Preview panics on Terraform `check` blocks with unresolved data sources
- Dominant language
- Go
- Stars
- 9
- Forks
- 5
- Avg merge
- 3d 20h
- Merged PRs (30d)
- 2
Description
## Problem
When a Terraform template uses a `check` block that references a data source (e.g. `data "external"` or `data "docker_network"`), workspace creation fails with:
```
Panic occurred in preview. This should not happen, please report this to Coder.
panic in preview: value is null
```
The template imports fine and `terraform plan/apply` handles the check block correctly, but `coder create` fails at the preview/parameter validation step.
## Steps to reproduce
1. Create a template with a `check` block that references a data source:
```hcl
check "docker_is_reachable" {
data "external" "docker_check" {
program = ["sh", "-c", "echo '{\"status\":\"ok\"}'"]
}
assert {
condition = data.external.docker_check.result.status == "ok"
error_message = "Docker is not reachable."
}
}
```
2. Push the template with `coder templates push` (succeeds)
3. Run `coder create` against the template
4. Preview panics
## Root cause
The `Preview()` function in `preview.go` uses trivy's HCL parser to evaluate the Terraform configuration. The parser can't execute providers, so data sources like `data.external.docker_check` resolve to a **null `cty.Value`**.
When the parser evaluates the `check` block's `assert` condition:
```hcl
condition = data.external.docker_check.result.status == "ok"
```
accessing `.result.status` on the null value triggers a panic in `go-cty` at [`value_ops.go:1162`](https://github.com/zclconf/go-cty/blob/v1.17.0/cty/value_ops.go#L1162):
```go
if val.IsNull() {
panic("value is null")
}
```
The `recover()` at `preview.go:148` catches this and wraps it as the diagnostic the user sees.
## Proposed fix
Terraform `check` blocks are non-blocking validation that runs as the last step of plan/apply. They have no bearing on parameter extraction, presets, tags, or any other preview concern. The preview should either:
1. **Skip `check` blocks entirely** during evaluation, or
2. **Guard against null values** from unresolved data sources when evaluating expressions inside `check` blocks
Option 1 seems cleanest since check blocks are irrelevant to the preview's purpose.
## Context
This came up while adding a Docker connectivity check to Coder's starter Docker template. The `check` block verifies the Docker daemon is reachable and surfaces a clear warning with setup docs instead of a generic provider error. The check works perfectly in Terraform itself but breaks Coder's workspace creation flow.
---
*This issue was created by Coder Agents on behalf of @bpmct.*
Contributor guide
Assessment
This issue has not been assessed yet.