feat: add -plugin-dir flag to wfctl infra commands

cmd/wfctl/deploy_providers.go

@@ -75,6 +75,13 @@ func newDeployProvider(provider string, wfCfg *config.WorkflowConfig, envName st
 // they may return nil for the closer.
 var resolveIaCProvider = discoverAndLoadIaCProvider
 
+// currentInfraPluginDir is the per-invocation plugin directory override set by
+// infra commands that accept -plugin-dir. It takes precedence over the
+// WFCTL_PLUGIN_DIR environment variable and the default "./data/plugins" path.
+// Set at the top of each runInfra* function and reset via defer, matching the
+// same seam pattern used by currentApplyIncludeFlag and applyAllowReplaceSet.
+var currentInfraPluginDir string
+
 // iacPluginManifest is the minimal shape needed to read both:
 //   - capabilities.iacProvider.name — used by findIaCPluginDir to
 //     match a plugin to a desired provider name; AND
@@ -166,7 +173,10 @@ func findIaCPluginDir(pluginDir, providerName string) (name, computePlanVersion
 // that do not register the typed IaCProviderRequired service are
 // rejected at load time with an actionable upgrade message.
 func discoverAndLoadIaCProvider(ctx context.Context, providerName string, cfg map[string]any) (interfaces.IaCProvider, io.Closer, error) {
-	pluginDir := os.Getenv("WFCTL_PLUGIN_DIR")
+	pluginDir := currentInfraPluginDir
+	if pluginDir == "" {
+		pluginDir = os.Getenv("WFCTL_PLUGIN_DIR")
+	}
 	if pluginDir == "" {
 		pluginDir = "./data/plugins"
 	}

cmd/wfctl/infra.go

@@ -243,9 +243,14 @@ func runInfraPlan(args []string) error {
 	var planIncludeFlag string
 	fs.StringVar(&planIncludeFlag, "include", "",
 		"Comma-separated list of resource names to scope this command to (filters both desired specs and current state)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 	format := &formatVal
 	output := &outputVal
 	showSensitive := showSensitiveVal
@@ -936,9 +941,14 @@ func runInfraImport(args []string) error {
 	fs.StringVar(&envName, "env", "", "Environment name")
 	fs.StringVar(&nameVal, "name", "", "Desired resource name from config")
 	fs.StringVar(&cloudIDVal, "id", "", "Cloud-provider resource ID")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 	cfgFile, err := resolveInfraConfig(fs, configFile)
 	if err != nil {
 		return err
@@ -1187,6 +1197,8 @@ func runInfraApply(args []string) error {
 	var includeFlag string
 	fs.StringVar(&includeFlag, "include", "",
 		"Comma-separated list of resource names to scope this command to (filters both desired specs and current state)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	autoApprove := &autoApproveVal
 	showSensitive := showSensitiveVal
 	if err := fs.Parse(args); err != nil {
@@ -1225,6 +1237,12 @@ func runInfraApply(args []string) error {
 	currentApplyIncludeFlag = includeFlag
 	defer func() { currentApplyIncludeFlag = "" }()
 
+	// Publish the --plugin-dir override so discoverAndLoadIaCProvider picks it
+	// up for this invocation. Reset after the command exits.
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
+
 	cfgFile := configFlag
 	if cfgFile == "" {
 		var err error
@@ -1264,6 +1282,9 @@ func runInfraApply(args []string) error {
 		if envName != "" {
 			bootstrapArgs = append(bootstrapArgs, "--env", envName)
 		}
+		if pluginDirFlag != "" {
+			bootstrapArgs = append(bootstrapArgs, "--plugin-dir", pluginDirFlag)
+		}
 		if err := runInfraBootstrap(bootstrapArgs); err != nil {
 			return fmt.Errorf("bootstrap: %w", err)
 		}
@@ -1521,9 +1542,14 @@ func runInfraStatus(args []string) error {
 	fs.StringVar(&configFile, "c", "", "Config file (short for --config)")
 	var envName string
 	fs.StringVar(&envName, "env", "", "Environment name (resolves per-module environments: overrides)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	cfgFile, err := resolveInfraConfig(fs, configFile)
 	if err != nil {
@@ -1556,9 +1582,14 @@ func runInfraDrift(args []string) error {
 	fs.StringVar(&configFile, "c", "", "Config file (short for --config)")
 	var envName string
 	fs.StringVar(&envName, "env", "", "Environment name (resolves per-module environments: overrides)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	cfgFile, err := resolveInfraConfig(fs, configFile)
 	if err != nil {
@@ -1594,10 +1625,15 @@ func runInfraDestroy(args []string) error {
 	fs.BoolVar(&autoApproveVal, "y", false, "Skip confirmation (short for --auto-approve)")
 	var envName string
 	fs.StringVar(&envName, "env", "", "Environment name (resolves per-module environments: overrides)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	autoApprove := &autoApproveVal
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	cfgFile := configFlag
 	if cfgFile == "" {

