fix(iac): let drivers suppress new-resource creates

Author: intel352

platform/differ.go

@@ -108,11 +108,13 @@ func ComputePlan(ctx context.Context, p interfaces.IaCProvider, desired []interf
 			hash = configHash(spec.Config)
 		}
 		if rs, exists := currentMap[spec.Name]; !exists {
-			creates = append(creates, interfaces.PlanAction{
-				Action:             "create",
-				Resource:           spec,
-				ResolvedConfigHash: hash,
-			})
+			create, err := classifyCreate(ctx, p, spec, hash)
+			if err != nil {
+				return interfaces.IaCPlan{}, err
+			}
+			if create != nil {
+				creates = append(creates, *create)
+			}
 		} else {
 			candidates = append(candidates, modCandidate{
 				spec:     spec,
@@ -350,6 +352,37 @@ func classifyModification(ctx context.Context, p interfaces.IaCProvider, spec in
 	return nil
 }
 
+// classifyCreate decides whether a desired resource absent from local state
+// should produce a create action. If a provider driver is available, it gets
+// one Diff call against nil current so externally-existing resources can be
+// treated as no-op. Nil provider / nil driver preserves legacy create behavior.
+func classifyCreate(ctx context.Context, p interfaces.IaCProvider, spec interfaces.ResourceSpec, hash string) (*interfaces.PlanAction, error) {
+	create := &interfaces.PlanAction{
+		Action:             "create",
+		Resource:           spec,
+		ResolvedConfigHash: hash,
+	}
+	if p == nil {
+		return create, nil
+	}
+	driver, err := p.ResourceDriver(spec.Type)
+	if err != nil {
+		return nil, fmt.Errorf("provider.ResourceDriver(%q): %w", spec.Type, err)
+	}
+	if driver == nil {
+		return create, nil
+	}
+	diff, err := driver.Diff(ctx, spec, nil)
+	if err != nil {
+		return nil, fmt.Errorf("provider.Diff(%q/%q): %w", spec.Type, spec.Name, err)
+	}
+	if diff == nil || (!diff.NeedsUpdate && !diff.NeedsReplace && !hasForceNew(diff.Changes)) {
+		return nil, nil
+	}
+	create.Changes = diff.Changes
+	return create, nil
+}
+
 // resourceStateToOutput converts the persisted ResourceState into the
 // *interfaces.ResourceOutput shape that ResourceDriver.Diff expects.
 // Sensitive map is not reconstructed here — drivers that need it should

platform/differ_test.go

@@ -58,6 +58,46 @@ func TestDiffer_NewResource(t *testing.T) {
 	}
 }
 
+func TestComputePlan_NewResource_DriverNoopDiffSkipsCreate(t *testing.T) {
+	desired := []interfaces.ResourceSpec{
+		{Name: "delegation", Type: "infra.dns_delegation", Config: map[string]any{"domain": "example.com"}},
+	}
+	driver := &fakeDriver{diff: &interfaces.DiffResult{NeedsUpdate: false}}
+	provider := &fakeProvider{driver: driver}
+
+	plan, err := platform.ComputePlan(context.Background(), provider, desired, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if len(plan.Actions) != 0 {
+		t.Fatalf("expected no actions for driver no-op new resource, got %+v", plan.Actions)
+	}
+	if got := driver.diffCallCount.Load(); got != 1 {
+		t.Fatalf("Diff call count = %d, want 1", got)
+	}
+}
+
+func TestComputePlan_NewResource_DriverUpdateDiffCreates(t *testing.T) {
+	desired := []interfaces.ResourceSpec{
+		{Name: "delegation", Type: "infra.dns_delegation", Config: map[string]any{"domain": "example.com"}},
+	}
+	driver := &fakeDriver{diff: &interfaces.DiffResult{NeedsUpdate: true}}
+	provider := &fakeProvider{driver: driver}
+
+	plan, err := platform.ComputePlan(context.Background(), provider, desired, nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if len(plan.Actions) != 1 || plan.Actions[0].Action != "create" {
+		t.Fatalf("expected one create action, got %+v", plan.Actions)
+	}
+	if got := driver.diffCallCount.Load(); got != 1 {
+		t.Fatalf("Diff call count = %d, want 1", got)
+	}
+}
+
 func TestDiffer_DeletedResource(t *testing.T) {
 	desired := []interfaces.ResourceSpec{}
 	current := []interfaces.ResourceState{