Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise. This patch restores security scanning on arm64 runners, fixes the pull-request status comment, and clears two HIGH dependency findings.
Bug Fixes
- Checkov on arm64 — upstream published no
checkov_linux_arm64.zipafter 3.3.21, so every security scan on an arm64 runner errored. Terrapod now builds the Linux Checkov binaries itself — from upstream's own tag, lockfile and PyInstaller spec — and publishes them forlinux/amd64andlinux/arm64. The chart points at them by default and the checksum gate is unchanged, still verifying every download and failing closed. See Checkov is fetched from Terrapod's releases in docs/deprecations.md before upgrading if you run air-gapped or allowlist egress by host. - The pull-request status comment works again — the one-comment consolidation carried code that read a database column this line does not have, so no status comment was posted or edited for any workspace pull request. Nothing in the test suite constructed a real session object, so it passed CI; a test that drives the real model now guards it.
- Exactly one comment per pull request, edited in place — not one per workspace per push. A module pull request with ten consuming workspaces previously accumulated ten comments and reposted them on every push.
- A blanked
checkov_versionresolves again — the ConfigMap renders the key behind a conditional, so clearing it falls through to the code default, which had drifted to a version the mirror does not carry. - A missing upstream artifact fails fast — a 404 raises a distinct error, so the API answers 4xx and the runner stops instead of retrying a 502 it cannot win. An errored scan is logged at error rather than info, which is how this went unnoticed across four releases.
- The Checkov mirror and checksum source cannot disagree — they are separate Helm values, and because Terrapod builds the Linux binaries its digests differ from upstream's by construction. Overriding only the mirror sent the bytes to one publisher and the digest to another, and the fail-closed gate then refused every fetch without naming either key. The mirror now decides; an underivable one is refused by name.
- The "Latest release" badge is decided against every release, not the hundred most recent — Terrapod publishes its Checkov builds into the same repository, so a time-windowed comparison could eventually let a patch on an older line take the badge from a newer minor.
Security
- Clears GHSA-hpwh-2r54-x7fx:
golang.org/x/net0.58.0 → 0.60.0 in theproviderandterrapod-migratebinaries, andlibcurl3t64-gnutls→8.14.1-2+deb13u7in the published images. - OPA 1.21.2 (from 1.21.1; the code default moves from 1.19.0).
Documentation
terrapod_run_phasemust be declaredephemeral = true— the runner applies the saved plan, so an ordinary variable's recordedplanvalue conflicts with theapplysupplied at apply time and the engine refuses the apply, whether or not the configuration reads the variable. The example now declares it and states the OpenTofu 1.11 / Terraform 1.10 minimums, with the trust-policy alternative for older engines.- Where the scan engines come from — Trivy comes from its own publisher; Checkov comes from Terrapod.
docs/security-scanning.md,docs/cve-policy.mdanddocs/registry.mdnow say so, including the mirror layout and that a brand-new upstream Checkov release is not immediately pinnable. - The staged signing-key promotion window is supported rather than refused, and a trailing slash on the issuer URL is not refused — both pages previously claimed the opposite.
Status
Stable — a patch release on the 1.10 line. No schema changes, no API changes, and no migrations.
Full Changelog: v1.10.1...v1.10.2