Add tflint.ErrSensitive

plugin/fromproto/fromproto.go

@@ -248,6 +248,8 @@ func Error(err error) error {
 			return fmt.Errorf("%s%w", st.Message(), tflint.ErrNullValue)
 		case proto.ErrorCode_ERROR_CODE_UNEVALUABLE:
 			return fmt.Errorf("%s%w", st.Message(), tflint.ErrUnevaluable)
+		case proto.ErrorCode_ERROR_CODE_SENSITIVE:
+			return fmt.Errorf("%s%w", st.Message(), tflint.ErrSensitive)
 		}
 	}
 

plugin/plugin2host/client.go

@@ -262,7 +262,7 @@ func (*GRPCClient) EnsureNoError(err error, proc func() error) error {
 		return proc()
 	}
 
-	if errors.Is(err, tflint.ErrUnevaluable) || errors.Is(err, tflint.ErrNullValue) || errors.Is(err, tflint.ErrUnknownValue) {
+	if errors.Is(err, tflint.ErrUnevaluable) || errors.Is(err, tflint.ErrNullValue) || errors.Is(err, tflint.ErrUnknownValue) || errors.Is(err, tflint.ErrSensitive) {
 		return nil
 	}
 	return err

plugin/plugin2host/plugin2host_test.go

@@ -1383,6 +1383,19 @@ func TestEvaluateExpr(t *testing.T) {
 				return !errors.Is(err, tflint.ErrUnevaluable)
 			},
 		},
+		{
+			Name:       "server returns a sensitive error",
+			Expr:       hclExpr(`1`),
+			TargetType: reflect.TypeOf(0),
+			ServerImpl: func(hcl.Expression, tflint.EvaluateExprOption) (cty.Value, error) {
+				return cty.Value{}, fmt.Errorf("sensitive%w", tflint.ErrSensitive)
+			},
+			Want:        0,
+			GetFileImpl: fileExists,
+			ErrCheck: func(err error) bool {
+				return !errors.Is(err, tflint.ErrSensitive)
+			},
+		},
 	}
 
 	for _, test := range tests {

plugin/proto/tflint.proto

@@ -231,6 +231,7 @@ enum ErrorCode {
     ERROR_CODE_UNKNOWN_VALUE = 1;
     ERROR_CODE_NULL_VALUE = 2;
     ERROR_CODE_UNEVALUABLE = 3;
+    ERROR_CODE_SENSITIVE = 4;
 }
 
 message ErrorDetail {

plugin/toproto/toproto.go

@@ -186,6 +186,8 @@ func Error(code codes.Code, err error) error {
 		errCode = proto.ErrorCode_ERROR_CODE_NULL_VALUE
 	} else if errors.Is(err, tflint.ErrUnevaluable) {
 		errCode = proto.ErrorCode_ERROR_CODE_UNEVALUABLE
+	} else if errors.Is(err, tflint.ErrSensitive) {
+		errCode = proto.ErrorCode_ERROR_CODE_SENSITIVE
 	}
 
 	if errCode == proto.ErrorCode_ERROR_CODE_UNSPECIFIED {

tflint/errors.go

@@ -14,4 +14,6 @@ var (
 	ErrNullValue = errors.New("")
 	// ErrUnevaluable is an error when a received expression has unevaluable references.
 	ErrUnevaluable = errors.New("")
+	// ErrSensitive is an error when a received expression contains a sensitive value.
+	ErrSensitive = errors.New("")
 )