dependabot / dependabot/dependabot-core
Fetch changelogs for Terraform modules hosted in private registry of Terraform Cloud `app.terraform.io`
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Currently, Changelogs / Release notes are fetched for public Terraform modules hosted on `registry.terraform.io`.
Unfortunately, that's not working for private modules hosted on Terraform Cloud `app.terraform.io`.
I saw the same problem with renovate bot and started this discussion there: https://github.com/renovatebot/renovate/discussions/21297#discussioncomment-5528647
TL;DR: There's an "extended API" responding with more information, including the `source` of the Terraform module, available in public and private terraform.io registry.
In renovatebot that's covered by a separate function calling this "extended API" https://github.com/renovatebot/renovate/blob/cec928d7219a0cce10942867884096c7f5430365/lib/modules/datasource/terraform-module/index.ts#L80
Is this something which could also be implemented in dependabot to get changelogs for private Terraform modules?
Contributor guide
Research direction
Start with the linked Renovate implementation at lib/modules/datasource/terraform-module/index.ts around line 80 and compare its extended API use with Dependabot’s existing public-registry changelog behavior. Confirm how the extended API exposes private Terraform Cloud module metadata, then make changelogs work for modules hosted at app.terraform.io and verify both public and private registry cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- terraform
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100