Feature/enforced provisioner#13591
Merged
hariom-hashicorp merged 20 commits intomainfrom Apr 17, 2026
Merged
Conversation
|
|
There was a problem hiding this comment.
Pull request overview
This PR adds support for fetching “enforced provisioner blocks” from HCP Packer and automatically injecting their provisioners into local Packer builds (JSON and HCL2), with an opt-out --skip-enforcement flag.
Changes:
- Add HCP API/client + registry plumbing to fetch enforced blocks and parse their provisioner content.
- Implement enforced provisioner parsing (HCL/JSON/legacy JSON) and injection into both JSON and HCL2 build flows.
- Add CLI flag and supporting utilities to prepare injected provisioners after builds are already prepared.
Reviewed changes
Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| packer/provisioner.go | Adds a shared wrapper helper for pause/timeout/retry behavior around provisioners. |
| packer/core.go | Adds support to build a legacy JSON CoreBuildProvisioner from an enforced HCL body/config. |
| packer/build.go | Refactors provisioner preparation and adds PrepareProvisioners for post-prepare injection. |
| internal/hcp/registry/types.bucket.go | Adds EnforcedBlock model + bucket method to fetch enforced blocks from HCP. |
| internal/hcp/registry/types.bucket_enforced_test.go | Tests fetching enforced blocks from the mocked HCP client. |
| internal/hcp/registry/registry.go | Extends the registry interface with enforced-block fetch + injection APIs. |
| internal/hcp/registry/null_registry.go | Implements no-op enforced-block methods for the null registry. |
| internal/hcp/registry/json.go | Implements enforced provisioner parsing + injection for legacy JSON templates. |
| internal/hcp/registry/json_enforced_test.go | Tests JSON injection behavior (override + only/except) and preparation of injected provisioners. |
| internal/hcp/registry/hcl.go | Implements enforced provisioner injection for HCL2 templates. |
| internal/hcp/api/service_enforced_provisioner.go | Adds HCP API client methods for enforced block CRUD + “by bucket” fetch. |
| internal/hcp/api/mock_service.go | Extends mock HCP service with enforced-block endpoints for tests. |
| internal/enforcedparser/parser.go | Introduces parsing of enforced block content into neutral provisioner blocks (HCL/JSON/legacy JSON). |
| internal/enforcedparser/parser_test.go | Adds parser test coverage for supported formats and options. |
| hcl2template/types.hcl_provisioner.go | Adjusts eval-context variable merging behavior in HCL2 provisioner preparation. |
| hcl2template/enforced_provisioner.go | Adds conversion from enforced provisioner blocks to CoreBuildProvisioner using HCL semantics. |
| hcl2template/enforced_provisioner_test.go | Adds tests for enforced provisioner conversion + override handling. |
| command/cli.go | Adds --skip-enforcement flag to the build command args. |
| command/build.go | Fetches enforced blocks and injects enforced provisioners into builds during packer build. |
| go.mod | Updates dependencies and adds a replace to an internal HCP SDK module to access enforced-block types. |
| go.sum | Updates checksums for updated dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
anurag5sh
reviewed
Apr 9, 2026
anurag5sh
reviewed
Apr 14, 2026
- Updated ParseProvisionerBlocks to handle both HCL and JSON syntax, including legacy JSON format. - Added comprehensive test cases for JSON provisioner parsing. - Improved ExtractBuildProvisionerHCL to merge inline commands from shell provisioners. - Enhanced logging for enforced block operations in HCP Packer.
- Update error handling in FetchEnforcedBlocks to return detailed errors instead of warnings. - Modify GetCoreBuildProvisionerFromBlock to accept build name for overrides. - Add tests for FetchEnforcedBlocks to ensure correct behavior and error handling. - Implement diagnostics for unsupported legacy JSON templates.
- Introduced a new package `enforcedparser` to handle parsing of enforced provisioner blocks from HCL and JSON formats. - Refactored existing code to utilize the new `ParseProvisionerBlocks` function from the `enforcedparser` package. - Updated `GetCoreBuildProvisionerFromEnforcedBlock` method to convert enforced provisioner blocks into core build provisioners. - Enhanced error handling and logging during the parsing process. - Added tests for the new parsing functionality and ensured existing tests were updated to reflect changes. - Modified `InjectEnforcedProvisioners` method in JSON registry to utilize the new parsing logic.
…e tests, and streamline API interactions
…binations and expand test coverage
hariom-hashicorp
force-pushed
the
feature/enforcedProvisioner
branch
from
6db0e6a to
9e28996
Compare
…plugin-sdk versions, adjust syft version, and update OpenTelemetry packages
…f json_enforced_test.go
…p and streamline registry initialization
anurag5sh
approved these changes
Apr 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add HCP enforced provisioners to local Packer builds: fetch enforced blocks from HCP and inject their provisioners into matching builds.
Why
Ensure baseline security/compliance provisioning is applied consistently without relying on template authors.
What changed
Fetch and parse enforced blocks during build
Inject provisioners respecting only/except
Clear errors for invalid block content
--skip-enforcement to bypass injection
Impact
No change when no enforced blocks exist; otherwise enforced provisioners apply automatically unless skipped.
Description
What code changed, and why?
Resolved Issues
If your PR resolves any open issue(s), please indicate them like this so they
will be closed when your PR is merged:
Closes #xxx
Closes #xxx
Rollback Plan
If a change needs to be reverted, we will roll out an update to the code within
7 days.
Changes to Security Controls
Are there any changes to security controls (access controls, encryption, logging)
in this pull request? If so, explain.