Skip to content

3.6.7

Release Date: May 21, 2026

🐛 Bug Fixes

Terraform Modules

Module: saif-api-service (api module — cookie_secret.tf)

Commit: 580bc508

Adds a lifecycle { ignore_changes = [scope] } block to the azurerm_role_assignment.cookie_secret_user resource. The AzureRM provider normalises resource group names to PascalCase in resource_versionless_id (e.g. Shared-Services), but Azure's RBAC API returns the casing used when the assignment was first created (e.g. shared-services). This mismatch caused Terraform to plan a forced replacement on every apply, and the subsequent PUT would 409 Conflict because the assignment already existed at the original scope.

Changes:

  • Added lifecycle { ignore_changes = [scope] } to azurerm_role_assignment.cookie_secret_user

Benefits:

  • 🚫 Eliminates 409 Conflict errors on workspaces where the cookie secret role assignment was created with lowercase resource group casing
  • 🔄 Prevents unnecessary role assignment replacement cycles caused purely by casing drift
  • ✅ Consistent with the fix applied to client_secret_reader in saif-resources (3.6.6)

✨ New Features

Tools

Import Functionality for Terraform Resources in Test-WorkspaceMigration.ps1 🧰

Tool: tools/Test-WorkspaceMigration.ps1

Commit: 010273ea

Adds an -Imports parameter to Test-WorkspaceMigration.ps1, allowing operators to pass a hashtable of Terraform resource addresses mapped to Azure resource IDs. The script automatically generates an imports.tf block and performs terraform state rm for each address before importing — ensuring a clean re-import even when the resource is already tracked in TFC state.

Changes:

  • Added -Imports parameter accepting a [hashtable] of address = id entries
  • Script generates imports.tf with import blocks for each entry
  • Script performs terraform state rm for each address before importing to prevent stale state conflicts

Benefits:

  • 🚀 Enables one-shot import and apply for drifted resources without manual state manipulation
  • 🔁 Idempotent — safe to re-run with the same import addresses
  • 🛠️ Unblocks production workspace migrations when Azure resource IDs diverge from TFC state

📝 Documentation

Instructions

Migration Pre-Release Gate Guidelines 📋

Commit: 9527158e

Adds guidelines to the migration instructions clarifying the pre-release gate process, ensuring migrations are validated against production workspaces before a release is tagged.

🔄 Breaking Changes

None in this release ✅

📋 Additional Notes

  • Total commits: 3
  • Files changed: 3
  • Contributors: Emmitt Johnson

Support

  • 📧 Teams Support Channel: Support