Keep empty static analysis blocks consistent after apply

[ryanduffin]

Several static_analysis configurations on cortex_catalog_entity no longer fail with "Provider produced inconsistent result after apply", and reading static analysis data no longer crashes the provider.

Claude Details

Summary

• The provider omits empty values from the descriptor it writes (omitempty), so the API returns nothing for them. For an attribute that is optional and not computed, Terraform requires the state after apply to match the configuration, so the provider must keep the configured empty value.
• The Mend read model returned an object even when the descriptor had no Mend data, and the Veracode lists read as [] instead of null. So a static_analysis block without mend, or a veracode block without sandboxes, also failed the apply, and an import wrote values that the configuration did not have.
• The parser crashed on a mend block with only one ID list, on numeric or null Mend IDs (the API accepts numbers), and on a veracode block without applicationNames or with null or numeric names.

Changes

• New keepEmptyObject helper (empty_values.go): where the prior value and the value read from the API are both empty (null, an empty list or set, or an object of empty values), at any depth, it keeps the prior value. Create and Update keep the planned static_analysis this way, and Read keeps the prior state. A value set outside Terraform still reads into state.
• Mend reads as null when it has no IDs, as the other integrations already do. A missing Mend ID list or Veracode list reads as null, not [].
• New stringValues parser helper for Mend IDs and Veracode application names: it keeps strings, converts numbers and booleans to strings, and skips null values and nested lists or maps. Mend also drops empty IDs, as before; Veracode keeps empty names, as before. The ID lists and applicationNames use checked assertions.
• New in-memory fake of the catalog entity routes (catalog_entity_fake_test.go): upsert, descriptor read, and delete. Like the backend, it stores the descriptor as submitted and returns it on read. The new tests run the resource through real Terraform plan, apply, refresh, and import with resource.UnitTest, without a Cortex tenant.
• CHANGELOG entry.

Not in this PR

• An empty string is not treated as empty (for example code_cov.owner = "" or sonar_qube.alias = ""). These configurations failed before this PR too.
• Importing an entity whose configuration has an empty block shows a one-time update from null to {}. The API stores nothing for an empty block, so the import cannot know about it.
• Other unchecked casts in the static analysis parser (Veracode sandboxes, SonarQube) can still panic on malformed input.
• A numeric ID that the API returns in a non-decimal form (for example hex or exponent notation) reads as its decimal value. Before this PR, any numeric ID crashed the provider.

Test plan

• go test ./...: all packages pass.
  • TestUnitCatalogEntity_EmptyStaticAnalysis: {}, { mend = {} }, and empty ID lists. Before the fix, all three fail with "Provider produced inconsistent result after apply". Each case also checks that the fake stores no x-cortex-static-analysis.
  • TestUnitCatalogEntity_StaticAnalysisWithOneIntegration: SonarQube only, Veracode names only, and Veracode sandboxes only, each with an import check.
  • TestUnitCatalogEntity_ImportThenPlanIsEmpty: seeds the fake, imports, and requires an empty plan. ImportStateVerify treats an empty list as absent, so this catches [] in state.
  • TestUnitCatalogEntity_MendWithOneIdList, _MendWithBothIdLists, _UpdateMendToEmptyAndBack, and _EmptyStaticAnalysisShowsRemoteChange (a value set outside Terraform under a configured empty block reaches state).
  • TestKeepEmptyObject and TestKeepEmptyObject_Nested, the Mend and Veracode FromApiModel model tests, and the Mend and Veracode parser tests.
  • Mutation checks: reverting each fix makes at least one of these tests fail.
• gofmt -l, go vet ./..., and golangci-lint run (v2.14.0): clean.
• make testacc: not run locally. CI runs it.

🤖 Generated with Claude Code