dependabot / dependabot/dependabot-core
Support project-specific versions of Terraform
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Let's say we have a strict Terraform version constrain in the Terraform project being checked, like this...
```
terraform {
required_version = "1.2.9"
}
```
Dependabot should honour this version constraint when performing operations with terraform.
At present dependabot-core operates with it's own fixed Terraform version, defined in it's own source code (1.3.0 at the time of writing). In the case of a strict constraint like the example above this results in a dependabot error during an attempted `terraform init` execution:
```
Error: Unsupported Terraform Core version
on backend.tf line 2, in terraform:
2: required_version = "1.2.9"
This configuration does not support Terraform version 1.3.0. To proceed,
either choose another supported Terraform version or update this version
constraint. Version constraints are normally set for good reason, so updating
the constraint may lead to other errors or unexpected behavior.
```
Why might we have such constraints?
- The project owner wants to fix and control the version of Terraform being used for all operations for consistency.
- Other tooling uses the version constraints to select a Terraform version, e.g. https://www.runatlantis.io/docs/terraform-versions.html. This was my particular use-case.
- Version constraints could be derived from a combination of sub-module constraints, often not under the direct control of the project owner.
Contributor guide
Research direction
The issue does not name files or tests. Start by locating dependabot-core’s fixed Terraform version and the entry point that runs Terraform operations, then trace how the project’s required_version constraint could be honored. Done means a project-specific constraint is used during Terraform operations without the reported init error, with coverage for the strict 1.2.9 example.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- terraform
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100