Import extensions with stable project scope

[IlyaasK]

Summary

• accept canonical <extension-id> and project-qualified <project-id>/<extension-id> imports
• inherit the provider project default for bare imports when configured
• preserve API-key-bound scope as null when no default exists
• let an explicit project-qualified import override the provider default
• initialize canonical ID and scope while leaving API-readable metadata unknown until Read
• keep write-only source_path null
• reject empty components, extra separators, invalid IDs, and missing provider configuration without partial state

Resource scope

This PR adds only the kernel_extension import parser and Terraform Framework import-state adapter. Full resource interface assembly and provider registration remain separate.

API contract notes

Extension metadata does not return project identity. Import must therefore persist explicit or provider-resolved scope before Read. Bare imports with no provider default intentionally remain API-key scoped rather than guessing a project.

Terraform state semantics

Import records canonical id and resolvable project_id. name and source_sha256 are unknown until the first metadata Read. source_path is write-only and remains null. Subsequent immutable configuration changes retain the schema's replacement semantics.

Sensitive fields

This slice handles no secret values, archive contents, API keys, credentials, or runtime data.

Import behavior

• terraform import kernel_extension.example extension_123
• terraform import kernel_extension.example project_123/extension_123

The qualified form is required to record explicit non-default project scope.

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

All commands passed locally. Tests are pure, deterministic, network-free, and container-free.

Acceptance status

The resource is not registered yet, so live acceptance testing remains deferred to the complete extension lifecycle PR.

Deferred concerns

• metadata cannot verify project identity returned by the server
• unqualified API-key-scoped imports cannot later prove an explicit project without replacement
• upload idempotency remains an API concern

GitHub issues

This PR does not resolve #24 or #25. Force deletion and code generation remain outside this resource-scoped import change.

---

Note

Low Risk
New import-only code with no live resource registration; behavior is covered by deterministic unit tests and does not touch auth or data migration paths.

Overview
Adds Terraform Framework import support for kernel_extension via new importExtensionResource and parseExtensionImportID.

Import IDs accept a bare <extension-id> or <project-id>/<extension-id>. Bare IDs use the provider’s DefaultProjectID() when set; otherwise project_id stays null (API-key scope). Qualified IDs set explicit project scope and override the provider default.

Successful import seeds state with canonical id, resolved project_id, unknown name/source_sha256 until Read, and null write-only source_path. Invalid IDs, nil client, and malformed paths error with no partial state.

Unit tests cover ID parsing, project inheritance, and error paths.

^{Reviewed by Cursor Bugbot for commit 345affd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit af1b09e. Configure here.}

[cursor]

Duplicated project-qualified import parser

Low Severity

parseExtensionImportID is functionally the same as browserpool’s parseImportID: same strings.Cut flow, extra-separator rejection, and empty-segment rules. Keeping two copies raises the risk that a future import-edge-case fix lands in only one resource.

 

^{Reviewed by Cursor Bugbot for commit af1b09e. Configure here.}