feat: the stackorder provider with the stackorder_outputs data source and ephemeral resource

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.go]
+indent_style = tab
+
+[GNUmakefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.github/workflows/ci.yml

@@ -0,0 +1,122 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - run: make lint
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - run: make test
+
+  acceptance:
+    name: acceptance (${{ matrix.cli }} ${{ matrix.version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - cli: terraform
+            version: 1.10.x
+          - cli: terraform
+            version: latest
+          - cli: tofu
+            version: 1.11.x
+          - cli: tofu
+            version: latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - if: matrix.cli == 'terraform'
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: ${{ matrix.version }}
+          terraform_wrapper: false
+      - name: Point the acceptance tests at the installed Terraform
+        if: matrix.cli == 'terraform'
+        run: echo "TF_ACC_TERRAFORM_PATH=$(command -v terraform)" >> "$GITHUB_ENV"
+      - name: Install OpenTofu and point the acceptance tests at it and its registry host
+        if: matrix.cli == 'tofu'
+        uses: opentofu/setup-opentofu@a1320f892987e89d278cc92dc5adc984fb93aca4 # v2.0.2
+        with:
+          tofu_version: ${{ matrix.version }}
+          tofu_wrapper: false
+          provider_acceptance_tests: true
+      - name: Show the CLI the acceptance tests run
+        run: '"$TF_ACC_TERRAFORM_PATH" version'
+      - run: make testacc
+
+  docs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: 1.14.x
+          terraform_wrapper: false
+      - run: go generate ./...
+      - name: Fail when the generated docs or the formatted examples differ from the committed files
+        run: |
+          git diff --exit-code -- docs/ examples/
+          untracked="$(git ls-files --others --exclude-standard -- docs/)"
+          if [ -n "$untracked" ]; then
+            echo "::error::go generate created docs that are not committed"
+            echo "$untracked"
+            exit 1
+          fi
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Build
+        run: go build ./...
+      - name: Cross-compile for macOS on arm64 and Windows on amd64
+        run: |
+          GOOS=darwin GOARCH=arm64 go build -o /dev/null .
+          GOOS=windows GOARCH=amd64 go build -o /dev/null .

.github/workflows/release.yml

@@ -0,0 +1,49 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: stable
+          cache: false
+      - name: Take the release notes from the changelog
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          awk -v version="${TAG#v}" '
+            /^## \[/ { printing = ($0 ~ "^## \\[" version "\\]") }
+            printing && !/^## \[/ && !/^\[[^]]+\]: / { print }
+          ' CHANGELOG.md | sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' > "$RUNNER_TEMP/notes.md"
+          if [ ! -s "$RUNNER_TEMP/notes.md" ]; then
+            echo "::error::CHANGELOG.md has no section for $TAG; add a '## [${TAG#v}]' section, also for a pre-release tag"
+            exit 1
+          fi
+      - name: Check for known vulnerabilities
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
+      - name: Import the signing key
+        id: import_gpg
+        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
+        with:
+          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PASSPHRASE }}
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: v2.18.2
+          args: release --clean --release-notes ${{ runner.temp }}/notes.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.gitignore

@@ -0,0 +1,9 @@
+/terraform-provider-stackorder
+/dist/
+**/.terraform/
+*.tfstate
+*.tfstate.*
+go.work
+go.work.sum
+.DS_Store
+*.tfrc

.golangci.yml

@@ -0,0 +1,51 @@
+version: "2"
+
+run:
+  timeout: 10m
+
+linters:
+  default: standard
+  enable:
+    - bodyclose
+    - copyloopvar
+    - errorlint
+    - gocritic
+    - gosec
+    - misspell
+    - nilerr
+    - noctx
+    - prealloc
+    - revive
+    - sqlclosecheck
+    - unconvert
+    - unparam
+    - usestdlibvars
+  settings:
+    gosec:
+      excludes:
+        - G104
+        - G304
+    revive:
+      rules:
+        - name: exported
+          disabled: true
+        - name: package-comments
+          disabled: true
+  exclusions:
+    generated: lax
+    rules:
+      - path: _test\.go
+        linters:
+          - gosec
+          - noctx
+          - unparam
+          - errorlint
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  settings:
+    goimports:
+      local-prefixes:
+        - github.com/stackorder/terraform-provider-stackorder

