fix: Ignore all hidden files and folders in archive (#4382)

This also adds a suite of tests to ensure this cannot happen again!

provisionersdk/archive.go

@@ -75,7 +75,7 @@ func Tar(directory string, limit int64) ([]byte, error) {
 		if err != nil {
 			return err
 		}
-		if strings.HasPrefix(rel, ".") {
+		if strings.HasPrefix(rel, ".") || strings.HasPrefix(filepath.Base(rel), ".") {
 			if fileInfo.IsDir() && rel != "." {
 				// Don't archive hidden files!
 				return filepath.SkipDir

provisionersdk/archive_test.go

@@ -1,6 +1,7 @@
 package provisionersdk_test
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
@@ -30,6 +31,62 @@ func TestTar(t *testing.T) {
 		_, err = provisionersdk.Tar(dir, 1024)
 		require.NoError(t, err)
 	})
+	t.Run("HiddenFiles", func(t *testing.T) {
+		t.Parallel()
+		dir := t.TempDir()
+		type file struct {
+			Name     string
+			Archives bool
+		}
+		files := []*file{{
+			Name:     "*.tf",
+			Archives: true,
+		}, {
+			Name:     ".*",
+			Archives: false,
+		}, {
+			Name:     "./testing/.test/*.tf",
+			Archives: false,
+		}, {
+			Name:     "./testing/asd.*",
+			Archives: true,
+		}, {
+			Name:     ".terraform/.*",
+			Archives: false,
+		}, {
+			Name:     "example/.terraform/*",
+			Archives: false,
+		}}
+		for _, file := range files {
+			newDir := dir
+			if filepath.Base(file.Name) != file.Name {
+				newDir = filepath.Join(newDir, filepath.Dir(file.Name))
+				err := os.MkdirAll(newDir, 0755)
+				require.NoError(t, err)
+				file.Name = filepath.Base(file.Name)
+			}
+			tmpFile, err := os.CreateTemp(newDir, file.Name)
+			require.NoError(t, err)
+			_ = tmpFile.Close()
+			file.Name, err = filepath.Rel(dir, tmpFile.Name())
+			require.NoError(t, err)
+			fmt.Printf("rel")
+		}
+		content, err := provisionersdk.Tar(dir, 1024)
+		require.NoError(t, err)
+		dir = t.TempDir()
+		err = provisionersdk.Untar(dir, content)
+		require.NoError(t, err)
+		for _, file := range files {
+			_, err = os.Stat(filepath.Join(dir, file.Name))
+			t.Logf("stat %q %+v", file.Name, err)
+			if file.Archives {
+				require.NoError(t, err)
+			} else {
+				require.ErrorIs(t, err, os.ErrNotExist)
+			}
+		}
+	})
 }
 
 func TestUntar(t *testing.T) {