Skip to content

Add support for policy_update_patterns in policy_set #2030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nithishravindra wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add support for policy_update_patterns in policy_set #2030

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d99ca5b
Add support for policy_update_patterns
nithishravindra Apr 8, 2026
bf9c9cb
Merge branch 'main' into nithish/TF-32131-update-policyset-1
nithishravindra Apr 15, 2026
f600a1f
Update changelog
nithishravindra Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ ENHANCEMENTS:

FEATURES:
* `r/tfe_notification_configuration`: Optionally set `url` as a write-only (`url_wo`). Adds support for auto-managed (via hash) for `token_wo` param to avoid manually managing `_version` arguments. By @drewmullen [#2028](https://github.com/hashicorp/terraform-provider-tfe/pull/2028)
- `r/tfe_policy_set` and `d/tfe_policy_set`: Add `policy_update_patterns` attribute support for policy sets. By @nithishravindra [#2030](https://github.com/hashicorp/terraform-provider-tfe/pull/2030)

## v0.76.1

Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ require (
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
github.com/hashicorp/go-slug v1.0.0
github.com/hashicorp/go-tfe v1.103.0
github.com/hashicorp/go-tfe v1.103.1-0.20260408065133-6253066cb49c
github.com/hashicorp/go-version v1.8.0
github.com/hashicorp/hcl v1.0.0
github.com/hashicorp/hcl/v2 v2.24.0 // indirect
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ github.com/hashicorp/go-slug v1.0.0 h1:aOwhQ1fIbyRAUdBDzXZK2LVmsFFQYuuvJhOM8X9XW
github.com/hashicorp/go-slug v1.0.0/go.mod h1:Zxkkl8/LfXmhxZO3fLXQUCy3MVXAJK9pybY8WoDPgvs=
github.com/hashicorp/go-tfe v1.103.0 h1:2sx/8733WdFoEhrKbRkVhrlR+Z3Jkv2juFNFvr9AYQs=
github.com/hashicorp/go-tfe v1.103.0/go.mod h1:h9zoGyk0+5YCxuahXVppZ5kUNxqHhdZ21jrnLPDPNS4=
github.com/hashicorp/go-tfe v1.103.1-0.20260408065133-6253066cb49c h1:utycJHvvT0anvj/KogSym8qDUiujwtWrNjMNZclwplE=
github.com/hashicorp/go-tfe v1.103.1-0.20260408065133-6253066cb49c/go.mod h1:h9zoGyk0+5YCxuahXVppZ5kUNxqHhdZ21jrnLPDPNS4=
github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
Expand Down
7 changes: 7 additions & 0 deletions internal/provider/data_source_policy_set.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,12 @@ func dataSourceTFEPolicySet() *schema.Resource {
Computed: true,
},

"policy_update_patterns": {
Type: schema.TypeList,
Elem: &schema.Schema{Type: schema.TypeString},
Computed: true,
},

"policy_ids": {
Type: schema.TypeSet,
Elem: &schema.Schema{Type: schema.TypeString},
Expand Down Expand Up @@ -158,6 +164,7 @@ func dataSourceTFEPolicySetRead(d *schema.ResourceData, meta interface{}) error
d.Set("description", policySet.Description)
d.Set("global", policySet.Global)
d.Set("policies_path", policySet.PoliciesPath)
d.Set("policy_update_patterns", policySet.PolicyUpdatePatterns)
d.Set("agent_enabled", policySet.AgentEnabled)

if policySet.Kind != "" {
Expand Down
7 changes: 7 additions & 0 deletions internal/provider/data_source_policy_set_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,12 @@ func TestAccTFEPolicySetDataSource_vcs(t *testing.T) {
"data.tfe_policy_set.bar", "project_ids.#", "0"),
resource.TestCheckResourceAttr(
"data.tfe_policy_set.bar", "vcs_repo.#", "1"),
resource.TestCheckResourceAttr(
"data.tfe_policy_set.bar", "policy_update_patterns.#", "2"),
resource.TestCheckResourceAttr(
"data.tfe_policy_set.bar", "policy_update_patterns.0", "**/*.sentinel"),
resource.TestCheckResourceAttr(
"data.tfe_policy_set.bar", "policy_update_patterns.1", "policies/**/*.hcl"),
),
},
},
Expand Down Expand Up @@ -401,6 +407,7 @@ resource "tfe_policy_set" "foobar" {
name = "tst-policy-set-%d"
description = "Policy Set"
organization = local.organization_name
policy_update_patterns = ["**/*.sentinel", "policies/**/*.hcl"]
vcs_repo {
identifier = "%s"
branch = "main"
Expand Down
22 changes: 21 additions & 1 deletion internal/provider/resource_tfe_policy_set.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,13 @@ func resourceTFEPolicySet() *schema.Resource {
Computed: true,
},

