Add OpenTofu exclude parameter support

.github/actionlint.yaml

@@ -30,10 +30,13 @@ paths:
       - 'property "git_https" is not defined in object type'
       - 'property "awkward_.*" is not defined in object type'
       - 'property "word" is not defined in object type'
-  .github/workflows/test-target-replace.yaml:
+  .github/workflows/test-target-replace-exclude.yaml:
     ignore:
       - 'property "count" is not defined in object type'
       - 'property "foreach" is not defined in object type'
+      - 'property "keep_me" is not defined in object type'
+      - 'property "exclude_me" is not defined in object type'
+      - 'property "also_exclude" is not defined in object type'
   .github/workflows/release.yaml:
     ignore:
       - 'Useless cat.'

.github/workflows/test-target-replace.yaml → .github/workflows/test-target-replace-exclude.yaml

@@ -1,4 +1,4 @@
-name: Test actions using target and replace
+name: Test actions using target, replace, and exclude
 
 on:
   - pull_request
@@ -27,7 +27,7 @@ jobs:
         id: plan
         with:
           label: test-target-replace plan_targeting
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.notpresent
           variables: |
@@ -46,7 +46,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-first-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
           variables: |
@@ -65,7 +65,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-first-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
           variables: |
@@ -84,7 +84,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-second-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           variables: |
@@ -103,7 +103,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-second-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           variables: |
@@ -129,7 +129,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-third-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
             random_string.foreach["hello"]
@@ -158,7 +158,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-targeted-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           replace: |
@@ -180,7 +180,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-targeted-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           replace: |
@@ -210,7 +210,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           replace: |
             random_string.foreach["hello"]
             random_string.count[0]
@@ -230,7 +230,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           replace: |
             random_string.foreach["hello"]
             random_string.count[0]
@@ -268,7 +268,7 @@ jobs:
 
       - name: Setup remote backend
         run: |
-          cat >tests/workflows/test-target-replace/backend.tf <<EOF
+          cat >tests/workflows/test-target-replace-exclude/backend.tf <<EOF
           terraform {
             backend "remote" {
               organization = "flooktech"
@@ -284,7 +284,7 @@ jobs:
       - name: Create test workspace
         uses: ./terraform-new-workspace
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           workspace: ${{ github.head_ref }}
           backend_config: token=${{ secrets.TF_API_TOKEN }}
 
