fix(ruleset): preserve exclude wildcard semantics

[philipsolo]

Description

Updates the cloudflare_ruleset v4-to-v5 transformer to migrate:
exclude = ["*"]
to:

exclude = {
  all = true
}

Ordinary lists, mixed lists, dynamic expressions, and existing include behavior remain unchanged.

Motivation

Provider v4 uses [""] as the exclude-all sentinel. Migrating it to list = [""] changes its meaning in provider v5 instead of preserving exclude-all behavior.

Related issue: cloudflare/terraform-provider-cloudflare#6087

Fixes #

Type of change

• New resource transformer
• Fix to an existing transformer
• CLI / framework change
• Documentation
• Test / CI
• Refactoring (no behaviour change)

Testing

• Unit tests (make test-unit)
• Integration tests (make test-integration)
• E2E tests (if applicable)
• make lint-testdata passes

Checklist

• I have read CONTRIBUTING.md
• New resource transformers are registered in internal/registry/registry.go
• Testdata resource names use the cftftest prefix
• Any # MIGRATION WARNING comments are documented in DIAGNOSTICS.md

[Copilot]

🔵 Needs a closer look

Wildcard detection must handle commented one-element lists without changing their semantics.

Pull request overview

Updates the cloudflare_ruleset v4-to-v5 transformer to preserve exclude-all wildcard semantics.

Changes:

• Converts exclude = ["*"] to exclude = { all = true }.
• Preserves ordinary, mixed, and dynamic expressions.
• Adds transformation coverage.

File summaries

File	Summary
internal/resources/ruleset/v4_to_v5.go	Adds wildcard conversion for query-string attributes; commented wildcard lists still require structural detection.
internal/resources/ruleset/v4_to_v5_test.go	Adds coverage for wildcard, mixed-list, and dynamic-expression behavior.

Review details

Suppressed comments (1)

internal/resources/ruleset/v4_to_v5.go:331

• isWildcardList matches formatted source against three exact strings. HCL permits comments in a literal tuple, for example exclude = [\n # all query parameters\n "*",\n]; hclwrite.Format preserves that comment, so this returns false and emits exclude = { list = ["*"] }, retaining the v4/v5 semantic bug. Detect a one-element, known string-valued list structurally while leaving unknown/dynamic expressions unchanged.

func isWildcardList(tokens hclwrite.Tokens) bool {
	formatted := string(hclwrite.Format(tokens.Bytes()))
	return formatted == "[\"*\"]" || formatted == "[\n  \"*\",\n]" || formatted == "[\"*\",]"

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ssicard]

Superceded by: #327