Improve missing Terraform config errors

[preko-p]

Description

This improves Terraform recipe inspection so a missing downloaded module directory, missing subdirectory, or module directory without Terraform configuration files returns an actionable error:

The Terraform configuration in location <templatePath> is not found.

Malformed Terraform configuration still flows through the existing tfconfig.LoadModule diagnostics as error loading the module: ....

Type of change

• This pull request fixes a bug in Radius and has an approved issue (issue link required).

Fixes: #9477

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

• An overview of proposed schema changes is included in a linked GitHub issue.
  • Yes
  • Not applicable
• A design document is added or updated under eng/design-notes/ in this repository, if new APIs are being introduced.
  • Yes
  • Not applicable
• The design document has been reviewed and approved by Radius maintainers/approvers.
  • Yes
  • Not applicable
• A PR for resource-types-contrib is created, if resource types or recipes are affected by the changes in this PR.
  • Yes
  • Not applicable
• A PR for dashboard is created, if the Radius Dashboard is affected by the changes in this PR.
  • Yes
  • Not applicable
• A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
  • Yes
  • Not applicable

Verification

• git diff --check
• docker run --rm golang:1.26.4 go version
• docker run --rm --user "$(id -u):$(id -g)" -v "$PWD":/repo -w /repo golang:1.26.4 gofmt -w pkg/recipes/terraform/module.go pkg/recipes/terraform/module_test.go
• docker run --rm --user "$(id -u):$(id -g)" -v "$PWD":/repo -w /repo -e HOME=/tmp -e GOCACHE=/tmp/gocache -e GOMODCACHE=/tmp/gomodcache golang:1.26.4 go test ./pkg/recipes/terraform -run Test_InspectTFModuleConfig
• docker run --rm --user "$(id -u):$(id -g)" -v "$PWD":/repo -w /repo -e HOME=/tmp -e GOCACHE=/tmp/gocache -e GOMODCACHE=/tmp/gomodcache golang:1.26.4 go test ./pkg/recipes/terraform ./pkg/recipes/driver/terraform

AI assistance disclosure

This PR was prepared with AI assistance and reviewed locally before submission.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR tightens Terraform module inspection by detecting missing Terraform configuration files up front and improving test coverage for missing/invalid module scenarios.

Changes:

• Added a pre-check for presence of .tf / .tf.json files before calling tfconfig.LoadModule.
• Introduced a standardized error message for missing module configuration.
• Expanded unit tests to cover missing submodules, missing config, and invalid config cases with optional exact error matching.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/recipes/terraform/module.go	Adds hasTerraformConfigFiles and returns a clearer “config not found” error before attempting module load.
pkg/recipes/terraform/module_test.go	Extends table-driven tests with setup hooks and exact error assertions for new failure modes.

[preko-p]

Thanks, addressed both review comments in a follow-up push.

What changed:

• Fixed the no-config test setup so it creates the module directory, not a directory named main.tf.
• Switched the file scan to entry.Type().IsRegular() to avoid the extra Info() stat.
• Added an explicit regression case for a directory named main.tf, so directory entries are still ignored even if their name looks like Terraform config.

Verification run locally through the Go 1.26.4 Docker image:

• gofmt on the changed Go files
• git diff --check
• go test ./pkg/recipes/terraform -run Test_InspectTFModuleConfig
• go test ./pkg/recipes/terraform ./pkg/recipes/driver/terraform

[DariuszPorowski]

good, targeted fix! thank you

@willtsai @zachcasper @nicolejms The hardcoded .terraform/modules breaks if TF_DATA_DIR is set (tfexec inherits the pod env). Pre-existing, out of scope here, but flagging as latent tech debt.

[codecov]

Codecov Report

❌ Patch coverage is 74.28571% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.88%. Comparing base (f703bc7) to head (811cc5a).

Files with missing lines	Patch %	Lines
pkg/recipes/terraform/module.go	74.28%	5 Missing and 4 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #12070   +/-   ##
=======================================
  Coverage   52.88%   52.88%           
=======================================
  Files         751      751           
  Lines       48353    48387   +34     
=======================================
+ Hits        25572    25591   +19     
- Misses      20384    20392    +8     
- Partials     2397     2404    +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[preko-p]

Pushed a follow-up for the new CodeQL findings and refreshed the branch with current main so the spellcheck config move is included.

What changed:

• Validate the downloaded module name and submodule path with filepath.Clean + filepath.IsLocal before building the .terraform/modules path.
• Add a missing Terraform config precheck so absent/non-config module dirs fail with the existing user-facing message.
• Add a nil guard after tfconfig.LoadModule diagnostics.
• Add regression tests for traversal attempts, missing submodules/config, and config-like directories.

Verification run with Go 1.26.4:

• git diff --check
• go test ./pkg/recipes/terraform -run Test_InspectTFModuleConfig
• go test ./pkg/recipes/terraform ./pkg/recipes/driver/terraform

Post-push checks have started; DCO and Check Trust are passing, Approval Gate is still pending.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	preko-p/radius
Commit ref	811cc5a
Unique ID	func0e1e01522d
Image tag	pr-func0e1e01522d

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func0e1e01522d
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func0e1e01522d
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func0e1e01522d
• controller test image location: ghcr.io/radius-project/dev/controller:pr-func0e1e01522d
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func0e1e01522d
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

[DariuszPorowski]

🤘🚀

[DariuszPorowski]

@preko-p overall looks good, approved. Thank you!

We require verified commits, see
https://github.com/radius-project/radius/blob/main/docs/contributing/contributing-code/contributing-code-first-commit/first-commit-06-creating-a-pr/index.md#signing-your-commits

Without it the PR will be blocked to merge.