From d0f2f320c970837ee70c5a048692b3bf74f905a5 Mon Sep 17 00:00:00 2001
From: Daniel Schmidt <danielmschmidt92@gmail.com>
Date: Tue, 2 Sep 2025 09:08:03 +0200
Subject: [PATCH] actions: ensure splat operations are invalid

---
 .../terraform/context_plan_actions_test.go    | 31 +++++++++++++++++++
 .../terraform/node_action_trigger_plan.go     |  3 ++
 2 files changed, 34 insertions(+)

diff --git a/internal/terraform/context_plan_actions_test.go b/internal/terraform/context_plan_actions_test.go
index fe7f01d72f6e..583dc1050cc5 100644
--- a/internal/terraform/context_plan_actions_test.go
+++ b/internal/terraform/context_plan_actions_test.go
@@ -2781,6 +2781,37 @@ resource "test_object" "a" {
 				}
 			},
 		},
+
+		"splat is not supported": {
+			module: map[string]string{
+				"main.tf": `
+action "test_unlinked" "hello" {
+  count = 42
+}
+resource "test_object" "a" {
+  lifecycle {
+    action_trigger {
+      events = [before_create]
+      actions = [action.test_unlinked.hello[*]]
+    }
+  }
+}
+`,
+			},
+			expectPlanActionCalled: false,
+			expectPlanDiagnostics: func(m *configs.Config) tfdiags.Diagnostics {
+				return tfdiags.Diagnostics{}.Append(&hcl.Diagnostic{
+					Severity: hcl.DiagError,
+					Summary:  "Invalid action expression",
+					Detail:   "Unexpected expression found in action_triggers.actions.",
+					Subject: &hcl.Range{
+						Filename: filepath.Join(m.Module.SourceDir, "main.tf"),
+						Start:    hcl.Pos{Line: 9, Column: 18, Byte: 161},
+						End:      hcl.Pos{Line: 9, Column: 47, Byte: 190},
+					},
+				})
+			},
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			if tc.toBeImplemented {
diff --git a/internal/terraform/node_action_trigger_plan.go b/internal/terraform/node_action_trigger_plan.go
index 199c09374f44..f8f75e04d22e 100644
--- a/internal/terraform/node_action_trigger_plan.go
+++ b/internal/terraform/node_action_trigger_plan.go
@@ -84,6 +84,9 @@ func (n *nodeActionTriggerPlanExpand) DynamicExpand(ctx EvalContext) (*Graph, tf
 
 			ref, evalActionDiags := evaluateActionExpression(n.lifecycleActionTrigger.actionExpr, repData)
 			diags = append(diags, evalActionDiags...)
+			if diags.HasErrors() {
+				continue
+			}
 
 			// The reference is either an action or action instance
 			var actionAddr addrs.AbsActionInstance