From 2010bf7eac1a06beb8ddbff682304aad93a72811 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 1 Sep 2026 15:01:02 -0400
Subject: [PATCH] fix(deploy): fail closed on unknown-only plan attributes

Include after_unknown keys in the version-only diff so a computed-only allowlist cannot hide an unexamined environment mutation.
---
 scripts/check-terraform-release-plan.py       |  2 +-
 scripts/test-terraform-release-plan-check.py  |  1 +
 .../unknown-only-description.json             | 39 +++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 scripts/testdata/terraform-release-plans/unknown-only-description.json

diff --git a/scripts/check-terraform-release-plan.py b/scripts/check-terraform-release-plan.py
index 6803643..e0f8a88 100644
--- a/scripts/check-terraform-release-plan.py
+++ b/scripts/check-terraform-release-plan.py
@@ -185,7 +185,7 @@ def changed_attributes(change: dict[str, Any]) -> set[str]:
     before = change.get("before") or {}
     after = change.get("after") or {}
     unknown = change.get("after_unknown") or {}
-    keys = set(before) | set(after)
+    keys = set(before) | set(after) | set(unknown)
     changed: set[str] = set()
     for key in keys:
         unknown_value = unknown.get(key)
diff --git a/scripts/test-terraform-release-plan-check.py b/scripts/test-terraform-release-plan-check.py
index c6ec333..5967d6f 100644
--- a/scripts/test-terraform-release-plan-check.py
+++ b/scripts/test-terraform-release-plan-check.py
@@ -254,6 +254,7 @@ def main() -> int:
         ("wrong-label", run_case("wrong-label.json"), 1),
         ("eb-setting-change", run_case("eb-setting-change.json"), 1),
         ("nested-unknown-tags", run_case("nested-unknown-tags.json"), 1),
+        ("unknown-only-description", run_case("unknown-only-description.json"), 1),
         ("iam-update", run_case("iam-update.json"), 1),
         ("dns-update", run_case("dns-update.json"), 1),
         ("create", run_case("create.json"), 1),
diff --git a/scripts/testdata/terraform-release-plans/unknown-only-description.json b/scripts/testdata/terraform-release-plans/unknown-only-description.json
new file mode 100644
index 0000000..e1dd3bc
--- /dev/null
+++ b/scripts/testdata/terraform-release-plans/unknown-only-description.json
@@ -0,0 +1,39 @@
+{
+  "resource_changes": [
+    {
+      "address": "module.environment.aws_elastic_beanstalk_environment.this",
+      "mode": "managed",
+      "type": "aws_elastic_beanstalk_environment",
+      "change": {
+        "actions": ["update"],
+        "before": {
+          "version_label": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-1-1",
+          "setting": [
+            {
+              "namespace": "aws:elasticbeanstalk:environment",
+              "name": "EnvironmentType",
+              "value": "LoadBalanced"
+            }
+          ],
+          "tags": { "env": "dev", "project": "shoc" }
+        },
+        "after": {
+          "version_label": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb-2-1",
+          "setting": [
+            {
+              "namespace": "aws:elasticbeanstalk:environment",
+              "name": "EnvironmentType",
+              "value": "LoadBalanced"
+            }
+          ],
+          "tags": { "env": "dev", "project": "shoc" }
+        },
+        "after_unknown": {
+          "instances": true,
+          "load_balancers": true,
+          "description": true
+        }
+      }
+    }
+  ]
+}