AZS002 + AZS003: schema Default/Type mismatch and empty-block panic risk (ports of long-open tfproviderlint PRs)

[katbyte]

Description:

AZS002 + AZS003: two new schema checks

Implements the checks from two tfproviderlint PRs that have sat open upstream — bflad/tfproviderlint#329 (S038, open since Feb 2025) and bflad/tfproviderlint#236 (XS003, open since Apr 2021) — as tfproviderlint appears dormant and both checks were written for (and validated against) the AzureRM provider. Both are reimplemented in azproviderlint's self-contained style rather than copied, since the originals mostly patch tfproviderlint helper internals we don't use.

AZS002 — Default value must match the declared Type

The plugin SDK's InternalValidate does not type-check Default against Type, so Type: schema.TypeInt, Default: true only surfaces as an error at plan time.

Improvements over the upstream S038 implementation:

• compares the Default constant's kind directly against the declared Type instead of inferring a mismatch from a nil sentinel — non-constant defaults of the correct type are no longer false positives (they're skipped as statically unjudgeable)
• covers TypeFloat (accepting both int and float constants; upstream silently ignored it)
• named constants (Default: SkuStandard) still resolve through the type checker

AZS003 — optional-only list blocks allow foo {}

Type: TypeList blocks whose nested properties are all optional with no Default/DefaultFunc and no AtLeastOneOf/ExactlyOneOf accept an empty block, which yields a nil list element that expand functions commonly crash on (raw[0].(map[string]interface{}) — see azurerm#11426), or a permanent diff. XS003's companion cleanup (azurerm#11452, merged 2021) fixed ~100 of these by adding AtLeastOneOf; this check gates the pattern going forward.

This is a heuristic: blocks whose expand functions guard against nil are safe in practice but still reported — suppress those with //azignore:AZS003.

Both checks

• identify schema literals by type (named type Schema/Resource in a package named schema), so direct helper/schema use, azurerm's pluginsdk aliases, and literals elided inside map[string]*Schema all resolve identically
• conservative bail-outs: non-constant/non-literal values, computed-only blocks, TypeSet, primitive elems and out-of-scope schema types stay quiet