# 3.6.7

**Release Date:** May 21, 2026

---

## 🐛 Bug Fixes

### Terraform Modules

#### Suppress Casing Drift for Cookie Secret Role Assignment in `saif-api-service` 🔧

**Module:** `saif-api-service` (api module — `cookie_secret.tf`)

**Commit:** [`580bc508`](https://github.com/saif-corp/forge/commit/580bc508)

Adds a `lifecycle { ignore_changes = [scope] }` block to the `azurerm_role_assignment.cookie_secret_user` resource. The AzureRM provider normalises resource group names to PascalCase in `resource_versionless_id` (e.g. `Shared-Services`), but Azure's RBAC API returns the casing used when the assignment was first created (e.g. `shared-services`). This mismatch caused Terraform to plan a forced replacement on every apply, and the subsequent `PUT` would 409 Conflict because the assignment already existed at the original scope.

**Changes:**

- Added `lifecycle { ignore_changes = [scope] }` to `azurerm_role_assignment.cookie_secret_user`

**Benefits:**

- 🚫 Eliminates 409 Conflict errors on workspaces where the cookie secret role assignment was created with lowercase resource group casing
- 🔄 Prevents unnecessary role assignment replacement cycles caused purely by casing drift
- ✅ Consistent with the fix applied to `client_secret_reader` in `saif-resources` (3.6.6)

---

## ✨ New Features

### Tools

#### Import Functionality for Terraform Resources in `Test-WorkspaceMigration.ps1` 🧰

**Tool:** `tools/Test-WorkspaceMigration.ps1`

**Commit:** [`010273ea`](https://github.com/saif-corp/forge/commit/010273ea)

Adds an `-Imports` parameter to `Test-WorkspaceMigration.ps1`, allowing operators to pass a hashtable of Terraform resource addresses mapped to Azure resource IDs. The script automatically generates an `imports.tf` block and performs `terraform state rm` for each address before importing — ensuring a clean re-import even when the resource is already tracked in TFC state.

**Changes:**

- Added `-Imports` parameter accepting a `[hashtable]` of `address = id` entries
- Script generates `imports.tf` with import blocks for each entry
- Script performs `terraform state rm` for each address before importing to prevent stale state conflicts

**Benefits:**

- 🚀 Enables one-shot import and apply for drifted resources without manual state manipulation
- 🔁 Idempotent — safe to re-run with the same import addresses
- 🛠️ Unblocks production workspace migrations when Azure resource IDs diverge from TFC state

---

## 📝 Documentation

### Instructions

#### Migration Pre-Release Gate Guidelines 📋

**Commit:** [`9527158e`](https://github.com/saif-corp/forge/commit/9527158e)

Adds guidelines to the migration instructions clarifying the pre-release gate process, ensuring migrations are validated against production workspaces before a release is tagged.

---

## 🔄 Breaking Changes

None in this release ✅

---

## 📋 Additional Notes

- Total commits: 3
- Files changed: 3
- Contributors: Emmitt Johnson

---

### Support

- 📧 Teams Support Channel: [Support](https://teams.microsoft.com/l/channel/19%3Acb611810fb0b42b080cfff5590bdd51c%40thread.tacv2/Support?groupId=514d2dac-2d62-48ce-bf99-0fa0ce39469c&tenantId=a86cb8ed-369b-4df5-ace5-43811f6e08cf)