feat(outputs)!: breaking change, add sensitive true to outputs + add tests

[westonplatter]

what

• add basic tests for locals.tf and main.tf
• while adding tests, I needed to updated the outputs.tf to include sensitive true.

why

tests/main.tftest.hcl... fail
  run "test_data_resource_creation_single_file"... fail
╷
│ Error: Output refers to sensitive values
│ 
│   on outputs.tf line 1:
│    1: output "all" {
│ 
│ To reduce the risk of accidentally exporting sensitive data that was intended to be only internal, OpenTofu requires that any root module output containing sensitive
│ data be explicitly marked as sensitive, to confirm your intent.
│ 
│ If you do intend to export this data, annotate the output value as sensitive by adding the following argument:
│     sensitive = true

Impacts

For any downstream root modules using this child module, they'd need to also used sensitive = true when accessing the values. In the examples/complete/outputs.tf file, we already do this, but I think this would be a breaking change?

[oycyc]

Simple + straightforward!

[Gowiem]

Couple questions, but I like that we're circling back to this module to add tests since we do use it a good bit!

[Gowiem]

You call this out as a breaking change in the PR title, but I'm not sure it is. Mind sharing why you're considering this a breaking change? It changes the output of this module, but I would just call that a feature enhancement, not a breaking change.

[westonplatter]

I am expecting that adding sensitive = true requires downstream child or root modules then also mark the output as sensitive. My practical concern is that users would need to make a code change on their end in order to get terraform plan/applies to run.

For example, https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables#reference-sensitive-variables

[gberenice]

Hmm, this is interesting. I wasn't aware of this behaviour, but we have to treat this as a breaking change indeed.

@westonplatter could you please rename a PR title to reflect this: feat(outputs)!: add sensitive true to outputs + add tests), so release-please correctly generates the release.
Also, we should ensure that this is described in the release notes.

[Gowiem]

@westonplatter good thinking in terms of this breaking downstream outputs, you're obviously right that this is a breaking change 💯 👍