genconfig: handle null nested attribute values without panic

[net0pyr]

Fixes #38569

Target Release

1.16.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

None.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.

Root cause

cty.Value.GetAttr asserts the value's internal representation to map[string]interface{}; that assertion panics on cty.NullVal(...) because the representation is nil. Two functions in internal/genconfig/generate_config.go — writeConfigNestedTypeAttributeFromExisting and writeConfigBlocksFromExisting — called GetAttr on the incoming parent value without first checking IsNull(). In the terraform query -generate-config-out flow, generateHCLListResourceDef (in internal/terraform) deliberately hands genconfig cty.NullVal(schema.Body.ImpliedType()) whenever the provider returned no state for a queried resource, which made the panic reachable from real usage.

Fix

Add an IsNull() guard before each problematic GetAttr call. In writeConfigNestedTypeAttributeFromExisting the guard emits a literal null for the attribute when the parent is null, mirroring the existing handling for null primitives in writeConfigAttributesFromExisting (which falls back to attrS.EmptyValue() for the same situation) and the per-nesting nestedVal.IsNull() branches further down in the same function. In writeConfigBlocksFromExisting the guard short-circuits the iteration because writeConfigNestedBlockFromExisting already treats a null block value as "nothing to emit". The diff stays inside internal/genconfig.

Regression test

Adds two table-driven cases to TestConfigGeneration in internal/genconfig/generate_config_test.go:

• resource_with_null_state constructs cty.NullVal(...) as the resource state and exercises every nested-type nesting mode (single/list/map) plus a nested block, asserting that generation completes without panic and emits well-formed HCL.
• resource_with_nested_value_sibling covers the inverse: a non-null parent with real nested values, to guard against the new null guard becoming too eager and silently dropping data.

Both tests construct the cty.Value directly — no provider, no network, no CLI invocation.

No public API changes

The change is internal to internal/genconfig. No exported symbols, function signatures, or behaviours for non-null inputs are altered.

[hashicorp-cla-app]

All committers have signed the CLA.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[jbardin]

A null resource value means the resource instance does not exist, so it should not be returned from a list resource. You can't generate config for a null resource value, because it is not there to be confnigured.

[jbardin]

This looks like you're testing for null attributes, but the linked issue is about a null nested block for timeouts.

[crw]

@net0pyr please also disclose your use of GenAI tooling per our Contributing.md guidelines. Thanks!