feat(zone_setting): v4 to v5 migration

[tamas-jozsa]

./scripts/run-e2e-tests.sh --apply-exemptions --provider /Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next --resources zone_setting
Building binaries...
go build -v -o bin/tf-migrate ./cmd/tf-migrate
go build -v -o bin/e2e-runner ./cmd/e2e-runner


========================================
State Migration Methods for Specified Resources
========================================

Resources using tf-migrate TransformState:
  zone_setting

Targeting specific resources: zone_setting
Target arguments: -target=module.zone_setting


========================================
E2E Migration Test
========================================

Step 0: Initializing test resources
Running tests with:
  User:       apix-ci@cloudflareapitest.com
  Account ID: a09697b020084f87a205896b35575a37
  Zone ID:    cd581854c1f59f8c686ee796d0eddce2
  Domain:     e2e.terraform.cfapi.net
  Provider:   Local (/Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next)

Running init script...

========================================
Syncing Test Resources
========================================

Filtering to specific resources: zone_setting
Syncing resource files from testdata...
  ✓ zone_setting/zone_setting.tf
  ✓ zone_setting/versions.tf

  Total: 2 files synced

Configuring terraform variables...


✓ Saved configuration
    Account ID: a09697b020084f87a205896b35575a37
    Zone ID: cd581854c1f59f8c686ee796d0eddce2
    Domain: e2e.terraform.cfapi.net
    File: v4/terraform.tfvars

Scanning for import annotations...

Updating main.tf with module references...
  ↻ Updated main.tf with 1 module references


========================================
✓ Sync Complete!
========================================

Summary:
  - Terraform v4 configs: /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/tf/v4
  - Modules: 1
  - Files synced: 2

Configuring remote backend...
✓ Backend configured

  ✓ Provider installation preserved
  ✓ Backend already configured

Next steps:
  cd tf/v4 && terraform apply

Note: Configuration is automatically loaded from terraform.tfvars
      State is managed remotely in R2

✓ Test resources initialized


========================================
Setting up local provider
========================================

Using provider from: /Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next
Building provider...
  Building in: /Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next
  Output: /Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next/terraform-provider-cloudflare
✓ Provider built successfully: /Users/tjozsa/cf-repos/sdks/terraform-devstack/cloudflare-terraform-next/terraform-provider-cloudflare
✓ Created dev overrides config: /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/.terraformrc-tf-migrate
✓ Local provider will be used for v5 testing

Note: v4 tests will use the registry provider (v4.x)
      v5 tests will use the local provider with dev overrides

Step 1: Testing v4 configurations
Running terraform init in v4/...
Found local state file, backing up and using remote state...
✓ Terraform init successful (remote state loaded from R2)
Running terraform plan in v4/...
✓ Terraform plan shows no changes

Running terraform apply in v4/...
✓ Terraform apply successful
  Apply complete! Resources: 0 added, 0 changed, 0 destroyed.
Syncing state from remote...
✓ Local state file synced from R2
Capturing v4 state...
✓ Saved v4 state to tmp/v4-state.json


Step 2: Running migration
Running ./scripts/migrate...
Building tf-migrate binary...
✓ Binary built successfully

========================================
Running v4 to v5 Migration
========================================

Preparing output directory...
  ✓ Preserved v5 provider installation (.terraform/)
  ✓ Preserved v5 dependency lock file (.terraform.lock.hcl)
Copying only targeted resources: zone_setting
    ✓ Copied root file: provider.tf
    ✓ Copied root file: terraform.tfvars
    ✓ Copied root file: terraform.tfstate

    ✓ Copied module: zone_setting
Creating filtered main.tf...
✓ Copied targeted resources to migrated-v4_to_v5/
✓ Updated provider.tf to use ~> 5.0 and removed backend config
Filtering state file to only include targeted resources...
✓ Filtered state to 10 resources from targeted modules

Migrating configuration files...
Cloudflare Terraform Provider Migration Tool
============================================

Configuration directory: /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/migrated-v4_to_v5
Output directory: in-place

Found 4 configuration files to migrate
[1/4] Processing main.tf... ✓
[2/4] Processing provider.tf... ✓
[3/4] Processing versions.tf... ✓
[4/4] Processing zone_setting.tf... ✓
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*rulesets.V4ToV5Migrator"
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*queue.V4ToV5Migrator"
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*zero_trust_split_tunnel.V4ToV5Migrator"
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*load_balancer_pools.V4ToV5Migrator"
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*zone_setting.V4ToV5Migrator"
2026-03-13T13:21:40.722-0500 [WARN]  tf-migrate: Migrator does not implement ResourceRenamer interface - cross-file references may not be updated: migrator="*zero_trust_gateway_certificate.V4ToV5Migrator"

Applying cross-file reference updates (31 updates across 4 files)...
✓ Updated cross-file references (31 updates applied)

Processing state file: terraform.tfstate... ✓
✓ Migration complete (config transformed, state will be upgraded by provider)


========================================
✓ Migration Complete!
========================================

Results:
  Input (v4):  /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/tf/v4
  Output (v5): /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/migrated-v4_to_v5

Next steps:
  cd /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/migrated-v4_to_v5
  terraform init
  terraform plan

✓ Migration successful

Step 3: Testing v5 configurations
Running terraform init in migrated-v4_to_v5/...
Cleaning v5 .terraform directory for fresh init...
Removing .terraform.lock.hcl to allow dev_overrides...
✓ Terraform init successful
Running terraform plan in v5/...
✓ Terraform plan shows only computed value refreshes (ignored with --apply-exemptions)

Drift exemptions applied:
  - zone_setting_migration_drift: 30 change(s) exempted
Running terraform apply in v5/...
✓ Terraform apply successful
Capturing v5 state...
✓ Saved v5 state to tmp/v5-state.json

Step 4: Verifying stable state (v5 plan after apply)
Running terraform plan again to check for ongoing drift...
✓ No ongoing drift detected - migration achieved stable state!


