
 )
 
 type Data struct {
@@ -51,7 +51,7 @@ func (d UnsupportedOperationDiag) ExtraInfo() interface{} {
 	return nil
 }
 
-func (c *Data) StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable) tfdiags.Diagnostics {
+func (c *Data) StaticValidateReferences(refs []*addrs.Reference, self addrs.Referenceable, source addrs.Referenceable) tfdiags.Diagnostics {
 	return tfdiags.Diagnostics{UnsupportedOperationDiag{}}
 }
 
@@ -86,3 +86,11 @@ func (c *Data) GetTerraformAttr(addrs.TerraformAttr, tfdiags.SourceRange) (cty.V
 func (c *Data) GetInputVariable(v addrs.InputVariable, s tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
 	return cty.UnknownVal(cty.DynamicPseudoType), tfdiags.Diagnostics{UnsupportedOperationDiag{}}
 }
+
+func (c *Data) GetCheckBlock(addr addrs.Check, s tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+	return cty.UnknownVal(cty.DynamicPseudoType), tfdiags.Diagnostics{UnsupportedOperationDiag{}}
+}
+
+func (c *Data) GetOutput(v addrs.OutputValue, s tfdiags.SourceRange) (cty.Value, tfdiags.Diagnostics) {
+	return cty.UnknownVal(cty.DynamicPseudoType), tfdiags.Diagnostics{UnsupportedOperationDiag{}}
+}

pkg/hcl_interpreter/funcs/override.go

@@ -1,7 +1,7 @@
 package funcs
 
 import (
-	"github.com/snyk/policy-engine/pkg/internal/terraform/lang"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/lang"
 	"github.com/spf13/afero"
 	"github.com/zclconf/go-cty/cty/function"
 )

pkg/hcl_interpreter/hcl_interpreter.go

@@ -26,7 +26,7 @@ import (
 	"github.com/snyk/policy-engine/pkg/hcl_interpreter/funcs"
 	"github.com/snyk/policy-engine/pkg/input/schemas"
 	tfschemas "github.com/snyk/policy-engine/pkg/input/schemas/tf"
-	"github.com/snyk/policy-engine/pkg/internal/terraform/lang"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/lang"
 	"github.com/snyk/policy-engine/pkg/models"
 	"github.com/snyk/policy-engine/pkg/topsort"
 )

pkg/hcl_interpreter/moduletree.go

@@ -17,7 +17,7 @@
 package hcl_interpreter
 
 import (
-	"fmt"
+	"errors"
 	"path/filepath"
 	"strings"
 
@@ -27,7 +27,8 @@ import (
 	"github.com/spf13/afero"
 	"github.com/zclconf/go-cty/cty"
 
-	"github.com/snyk/policy-engine/pkg/internal/terraform/configs"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/addrs"
+	"github.com/snyk/policy-engine/pkg/internal/tofu/configs"
 )
 
 type ModuleMeta struct {
@@ -119,27 +120,34 @@ func ParseFiles(
 		diags = append(diags, fDiags...)
 		parsedFiles = append(parsedFiles, f)
 	}
-	module, lDiags := configs.NewModule(parsedFiles, overrideFiles)
+
+	smc := configs.NewStaticModuleCall(addrs.RootModule, nil, dir, "")
+	module, lDiags := configs.NewModule(parsedFiles, overrideFiles, smc, dir, configs.SelectiveLoadAll)
 	diags = append(diags, lDiags...)
 
 	// Deal with varfiles
 	variableValues := map[string]cty.Value{}
 	for _, varfile := range varfiles {
-		values, lDiags := parser.LoadValuesFile(varfile)
-		for k, v := range values {
-			variableValues[k] = v
-		}
+		body, lDiags := parser.LoadHCLFile(varfile)
+		diags = append(diags, lDiags...)
+		attrs, lDiags := body.JustAttributes()
 		diags = append(diags, lDiags...)
+
+		for k, v := range attrs {
+			val, lDiags := v.Expr.Value(nil)
+			diags = append(diags, lDiags...)
+			variableValues[k] = val
+		}
 	}
 
-	errors := []error{}
+	errs := []error{}
 	if diags.HasErrors() {
 		return nil, &multierror.Error{Errors: diags.Errs()}
 	}
 	if module == nil {
 		// Only actually throw an error if we don't have a module.  We can
 		// still try and validate what we can.
-		return nil, fmt.Errorf(diags.Error())
+		return nil, errors.New(diags.Error())
 	}
 
 	children := map[string]*ModuleTree{}
@@ -164,12 +172,12 @@ func ParseFiles(
 
 						child, err := ParseDirectory(moduleRegister, parserFs, childDir, childModuleName, []string{})
 						if err == nil {
-							child.meta.Location = &moduleCall.SourceAddrRange
+							child.meta.Location = moduleCall.Source.Range().Ptr()
 							child.config = moduleCall.Config
 							children[key] = child
 						} else {
-							errors = append(
-								errors,
+							errs = append(
+								errs,
 								SubmoduleLoadingError{key, err},
 							)
 						}
@@ -179,7 +187,7 @@ func ParseFiles(
 		}
 	}
 
-	return &ModuleTree{parserFs, meta, nil, module, variableValues, children, errors}, nil
+	return &ModuleTree{parserFs, meta, nil, module, variableValues, children, errs}, nil
 }
 
 func (mtree *ModuleTree) Errors() []error {

pkg/hcl_interpreter/source_locations.go

@@ -15,6 +15,7 @@
 package hcl_interpreter
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 
@@ -92,7 +93,7 @@ func (node *hclSourceNode) getKey(key string) (*hclSourceNode, error) {
 			},
 		})
 		if diags.HasErrors() {
-			return nil, fmt.Errorf(diags.Error())
+			return nil, errors.New(diags.Error())
 		}
 
 		blocks := bodyContent.Blocks.OfType(key)