Backport of ephemeral fixes into v1.14

.changes/v1.14/BUG FIXES-20251024-164434.yaml

@@ -0,0 +1,5 @@
+kind: BUG FIXES
+body: 'test: allow ephemeral outputs in root modules'
+time: 2025-10-24T16:44:34.197847+02:00
+custom:
+    Issue: "37813"

internal/command/test_test.go

@@ -409,6 +409,12 @@ func TestTest_Runs(t *testing.T) {
 			expectedOut: []string{"3 passed, 0 failed."},
 			code:        0,
 		},
+		"ephemeral_output": {
+			code: 0,
+		},
+		"ephemeral_output_referenced": {
+			code: 0,
+		},
 		"no-tests": {
 			code: 0,
 		},
@@ -3998,7 +4004,6 @@ Error: Test assertion failed
   on main.tftest.hcl line 8, in run "first":
    8:     condition     = test_resource.resource.value == output.null_output
     ├────────────────
-    │ Warning: LHS and RHS values are of different types
     │ Diff:
     │ --- actual
     │ +++ expected
@@ -4051,6 +4056,7 @@ Error: Unknown condition value
    8:     condition = output.destroy_fail == run.one.destroy_fail
     ├────────────────
     │ output.destroy_fail is false
+    │ run.one.destroy_fail is a bool
 
 Condition expression could not be evaluated at this time. This means you have
 executed a %s block with %s and one of the values your

internal/command/testdata/test/ephemeral_output/main.tf

@@ -0,0 +1,8 @@
+variable "foo" {
+    ephemeral = true
+    type = string
+}
+output "value" {
+  value = var.foo
+  ephemeral = true
+}

internal/command/testdata/test/ephemeral_output/main.tftest.hcl

@@ -0,0 +1,5 @@
+run "validate_ephemeral_input" {
+  variables {
+    foo = "whaaat"
+  }
+}

internal/command/testdata/test/ephemeral_output_referenced/main.tf

@@ -0,0 +1,8 @@
+variable "foo" {
+    ephemeral = true
+    type = string
+}
+output "value" {
+  value = var.foo
+  ephemeral = true
+}

internal/command/testdata/test/ephemeral_output_referenced/main.tftest.hcl

@@ -0,0 +1,20 @@
+run "validate_ephemeral_output_plan" {
+  command = plan
+  variables {
+    foo = "whaaat"
+  }
+  assert {
+    condition = output.value == "whaaat"
+    error_message = "wrong value"
+  }
+}
+run "validate_ephemeral_output_apply" {
+  command = apply
+  variables {
+    foo = "whaaat"
+  }
+  assert {
+    condition = output.value == "whaaat"
+    error_message = "wrong value"
+  }
+}

internal/configs/config.go

@@ -1039,6 +1039,9 @@ func (c *Config) EffectiveRequiredProviderConfigs() addrs.Map[addrs.RootProvider
 	for _, rc := range c.Module.Actions {
 		maybePutLocal(rc.ProviderConfigAddr(), false)
 	}
+	for _, rc := range c.Module.EphemeralResources {
+		maybePutLocal(rc.ProviderConfigAddr(), false)
+	}
 	for _, ic := range c.Module.Import {
 		if ic.ProviderConfigRef != nil {
 			maybePutLocal(addrs.LocalProviderConfig{

internal/moduletest/graph/apply.go

@@ -154,8 +154,9 @@ func apply(tfCtx *terraform.Context, run *configs.TestRun, module *configs.Confi
 	}
 
 	applyOpts := &terraform.ApplyOpts{
-		SetVariables:      ephemeralVariables,
-		ExternalProviders: providers,
+		SetVariables:              ephemeralVariables,
+		ExternalProviders:         providers,
+		AllowRootEphemeralOutputs: true,
 	}
 
 	waiter.update(tfCtx, progress, created)

