[simonchrz]

Adds Terraform providers to the terraform registry, which so far handles modules only. Module dependencies already list providers as namespace/type, so that's the name a provider takes here: two segments for a provider (hashicorp/random), three for a module (hashicorp/consul/aws), as in a source address without its hostname.

Draft, because a few choices below need a decision first.

Behaviour

• FetchVersions reads the Provider Registry Protocol's version list, GET /v1/providers/{namespace}/{type}/versions. Every registry serves it (checked against registry.terraform.io and registry.opentofu.org). Each version has protocols and platforms (linux_amd64, …) in its metadata. The list is unordered, so versions are sorted newest first with vers.
• FetchPackage reads registry.terraform.io's provider details, GET /v1/providers/{namespace}/{type}: description, source repository, latest version, and tier and downloads in the metadata. Other registries answer 404 there; for them the package falls back to the version list, with the latest version from core.SelectLatestVersion.
• FetchDependencies returns none without a request, since providers declare none.
• FetchMaintainers returns the namespace, as for modules.
• A missing provider is a NotFoundError.

URLs

• Registry and Documentation link to https://registry.terraform.io/providers/{namespace}/{type}/{version|latest}[/docs]. For any other base URL they're empty, since other registries have no pages at those paths.
• Download is empty for a provider: each platform has its own archive, named by GET /v1/providers/{namespace}/{type}/{version}/download/{os}/{arch}.
• PURL is pkg:terraform/{namespace}/{type}@{version}, with repository_url for any registry but the default one. It's built with purl.New, so it doesn't depend on Add the terraform type proposed in purl-spec#889 purl#66 (which teaches MakePURL the type).

Open questions

1. Artifacts. A version could list one artifact per platform, with download_url, filename and the SHA-256 from the download endpoint. That's one request per platform, about 15 for a typical provider, so I left it out of FetchVersions. It could go in a FetchVersion, which only FetchVersionFromPURL calls.
2. Publish times. Only registry.terraform.io has them, in each version's details, again one request per version. They're left empty for now.
3. Pages on other registries. I left Registry and Documentation empty off registry.terraform.io. The module URLs always point at registry.terraform.io whatever the base URL; I didn't change that here.

Tests

internal/terraform/provider_test.go, against an HTTP test server with responses trimmed from registry.terraform.io and registry.opentofu.org:

• details, the fallback to the version list, and a missing provider
• versions newest first by version rather than by string, a prerelease, protocols and platforms, an entry without a version, and a missing provider
• no dependencies and no request, the namespace as maintainer, name parsing
• URLs and PURLs for the default registry and another one

The module tests are unchanged. The new code was mutation-checked; each change fails a test.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts