dependabot / dependabot/dependabot-core

Support project-specific versions of Terraform

Open
#5,797 6 comments 35 reactions 0 assignees View on GitHub
L: terraform T: feature-request versioning
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Let's say we have a strict Terraform version constrain in the Terraform project being checked, like this...

```
terraform {
required_version = "1.2.9"
}
```

Dependabot should honour this version constraint when performing operations with terraform.

At present dependabot-core operates with it's own fixed Terraform version, defined in it's own source code (1.3.0 at the time of writing). In the case of a strict constraint like the example above this results in a dependabot error during an attempted `terraform init` execution:

```
Error: Unsupported Terraform Core version

on backend.tf line 2, in terraform:
2: required_version = "1.2.9"

This configuration does not support Terraform version 1.3.0. To proceed,
either choose another supported Terraform version or update this version
constraint. Version constraints are normally set for good reason, so updating
the constraint may lead to other errors or unexpected behavior.
```

Why might we have such constraints?
- The project owner wants to fix and control the version of Terraform being used for all operations for consistency.
- Other tooling uses the version constraints to select a Terraform version, e.g. https://www.runatlantis.io/docs/terraform-versions.html. This was my particular use-case.
- Version constraints could be derived from a combination of sub-module constraints, often not under the direct control of the project owner.

Contributor guide

Open the contributing guide

Research direction

The issue does not name files or tests. Start by locating dependabot-core’s fixed Terraform version and the entry point that runs Terraform operations, then trace how the project’s required_version constraint could be honored. Done means a project-specific constraint is used during Terraform operations without the reported init error, with coverage for the strict 1.2.9 example.

Written by the indexing model from the issue text.

Assessment

Tech stack
terraform
Domain
infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.