CI: thin-slice runtime coverage for newer-protocol features on current stable Terraform AND OpenTofu #337

Why

CI's Terraform ceiling is 1.6.5 (.terraform.versions.json tested: ["1.5.5","1.6.5"], which every workflow matrix derives from). Terraform only emits functions / ephemeral_resource_schemas / write_only from 1.8/1.10/1.11 — so no CI job can ever fetch a schema containing the features #296 adds. The generation codepaths run in CI against empty inputs; the generated surfaces are covered only by fixture unit tests, the edge-provider compile slice (#311), and the external demo harness (sakul-learning/cdktn-provider-features-demo#5). That demo run caught three real bugs snapshot tests couldn't (nodenext import resolution, Node type-stripping rejecting a parameter property, variadic union binding) — proof the runtime slice has unique value.

Scope: one integration test × two pinned jobs

A single new integration test (test/typescript/provider-features/) running the standard harness (cdktn get → tsc → synth) against hashicorp-namespace providers only (random + time) — both small and mirrored on registry.opentofu.org. Assertions:

• generated provider class exposes the functions getter; instance-method bindings compile and synthesize provider::<name>::<fn>(...) expressions;
• nullable-parameter rendering: omitted optional and explicit null produce the bare null keyword in position (no JS undefined dropping / arg shifting);
• ephemeral resource synthesizes to the top-level ephemeral key;
• targetVersions floors below the feature admit range fail synth with the family validation error.

Matrix: exactly two additive entries, landing together — Terraform current stable (1.15.x) and OpenTofu current stable (1.12.x) — pinned per-test, explicitly not by touching .terraform.versions.json (the existing 1.5.5/1.6.5 cross-product stays untouched).

Implementation notes

• Preferred mechanism: an opt-in per-test pinVersions field in tools/build-test-matrix.mjs so the thin job inherits existing integration plumbing (container, caching, ci/skip-integration label). Integration test: ephemeral resources end-to-end, gated on Terraform >= 1.10 #312's TF>=1.10 ephemeral test should reuse the same mechanism.
• First OpenTofu in this repo's CI: needs a setup step (opentofu/setup-opentofu or mise), TERRAFORM_BINARY_NAME pointing at tofu, and awareness of the divergences already documented in commons (registry.opentofu.org/... cache/registry key shape; no deprecation_message in function schemas; provider-function language support 1.7 vs schema emission 1.8).
• Do not use cdktn-io/cfncompat in this test until it is published on the OpenTofu registry — it currently is not (provider registry registry.opentofu.org does not have a provider named registry.opentofu.org/cdktn-io/cfncompat, confirmed during feat: support newer provider plugin-protocol features via targetVersions (RFC-04) #296 validation).

Research task

• Get cdktn-io/cfncompat listed on registry.opentofu.org (OpenTofu's registry is PR-driven via opentofu/registry — scope the submission requirements: GPG signing key, version manifest), so tofu-side coverage can later include a non-hashicorp, functions-heavy provider.

Relations

• Edge-provider schema: cross-language compile coverage for ephemeral resources, provider functions, write-only attributes #311 — compile slice (edge-provider schema; lands with feat: support newer provider plugin-protocol features via targetVersions (RFC-04) #296), disjoint failure class from this runtime slice.
• Integration test: ephemeral resources end-to-end, gated on Terraform >= 1.10 #312 — ephemeral end-to-end integration; unblocked by (and should reuse) the pin mechanism here.
• Bumping .terraform.versions.json tested itself is a version-support-policy decision, deliberately out of scope here.