"policy_update_patterns": {
Type: schema.TypeList,
Elem: &schema.Schema{Type: schema.TypeString},
Optional: true,
Computed: true,
},

"policies_path": {
Type: schema.TypeString,
Optional: true,
Expand Down Expand Up @@ -209,6 +216,12 @@ func resourceTFEPolicySetCreate(d *schema.ResourceData, meta interface{}) error
options.PolicyToolVersion = tfe.String(vPolicyToolVersion.(string))
}

if vPolicyUpdatePatterns, ok := d.GetOk("policy_update_patterns"); ok {
for _, pattern := range vPolicyUpdatePatterns.([]interface{}) {
options.PolicyUpdatePatterns = append(options.PolicyUpdatePatterns, pattern.(string))
}
}

if desc, ok := d.GetOk("description"); ok {
options.Description = tfe.String(desc.(string))
}
Expand Down Expand Up @@ -286,6 +299,7 @@ func resourceTFEPolicySetRead(d *schema.ResourceData, meta interface{}) error {
d.Set("description", policySet.Description)
d.Set("global", policySet.Global)
d.Set("policies_path", policySet.PoliciesPath)
d.Set("policy_update_patterns", policySet.PolicyUpdatePatterns)
d.Set("agent_enabled", policySet.AgentEnabled)

if policySet.Organization != nil {
Expand Down Expand Up @@ -383,7 +397,7 @@ func resourceTFEPolicySetUpdate(d *schema.ResourceData, meta interface{}) error
}

// Don't bother updating the policy set's attributes if they haven't changed
if d.HasChange("name") || d.HasChange("description") || d.HasChange("global") || d.HasChange("vcs_repo") || d.HasChange("overridable") || d.HasChange("agent_enabled") || d.HasChange("policy_tool_version") {
if d.HasChange("name") || d.HasChange("description") || d.HasChange("global") || d.HasChange("vcs_repo") || d.HasChange("overridable") || d.HasChange("agent_enabled") || d.HasChange("policy_tool_version") || d.HasChange("policy_update_patterns") {
Copy link
Copy Markdown
Contributor

@sana-faraz sana-faraz Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Can be rewitten like

fields := []string{
    "name", "description", "global", "vcs_repo", 
    "overridable", "agent_enabled", "policy_tool_version", 
    "policy_update_patterns",
}

hasAnyChange := false
for _, field := range fields {
    if d.HasChange(field) {
        hasAnyChange = true
        break
    }
}

if hasAnyChange {
    ....
}

// Create a new options struct.
options := tfe.PolicySetUpdateOptions{
Name: tfe.String(name),
Expand All @@ -408,6 +422,12 @@ func resourceTFEPolicySetUpdate(d *schema.ResourceData, meta interface{}) error
options.PolicyToolVersion = tfe.String(policyToolVersion.(string))
}

if d.HasChange("policy_update_patterns") {
for _, pattern := range d.Get("policy_update_patterns").([]interface{}) {
Copy link
Copy Markdown
Contributor

@sana-faraz sana-faraz Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: iteration can be moved to another function and reused

options.PolicyUpdatePatterns = append(options.PolicyUpdatePatterns, pattern.(string))
}
}

if v, ok := d.GetOk("vcs_repo"); ok {
vcsRepo := v.([]interface{})[0].(map[string]interface{})