internal/moduletest/graph/node_state_cleanup.go

@@ -126,13 +126,14 @@ func (n *NodeStateCleanup) restore(ctx *EvalContext, file *configs.TestFile, run
 	setVariables, _, _ := FilterVariablesToModule(module, variables)
 
 	planOpts := &terraform.PlanOpts{
-		Mode:                   plans.NormalMode,
-		SetVariables:           setVariables,
-		Overrides:              mocking.PackageOverrides(run, file, mocks),
-		ExternalProviders:      providers,
-		SkipRefresh:            true,
-		OverridePreventDestroy: true,
-		DeferralAllowed:        ctx.deferralAllowed,
+		Mode:                      plans.NormalMode,
+		SetVariables:              setVariables,
+		Overrides:                 mocking.PackageOverrides(run, file, mocks),
+		ExternalProviders:         providers,
+		SkipRefresh:               true,
+		OverridePreventDestroy:    true,
+		DeferralAllowed:           ctx.deferralAllowed,
+		AllowRootEphemeralOutputs: true,
 	}
 
 	tfCtx, _ := terraform.NewContext(n.opts.ContextOpts)
@@ -177,13 +178,14 @@ func (n *NodeStateCleanup) destroy(ctx *EvalContext, file *configs.TestFile, run
 	setVariables, _, _ := FilterVariablesToModule(module, variables)
 
 	planOpts := &terraform.PlanOpts{
-		Mode:                   plans.DestroyMode,
-		SetVariables:           setVariables,
-		Overrides:              mocking.PackageOverrides(run, file, mocks),
-		ExternalProviders:      providers,
-		SkipRefresh:            true,
-		OverridePreventDestroy: true,
-		DeferralAllowed:        ctx.deferralAllowed,
+		Mode:                      plans.DestroyMode,
+		SetVariables:              setVariables,
+		Overrides:                 mocking.PackageOverrides(run, file, mocks),
+		ExternalProviders:         providers,
+		SkipRefresh:               true,
+		OverridePreventDestroy:    true,
+		DeferralAllowed:           ctx.deferralAllowed,
+		AllowRootEphemeralOutputs: true,
 	}
 
 	tfCtx, _ := terraform.NewContext(n.opts.ContextOpts)

internal/moduletest/graph/node_test_run.go

@@ -193,7 +193,8 @@ func (n *NodeTestRun) testValidate(providers map[addrs.RootProviderConfig]provid
 	}
 	waiter.update(tfCtx, moduletest.Running, nil)
 	validateDiags := tfCtx.Validate(config, &terraform.ValidateOpts{
-		ExternalProviders: providers,
+		ExternalProviders:         providers,
+		AllowRootEphemeralOutputs: true,
 	})
 	run.Diagnostics = run.Diagnostics.Append(validateDiags)
 	if validateDiags.HasErrors() {

internal/moduletest/graph/plan.go

@@ -127,14 +127,15 @@ func plan(ctx *EvalContext, tfCtx *terraform.Context, file *configs.TestFile, ru
 				return plans.NormalMode
 			}
 		}(),
-		Targets:            targets,
-		ForceReplace:       replaces,
-		SkipRefresh:        !run.Options.Refresh,
-		SetVariables:       variables,
-		ExternalReferences: references,
-		ExternalProviders:  providers,
-		Overrides:          mocking.PackageOverrides(run, file, mocks),
-		DeferralAllowed:    ctx.deferralAllowed,
+		Targets:                   targets,
+		ForceReplace:              replaces,
+		SkipRefresh:               !run.Options.Refresh,
+		SetVariables:              variables,
+		ExternalReferences:        references,
+		ExternalProviders:         providers,
+		Overrides:                 mocking.PackageOverrides(run, file, mocks),
+		DeferralAllowed:           ctx.deferralAllowed,
+		AllowRootEphemeralOutputs: true,
 	}
 
 	waiter.update(tfCtx, moduletest.Running, nil)

