Add speculative_enabled argument to tfe_workspace

go.mod

@@ -1,7 +1,7 @@
 module github.com/terraform-providers/terraform-provider-tfe
 
 require (
-	github.com/hashicorp/go-tfe v0.10.0
+	github.com/hashicorp/go-tfe v0.10.2
 	github.com/hashicorp/go-version v1.2.0
 	github.com/hashicorp/hcl v0.0.0-20180404174102-ef8a98b0bbce
 	github.com/hashicorp/terraform-plugin-sdk v1.13.1

go.sum

@@ -103,8 +103,8 @@ github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhE
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-slug v0.4.1 h1:/jAo8dNuLgSImoLXaX7Od7QB4TfYCVPam+OpAt5bZqc=
 github.com/hashicorp/go-slug v0.4.1/go.mod h1:I5tq5Lv0E2xcNXNkmx7BSfzi1PsJ2cNjs3cC3LwyhK8=
-github.com/hashicorp/go-tfe v0.10.0 h1:gn1rgV/laCeqSMRtcOS2eictemN3lUy/o/dCCq0H9Qo=
-github.com/hashicorp/go-tfe v0.10.0/go.mod h1:XAV72S4O1iP8BDaqiaPLmL2B4EE6almocnOn8E8stHc=
+github.com/hashicorp/go-tfe v0.10.2 h1:nYYlk0B0ku9cyuU9JHvpVd21whpwWfGiRf05VV9jdAY=
+github.com/hashicorp/go-tfe v0.10.2/go.mod h1:XAV72S4O1iP8BDaqiaPLmL2B4EE6almocnOn8E8stHc=
 github.com/hashicorp/go-uuid v1.0.1 h1:fv1ep09latC32wFoVwnqcnKJGnMSdBanPczbHAYm1BE=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.1.0 h1:bPIoEKD27tNdebFGGxxYwcL4nepeY4j1QP23PFRGzg0=

tfe/data_source_workspace.go

@@ -43,6 +43,11 @@ func dataSourceTFEWorkspace() *schema.Resource {
 				Computed: true,
 			},
 
+			"speculative_enabled": {
+				Type:     schema.TypeBool,
+				Computed: true,
+			},
+
 			"ssh_key_id": {
 				Type:     schema.TypeString,
 				Computed: true,
@@ -116,6 +121,7 @@ func dataSourceTFEWorkspaceRead(d *schema.ResourceData, meta interface{}) error
 	d.Set("file_triggers_enabled", workspace.FileTriggersEnabled)
 	d.Set("operations", workspace.Operations)
 	d.Set("queue_all_runs", workspace.QueueAllRuns)
+	d.Set("speculative_enabled", workspace.SpeculativeEnabled)
 	d.Set("terraform_version", workspace.TerraformVersion)
 	d.Set("trigger_prefixes", workspace.TriggerPrefixes)
 	d.Set("working_directory", workspace.WorkingDirectory)

tfe/data_source_workspace_test.go

@@ -30,6 +30,8 @@ func TestAccTFEWorkspaceDataSource_basic(t *testing.T) {
 						"data.tfe_workspace.foobar", "file_triggers_enabled", "true"),
 					resource.TestCheckResourceAttr(
 						"data.tfe_workspace.foobar", "queue_all_runs", "false"),
+					resource.TestCheckResourceAttr(
+						"data.tfe_workspace.foobar", "speculative_enabled", "true"),
 					resource.TestCheckResourceAttr(
 						"data.tfe_workspace.foobar", "terraform_version", "0.11.1"),
 					resource.TestCheckResourceAttr(
@@ -61,6 +63,7 @@ resource "tfe_workspace" "foobar" {
   auto_apply            = true
   file_triggers_enabled = true
   queue_all_runs        = false
+  speculative_enabled   = true
   terraform_version     = "0.11.1"
   trigger_prefixes      = ["/modules", "/shared"]
   working_directory     = "terraform/test"

tfe/resource_tfe_workspace.go

@@ -66,6 +66,12 @@ func resourceTFEWorkspace() *schema.Resource {
 				Default:  true,
 			},
 
+			"speculative_enabled": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+			},
+
 			"ssh_key_id": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -143,6 +149,7 @@ func resourceTFEWorkspaceCreate(d *schema.ResourceData, meta interface{}) error
 		FileTriggersEnabled: tfe.Bool(d.Get("file_triggers_enabled").(bool)),
 		Operations:          tfe.Bool(d.Get("operations").(bool)),
 		QueueAllRuns:        tfe.Bool(d.Get("queue_all_runs").(bool)),
+		SpeculativeEnabled:  tfe.Bool(d.Get("speculative_enabled").(bool)),
 		WorkingDirectory:    tfe.String(d.Get("working_directory").(string)),
 	}
 
