fix(verify-drift): detect resource types instead of module names

[Shubham-Padkonde]

Description

tf-migrate verify-drift now reports the Cloudflare resource types in a plan (dns_record, ruleset) instead of the names of the modules that contain them (dns, zone).

DetectResourcesFromPlan used to call extractAffectedResources, which takes the second segment of module.<name>.…. That works for the e2e runner, where every resource sits in a module named after its type, but not for customer plans, where modules have arbitrary names and root-module resources were not detected at all.

DetectResourcesFromPlan now has its own parser. It reads the resource type from each plan header's address:

• skips any module.<name>[key] path, including nested modules;
• skips instance keys such as ["example.com_@_issue_x"], which may contain dots;
• ignores data sources and non-Cloudflare resources;
• strips the cloudflare_ prefix so the names still match the per-resource exemption files.

extractAffectedResources, and therefore the e2e runner, is unchanged.

In verify-drift this only affects the report header. loadEmbeddedExemptions already loads every exemption file regardless of what's detected, so which exemptions apply doesn't change.

Motivation

Fixes #325

Type of change

• New resource transformer
• Fix to an existing transformer
• CLI / framework change
• Documentation
• Test / CI
• Refactoring (no behaviour change)

Testing

• Unit tests (make test-unit)
• Integration tests (make test-integration)
• E2E tests (if applicable): not applicable, the e2e path is unchanged
• make lint-testdata passes: no testdata changes

Details:

• New TestDetectResourcesFromPlan covers:
  • module names that differ from the resource type (the plan from the issue);
  • root and nested modules;
  • instance keys containing dots and brackets;
  • data sources and non-Cloudflare resources.
• New TestVerify_DetectsResourceTypesNotModuleNames checks the same thing through Verify.
• On main without the fix, 4 of the 5 new TestDetectResourcesFromPlan cases and TestVerify_DetectsResourceTypesNotModuleNames fail. All pass with it.
• make test passes (exit 0). go vet is clean on both packages, and gofmt -l reports nothing for the changed files.
• CLI check with the plan from the issue:

  before: Resources detected: dns, zone
  after:  Resources detected: dns_record, ruleset
  

Checklist

• I have read CONTRIBUTING.md
• New resource transformers are registered in internal/registry/registry.go (n/a)
• Testdata resource names use the cftftest prefix (n/a)
• Any # MIGRATION WARNING comments are documented in DIAGNOSTICS.md (n/a)

This change was written with help from an AI coding assistant (Claude Code). I reproduced the bug and reviewed and tested the change as described above.

🤖 Generated with Claude Code