terraform: "Close" the graph walker when a graph walker is complete

We now need to clean up any straggling ephemeral resource instances before
we complete each graph walk, and ephemeral resource instances are
ultimately owned by the graph walker, so the graph walker now has a Close
method that's responsible for cleaning up anything that the walker owns
which needs to be explicitly closed at the end of a walk.

internal/terraform/context_apply.go

@@ -234,6 +234,7 @@ Note that the -target option is not suitable for routine use, and is provided on
 	// expressions, like in "terraform console" or the test harness.
 	evalScope := evalScopeFromGraphWalk(walker, addrs.RootModuleInstance)
 
+	diags = diags.Append(walker.Close())
 	return newState, evalScope, diags
 }
 

internal/terraform/context_eval.go

@@ -103,7 +103,10 @@ func (c *Context) Eval(config *configs.Config, state *states.State, moduleAddr a
 		walker = c.graphWalker(graph, walkEval, walkOpts)
 	}
 
-	return evalScopeFromGraphWalk(walker, moduleAddr), diags
+	scope := evalScopeFromGraphWalk(walker, moduleAddr)
+
+	diags = diags.Append(walker.Close())
+	return scope, diags
 }
 
 // evalScopeFromGraphWalk takes a [ContextGraphWalker] that was already used

internal/terraform/context_plan.go

@@ -821,6 +821,7 @@ func (c *Context) planWalk(config *configs.Config, prevRunState *states.State, o
 	// expressions, like in "terraform console" or the test harness.
 	evalScope := evalScopeFromGraphWalk(walker, addrs.RootModuleInstance)
 
+	diags = diags.Append(walker.Close())
 	return plan, evalScope, diags
 }
 

internal/terraform/context_validate.go

@@ -116,9 +116,6 @@ func (c *Context) Validate(config *configs.Config, opts *ValidateOpts) tfdiags.D
 	})
 	diags = diags.Append(walker.NonFatalDiagnostics)
 	diags = diags.Append(walkDiags)
-	if walkDiags.HasErrors() {
-		return diags
-	}
-
+	diags = diags.Append(walker.Close())
 	return diags
 }

internal/terraform/graph_walk.go

@@ -14,6 +14,7 @@ type GraphWalker interface {
 	enterScope(evalContextScope) EvalContext
 	exitScope(evalContextScope)
 	Execute(EvalContext, GraphNodeExecutable) tfdiags.Diagnostics
+	Close() tfdiags.Diagnostics
 }
 
 // NullGraphWalker is a GraphWalker implementation that does nothing.
@@ -25,3 +26,4 @@ func (NullGraphWalker) EvalContext() EvalContext
 func (NullGraphWalker) enterScope(evalContextScope) EvalContext                      { return new(MockEvalContext) }
 func (NullGraphWalker) exitScope(evalContextScope)                                   {}
 func (NullGraphWalker) Execute(EvalContext, GraphNodeExecutable) tfdiags.Diagnostics { return nil }
+func (NullGraphWalker) Close() tfdiags.Diagnostics                                   { return nil }

internal/terraform/graph_walk_context.go

@@ -155,3 +155,15 @@ func (w *ContextGraphWalker) Execute(ctx EvalContext, n GraphNodeExecutable) tfd
 
 	return n.Execute(ctx, w.Operation)
 }
+
+func (w *ContextGraphWalker) Close() tfdiags.Diagnostics {
+	var diags tfdiags.Diagnostics
+	if er := w.EphemeralResources; er != nil {
+		// FIXME: The graph walk bits all long predate Go's context.Context
+		// and so we don't have a general ambient context.Context for the
+		// overall operation. Hopefully one day we do, and then it could
+		// be passed in here.
+		diags = diags.Append(er.Close(context.TODO()))
+	}
+	return diags
+}