test(terraform): add regression test for same-source module edge resolution

Add test_module_output_edge_with_same_source_siblings to verify that
variable resolution works when two modules share the same source and a
third module references one of their outputs.

The test fixture uses a minimal reproduction: a variable-to-output
module (mod_a) instantiated twice, with the alphabetically-first
instance receiving the other's output, and a separate module (mod_c)
whose explicitly-passed variable must resolve correctly.

Author: pszypowicz

tests/terraform/graph/graph_builder/test_local_graph.py

@@ -434,3 +434,30 @@ def test_variables_same_name_different_modules(self):
         # Check they point to 2 different modules
         self.assertEqual(2, len(module_variable_edges))
         self.assertNotEqual(local_graph.vertices[module_variable_edges[0].origin], local_graph.vertices[module_variable_edges[1].origin])
+
+    def test_module_output_edge_with_same_source_siblings(self):
+        resources_dir = os.path.realpath(os.path.join(TEST_DIRNAME, '../resources/modules/same_source_module_edge'))
+        hcl_config_parser = TFParser()
+        module, _ = hcl_config_parser.parse_hcl_module(resources_dir, self.source)
+        local_graph = TerraformLocalGraph(module)
+        local_graph.build_graph(render_variables=True)
+
+        # Find the azurerm_storage_account.sa vertex (inside module "c")
+        sa_vertices = [
+            v for v in local_graph.vertices
+            if v.block_type == BlockType.RESOURCE
+            and v.name == "azurerm_storage_account.sa"
+        ]
+        self.assertEqual(1, len(sa_vertices))
+        sa_vertex = sa_vertices[0]
+
+        # The key assertion: var.default_action must have been resolved to "Deny"
+        # Without the fix, the edge connects to module "a"'s output (wrong module),
+        # corrupting variable resolution and leaving "var.default_action" unresolved.
+        network_rules = sa_vertex.config.get("azurerm_storage_account", {}).get("sa", {}).get("network_rules", {})
+        if isinstance(network_rules, list):
+            network_rules = network_rules[0]
+        default_action = network_rules.get("default_action", [None])
+        if isinstance(default_action, list):
+            default_action = default_action[0]
+        self.assertEqual("Deny", default_action)

tests/terraform/graph/resources/modules/same_source_module_edge/main.tf

@@ -0,0 +1,16 @@
+module "b" {
+  source = "./mod_a"
+}
+
+module "a" {
+  source = "./mod_a"
+  result = module.b.result
+}
+
+module "c" {
+  source = "./mod_c"
+
+  default_action = "Deny"
+
+  ref = module.b.result.some_attr
+}

tests/terraform/graph/resources/modules/same_source_module_edge/mod_a/main.tf

@@ -0,0 +1,7 @@
+variable "result" {
+  default = null
+}
+
+output "result" {
+  value = var.result
+}

tests/terraform/graph/resources/modules/same_source_module_edge/mod_c/main.tf

@@ -0,0 +1,14 @@
+variable "default_action" {
+  type    = string
+  default = "Deny"
+}
+
+variable "ref" {
+  default = null
+}
+
+resource "azurerm_storage_account" "sa" {
+  network_rules {
+    default_action = var.default_action
+  }
+}