feat: filter tag policies by IaC type [FIX-488]

Tagging policies need to target specific IaC types, since tags behave
differently in Kubernetes to other IaC types and further types may diverge
in future.

Adds pkg/project as the canonical home for IaC project types. These values
are currently declared in infracost/config, which already depends on
go-proto, so putting them at the bottom of the graph lets config alias them
rather than declare its own and keeps config, the CLI and the runner
agreeing on the spelling. It also adds the kubernetes type, which config
was missing and the kubernetes parser plugin hardcodes as a literal.

EvaluateAgainstResources now matches TagPolicy.iac_type_filter against
ProjectInfo.type. The project's type is collapsed onto the set a user can
select before matching, so a cloudformation policy still covers CDK
projects and a terraform policy still covers Cisco Stacks and untyped
projects. Terragrunt stays distinct, being a tool users target deliberately.

NOTE: go.mod pins infracost/proto to a commit on its FIX-488 branch. This
must be re-pointed at the release tag before merge.

Author: liamcervante

go.mod

@@ -4,7 +4,7 @@ go 1.25.2
 
 require (
 	github.com/hashicorp/hcl/v2 v2.24.0
-	github.com/infracost/proto v1.150.0
+	github.com/infracost/proto v1.163.1-0.20260804063818-1685ac50472d
 	github.com/stretchr/testify v1.11.1
 	github.com/zclconf/go-cty v1.17.0
 )

go.sum

@@ -26,6 +26,8 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/infracost/proto v1.150.0 h1:vLB8ozP4u+WAlEPeevsC2I35r1/7rh7DNuhy4zm3gpw=
 github.com/infracost/proto v1.150.0/go.mod h1:Z8vPWBWblwJlw+/ksO+BtsXwf9NiOcSTWx0WRWNbfUA=
+github.com/infracost/proto v1.163.1-0.20260804063818-1685ac50472d h1:q07iBffPPUg2dqzI01GOh+rFNhou7aO+pURWy9bzzKA=
+github.com/infracost/proto v1.163.1-0.20260804063818-1685ac50472d/go.mod h1:Z8vPWBWblwJlw+/ksO+BtsXwf9NiOcSTWx0WRWNbfUA=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

pkg/event/tagging.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/agnivade/levenshtein"
 	"github.com/infracost/go-proto/pkg/address"
+	"github.com/infracost/go-proto/pkg/project"
 	"github.com/infracost/proto/gen/go/infracost/parser/event"
 	"github.com/infracost/proto/gen/go/infracost/provider"
 )
@@ -83,11 +84,18 @@ type TagPolicies []*event.TagPolicy
 
 func (t TagPolicies) EvaluateAgainstResources(resources []*provider.Resource, projectInfo *provider.ProjectInfo) []TaggingPolicyResult {
 
+	// Policies are filtered by the family a user can select, not the raw type,
+	// so a cloudformation policy still covers a CDK project. Filter values are
+	// validated against that set when the policy is saved, so only the
+	// project's own type needs collapsing here.
+	iacType := string(project.NormalizeForFilter(project.Type(projectInfo.GetType())))
+
 	// filter out policies for other repos/branches etc.
 	var filteredPolicies []*event.TagPolicy
 	for _, policy := range t {
 		if StringFilterFromProto(policy.GetProjectFilter()).Matches(projectInfo.Name) &&
-			StringFilterFromProto(policy.GetBranchFilter()).Matches(projectInfo.BranchName) {
+			StringFilterFromProto(policy.GetBranchFilter()).Matches(projectInfo.BranchName) &&
+			StringFilterFromProto(policy.GetIacTypeFilter()).Matches(iacType) {
 			filteredPolicies = append(filteredPolicies, policy)
 		}
 	}

pkg/event/tagging_test.go

@@ -408,6 +408,56 @@ func TestEvaluateAgainstResources_ProjectFilter(t *testing.T) {
 	})
 }
 
+func TestEvaluateAgainstResources_IacTypeFilter(t *testing.T) {
+	resources := []*provider.Resource{
+		mkResource("aws_instance.web", "aws_instance", []*provider.Tag{mkTag("Env", "prod")}),
+	}
+	requirements := []*eventpb.TagPolicyRequirement{
+		{Key: "Env", Type: eventpb.TagPolicyRequirement_ANY, Mandatory: true},
+	}
+
+	tests := []struct {
+		name        string
+		filter      *eventpb.StringFilter
+		projectType string
+		wantApplies bool
+	}{
+		{"no filter applies to everything", nil, "kubernetes", true},
+		{"included type applies", &eventpb.StringFilter{Include: []string{"kubernetes"}}, "kubernetes", true},
+		{"type outside include list is skipped", &eventpb.StringFilter{Include: []string{"kubernetes"}}, "terraform", false},
+		{"excluded type is skipped", &eventpb.StringFilter{Exclude: []string{"kubernetes"}}, "kubernetes", false},
+		{"type outside exclude list applies", &eventpb.StringFilter{Exclude: []string{"kubernetes"}}, "terraform", true},
+		{"multiple included types", &eventpb.StringFilter{Include: []string{"terraform", "cloudformation"}}, "cloudformation", true},
+
+		// The project's type is collapsed onto the selectable set before
+		// matching, so CDK projects are covered by a cloudformation policy.
+		{"cdk project matches cloudformation", &eventpb.StringFilter{Include: []string{"cloudformation"}}, "cdk_python", true},
+		{"cisco stacks matches terraform", &eventpb.StringFilter{Include: []string{"terraform"}}, "cisco_stacks", true},
+		{"untyped project matches terraform", &eventpb.StringFilter{Include: []string{"terraform"}}, "", true},
+		{"terragrunt is not covered by terraform", &eventpb.StringFilter{Include: []string{"terraform"}}, "terragrunt", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			policies := TagPolicies{{
+				Id:            "iac-type-filter",
+				Name:          "IaC Type Filter Policy",
+				IacTypeFilter: tt.filter,
+				Requirements:  requirements,
+			}}
+
+			projectInfo := &provider.ProjectInfo{Name: "proj", BranchName: "main", Type: tt.projectType}
+			results := policies.EvaluateAgainstResources(resources, projectInfo)
+
+			if tt.wantApplies {
+				assert.Len(t, results, 1)
+			} else {
+				assert.Empty(t, results)
+			}
+		})
+	}
+}
+
 func TestEvaluateAgainstResources_MultipleRequirements(t *testing.T) {
 	policy := &eventpb.TagPolicy{
 		Id:   "multi-req",