cmd/wfctl/infra_align.go

@@ -40,9 +40,14 @@ func runInfraAlign(args []string) error {
 	fs.BoolVar(&opts.strictHealth, "strict-health", false, "Treat R-A2 health-check WARNs as FAILs")
 	fs.BoolVar(&opts.strictCIDR, "strict-cidr", false, "Enable strict CIDR overlap checks (reserved for future use)")
 	fs.IntVar(&opts.maxChanges, "max-changes", 50, "Warn when plan has more than N changes")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	// Resolve config file
 	if opts.configFile == "" {

cmd/wfctl/infra_audit_keys.go

@@ -143,12 +143,17 @@ func runInfraAuditKeysCmd(args []string) error {
 	fs.StringVar(&configFile, "c", "", "Config file (short for --config)")
 	fs.StringVar(&envName, "env", "", "Environment name for config resolution")
 	fs.StringVar(&resourceType, "type", "", "Resource type to enumerate (e.g. infra.spaces_key)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
 	if resourceType == "" {
 		return fmt.Errorf("audit-keys: --type is required")
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	ctx := context.Background()
 	providers, closers, err := auditKeysLoadProviders(ctx, fs, configFile, envName)

cmd/wfctl/infra_bootstrap.go

@@ -56,9 +56,14 @@ func runInfraBootstrap(args []string) error {
 	fs.StringVar(&envName, "env", "", "Environment name (resolves per-module environments: overrides)")
 	var rotateNames multiStringFlag
 	fs.Var(&rotateNames, "force-rotate", "Comma-separated list of secret names to regenerate, replacing existing values. Repeatable. Use for recovery from known-bad secrets (empty value, leak, etc).")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 	if err := fs.Parse(args); err != nil {
 		return err
 	}
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
 
 	cfgFile, err := resolveInfraConfig(fs, configFile)
 	if err != nil {

cmd/wfctl/infra_cleanup.go

@@ -65,6 +65,8 @@ func runInfraCleanup(args []string) error { //nolint:cyclop
 	tag := fs.String("tag", "", "tag to match resources for cleanup (required)")
 	dryRun := fs.Bool("dry-run", true, "preview only; do not delete resources (default: true)")
 	fix := fs.Bool("fix", false, "actually delete resources (overrides --dry-run)")
+	var pluginDirFlag string
+	fs.StringVar(&pluginDirFlag, "plugin-dir", "", "Plugin directory (overrides WFCTL_PLUGIN_DIR and default data/plugins)")
 
 	if err := fs.Parse(args); err != nil {
 		return err
@@ -77,6 +79,10 @@ func runInfraCleanup(args []string) error { //nolint:cyclop
 	// default invariant (cleanup is destructive: never delete without --fix).
 	*dryRun = !*fix
 
+	prevInfraPluginDir := currentInfraPluginDir
+	currentInfraPluginDir = pluginDirFlag
+	defer func() { currentInfraPluginDir = prevInfraPluginDir }()
+
 	ctx := context.Background()
 	providers, closers, err := cleanupLoadProviders(ctx, fs, configFile, envName)
 	if err != nil {