actions: fail invoke plans when action configurations are unknown (#37793)

internal/terraform/context_plan_actions_test.go

@@ -2726,6 +2726,43 @@ action "test_action" "one" {
 				},
 			},
 
+			"invoke action with partially applied configuration": {
+				module: map[string]string{
+					"main.tf": `
+resource "test_object" "a" {
+  name = "hello"
+}
+
+action "test_action" "one" {
+  config {
+    attr = test_object.a.name
+  }
+}
+`,
+				},
+				planOpts: &PlanOpts{
+					Mode: plans.RefreshOnlyMode,
+					ActionTargets: []addrs.Targetable{
+						addrs.AbsAction{
+							Action: addrs.Action{
+								Type: "test_action",
+								Name: "one",
+							},
+						},
+					},
+				},
+				expectPlanActionCalled: false,
+				assertPlanDiagnostics: func(t *testing.T, diagnostics tfdiags.Diagnostics) {
+					if len(diagnostics) != 1 {
+						t.Errorf("expected exactly one diagnostic but got %d", len(diagnostics))
+					}
+
+					if diagnostics[0].Description().Summary != "Partially applied configuration" {
+						t.Errorf("wrong diagnostic: %s", diagnostics[0].Description().Summary)
+					}
+				},
+			},
+
 			"non-referenced resource isn't refreshed during invoke": {
 				module: map[string]string{
 					"main.tf": `

internal/terraform/node_action_invoke.go

@@ -165,6 +165,20 @@ func (n *nodeActionInvokeInstance) Execute(ctx EvalContext, _ walkOperation) tfd
 	}
 
 	unmarkedConfig, _ := actionInstance.ConfigValue.UnmarkDeepWithPaths()
+
+	if !unmarkedConfig.IsWhollyKnown() {
+		// we're not actually planning or applying changes from the
+		// configuration. if the configuration of the action has unknown values
+		// it means one of the resources that are referenced hasn't actually
+		// been created.
+		return diags.Append(&hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Partially applied configuration",
+			Detail:   fmt.Sprintf("The action %s contains unknown values while planning. This means it is referencing resources that have not yet been created, please run a complete plan/apply cycle to ensure the state matches the configuration before using the -invoke argument.", n.Target.String()),
+			Subject:  n.Config.DeclRange.Ptr(),
+		})
+	}
+
 	resp := provider.PlanAction(providers.PlanActionRequest{
 		ActionType:         n.Target.Action.Action.Type,
 		ProposedActionData: unmarkedConfig,