Merge remote-tracking branch 'origin/main' into apex/cloudhsm

Author: wuxu92

.github/workflows/build.yml

@@ -123,6 +123,8 @@ jobs:
       - get-go-version
       - set-product-version
     runs-on: custom-ubuntu-22.04-medium
+    if: github.repository_owner == 'hashicorp'
+    timeout-minutes: 10
     strategy:
       fail-fast: true
       # Verify expected Artifacts list for a workflow run.
@@ -184,4 +186,4 @@ jobs:
           echo "### What's next?" >> "$GITHUB_STEP_SUMMARY"
           echo "#### For a release branch (see \`.release/ci.hcl\`)" >> $GITHUB_STEP_SUMMARY
           echo "After this \`build\` workflow run completes succesfully, you can expect the CRT \`prepare\` workflow to begin momentarily." >> "$GITHUB_STEP_SUMMARY"
-          echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)" >> "$GITHUB_STEP_SUMMARY"
+          echo "To find the \`prepare\` workflow run, [view the checks for this commit]($github_dot_com/$owner_with_name/commits/$ref)" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/comment-failure.yaml

@@ -9,11 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Get run url
-        if: failure()
         run: |
           echo "gha_url=https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}" >> $GITHUB_ENV
       - name: Send build failure comment
-        if: failure()
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           result-encoding: string
@@ -23,4 +21,4 @@ jobs:
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '<b>Build failure</b> \n\n This pull request contains a build failure which needs addressed [here](${{ env.gha_url}}) .'
-             })
+             })

.github/workflows/preview-api-version-linter.yaml

@@ -3,7 +3,7 @@ name: Preview ARM API Version Linter
 
 permissions:
   contents: read
-  pull-requests: read
+  pull-requests: write
 
 on:
   pull_request:
@@ -23,5 +23,6 @@ jobs:
           go-version-file: ./.go-version
       - run: go run internal/tools/preview-api-version-linter/main.go
   comment-on-fail:
-    if: ${{ needs.depscheck.result }} == 'failure'
-    uses: ./.github/workflows/comment-failure.yaml
+    needs: preview-api-version-linter
+    if: ${{ failure() }}
+    uses: ./.github/workflows/comment-failure.yaml

.github/workflows/provider-test.yaml

@@ -44,7 +44,7 @@ jobs:
           go-version-file: ./.go-version
 
       - name: Azure CLI login (using OIDC)
-        uses: azure/login@v1
+        uses: azure/login@cb79c773a3cfa27f31f25eb3f677781210c9ce3d # v1.6.1
         with:
           client-id: ${{ secrets.ARM_CLIENT_ID }}
           tenant-id: ${{ secrets.ARM_TENANT_ID }}

.github/workflows/shellcheck.yaml

@@ -0,0 +1,32 @@
+---
+name: ShellCheck Scripts
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: ['opened', 'synchronize']
+    paths:
+      - '.github/workflows/shellcheck.yaml'
+      - 'scripts/**'
+
+concurrency:
+  group: 'shellcheck-${{ github.head_ref }}'
+  cancel-in-progress: true
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Run ShellCheck
+        run: make shellcheck
+  save-artifacts-on-fail:
+    needs: shellcheck
+    if: ${{ failure() }}
+    uses: ./.github/workflows/save-artifacts.yaml
+  comment-on-fail:
+    needs: shellcheck
+    if: ${{ failure() }}
+    uses: ./.github/workflows/comment-failure.yaml

.release/provider-schema.json

@@ -1,3 +1,20 @@
+## 4.59.0 (February 06, 2026)
+
+ENHANCEMENTS:
+
+* dependencies: `go-azure-sdk` - update to `v0.20260129.1200123` ([#31621](https://github.com/hashicorp/terraform-provider-azurerm/issues/31621))
+* `azurerm_automation_runbook` - add support for the `runtime_environment_name` property ([#30992](https://github.com/hashicorp/terraform-provider-azurerm/issues/30992))
+* `azurerm_kusto_eventgrid_data_connection` - update validation for `eventhub_consumer_group_name` to allow `$Default` as input ([#31551](https://github.com/hashicorp/terraform-provider-azurerm/issues/31551))
+* `azurerm_linux_function_app` - add support for `3.14` to `site_config.application_stack.python_version` ([#31195](https://github.com/hashicorp/terraform-provider-azurerm/issues/31195))
+* `azurerm_linux_function_app_slot` - add support for `3.14` to `site_config.application_stack.python_version` ([#31195](https://github.com/hashicorp/terraform-provider-azurerm/issues/31195))
+* `azurerm_netapp_volume_group_sap_hana_resource` - add support for `zone`, `encryption_key_source`, `key_vault_private_endpoint_id`, and `network_features` ([#31603](https://github.com/hashicorp/terraform-provider-azurerm/issues/31603))
+* `azurerm_user_assigned_identity` - add support for the `isolation_scope` property ([#31216](https://github.com/hashicorp/terraform-provider-azurerm/issues/31216))
+
+BUG FIXES:
+
+* `azurerm_kubernetes_cluster` -  the`network_policy` property now allows updating from `calico` to `cilium` ([#31627](https://github.com/hashicorp/terraform-provider-azurerm/issues/31627))
+* `azurerm_logic_app_trigger_http_request` - fix an issue that prevented importing existing resources due to empty trigger inputs ([#31433](https://github.com/hashicorp/terraform-provider-azurerm/issues/31433))
+
 ## 4.58.0 (January 22, 2026)
 
 FEATURES:

CHANGELOG.md

@@ -54,6 +54,11 @@ goimports:
 lint:
 	@golangci-lint run -v ./...
 
