ci: gate the cross-module dependency graph on an allowlist

[james00012]

Follow-up to #1875. Nothing currently stops the dependency cleanup from being undone.

Gap

check-acyclic-deps.sh enforces layering only. aws and k8s are both tier 3, so k8s importing aws for one EC2 call never violated it, and it survived until a user noticed that depending on k8s pulled in 23 AWS service SDKs.

The second half is staleness. When k8s dropped aws, helm kept it as an indirect require, because go-mod-tidy-check runs at the repo root and diffs only the root go.mod and go.sum. helm carried 72 aws-sdk-go-v2 go.sum entries for code no module imported.

Change

scripts/check-module-deps.sh, wired into v2-checks.yml and create-release.yml:

1. Every direct cross-module require must be in ALLOWED_EDGES, so adding one is deliberate and reviewed.
2. Every allowlisted edge must still exist, so the list documents the real graph rather than history.
3. Every indirect terratest require must be reachable through the declared direct graph. An unreachable one is stale.

The allowlist is seeded from the current graph: 26 edges, each with a note where the reason is not obvious.

Verification

Both historical regressions were replayed and both fail the check:

k8s -> aws re-added:      undeclared cross-module dependency 'k8s:aws'
helm stale indirect aws:  stale indirect require 'aws': no module in helm's dependency graph requires it any more

Clean on current main. shellcheck clean.

Summary by CodeRabbit

• Bug Fixes

  • Added automated validation to detect missing, obsolete, or unreachable module dependency declarations.
  • Release and verification checks now fail when dependency relationships violate the approved allowlist.

• Chores

  • Added dependency checks to the project’s automated verification workflows.
  • Validation reports clear errors and success details for easier troubleshooting.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e4fe216b-26d1-4dc2-bbdf-c2e6572270cd

📥 Commits

Reviewing files that changed from the base of the PR and between 18eb952 and d91a237.

📒 Files selected for processing (3)

• .github/workflows/create-release.yml
• .github/workflows/v2-checks.yml
• scripts/check-module-deps.sh

🚧 Files skipped from review as they are similar to previous changes (3)

• scripts/check-module-deps.sh
• .github/workflows/v2-checks.yml
• .github/workflows/create-release.yml

---

Walkthrough

The change adds a Bash validator for Terratest module dependency allowlists. It checks direct and indirect dependency consistency, then runs in the v2 checks and release pre-flight workflows.

Changes

Module dependency validation

Layer / File(s)	Summary
Dependency policy and module discovery scripts/check-module-deps.sh	The script defines allowed cross-module edges, discovers modules, and extracts direct and indirect requirements from go.mod files.
Dependency graph validation scripts/check-module-deps.sh	The script validates direct edges, detects obsolete allowlist entries, checks graph reachability, reports stale indirect requirements, and returns failure when violations exist.
CI and release integration .github/workflows/v2-checks.yml, .github/workflows/create-release.yml	The workflows run the dependency validator during checks and release pre-flight verification.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant check-module-deps.sh
  participant GoModFiles
  GitHubActions->>check-module-deps.sh: Run dependency validation
  check-module-deps.sh->>GoModFiles: Read module dependency declarations
  GoModFiles-->>check-module-deps.sh: Return direct and indirect requirements
  check-module-deps.sh-->>GitHubActions: Return validation status

Loading

Possibly related PRs

• gruntwork-io/terratest#1856: Extends the same CI and release workflows with module dependency validation.
• gruntwork-io/terratest#1874: Also modifies the release pre-flight workflow for dependency validation.

Suggested reviewers: denis256, yhakbar

Poem

Modules line up, edges stay neat,
Allowlisted paths make checks complete.
CI reads each go.mod sign,
Stale links get a failing sign.
Release gates now guard the graph.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: enforcing the cross-module dependency graph with an allowlist.
Description check	✅ Passed	The description explains the problem, implementation, CI wiring, allowlist behavior, regression tests, and verification results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/dependency-graph-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}