[refeed]

Pull Request Template

Description

• What changes are being made?

  • A new terraform_plan operation, provider_name, returns resource_changes[*].provider_name for every resource of the requested type (* for all). It honors exclude_resource_types on a wildcard, like action and count, and reports severity 1 when no resource of the type is found.
  • Docs for the operation in documentation/docs/tirith-providers/terraform-plan.md.

• Why are these changes necessary?

  • No operation returns the provider name, so a policy can't check that AWS, Google Cloud and Azure resources use the official HashiCorp providers. provider_config needs one exact provider name and doesn't return the name.

• Which issues or tickets does this PR close or relate to?

  • Closes [Feature] terraform_plan: provider_name operation to check which provider manages each resource #420

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Other (please specify):

Checklist

• Code has been linted. (black 25.9.0, line length 120: both changed Python files unchanged)
• Documentation has been updated (if needed).
• Tests have been added or updated (if needed). tests/providers/terraform_plan/test_provider_name.py: 6 tests, including the official-providers regex passing for hashicorp/aws, hashicorp/google (OpenTofu registry), random and kubernetes, and failing for acme/aws.
• Any breaking changes have been communicated to the team. (none)

Additional Information

Locally, tests/providers/terraform_plan has 48 passing tests and the 10 test_direct_references.py failures that need a terraform binary, the same as on main.