+shellcheck:
+	@command -v shellcheck >/dev/null || (echo "shellcheck not installed. Install via: brew install shellcheck (macOS) or apt install shellcheck (Linux)" && exit 1)
+	@echo "==> Checking shell scripts with shellcheck..."
+	@shellcheck scripts/*.sh
+
 depscheck:
 	@echo "==> Checking dependencies.."
 	@./scripts/track2-check.sh

GNUmakefile

@@ -30,6 +30,7 @@ More granular documentation covers how these fit together - and the most common
 
 * [Adding a new Service Package](topics/guide-new-service-package.md)
 * [Adding a new Resource](topics/guide-new-resource.md)
+* [Adding a new List Resource](topics/guide-list-resource.md)
 * [Adding a new Data Source](topics/guide-new-data-source.md)
 * [When to create a new Resource vs Inline Block](topics/guide-new-resource-vs-inline.md)
 

contributing/README.md

@@ -143,42 +143,24 @@ Before adding a List Resource, the resource must have Resource Identity implemen
                 // Set the ID of the resource for the ResourceData object
                 id, err := networkprofiles.ParseNetworkProfileID(pointer.From(profile.Id))
                 if err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, "parsing Network Profile ID", err)
+                    sdk.SetErrorDiagnosticAndPushListResult(result, push, "parsing Network Profile ID", err)
                     return
                 }
                 rd.SetId(id.ID())
     
                 // Use the resource flatten function to set the attributes into the resource state
                 if err := resourceNetworkProfileFlatten(rd, id, &profile); err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, fmt.Sprintf("encoding `%s` resource data", azureNetworkProfileResourceName), err)
+                    sdk.SetErrorDiagnosticAndPushListResult(result, push, fmt.Sprintf("encoding `%s` resource data", azureNetworkProfileResourceName), err)
                     return
                 }
     
-                // Convert and set the identity and resource state into the result
-                tfTypeIdentity, err := rd.TfTypeIdentityState()
-                if err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, "converting Identity State", err)
-                    return
-                }
-    
-                if err := result.Identity.Set(ctx, *tfTypeIdentity); err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, "setting Identity Data", err)
-                    return
-                }
-    
-                // Convert and set the resource state into the result
-                tfTypeResourceState, err := rd.TfTypeResourceState()
-                if err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, "converting Resource State", err)
-                    return
-                }
-    
-                if err := result.Resource.Set(ctx, *tfTypeResourceState); err != nil {
-                    sdk.SetListIteratorErrorDiagnostic(result, push, "setting Resource Data", err)
-                    return
-                }
-    
-                // Send the result to the stream
+               // Convert and set the identity and resource state into the result
+               sdk.EncodeListResult(ctx, rd, &result)
+               if result.Diagnostics.HasError() {
+                   push(result)
+                   return
+               }
+
                 if !push(result) {
                     return
                 }
@@ -189,7 +171,7 @@ Before adding a List Resource, the resource must have Resource Identity implemen
 
 5. Register the new List Resource
 
-List Resources are registered within the `registration.go` within each Service Package - and should look something like this:
+   List Resources are registered within the `registration.go` within each Service Package - and should look something like this:
 
     ```
     package network
@@ -212,9 +194,9 @@ List Resources are registered within the `registration.go` within each Service P
 
 6. Add Acceptance Tests for this List Resource
 
-Create a new acceptance test file for the List Resource (for example, `network_profile_resource_list_test.go`) and add tests to cover the List Resource functionality. The test should provision any prerequisite resources and multiple resources of the type of List Resource we want to test. 
-
-The test should look something like this:
+   Create a new acceptance test file for the List Resource (for example, `network_profile_resource_list_test.go`) and add tests to cover the List Resource functionality. The test should provision any prerequisite resources and multiple resources of the type of List Resource we want to test. 
+   
+   The test should look something like this:
 
     ```
     package network_test
@@ -346,9 +328,9 @@ The test should look something like this:
 
 7. Add documentation for this List Resource
 
-Documentation should be written manually and added to the `./website/docs/list-resources/` folder.
-
-It should include an example, arguments reference, and look something like this:
+   Documentation should be written manually and added to the `./website/docs/list-resources/` folder.
+   
+   It should include an example, arguments reference, and look something like this:
 
     ````markdown
     ---
@@ -392,4 +374,36 @@ It should include an example, arguments reference, and look something like this:
     * `resource_group_name` - (Optional) The name of the resource group to query.
     
     * `subscription_id` - (Optional) The Subscription ID to query. Defaults to the value specified in the Provider Configuration.
-    ````
+    ````
+
+## Known Issues and Considerations
+
+### Cancelled Context
+
+Some resources need to send additional API requests in the flatten function, these API requests require a valid context (i.e. not cancelled or done). However, due to the way the List resources function, the context provided will be cancelled by the time Terraform calls the iterator (`stream.Results`).
+
+In this scenario, you must instantiate a new context within the iterator using the deadline from the provided context, this should look like the below:
+
+```go
+func (r ExampleListResource) List(ctx context.Context, request list.ListRequest, stream *list.ListResultsStream, metadata sdk.ResourceMetadata) {
+    ...
+    
+    // retrieve the deadline from the supplied context
+    deadline, ok := ctx.Deadline()
+    if !ok {
+        // This *should* never happen given the List Wrapper instantiates a context with a timeout
+        sdk.SetResponseErrorDiagnostic(stream, "internal-error", "context had no deadline")
+        return
+    }
+    
+    stream.Result = func(push func(list.ListResult) bool) {
+        // Instantiate a new context based on the deadline retrieved earlier
+        ctx, cancel := context.WithDeadline(context.Background(), deadline)
+        defer cancel()
+        
+        for _, example := range results {
+            // Remaining logic to retrieve and set the resource data
+        }
+    }
+}
+```