Bump modules/cnames AWS provider constraint to ~> 6.0 (#117)

* Relax modules/cnames AWS provider constraint to span 6.x

The cnames module pinned aws `~> 5.0` (< 6.0), but it is used alongside
the vpc module, whose `terraform-aws-modules/vpc ~> 6.0` dependency
requires aws >= 6.28. A root using both modules (the topology
`examples/main.tf` documents) failed `terraform init` with an
unsatisfiable provider constraint. Widen to `>= 5.79, < 7.0` so it
resolves into 6.x while still blocking the next major — completing the
registry-pinning reconciliation started in #110/#112.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add CHANGELOG entry for cnames provider constraint fix (#117)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Use ~> 6.0 for cnames AWS pin; drop inline comment

Match the registry-pinning convention (~>) used by the vpc module
rather than a bare range; the rationale lives in the CHANGELOG and PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add cnames to the smoke wrapper as a cross-module provider guard

The quilt/cnames provider conflict went unnoticed because CI only ever
validates each module standalone — no job composed two modules in one
root, so their combined AWS provider constraints were never resolved.

Compose `cnames` alongside `quilt` in the smoke wrapper so the test
job's `terraform init` resolves both modules' constraints together. A
future incompatible pin on either module now fails init in CI (verified:
reverting cnames to `~> 5.0` makes this wrapper's init fail). Also drops
the now-stale cnames note from the root provider-pin comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Tighten cnames guard comment in smoke wrapper

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sir-sigurd

CHANGELOG.md

@@ -18,6 +18,8 @@ Optional release notice.
 
 ## [Unreleased] - YYYY-MM-DD
 
+- [Fixed] Bump `modules/cnames` AWS provider constraint from `~> 5.0` to `~> 6.0` so it resolves alongside the `vpc` module's `aws >= 6.28` requirement — using `quilt` + `cnames` in one root previously failed `terraform init` ([#117](https://github.com/quiltdata/iac/pull/117))
+
 ## [1.7.1] - 2026-06-04
 
 - [Fixed] Pin every registry module with `~>` so an upstream major can't silently break `terraform plan`/`apply` — resolves the `security-group` v6.0.0 break and constrains the rest (`security-group`/`rds` → `~> 5.0`, `vpc` → `~> 6.0`) ([#110](https://github.com/quiltdata/iac/pull/110), [#112](https://github.com/quiltdata/iac/pull/112))

modules/cnames/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
   }
 }

modules/quilt/tests/smoke/main.tf

@@ -16,8 +16,7 @@ terraform {
       source = "hashicorp/aws"
       # Match what the modules under test transitively require: the
       # terraform-aws-modules/vpc ~> 6.0 module needs aws >= 6.28. Pinning keeps
-      # CI deterministic and off a future major. (Note: examples/main.tf and
-      # modules/cnames still pin ~> 5.0, which is incompatible with that floor.)
+      # CI deterministic and off a future major.
       version = "~> 6.0"
     }
   }
@@ -87,6 +86,17 @@ module "quilt" {
   user_subnets        = var.user_subnets
 }
 
+# Compose `cnames` with `quilt` so CI's init resolves both modules' AWS
+# provider constraints together — a future incompatible pin fails init here.
+# Inputs are literal dummies; this guards resolution, not value flow.
+module "cnames" {
+  source = "../../../cnames"
+
+  zone_id        = "Z00000000000000000000"
+  quilt_web_host = "quilt-test.example.com"
+  lb_dns_name    = "test-lb.example.com"
+}
+
 # Re-expose ONLY the non-sensitive stack name. Do not output module.quilt.stack
 # (it embeds the DB URL + admin password) or any *_password value — a sensitive
 # root output makes `terraform test` fail, which is the whole reason this

modules/quilt/tests/smoke/smoke.tftest.hcl

@@ -4,6 +4,8 @@
 # Plan-only with the AWS provider mocked: no credentials, no infrastructure.
 # Exercises the full wiring (vpc + db + search + the CloudFormation stack), so
 # a change that breaks the public boundary or the vpc pass-through fails in CI.
+# The wrapper also composes the `cnames` module (see main.tf), so an AWS
+# provider constraint that can't resolve across quilt + cnames fails at init.
 #
 # Assertions reference known inputs (the stack name), not mocked computed
 # attributes, whose generated values are intentionally arbitrary.