mattrobinsonsre/terrapod v1.10.8

on GitHub

Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise. This is a fix release on the 1.10 line, addressing two VCS defects reported against v1.11.2 and present here plus work already carried to the branch.

Bug Fixes

• A pull request session is closed only when the provider says the PR closed — two workspaces sharing a VCS connection and repository while tracking different base branches closed each other's PR sessions on every poll cycle. The planned run was force-cancelled as "Pull request #N is no longer open" and subsequent terrapod ... comments answered that Terrapod was not tracking the pull request, while it was still open. A workspace whose tracked branch resolved to no open pull requests — or did not exist — closed every session on the repository, every cycle. Open pull requests are now established across the whole repository rather than one base branch. The listing is read a page at a time, so a pull request merged while that is in progress could shift another out of view and read as a closure; the listing is now paginated in a stable order, a session closes only once the provider confirms that pull request is closed, and an incomplete listing reconciles nothing rather than concluding anything from an absence. Nothing to configure. (#2349)
• GitHub acknowledgement reactions work — the 👍 and 👎 on a terrapod ... comment never appeared on GitHub, because thumbsup/thumbsdown are GitLab award-emoji names and GitHub's reactions API accepts only +1/-1. The failure was swallowed by the best-effort reaction path, so 👀 appeared and the verdict never did. GitLab is unaffected and unchanged. (#2350)
• A listener is no longer removed from service by a proxy 403 — a 403 from the certificate-renewal endpoint was treated as the API refusing the certificate, which makes the listener delete its credentials and re-join. No Terrapod code path returns 403 there, so every one an operator can actually see comes from an ingress, WAF or service mesh; on an agent pool whose join token allows a single use, one such blip left the listener unable to join again. A 403 is now retried. (#2352)
• A listener no longer reconnects in a tight loop while waiting to retry a re-join — the throttle that bounds re-join attempts reported a refused attempt as a successful one, so the SSE loop skipped its backoff and reconnected at full speed, one request and one warning line per attempt, until the interval elapsed. Visible as a burst of Auth rejected by API or stale-registration warnings and a spike in API requests from the affected listener. (#2352)
• A listener that fails to re-join no longer burns its join token — the retry was attempted again on every subsequent authentication failure, roughly every half minute, each attempt clearing the credentials and consuming another token use. Recovery is still attempted promptly; the rate is now bounded. (#2352)
• A listener whose certificate expired can recover again — _rejoin is the listener's only automatic recovery from the API no longer accepting its certificate, and it was gated on three consecutive 401s from the SSE connect, which any other error reset. A listener whose certificate had expired could not reach the threshold while its connections were also failing, and an expired certificate cannot renew itself. (#2331)
• The security-scan threshold setting no longer claims the enforcement setting is absent — its description said the enforcement level "is deliberately not on this tool", which stopped being true when security_scan_enforcement was added to the same surface. (#2174)

Other

• The MCP workspace surface is complete on this line — auto_merge, auto_merge_strategy, debug_mode and security_scan_enforcement are now settable through terrapod_workspace_update, which an agent could previously read and not change. The MCP server carries the caller's own token and the API applies the same RBAC it applies to every other client, so an absent attribute was never a control. (#2174)
• The three static-analysis suppressions already on main are carried to this line, so a scan of this tag reports what main reports rather than three findings that were judged and suppressed elsewhere. (#2275)

Status

Stable — a fix release for the previous minor, which per SECURITY.md receives security fixes and obvious bug fixes. No schema, API or configuration changes; upgrading requires no action.

Full Changelog: v1.10.7...v1.10.8