========================================
Drift Report
========================================

✓ Exempted changes in v5 plan (before apply):
The following changes were detected but exempted by drift exemption rules:
  module.zone_setting.cloudflare_zone_setting.minimal_brotli:
      # module.zone_setting.cloudflare_zone_setting.minimal_brotli will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_name_mapping:
      # module.zone_setting.cloudflare_zone_setting.with_name_mapping will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_name_mapping_http2:
      # module.zone_setting.cloudflare_zone_setting.with_name_mapping_http2 will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_security_header:
      # module.zone_setting.cloudflare_zone_setting.with_security_header will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_ignore_changes_server_side_exclude:
      # module.zone_setting.cloudflare_zone_setting.with_ignore_changes_server_side_exclude will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_integers:
      # module.zone_setting.cloudflare_zone_setting.with_integers will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_interpolation_min_tls_version:
      # module.zone_setting.cloudflare_zone_setting.with_interpolation_min_tls_version will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_lifecycle_always_online:
      # module.zone_setting.cloudflare_zone_setting.with_lifecycle_always_online will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_security_header_security_header:
      # module.zone_setting.cloudflare_zone_setting.with_security_header_security_header will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.minimal:
      # module.zone_setting.cloudflare_zone_setting.minimal will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_deprecated:
      # module.zone_setting.cloudflare_zone_setting.with_deprecated will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_integers_challenge_ttl:
      # module.zone_setting.cloudflare_zone_setting.with_integers_challenge_ttl will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.conditional_enabled_rocket_loader[0]:
      # module.zone_setting.cloudflare_zone_setting.conditional_enabled_rocket_loader[0] will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.conditional_enabled_websockets[0]:
      # module.zone_setting.cloudflare_zone_setting.conditional_enabled_websockets[0] will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.minimal_always_online:
      # module.zone_setting.cloudflare_zone_setting.minimal_always_online will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_integers_browser_cache_ttl:
      # module.zone_setting.cloudflare_zone_setting.with_integers_browser_cache_ttl will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_name_mapping_http3:
      # module.zone_setting.cloudflare_zone_setting.with_name_mapping_http3 will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_functions:
      # module.zone_setting.cloudflare_zone_setting.with_functions will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_functions_browser_cache_ttl:
      # module.zone_setting.cloudflare_zone_setting.with_functions_browser_cache_ttl will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_ignore_changes:
      # module.zone_setting.cloudflare_zone_setting.with_ignore_changes will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_ignore_changes_email_obfuscation:
      # module.zone_setting.cloudflare_zone_setting.with_ignore_changes_email_obfuscation will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_interpolation_automatic_https_rewrites:
      # module.zone_setting.cloudflare_zone_setting.with_interpolation_automatic_https_rewrites will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_lifecycle:
      # module.zone_setting.cloudflare_zone_setting.with_lifecycle will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_deprecated_always_online:
      # module.zone_setting.cloudflare_zone_setting.with_deprecated_always_online will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_functions_cache_level:
      # module.zone_setting.cloudflare_zone_setting.with_functions_cache_level will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.conditional_enabled[0]:
      # module.zone_setting.cloudflare_zone_setting.conditional_enabled[0] will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_deprecated_brotli:
      # module.zone_setting.cloudflare_zone_setting.with_deprecated_brotli will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_interpolation:
      # module.zone_setting.cloudflare_zone_setting.with_interpolation will be destroyed [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_lifecycle_ipv6:
      # module.zone_setting.cloudflare_zone_setting.with_lifecycle_ipv6 will be created [exempted: zone_setting_migration_drift]
  module.zone_setting.cloudflare_zone_setting.with_security_header_ssl:
      # module.zone_setting.cloudflare_zone_setting.with_security_header_ssl will be created [exempted: zone_setting_migration_drift]



========================================
✓ E2E Test Complete!
========================================

Summary:

  Step 1: v4 terraform apply
    Status: ✓ SUCCESS

  Step 2: Migration (v4 → v5)
    Status: ✓ SUCCESS

  Step 3: v5 plan (before apply)
    Status: ⚠ Changes detected but all exempted
    Result: 0 real changes (30 exempted)
    Terraform: Plan: 20 to add, 0 to change, 10 to destroy.

  Step 4: v5 terraform apply
    Status: ✓ SUCCESS

  Step 5: v5 plan (after apply)
    Status: ✓ SUCCESS - Stable state achieved
    Result: No changes detected

Logs saved to:
  - /Users/tjozsa/cf-repos/sdks/sdk-devstack/tf-migrate/e2e/tmp