internal/stacks/stackruntime/apply_test.go

@@ -64,6 +64,7 @@ func TestApply(t *testing.T) {
 
 	tcs := map[string]struct {
 		path   string
+		skip   bool
 		state  *stackstate.State
 		store  *stacks_testing_provider.ResourceStore
 		cycles []TestCycle
@@ -2229,10 +2230,78 @@ After applying this plan, Terraform will no longer manage these objects. You wil
 				},
 			},
 		},
+		"ephemeral-module-outputs": {
+			path: "ephemeral-module-output",
+			skip: true, // TODO(issues/37822): Enable this.
+			cycles: []TestCycle{
+				{
+					wantPlannedChanges: []stackplan.PlannedChange{
+						&stackplan.PlannedChangeApplyable{
+							Applyable: true,
+						},
+						&stackplan.PlannedChangeComponentInstance{
+							Addr:                mustAbsComponentInstance("component.ephemeral_in"),
+							PlanApplyable:       false,
+							PlanComplete:        true,
+							Action:              plans.Create,
+							RequiredComponents:  collections.NewSet(mustAbsComponent("component.ephemeral_out")),
+							PlannedInputValues:  make(map[string]plans.DynamicValue),
+							PlannedOutputValues: make(map[string]cty.Value),
+							PlannedCheckResults: new(states.CheckResults),
+							PlanTimestamp:       fakePlanTimestamp,
+						},
+						&stackplan.PlannedChangeComponentInstance{
+							Addr:               mustAbsComponentInstance("component.ephemeral_out"),
+							PlanApplyable:      false,
+							PlanComplete:       true,
+							Action:             plans.Create,
+							PlannedInputValues: make(map[string]plans.DynamicValue),
+							PlannedOutputValues: map[string]cty.Value{
+								"value": cty.DynamicVal, // ephemeral
+							},
+							PlannedCheckResults: new(states.CheckResults),
+							PlanTimestamp:       fakePlanTimestamp,
+						},
+						&stackplan.PlannedChangeHeader{
+							TerraformVersion: version.SemVer,
+						},
+						&stackplan.PlannedChangePlannedTimestamp{
+							PlannedTimestamp: fakePlanTimestamp,
+						},
+					},
+					wantAppliedChanges: []stackstate.AppliedChange{
+						&stackstate.AppliedChangeComponentInstance{
+							ComponentAddr:         mustAbsComponent("component.ephemeral_in"),
+							ComponentInstanceAddr: mustAbsComponentInstance("component.ephemeral_in"),
+							Dependencies: collections.NewSet[stackaddrs.AbsComponent](
+								mustAbsComponent("component.ephemeral_out"),
+							),
+							OutputValues: make(map[addrs.OutputValue]cty.Value),
+							InputVariables: map[addrs.InputVariable]cty.Value{
+								mustInputVariable("input"): cty.UnknownVal(cty.String), // ephemeral
+							},
+						},
+						&stackstate.AppliedChangeComponentInstance{
+							ComponentAddr:         mustAbsComponent("component.ephemeral_out"),
+							ComponentInstanceAddr: mustAbsComponentInstance("component.ephemeral_out"),
+							Dependents: collections.NewSet[stackaddrs.AbsComponent](
+								mustAbsComponent("component.ephemeral_in"),
+							),
+							OutputValues:   make(map[addrs.OutputValue]cty.Value),
+							InputVariables: make(map[addrs.InputVariable]cty.Value),
+						},
+					},
+				},
+			},
+		},
 	}
 
 	for name, tc := range tcs {
 		t.Run(name, func(t *testing.T) {
+			if tc.skip {
+				t.Skip()
+			}
+
 			ctx := context.Background()
 
 			lock := depsfile.NewLocks()

internal/stacks/stackruntime/internal/stackeval/applying.go

@@ -228,7 +228,8 @@ func ApplyComponentPlan(ctx context.Context, main *Main, plan *plans.Plan, requi
 		// of either "modifiedPlan" or "plan" (since they share lots of the same
 		// pointers to mutable objects and so both can get modified together.)
 		newState, moreDiags = tfCtx.Apply(plan, moduleTree, &terraform.ApplyOpts{
-			ExternalProviders: providerClients,
+			ExternalProviders:         providerClients,
+			AllowRootEphemeralOutputs: false, // TODO(issues/37822): Enable this.
 		})
 		diags = diags.Append(moreDiags)
 	} else {

