Distillation

🟡 (19:45) Frozen source for opentofu-github-pr-2959 says CODEOWNERS was not working after a new governance chart because the new team is named opentofu-maintainers; the PR updated CODEOWNERS to match.
🟡 (19:45) opentofu-github-pr-2959 metadata: 1 changed file, merged at 2025-06-25T15:47:24Z; base SHA 0afbaae42d70c49159f25bac5a95f94f7048a17c, head SHA 6c1afd075a69497c77a5341eb47162aeacb8f67f, and merge commit SHA b82ed64756670f0ff54f034120d1e71aefa21358. The contribution checklist was fully checked, while all Go and website/documentation checklist items shown were unchecked.
🟡 (19:45) Frozen source for opentofu-github-pr-3559 says RELEASE.md was updated with the support policy discussed in the @opentofu/technical-steering-committee meeting on 09-12-25.
🟡 (19:45) opentofu-github-pr-3559 metadata: 1 changed file, merged at 2025-12-09T17:53:08Z; base SHA 1907ce104cbd6ec9a60e347b973b0f262eb4d43b, head SHA d06503ad9f725637a690bf9348bcff1f6ade528f, and merge commit SHA b2c6b935e06bfca47662792e7f71a7df8a6a36ad.
🟡 (19:45) Frozen source for opentofu-github-pr-727 adds # SPDX-License-Identifier: MPL-2.0 immediately after the shebang in compare-release-versions.sh; the author said the license was missed when writing the release-workflow version-comparison script, related it to issue #720, requested inclusion “anytime, asap ideally,” and labeled it a non-user-facing ENHANCEMENTS changelog update.
🟡 (19:45) opentofu-github-pr-727 metadata: 1 changed file, merged at 2023-10-15T08:04:41Z; base SHA 913578a9f45acebbb2c35279925e475ff839c14b, head SHA 8e98cd47b7dccb37b6ac437680d18a50d81bc7f6, and merge commit SHA 131b15c45e373c743648b0059d022b58b2f53251.
🔴 (19:45) User stated they need to use -target applies in some circumstances to get a job done.
🔴 (19:45) User stated they want to instruct Terraform that under no circumstances should it change the VPC when only vpc_flow_logs is targeted.
🔴 (19:45) User stated they work on a multi-cloud, multi-region platform with hundreds of tenants spanning hundreds of AWS accounts and GCP projects, including shared-tenancy and shared-ownership resources that other people can alter.
🔴 (19:45) User stated they use ignore_changes to limit updates Terraform detects and currently compensate for unsafe -target behavior by writing code that runs terraform plan, verifies that changes affect only originally targeted resources, and applies only if that validation succeeds.
🔴 (19:45) User stated their CI pipeline contains hundreds and hundreds of Terraform installations that must be processed in parallel across many end clients.
🟡 (19:45) Frozen source for terraform-github-issue-22468, concerning Terraform 0.11.14 and probably all versions, requests a strict targeting mode: Terraform may traverse, refresh, and calculate deltas for dependencies, but must either modify only explicitly targeted resources or fail gracefully for investigation.
🟡 (19:45) terraform-github-issue-22468 gives the concrete case of targeting a vpc_flow_logs resource on a shared-ownership VPC with governance requirements: refreshing the VPC and calculating its drift are acceptable, but changing the VPC is not. The desired behavior is effectively “don’t change anything other than what I’ve told you, and if you can’t do that, bail out.”
🟡 (19:45) Frozen source for terraform-github-issue-34139 reports Terraform 1.6.0 x64 failing to create azuread_access_package_assignment_policy.this in an Azure DevOps pipeline with HTTP 403 and OData error UnAuthorized: User is not authorized to perform the operation. Reason: Unauthorized.
🟡 (19:45) terraform-github-issue-34139 configuration makes azuread_access_package_assignment_policy.this depend on azuread_access_package.this, azuread_access_package_resource_catalog_association.this, and azuread_access_package_resource_package_association.this.
🟡 (19:45) Expected order in terraform-github-issue-34139: 1. create azuread_access_package_resource_catalog_association.this; 2. create azuread_access_package_resource_package_association.this; 3. create azuread_access_package_assignment_policy.this. Actual behavior reaches policy retrieval and fails with AccessPackageAssignmentPolicyClient.BaseClient.Get(): unexpected status 403.
🟡 (19:45) The Azure DevOps pipeline service role in terraform-github-issue-34139 has Identity Governance Administrator and Directory.ReadWrite.All; the pipeline successfully creates a new catalogue and an AAD group, then creates the Access Package, but policy association fails because the referenced object ID is reported unauthorized. IDs were replaced with "x" for security.
🟡 (19:54) Evidence inventory identifies opentofu-github-pr-823 as an opentofu/opentofu GitHub pull request published 2023-11-05; its file listing is complete, patch selection is not truncated, no patches are unavailable, and source text is not truncated.
🟡 (19:54) Evidence inventory identifies opentofu-github-pr-2953 as an opentofu/opentofu GitHub pull request published 2025-06-24; its file listing is complete and source text is not truncated, but patch selection is truncated.
🟡 (19:54) Evidence inventory reports complete, non-truncated source and patch selections with zero unavailable patches for opentofu-github-pr-2959 (published 2025-06-25), opentofu-github-pr-3473 (2025-11-05), opentofu-github-pr-3559 (2025-12-09), opentofu-github-pr-4018 (2026-04-09), opentofu-github-pr-727 (2023-10-14), and opentofu-github-pr-990 (2023-12-10).
🟡 (19:54) Evidence inventory identifies terraform-github-issue-22468 as a hashicorp/terraform GitHub issue published 2019-08-14 and terraform-github-issue-34139 as one published 2023-10-25; neither source text nor patch selection is truncated, each has zero unavailable patches, and file-listing completeness is not applicable (null).

Distillation

Observations