@@ -215,6 +222,7 @@ func resourceTFEWorkspaceRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("file_triggers_enabled", workspace.FileTriggersEnabled)
 	d.Set("operations", workspace.Operations)
 	d.Set("queue_all_runs", workspace.QueueAllRuns)
+	d.Set("speculative_enabled", workspace.SpeculativeEnabled)
 	d.Set("terraform_version", workspace.TerraformVersion)
 	d.Set("trigger_prefixes", workspace.TriggerPrefixes)
 	d.Set("working_directory", workspace.WorkingDirectory)
@@ -260,14 +268,15 @@ func resourceTFEWorkspaceUpdate(d *schema.ResourceData, meta interface{}) error
 	if d.HasChange("name") || d.HasChange("auto_apply") || d.HasChange("queue_all_runs") ||
 		d.HasChange("terraform_version") || d.HasChange("working_directory") || d.HasChange("vcs_repo") ||
 		d.HasChange("file_triggers_enabled") || d.HasChange("trigger_prefixes") ||
-		d.HasChange("operations") {
+		d.HasChange("operations") || d.HasChange("speculative_enabled") {
 		// Create a new options struct.
 		options := tfe.WorkspaceUpdateOptions{
 			Name:                tfe.String(d.Get("name").(string)),
 			AutoApply:           tfe.Bool(d.Get("auto_apply").(bool)),
 			FileTriggersEnabled: tfe.Bool(d.Get("file_triggers_enabled").(bool)),
 			Operations:          tfe.Bool(d.Get("operations").(bool)),
 			QueueAllRuns:        tfe.Bool(d.Get("queue_all_runs").(bool)),
+			SpeculativeEnabled:  tfe.Bool(d.Get("speculative_enabled").(bool)),
 			WorkingDirectory:    tfe.String(d.Get("working_directory").(string)),
 		}
 

tfe/resource_tfe_workspace_test.go

@@ -36,6 +36,8 @@ func TestAccTFEWorkspace_basic(t *testing.T) {
 						"tfe_workspace.foobar", "operations", "true"),
 					resource.TestCheckResourceAttr(
 						"tfe_workspace.foobar", "queue_all_runs", "true"),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "speculative_enabled", "true"),
 					resource.TestCheckResourceAttr(
 						"tfe_workspace.foobar", "trigger_prefixes.#", "0"),
 					resource.TestCheckResourceAttr(
@@ -329,6 +331,37 @@ func TestAccTFEWorkspace_updateTriggerPrefixes(t *testing.T) {
 	})
 }
 
+func TestAccTFEWorkspace_updateSpeculative(t *testing.T) {
+	workspace := &tfe.Workspace{}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckTFEWorkspaceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccTFEWorkspace_basic,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTFEWorkspaceExists(
+						"tfe_workspace.foobar", workspace),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "speculative_enabled", "true"),
+				),
+			},
+
+			{
+				Config: testAccTFEWorkspace_basicSpeculativeOff,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTFEWorkspaceExists(
+						"tfe_workspace.foobar", workspace),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "speculative_enabled", "false"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccTFEWorkspace_updateVCSRepo(t *testing.T) {
 	workspace := &tfe.Workspace{}
 
@@ -801,6 +834,19 @@ resource "tfe_workspace" "foobar" {
   file_triggers_enabled = false
 }`
 
+const testAccTFEWorkspace_basicSpeculativeOff = `
+resource "tfe_organization" "foobar" {
+  name  = "tst-terraform"
+  email = "[email protected]"
+}
+
+resource "tfe_workspace" "foobar" {
+  name                  = "workspace-test"
+  organization          = "${tfe_organization.foobar.id}"
+  auto_apply            = true
+  speculative_enabled = false
+}`
+
 const testAccTFEWorkspace_monorepo = `
 resource "tfe_organization" "foobar" {
   name  = "tst-terraform"

vendor/modules.txt

@@ -99,7 +99,7 @@ github.com/hashicorp/go-retryablehttp
 github.com/hashicorp/go-safetemp
 # github.com/hashicorp/go-slug v0.4.1
 github.com/hashicorp/go-slug
-# github.com/hashicorp/go-tfe v0.10.0
+# github.com/hashicorp/go-tfe v0.10.2
 github.com/hashicorp/go-tfe
 # github.com/hashicorp/go-uuid v1.0.1
 github.com/hashicorp/go-uuid

website/docs/d/workspace.html.markdown

@@ -36,6 +36,7 @@ In addition to all arguments above, the following attributes are exported:
 * `file_triggers_enabled` - Indicates whether runs are triggered based on the changed files in a VCS push (if `true`) or always triggered on every push (if `false`).
 * `operations` - Indicates whether the workspace is using remote execution mode. Set to `false` to switch execution mode to local. `true` by default.
 * `queue_all_runs` - Indicates whether all runs should be queued.
+* `speculative_enabled` - Indicates whether this workspace allows speculative plans.
 * `ssh_key_id` - The ID of an SSH key assigned to the workspace.
 * `terraform_version` - The version of Terraform used for this workspace.
 * `trigger_prefixes` - List of repository-root-relative paths which describe all locations to be tracked for changes.

website/docs/r/workspace.html.markdown

@@ -36,6 +36,11 @@ The following arguments are supported:
 * `queue_all_runs` - (Optional) Whether all runs should be queued. When set
   to `false`, runs triggered by a VCS change will not be queued until at least
   one run is manually queued. Defaults to `true`.
+* `speculative_enabled` - (Optional) Whether this workspace allows speculative
+  plans. Setting this to `false` prevents Terraform Cloud or the Terraform
+  Enterprise instance from running plans on pull requests, which can improve
+  security if the VCS repository is public or includes untrusted contributors.
+  Defaults to `true`.
 * `ssh_key_id` - (Optional) The ID of an SSH key to assign to the workspace.
 * `terraform_version` - (Optional) The version of Terraform to use for this workspace. Defaults to the latest available version.
 * `trigger_prefixes` - (Optional) List of repository-root-relative paths which describe all locations to be tracked for changes.