feat(outputs)!: breaking change, add sensitive true to outputs + add tests

outputs.tf

@@ -1,4 +1,5 @@
 output "all" {
   value       = local.secrets
   description = "The final secrets pulled from various sources."
+  sensitive   = true
 }

tests/locals.tftest.hcl

@@ -0,0 +1,81 @@
+mock_provider "sops" {
+  mock_data "sops_file" {
+    defaults = {
+      raw = "db_password: supersecret123\napi_key: test-api-key-456"
+    }
+  }
+}
+
+run "test_empty_secret_mapping" {
+  command = plan
+
+  variables {
+    secret_mapping = []
+  }
+
+  assert {
+    condition = length(local.secrets) == 0
+    error_message = "Empty input should result in empty final secrets"
+  }
+}
+
+run "test_multiple_files_and_secrets" {
+  command = plan
+
+  variables {
+    secret_mapping = [
+      {
+        name = "db_password"
+        type = "sops"
+        file = "database.yaml"
+      },
+      {
+        name = "api_key"
+        type = "sops"
+        file = "api.yaml"
+      },
+      {
+        name = "redis_password"
+        type = "sops"
+        file = "database.yaml"
+      }
+    ]
+  }
+
+  assert {
+    condition = length(local.sops_secret_mapping) == 3
+    error_message = "Should have 3 sops secret mappings"
+  }
+
+  assert {
+    condition = (
+      length(local.sops_files) == 2
+      && contains(local.sops_files, "database.yaml")
+      && contains(local.sops_files, "api.yaml")
+    )
+    error_message = "Should have 2 unique sops files (database.yaml and api.yaml)"
+  }
+
+  assert {
+    condition = length(local.sops_yamls) == 2
+    error_message = "Should have 2 YAML files loaded in sops_yamls"
+  }
+
+  assert {
+    condition = length(local.sops_secrets) == 3
+    error_message = "Should have 3 secrets in sops_secrets map"
+  }
+
+  assert {
+    condition = alltrue([
+      for mapping in local.sops_secret_mapping :
+      contains(keys(local.sops_secrets), mapping.name)
+    ])
+    error_message = "All secret mappings should result in corresponding secret names"
+  }
+
+  assert {
+    condition = length(distinct(keys(local.sops_secrets))) == length(keys(local.sops_secrets))
+    error_message = "All secret keys should be unique"
+  }
+}

tests/outputs.tftest.hcl

@@ -0,0 +1,64 @@
+mock_provider "sops" {
+  mock_data "sops_file" {
+    defaults = {
+      raw = "db_password: supersecret123\napi_key: test-api-key-456\nredis_password: redis-secret-789"
+    }
+  }
+}
+
+run "test_output_structure_and_content" {
+  command = plan
+
+  variables {
+    secret_mapping = [
+      {
+        name = "db_password"
+        type = "sops"
+        file = "database.yaml"
+      },
+      {
+        name = "api_key"
+        type = "sops"
+        file = "api.yaml"
+      }
+    ]
+  }
+
+  assert {
+    condition     = output.all["db_password"] == "supersecret123"
+    error_message = "db_password should have the expected value from mocked SOPS data"
+  }
+
+  assert {
+    condition     = output.all["api_key"] == "test-api-key-456"
+    error_message = "api_key should have the expected value from mocked SOPS data"
+  }
+
+  assert {
+    condition     = !contains(keys(output.all), "redis_password")
+    error_message = "redis_password should not be in the output"
+  }
+
+  assert {
+    condition     = length(output.all) == 2
+    error_message = "Output should contain exactly 2 secrets"
+  }
+}
+
+run "test_output_empty_secrets" {
+  command = plan
+
+  variables {
+    secret_mapping = []
+  }
+
+  assert {
+    condition     = length(output.all) == 0
+    error_message = "Output should be empty when no secrets are configured"
+  }
+
+  assert {
+    condition     = output.all == {}
+    error_message = "Output should be an empty map when no secrets are configured"
+  }
+}