Null provider tirggers always

[af6140]

data "external" "artifact_info" {
  program = ["bash", "${path.module}/parse_artifact_info.sh"]

  query {
    info_file = "${local.artifact_info_file}"
  }

  depends_on = ["local_file.artifact_info"]
}

resource "null_resource" "get_artifact" {
  triggers {
    key = "${data.external.artifact_info.result["md5"]}"
  }

  provisioner "local-exec" {
    command = "curl -k  -L '${data.external.artifact_info.result["url"]}' -o ${path.module}/tmp/${var.artifact}.zip"
  }

  depends_on = ["data.external.artifact_info"]
}

terraform run

-/+ null_resource.get_artifact (new resource required)
      id:                    "8272426212213023344" => <computed> (forces new resource)
      triggers.%:            "1" => <computed> (forces new resource)
      triggers.key:       "b0bac262cc4171fcda8557562ff79b21" => "" (forces new resource)

Notice the triggers.key does not show "computed" other than empty, this triggers my local-exec provisioner to run everytime.

[apparentlymart]

Hi @af6140,

The problem here is that the data source has depends_on set to include a resource, and so Terraform is forced to wait until the apply step to read from it. That in turn causes its result to be unknown during planning, and so Terraform conservatively assumes that the null_resource triggers will update.

You can avoid this problem by removing that depends_on and instead using a reference inside the query map. Terraform can then tell that it only needs to defer the data resource to the apply phase if the resource filename isn't set, but that's usually set directly inside the configuration and thus always available at planning time:

data "external" "artifact_info" {
  program = ["bash", "${path.module}/parse_artifact_info.sh"]

  query {
    info_file = "${local_file.artifact_info.filename}"
  }
}

You can see more information about why Terraform behaves this way (and what a future version of Terraform CLI might do about it) in hashicorp/terraform#17034.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.