.goreleaser.yml

@@ -0,0 +1,89 @@
+version: 2
+
+project_name: terraform-provider-stackorder
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - env:
+      - CGO_ENABLED=0
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    flags:
+      - -trimpath
+    ldflags:
+      - -s -w -X main.version={{ .Version }}
+    goos:
+      - freebsd
+      - windows
+      - linux
+      - darwin
+    goarch:
+      - amd64
+      - "386"
+      - arm
+      - arm64
+      - s390x
+    ignore:
+      - goos: darwin
+        goarch: "386"
+      - goos: darwin
+        goarch: s390x
+      - goos: freebsd
+        goarch: s390x
+      - goos: windows
+        goarch: arm
+      - goos: windows
+        goarch: s390x
+    binary: "{{ .ProjectName }}_v{{ .Version }}"
+
+archives:
+  - formats: [zip]
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
+  algorithm: sha256
+  extra_files:
+    - glob: terraform-registry-manifest.json
+      name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
+
+signs:
+  - artifacts: checksum
+    args:
+      - --batch
+      - --local-user
+      - "{{ .Env.GPG_FINGERPRINT }}"
+      - --output
+      - ${signature}
+      - --detach-sign
+      - ${artifact}
+
+changelog:
+  use: github
+  sort: asc
+  groups:
+    - title: Features
+      regexp: '^feat(\([^)]*\))?:'
+      order: 0
+    - title: Fixes
+      regexp: '^fix(\([^)]*\))?:'
+      order: 1
+    - title: Other
+      order: 999
+  filters:
+    exclude:
+      - '^chore\(deps\)'
+      - '^ci:'
+      - '^test'
+
+release:
+  github:
+    owner: stackorder
+    name: terraform-provider-stackorder
+  extra_files:
+    - glob: terraform-registry-manifest.json
+      name_template: "{{ .ProjectName }}_{{ .Version }}_manifest.json"
+  draft: false
+  prerelease: auto

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this provider are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow [Semantic Versioning](https://semver.org/). Each `vX.Y.Z` tag publishes signed archives for the Terraform and OpenTofu registries. A tag takes its release notes from the section of its version, so a pre-release tag such as `v0.1.0-rc.1` needs a section of its own.
+
+## [Unreleased]
+
+It needs Stackorder 0.4.0 or later on the server and in the CLI, the first release to serve shared outputs.
+
+### Added
+
+- The `stackorder` provider for Terraform and OpenTofu, at `registry.terraform.io/stackorder/stackorder` on plugin protocol 6. It reads the outputs another stack shares through the [Stackorder](https://github.com/stackorder/stackorder) server, so a stack needs no access to the state of the stacks it reads. `server_url`, `api_key`, `repository` and `oidc_audience` are optional and fall back to `STACKORDER_SERVER_URL`, `STACKORDER_API_KEY`, `STACKORDER_REPOSITORY` (then `GITHUB_REPOSITORY`) and `STACKORDER_OIDC_AUDIENCE`.
+- The `stackorder_outputs` data source: `stack` names the producer as `path`, `path:instance` or `owner/repo//key`, `values` holds every output the producer serves and is sensitive, `nonsensitive_values` holds the outputs not marked sensitive, and a warning names the sensitive outputs the producer withholds. Each refusal of the server gets its own error, which says what to check or change.
+- The `stackorder_outputs` ephemeral resource, with the same `stack`, `values` and `nonsensitive_values`, which Terraform never writes to the plan file or state. It needs Terraform 1.10 or OpenTofu 1.11 or later.
+- Credentials: inside a Stackorder plan, apply or drift job, a fresh GitHub Actions ID token for every request, bound to the reading stack through `STACKORDER_RUN_ID` and `STACKORDER_STACK`; elsewhere, an API key from `api_key` or `STACKORDER_API_KEY`. Where an ID token can be requested, a configured API key is ignored, so an admin key never replaces the job's own identity.
+
+[Unreleased]: https://github.com/stackorder/terraform-provider-stackorder/commits/main

GNUmakefile

@@ -0,0 +1,37 @@
+SHELL := /bin/bash
+
+BINARY := terraform-provider-stackorder
+GOLANGCI_LINT_VERSION ?= v2.14.0
+
+.PHONY: all build test testacc lint fmt generate docs-check tidy
+
+all: build
+
+build:
+	go build -o $(BINARY)
+
+test:
+	go test -race -count=1 ./...
+
+testacc:
+	TF_ACC=1 go test -count=1 -run 'TestAcc' ./internal/provider/... -timeout 20m
+
+lint:
+	@out=$$(gofmt -s -l .) || exit 1; \
+	if [ -n "$$out" ]; then echo "gofmt needed:"; echo "$$out"; exit 1; fi
+	go vet ./...
+	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run
+
+fmt:
+	gofmt -s -w .
+
+generate:
+	go generate ./...
+
+docs-check: generate
+	@git diff --exit-code HEAD -- docs/ examples/ || { echo "docs/ or examples/ differ from the last commit: run make generate and commit the result"; exit 1; }
+	@untracked=$$(git ls-files --others --exclude-standard docs/); \
+	if [ -n "$$untracked" ]; then echo "docs/ has files that are not committed:"; echo "$$untracked"; exit 1; fi
+
+tidy:
+	go mod tidy