Expand Down
27 changes: 27 additions & 0 deletions internal/provider/resource_tfe_policy_set_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -522,6 +522,12 @@ func TestAccTFEPolicySet_vcs(t *testing.T) {
"tfe_policy_set.foobar", "vcs_repo.0.ingress_submodules", "true"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policies_path", envGithubPolicySetPath),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.#", "2"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.0", "**/*.sentinel"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.1", "policies/**/*.hcl"),
),
},
},
Expand Down Expand Up @@ -577,6 +583,12 @@ func TestAccTFEPolicySet_GithubApp(t *testing.T) {
"tfe_policy_set.foobar", "vcs_repo.0.ingress_submodules", "true"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policies_path", envGithubPolicySetPath),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.#", "2"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.0", "**/*.sentinel"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.1", "policies/**/*.hcl"),
),
},
},
Expand Down Expand Up @@ -632,6 +644,12 @@ func TestAccTFEPolicySet_updateVCSBranch(t *testing.T) {
"tfe_policy_set.foobar", "vcs_repo.0.ingress_submodules", "true"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policies_path", envGithubPolicySetPath),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.#", "2"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.0", "**/*.sentinel"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.1", "policies/**/*.hcl"),
),
},

Expand All @@ -654,6 +672,12 @@ func TestAccTFEPolicySet_updateVCSBranch(t *testing.T) {
"tfe_policy_set.foobar", "vcs_repo.0.ingress_submodules", "true"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policies_path", envGithubPolicySetPath),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.#", "2"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.0", "**/*.sentinel"),
resource.TestCheckResourceAttr(
"tfe_policy_set.foobar", "policy_update_patterns.1", "policies/**/*.hcl"),
),
},
},
Expand Down Expand Up @@ -1258,6 +1282,7 @@ resource "tfe_policy_set" "foobar" {
name = "tst-terraform"
description = "Policy Set"
organization = local.organization_name
policy_update_patterns = ["**/*.sentinel", "policies/**/*.hcl"]
vcs_repo {
identifier = "%s"
branch = "main"
Expand All @@ -1284,6 +1309,7 @@ resource "tfe_policy_set" "foobar" {
name = "tst-terraform"
description = "Policy Set"
organization = local.organization_name
policy_update_patterns = ["**/*.sentinel", "policies/**/*.hcl"]
vcs_repo {
identifier = "%s"
branch = "main"
Expand Down Expand Up @@ -1318,6 +1344,7 @@ resource "tfe_policy_set" "foobar" {
name = "tst-terraform"
description = "Policy Set"
organization = local.organization_name
policy_update_patterns = ["**/*.sentinel", "policies/**/*.hcl"]
vcs_repo {
identifier = "%s"
branch = "%s"
Expand Down
4 changes: 4 additions & 0 deletions website/docs/d/policy_set.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ The following arguments are supported:
* `project_ids` - IDs of the projects that use the policy set.
* `policy_ids` - IDs of the policies attached to the policy set.
* `policies_path` - The sub-path within the attached VCS repository when using `vcs_repo`.
* `policy_update_patterns` - Glob patterns specifying which file changes trigger
policy set updates. Patterns are relative to the repository root, and a
maximum of 100 patterns can be returned. This attribute is only valid when
the policy set specifies a VCS repository.
* `vcs_repo` - Settings for the workspace's VCS repository.

The `vcs_repo` block contains:
Expand Down
6 changes: 6 additions & 0 deletions website/docs/r/policy_set.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ resource "tfe_policy_set" "test" {
kind = "sentinel"
agent_enabled = "true"
policy_tool_version = "0.24.1"
# Top-level policy set argument that applies when vcs_repo is configured.
policy_update_patterns = ["**/*.sentinel", "policies/**/*.hcl"]
policies_path = "policies/my-policy-set"
workspace_ids = [tfe_workspace.test.id]

Expand Down Expand Up @@ -90,6 +92,10 @@ The following arguments are supported:
* `policy_tool_version` - (Optional) The policy tool version to run the evaluation against. For both Sentinel and OPA,
leaving this argument unspecified results in selecting the latest available version at the time of creation.
For "opa" policy sets, 'latest' will not be a valid input.
* `policy_update_patterns` - (Optional) A list of glob patterns specifying which
file changes trigger policy set updates. Patterns are relative to the repository
root, and you can specify a maximum of 100 patterns. This argument is only
valid when you specify a VCS repository for the policy set.
* `overridable` - (Optional) Whether or not users can override this policy when
it fails during a run. Defaults to `false`. Only valid for OPA policies.
* `organization` - (Optional) Name of the organization. If omitted, organization must be defined in the provider config.
Expand Down
Loading