internal/stacks/stackruntime/internal/stackeval/component_config.go

@@ -378,7 +378,8 @@ func (c *ComponentConfig) checkValid(ctx context.Context, phase EvalPhase) tfdia
 		}()
 
 		diags = diags.Append(tfCtx.Validate(moduleTree, &terraform.ValidateOpts{
-			ExternalProviders: providerClients,
+			ExternalProviders:         providerClients,
+			AllowRootEphemeralOutputs: false, // TODO(issues/37822): Enable this.
 		}))
 		return diags, nil
 	})

internal/stacks/stackruntime/internal/stackeval/component_instance.go

@@ -171,6 +171,8 @@ func (c *ComponentInstance) PlanOpts(ctx context.Context, mode plans.Mode, skipR
 		ExternalProviders:          providerClients,
 		ExternalDependencyDeferred: c.deferred,
 		DeferralAllowed:            true,
+		AllowRootEphemeralOutputs:  false, // TODO(issues/37822): Enable this.
+
 		// We want the same plantimestamp between all components and the stacks language
 		ForcePlanTimestamp: &plantimestamp,
 	}, nil

internal/stacks/stackruntime/internal/stackeval/removed_component_config.go

@@ -196,7 +196,8 @@ func (r *RemovedComponentConfig) CheckValid(ctx context.Context, phase EvalPhase
 		}()
 
 		diags = diags.Append(tfCtx.Validate(moduleTree, &terraform.ValidateOpts{
-			ExternalProviders: providerClients,
+			ExternalProviders:         providerClients,
+			AllowRootEphemeralOutputs: false, // TODO(issues/37822): Enable this.
 		}))
 		return diags, nil
 	})

internal/stacks/stackruntime/internal/stackeval/removed_component_instance.go

@@ -135,6 +135,7 @@ func (r *RemovedComponentInstance) ModuleTreePlan(ctx context.Context) (*plans.P
 			DeferralAllowed:            true,
 			ExternalDependencyDeferred: deferred,
 			Forget:                     forget,
+			AllowRootEphemeralOutputs:  false, // TODO(issues/37822): Enable this.
 
 			// We want the same plantimestamp between all components and the stacks language
 			ForcePlanTimestamp: &plantimestamp,

internal/stacks/stackruntime/testdata/mainbundle/test/ephemeral-module-output/ephemeral-input/ephemeral-input.tf

@@ -0,0 +1,10 @@
+
+variable "input" {
+  type = string
+  ephemeral = true
+}
+
+resource "testing_write_only_resource" "resource" {
+  id = "8453e0fa5aa2"
+  write_only = var.input
+}

internal/stacks/stackruntime/testdata/mainbundle/test/ephemeral-module-output/ephemeral-module-output.tfcomponent.hcl

@@ -0,0 +1,28 @@
+required_providers {
+  testing = {
+    source  = "hashicorp/testing"
+    version = "0.1.0"
+  }
+}
+
+provider "testing" "main" {}
+
+component "ephemeral_out" {
+  source = "./ephemeral-output"
+
+  providers = {
+    testing = provider.testing.main
+  }
+}
+
+component "ephemeral_in" {
+  source = "./ephemeral-input"
+
+  providers = {
+    testing = provider.testing.main
+  }
+
+  inputs = {
+    input = component.ephemeral_out.value
+  }
+}

internal/stacks/stackruntime/testdata/mainbundle/test/ephemeral-module-output/ephemeral-output/ephemeral-output.tf

@@ -0,0 +1,7 @@
+
+ephemeral "testing_resource" "resource" {}
+
+output "value" {
+  value = ephemeral.testing_resource.resource.value
+  ephemeral = true
+}