@@ -293,7 +293,7 @@ jobs:
         id: plan
         with:
           label: test-target-replace remote_plan_targeting
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.notpresent
           variables: |
@@ -314,7 +314,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-first-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
           variables: |
@@ -335,7 +335,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-first-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
           variables: |
@@ -356,7 +356,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-second-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           variables: |
@@ -377,7 +377,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-second-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           variables: |
@@ -405,7 +405,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-third-change
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.count[0]
             random_string.foreach["hello"]
@@ -436,7 +436,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-targeted-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           replace: |
@@ -460,7 +460,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-targeted-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           target: |
             random_string.foreach["hello"]
           replace: |
@@ -492,7 +492,7 @@ jobs:
         uses: ./terraform-plan
         id: plan-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           replace: |
             random_string.foreach["hello"]
             random_string.count[0]
@@ -514,7 +514,7 @@ jobs:
         uses: ./terraform-apply
         id: apply-replacement
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           replace: |
             random_string.foreach["hello"]
             random_string.count[0]
@@ -543,8 +543,131 @@ jobs:
       - name: Destroy the workspace
         uses: ./terraform-destroy-workspace
         with:
-          path: tests/workflows/test-target-replace
+          path: tests/workflows/test-target-replace-exclude
           workspace: ${{ github.head_ref }}
           variables: |
             length = 10
           backend_config: token=${{ secrets.TF_API_TOKEN }}
+
+  tofu_exclude_testing:
+    runs-on: ubuntu-24.04
+    name: OpenTofu exclude testing
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Plan excluding resources
+        uses: ./tofu-plan
+        id: plan-exclude
+        with:
+          label: test-exclude tofu_exclude_testing
+          path: tests/workflows/test-target-replace-exclude
+          exclude: |
+            random_string.exclude_me
+            random_string.also_exclude
+          variables: |
+            length = 5
+
+      - name: Verify exclude plan outputs
+        env:
+          CHANGES: ${{ steps.plan-exclude.outputs.changes }}
+        run: |
+          if [[ "$CHANGES" != "true" ]]; then
+            echo "::error:: Exclude plan should have changes for non-excluded resources"
+            exit 1
+          fi
+
+      - name: Apply excluding resources
+        uses: ./tofu-apply
+        id: apply-exclude
+        with:
+          label: test-exclude tofu_exclude_testing
+          path: tests/workflows/test-target-replace-exclude
+          exclude: |
+            random_string.exclude_me
+            random_string.also_exclude
+          variables: |
+            length = 5
+
+      - name: Verify exclude apply outputs
+        env:
+          COUNT: ${{ steps.apply-exclude.outputs.count }}
+          FOREACH: ${{ steps.apply-exclude.outputs.foreach }}
+          KEEP_ME: ${{ steps.apply-exclude.outputs.keep_me }}
+          EXCLUDE_ME: ${{ steps.apply-exclude.outputs.exclude_me }}
+          ALSO_EXCLUDE: ${{ steps.apply-exclude.outputs.also_exclude }}
+        run: |
+          # Should have created non-excluded resources
+          if [[ "$COUNT" == "" ]]; then
+            echo "::error:: count output should be set (resource not excluded)"
+            exit 1
+          fi
+          if [[ "$FOREACH" == "" ]]; then
+            echo "::error:: foreach output should be set (resource not excluded)"
+            exit 1
+          fi
+          if [[ "$KEEP_ME" == "" ]]; then
+            echo "::error:: keep_me output should be set (resource not excluded)"
+            exit 1
+          fi
+
+          # Should NOT have created excluded resources
+          if [[ "$EXCLUDE_ME" != "" ]]; then
+            echo "::error:: exclude_me output should be empty (resource excluded)"
+            exit 1
+          fi
+          if [[ "$ALSO_EXCLUDE" != "" ]]; then
+            echo "::error:: also_exclude output should be empty (resource excluded)"
+            exit 1
+          fi
+
+      - name: Plan excluding resources without label
+        uses: ./tofu-plan
+        id: plan-exclude-no-label
+        with:
+          path: tests/workflows/test-target-replace-exclude
+          exclude: |
+            random_string.exclude_me
+          variables: |
+            length = 8
+
+      - name: Verify exclude plan without label
+        env:
+          CHANGES: ${{ steps.plan-exclude-no-label.outputs.changes }}
+        run: |
+          if [[ "$CHANGES" != "true" ]]; then
+            echo "::error:: Exclude plan without label should have changes for non-excluded resources"
+            exit 1
+          fi
+
+      - name: Apply excluding resources without label
+        uses: ./tofu-apply
+        id: apply-exclude-no-label
+        with:
+          path: tests/workflows/test-target-replace-exclude
+          exclude: |
+            random_string.exclude_me
+          variables: |
+            length = 8
+
+      - name: Verify exclude apply without label
+        env:
+          EXCLUDE_ME: ${{ steps.apply-exclude-no-label.outputs.exclude_me }}
+          KEEP_ME: ${{ steps.apply-exclude-no-label.outputs.keep_me }}
+        run: |
+          # Should NOT have created excluded resource
+          if [[ "$EXCLUDE_ME" != "" ]]; then
+            echo "::error:: exclude_me output should be empty (resource excluded without label)"
+            exit 1
+          fi
+
+          # Should have updated non-excluded resource
+          if [[ "$KEEP_ME" == "" ]]; then
+            echo "::error:: keep_me output should be set (resource not excluded without label)"
+            exit 1
+          fi

.gitignore

@@ -9,3 +9,6 @@ build/
 __pycache__/
 .DS_Store
 *.egg-info/
+
+# API cache files
+github_api_cache.sqlite

docs-gen/action.py

@@ -172,6 +172,7 @@ def assert_ordering(self):
             "backend_config_file",
             "replace",
             "target",
+            "exclude",
             "destroy",
             "refresh",
             "plan_path",

docs-gen/actions/apply.py

@@ -19,6 +19,7 @@
 from inputs.refresh import refresh
 from inputs.replace import replace
 from inputs.target import target
+from inputs.exclude import exclude
 from inputs.var_file import var_file
 from inputs.variables import variables
 from inputs.var import var
@@ -79,6 +80,10 @@
         dataclasses.replace(target, description='''
   List of resources to apply, one per line.
   The apply operation will be limited to these resources and their dependencies.
+        '''),
+        dataclasses.replace(exclude, description='''
+  List of resources to exclude from the apply operation, one per line.
+  The apply operation will include all resources except the specified ones and their dependencies.
         '''),
         dataclasses.replace(destroy, description='''
 Set to `true` to destroy all resources.