Skip to content
Sarj Code Standards

iac-source-coupled-test

Disallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior.

rawSourceOracle Rule source Tests Catalog JSON

Why

Substring and regex checks can pass on comments, formatting, or unreachable Terraform configuration while clients fail silently.

Fix

Reuse adequate existing validation; otherwise assert a distinct rendered-plan, provider-state, or runtime contract. Preserve deliberate representation contracts with an exact justified suppression.

Examples

Before — flagged Do not prove Terraform behavior with a regex
src/policy.test.ts
import { readFileSync } from "node:fs";
test("policy", () => {
  const source = readFileSync("main.tf", "utf8");
  expect(source).toMatch(/prevent_destroy/);
});
After — preferred Assert on rendered plan behavior
src/policy.test.ts
import { readFileSync } from "node:fs";
test("policy", () => {
  const plan = JSON.parse(readFileSync("plan.json", "utf8"));
  expect(validate(plan)).toEqual([]);
});