pkg/project/project.go

@@ -0,0 +1,61 @@
+// Package project holds the canonical definition of an IaC project type: the
+// value a parser plugin reports via GetParserConfig's config_file_project_type,
+// which the config file records and ProjectInfo.type carries over the wire.
+//
+// This package is the single source of truth for those values. The config
+// package aliases them rather than declaring its own, so config, the CLI and
+// the runner all agree on the spelling. It deliberately has no imports, so it
+// can sit at the bottom of the dependency graph.
+package project
+
+// Type is the project type reported by a parser plugin. It is an open string
+// rather than an enum: a plugin may return a custom type via
+// config_file_project_type, defaulting to its own name when unset.
+type Type string
+
+const (
+	// Unknown is a project with no recorded type. Treated as Terraform, which
+	// is what the config file assumes for an untyped project.
+	Unknown        Type = ""
+	Terraform      Type = "terraform"
+	Terragrunt     Type = "terragrunt"
+	CloudFormation Type = "cloudformation"
+	CDKTypeScript  Type = "cdk_typescript"
+	CDKJavaScript  Type = "cdk_javascript"
+	CDKPython      Type = "cdk_python"
+	CiscoStacks    Type = "cisco_stacks"
+	Kubernetes     Type = "kubernetes"
+)
+
+// Filterable is the set of types a governance policy can be filtered by, in
+// display order. It is deliberately coarser than the full set above:
+// NormalizeForFilter folds the niche and derived types onto the family a user
+// would recognise, so policies are written against a short, stable list.
+var Filterable = []Type{Terraform, Terragrunt, CloudFormation, Kubernetes}
+
+// NormalizeForFilter collapses a project type onto the Filterable set, so a
+// policy targeting "cloudformation" also covers the CDK variants that the
+// cloudformation plugin parses, and one targeting "terraform" covers the
+// Terraform-family types that are not worth surfacing separately.
+//
+// Terragrunt is kept distinct despite sharing Terraform's options schema: it is
+// a tool users target deliberately. Cisco Stacks is not, and is already
+// reported as Terraform elsewhere.
+//
+// Anything unrecognised is returned unchanged: a new plugin's type must not
+// silently fall into an existing family before it is added above. Callers
+// filtering on the result will simply not match it, which is the safe default.
+func NormalizeForFilter(t Type) Type {
+	switch t {
+	case Unknown, Terraform, CiscoStacks:
+		return Terraform
+	case CloudFormation, CDKTypeScript, CDKJavaScript, CDKPython:
+		return CloudFormation
+	case "terraform-plan":
+		// Not a declared project type: the terraform-plan plugin sets no
+		// config_file_project_type, so the caller falls back to the plugin name.
+		return Terraform
+	default:
+		return t
+	}
+}

pkg/project/project_test.go

@@ -0,0 +1,51 @@
+package project
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeForFilter(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    Type
+		expected Type
+	}{
+		{"terraform is unchanged", Terraform, Terraform},
+		{"terragrunt stays distinct", Terragrunt, Terragrunt},
+		{"cloudformation is unchanged", CloudFormation, CloudFormation},
+		{"kubernetes is unchanged", Kubernetes, Kubernetes},
+
+		{"untyped project folds to terraform", Unknown, Terraform},
+		{"cisco stacks folds to terraform", CiscoStacks, Terraform},
+		{"terraform-plan folds to terraform", "terraform-plan", Terraform},
+
+		{"cdk typescript folds to cloudformation", CDKTypeScript, CloudFormation},
+		{"cdk javascript folds to cloudformation", CDKJavaScript, CloudFormation},
+		{"cdk python folds to cloudformation", CDKPython, CloudFormation},
+
+		{"unrecognised type is left alone", "pulumi", "pulumi"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, NormalizeForFilter(tt.input))
+		})
+	}
+}
+
+// Every type must normalize onto the set users can actually pick from,
+// otherwise a policy could never match projects of that type.
+func TestNormalizeForFilter_LandsOnFilterableSet(t *testing.T) {
+	all := []Type{
+		Unknown, Terraform, Terragrunt, CloudFormation,
+		CDKTypeScript, CDKJavaScript, CDKPython, CiscoStacks, Kubernetes,
+	}
+
+	for _, projectType := range all {
+		t.Run(string(projectType), func(t *testing.T) {
+			assert.Contains(t, Filterable, NormalizeForFilter(projectType))
+		})
+	}
+}