Apply tagsAll PreCheckCallback to Plugin Framework resources to fix empty preview diffs

[eon-pulumi-agent]

Problem

SecurityGroupIngressRule, SecurityGroupEgressRule, and other Plugin Framework (PF) resources showed a spurious (update) with an empty diff during pulumi preview --diff when aws:defaultTags was changed. The tags were being applied correctly by pulumi up, but the preview output gave no indication of what would change.

In contrast, SDKv2 resources like NatGateway correctly displayed the tagsAll diff.

Fixes #6602.

Root Cause

The applyTagsPreCheckCallback in provider/tags.go computes the merged tagsAll value at Check time and stores it as a pseudo-input. This is what allows the Pulumi diff to display tagsAll changes during preview. Previously this callback was only applied to SDKv2 resources:

// Before
if _, isSDKV2 := up.ResourcesMap[key]; isSDKV2 && metadata.HasTagsAndTagsAll {
    applyTagsPreCheckCallback(prov, key)
}

PF resources were excluded with the reasoning that "upstream handles their tag behavior." While the upstream PF provider does correctly apply tags_all during Create/Update, it does not help with the Pulumi-side Check/Diff flow. Without the callback, tagsAll is not computed at Check time, so the Pulumi engine has nothing to diff against the prior state — resulting in an empty diff even though an update is triggered by the provider config change.

Fix

Remove the SDKv2 gate so the callback is applied to all resources (both SDKv2 and PF) that have hasTagsAndTagsAll:

// After
if metadata.HasTagsAndTagsAll {
    applyTagsPreCheckCallback(prov, key)
}

For PF resources, the upstream provider continues to handle the actual tag merge at apply time. The callback only adds early computation of tagsAll at Check time, which is what makes the preview diff visible.

Tests

• TestTagsPreCheckCallbackAppliesOnlyToSDKV2Resources — updated to cover the SDKv2 case only (still passes)
• TestTagsPreCheckCallbackAppliesAlsoToPFResources — new test verifying PF resources now have the callback and produce correct tagsAll output

All existing provider tests pass.

---

Created with Eon

[github-actions]

Does the PR have any schema changes?

Generated by schema-tools v0.8.1.

Looking good! No breaking changes found.
No new resources/functions/types.

Maintainer note: consult the runbook for dealing with any breaking changes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.84%. Comparing base (015d343) to head (510d2da).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6604   +/-   ##
=======================================
  Coverage   15.84%   15.84%           
=======================================
  Files         376      376           
  Lines       92183    92183           
=======================================
  Hits        14608    14608           
  Misses      77554    77554           
  Partials       21       21           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[corymhall]

See #6602 (comment)

The correct fix is pulumi/pulumi-terraform-bridge#2281