command: "terraform apply" accepts variable values with saved plan

To support ephemeral values we need a more complicated set of rules about
what input variables can and must be set when applying a saved plan. The
command itself does not have enough information to implement those rules
itself, so we'll let them pass through and check this in the local
backend's apply phase instead.

The local backend's apply phase already had basic support for dealing with
apply-time variable values, but it'll now also be responsible for
rejecting attempts to set variables when the experiment isn't enabled,
to keep all of this logic in roughly the same place.

Author: apparentlymart

internal/backend/local/backend_apply.go

@@ -258,6 +258,34 @@ func (b *Local) opApply(
 		applyOpts = &terraform.ApplyOpts{
 			SetVariables: applyTimeValues,
 		}
+	} else {
+		// When the ephemeral values experiment isn't enabled, no variables
+		// may be _explicitly_ set during the apply phase at all, but it's
+		// valid for variable to show up from more implicit locations like
+		// environment variables and .auto.tfvars files.
+		if len(op.Variables) != 0 && !combinedPlanApply {
+			for _, rawV := range op.Variables {
+				// We're "parsing" only to get the resulting value's SourceType,
+				// so we'll use configs.VariableParseLiteral just because it's
+				// the most liberal interpretation and so least likely to
+				// fail with an unrelated error.
+				v, _ := rawV.ParseVariableValue(configs.VariableParseLiteral)
+				if v == nil {
+					// We'll ignore any that don't parse at all, because
+					// they'll fail elsewhere in this process anyway.
+					continue
+				}
+				if v.SourceType == terraform.ValueFromCLIArg || v.SourceType == terraform.ValueFromNamedFile {
+					diags = diags.Append(tfdiags.Sourceless(
+						tfdiags.Error,
+						"Can't set variables when applying a saved plan",
+						"The -var and -var-file options cannot be used when applying a saved plan file, because a saved plan includes the variable values that were set when it was created.",
+					))
+					op.ReportResult(runningOp, diags)
+					return
+				}
+			}
+		}
 	}
 
 	// Start the apply in a goroutine so that we can be interrupted.

internal/command/apply.go

@@ -71,17 +71,6 @@ func (c *ApplyCommand) Run(rawArgs []string) int {
 		return 1
 	}
 
-	// Check for invalid combination of plan file and variable overrides
-	if planFile != nil && !args.Vars.Empty() {
-		diags = diags.Append(tfdiags.Sourceless(
-			tfdiags.Error,
-			"Can't set variables when applying a saved plan",
-			"The -var and -var-file options cannot be used when applying a saved plan file, because a saved plan includes the variable values that were set when it was created.",
-		))
-		view.Diagnostics(diags)
-		return 1
-	}
-
 	// FIXME: the -input flag value is needed to initialize the backend and the
 	// operation, but there is no clear path to pass this value down, so we
 	// continue to mutate the Meta object state for now.

internal/command/apply_test.go

@@ -900,6 +900,16 @@ func TestApply_planWithVarFile(t *testing.T) {
 }
 
 func TestApply_planVars(t *testing.T) {
+	// This test ensures that it isn't allowed to set input variables
+	// when applying from a saved plan file, since in that case the
+	// variable values come from the saved plan file.
+	//
+	// This situation was originally checked by the apply command itself,
+	// and that's what this test was originally exercising. This rule
+	// is now enforced by the "local" backend instead, but this test
+	// is still valid since the command instance delegates to the
+	// local backend.
+
 	planPath := applyFixturePlanFile(t)
 	statePath := testTempFile(t)